Jump to content

ddtisme

Members
  • Posts

    8
  • Joined

  • Last visited

Everything posted by ddtisme

  1. This gave me my default windows shortcuts back. Thank you again for all of your help!
  2. Thank you again for all of your help! My computer seems to be running very well now, but I still am missing most of my shortcuts under "all programs". I guess I will have to go in an manually create shortcuts and put them back.
  3. ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=3265ae1e1b3a0848ac4b2dac7e31fd86 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-04-22 12:34:18 # local_time=2012-04-21 07:34:18 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1024 16777215 100 0 18718662 18718662 0 0 # compatibility_mode=5893 16776574 100 94 25827263 86588552 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=439924 # found=1 # cleaned=1 # scan_time=9756 C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL Win32/Toolbar.AskSBar application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
  4. ComboFix 12-04-19.01 - Dadee2 04/20/2012 17:08:11.2.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.6142.4030 [GMT -5:00] Running from: c:\users\Dadee2\Downloads\ComboFix.exe Command switches used :: c:\users\Dadee2\Downloads\CFScript.txt AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\SysWow64\PARTIZAL.EXE . . ((((((((((((((((((((((((( Files Created from 2012-03-21 to 2012-04-21 ))))))))))))))))))))))))))))))) . . 2012-04-21 00:06 . 2012-04-21 00:06 39184 ----a-w- c:\windows\SysWow64\Partizan.exe 2012-04-20 22:19 . 2012-04-20 22:29 -------- d-----w- c:\users\NeroMediaHomeUser.4\AppData\Local\temp 2012-04-20 22:19 . 2012-04-20 22:19 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-04-20 22:19 . 2012-04-20 22:19 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-04-11 08:00 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-11 08:00 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll 2012-04-11 08:00 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll 2012-04-11 08:00 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-04-11 08:00 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files (x86)\Internet Explorer\PLUGINS\nppdf32.dll 2012-03-31 00:54 . 2012-03-31 00:54 -------- d-----w- c:\windows\RestoreSafeDeleted 2012-03-29 15:58 . 2012-03-29 15:58 -------- d-----w- c:\users\Dadee2\AppData\Roaming\RealNetworks 2012-03-29 12:16 . 2012-03-29 12:16 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll 2012-03-29 12:16 . 2012-03-29 12:16 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll 2012-03-29 12:16 . 2012-03-29 12:16 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll 2012-03-29 12:16 . 2012-03-29 12:16 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll 2012-03-29 12:13 . 2012-03-29 12:13 -------- d-----we c:\windows\system64 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-07 16:15 . 2009-12-01 04:23 270776 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-04-07 16:15 . 2009-12-01 02:18 270776 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-04-07 16:15 . 2009-12-01 02:18 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2012-04-04 20:56 . 2010-05-15 00:44 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-03-09 14:12 . 2012-03-09 14:12 138360 ----a-w- c:\windows\SysWow64\drivers\AnyDVD.sys 2012-03-09 14:12 . 2012-03-09 14:12 138360 ----a-w- c:\windows\system32\drivers\AnyDVD.sys 2012-02-23 02:56 . 2011-01-17 17:33 39184 ----a-w- c:\windows\system32\Partizan.exe 2012-02-23 02:51 . 2011-05-23 03:00 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-17 23:58 . 2010-06-10 03:02 30528 ----a-w- c:\windows\GVTDrv64.sys 2012-02-17 23:57 . 2010-06-10 03:17 25640 ----a-w- c:\windows\gdrv.sys 2012-02-17 06:38 . 2012-03-14 09:27 1112064 ----a-w- c:\windows\system32\rdpcorets.dll 2012-02-17 06:38 . 2012-03-14 09:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll 2012-02-17 05:34 . 2012-03-14 09:27 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll 2012-02-17 04:58 . 2012-03-14 09:27 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-17 04:57 . 2012-03-14 09:27 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys 2012-02-10 06:36 . 2012-03-14 09:27 1544192 ----a-w- c:\windows\system32\DWrite.dll 2012-02-10 05:38 . 2012-03-14 09:27 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll 2012-02-10 04:13 . 2012-02-23 02:00 8008000 ----a-w- c:\windows\system32\nvcuda.dll 2012-02-10 04:13 . 2012-02-23 02:00 7713088 ----a-w- c:\windows\SysWow64\nvwgf2um.dll 2012-02-10 04:13 . 2012-02-23 02:00 68928 ----a-w- c:\windows\system32\OpenCL.dll 2012-02-10 04:13 . 2012-02-23 02:00 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll 2012-02-10 04:13 . 2012-02-23 02:00 5892928 ----a-w- c:\windows\SysWow64\nvcuda.dll 2012-02-10 04:13 . 2012-02-23 02:00 2872640 ----a-w- c:\windows\system32\nvcuvenc.dll 2012-02-10 04:13 . 2012-02-23 02:00 2672448 ----a-w- c:\windows\system32\nvcuvid.dll 2012-02-10 04:13 . 2012-02-23 02:00 25541952 ----a-w- c:\windows\system32\nvoglv64.dll 2012-02-10 04:13 . 2012-02-23 02:00 25222976 ----a-w- c:\windows\system32\nvcompiler.dll 2012-02-10 04:13 . 2012-02-23 02:00 2517312 ----a-w- c:\windows\SysWow64\nvcuvid.dll 2012-02-10 04:13 . 2012-02-23 02:00 2437440 ----a-w- c:\windows\SysWow64\nvcuvenc.dll 2012-02-10 04:13 . 2012-02-23 02:00 19443520 ----a-w- c:\windows\SysWow64\nvoglv32.dll 2012-02-10 04:13 . 2012-02-23 02:00 17642816 ----a-w- c:\windows\system32\nvd3dumx.dll 2012-02-10 04:13 . 2012-02-23 02:00 17543488 ----a-w- c:\windows\SysWow64\nvcompiler.dll 2012-02-10 04:13 . 2012-02-23 02:00 15009600 ----a-w- c:\windows\SysWow64\nvd3dum.dll 2012-02-10 04:13 . 2012-02-23 02:00 13624128 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys 2012-02-10 04:13 . 2011-11-07 19:00 1737536 ----a-w- c:\windows\system32\nvdispco64.dll 2012-02-10 04:13 . 2011-11-07 19:00 1466176 ----a-w- c:\windows\system32\nvgenco64.dll 2012-02-10 04:13 . 2010-04-04 03:55 2301248 ----a-w- c:\windows\SysWow64\nvapi.dll 2012-02-10 04:13 . 2009-09-28 05:12 2660160 ----a-w- c:\windows\system32\nvapi64.dll 2012-02-10 04:13 . 2009-07-13 21:59 9717568 ----a-w- c:\windows\system32\nvwgf2umx.dll 2012-02-10 03:14 . 2011-02-23 06:39 6074176 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-10 03:14 . 2011-02-23 06:39 3089728 ----a-w- c:\windows\system32\nvsvc64.dll 2012-02-10 03:07 . 2011-02-23 06:38 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-02-10 03:07 . 2011-02-23 06:38 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-10 03:07 . 2009-09-28 00:22 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-02-10 02:05 . 2012-02-10 02:05 416064 ----a-w- c:\windows\SysWow64\nvStreaming.exe 2012-02-07 16:02 . 2012-02-07 16:02 1070352 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34 . 2012-03-14 09:27 3145728 ----a-w- c:\windows\system32\win32k.sys 2012-02-01 03:12 . 2009-12-01 02:18 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-02-01 02:23 . 2010-06-10 11:52 25640 ----a-w- c:\windows\etdrv.sys 2012-01-25 06:38 . 2012-03-14 09:27 77312 ----a-w- c:\windows\system32\rdpwsx.dll 2012-01-25 06:38 . 2012-03-14 09:27 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-01-25 06:33 . 2012-03-14 09:27 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe . . ((((((((((((((((((((((((((((( SnapShot@2012-04-19_22.24.28 ))))))))))))))))))))))))))))))))))))))))) . - 2012-04-19 22:21 . 2012-04-19 22:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-04-20 22:21 . 2012-04-20 22:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-04-19 22:21 . 2012-04-19 22:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-04-20 22:21 . 2012-04-20 22:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 05:01 . 2012-04-20 22:20 403304 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-04-19 22:20 403304 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2010-02-04 02:20 . 2012-04-19 22:20 3348888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2010-02-04 02:20 . 2012-04-20 22:20 3348888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-12-25 04:30 . 2012-04-20 22:20 3923788 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4072682658-3226377195-3274890804-1001-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2011-11-28 14:14 1547104 ----a-w- c:\program files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll" [2011-11-28 1547104] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UnHackMe Monitor"="c:\program files (x86)\UnHackMe\hackmon.exe" [2012-01-23 594192] "RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-09-26 160328] "Akamai NetSession Interface"="c:\users\Dadee2\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872] "ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "TkBellExe"="c:\program files (x86)\real\realplayer\update\realsched.exe" [2011-11-27 296056] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0utocheck turegopt\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart\0Partizan\0 . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp wsauth . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer] @="Service" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "NBKeyScan"="c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" "Nero MediaHome 4"="c:\program files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe" /AUTORUN "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" "ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" "TkBellExe"="c:\program files (x86)\real\realplayer\update\realsched.exe" -osboot "Garmin Lifetime Updater"=c:\program files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized "RIMBBLaunchAgent.exe"=c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" . R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 136176] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-09-01 1025352] R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x] R3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM10864.sys [x] R3 etdrv;etdrv;c:\windows\etdrv.sys [2012-02-01 25640] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 136176] R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-02-17 30528] R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x] R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x] R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x] R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x] R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x] R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Professional Home 2010c\RpcAgentSrv.exe [2009-08-24 93336] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] R4 vToolbarUpdater;vToolbarUpdater;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe [2011-11-28 855904] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x] S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys [x] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x] S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-04-28 52496] S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-04-28 61200] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776] S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\NServiceEntry.exe [2010-11-05 81920] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 MotoHelper;MotoHelper Service;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-12-06 214896] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-10 2348352] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-10 382272] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-12-17 1394504] S2 wsnm;VMware View Client;c:\program files\VMware\VMware View\Client\bin\wsnm.exe [2011-09-08 494192] S2 wsnm_usbctrl;VMware View USB Control;c:\program files\VMware\VMware View\Client\bin\wsnm_usbctrl.exe [2011-09-08 1125488] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 nvoclk64;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\DRIVERS\nvoclk64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856] S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM10864.sys [x] S3 vmwvusb;VMware View Generic USB Driver;c:\windows\system32\Drivers\vmwvusb.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder . 2012-04-21 c:\windows\Tasks\GlaryInitialize.job - c:\program files (x86)\Glary Utilities\initialize.exe [2012-01-16 01:33] . 2012-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 22:46] . 2012-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 22:46] . 2012-04-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4072682658-3226377195-3274890804-1001Core.job - c:\users\Dadee2\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-08 02:31] . 2012-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4072682658-3226377195-3274890804-1001UA.job - c:\users\Dadee2\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-08 02:31] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-18 8067616] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp pdlnemsg w39n51 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://my.yahoo.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = 127.0.0.1:9421;192.168.*.*;<local> IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB DPF: {16F67783-7E72-4C39-99C4-4780A8335484} - hxxp://www.syncmyride.com/Own/Modules/UpdateCenter/applets/sync.cab FF - ProfilePath - c:\users\Dadee2\AppData\Roaming\Mozilla\Firefox\Profiles\rej2lse3.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=14652 FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B2401947c-48f1-4340-97d3-3a2aa937696c%7D&mid=59ff73e93822a08274b6fd502658836f-3093bac924fc3c196c30ab126a3c06a51257d089&ds=AVG&v=9.0.0.18.1〈=en&pr=fr&d=2011-09-07%2009%3A15%3A36&sap=ku&q= FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - ORPHANS REMOVED - - - - . Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) AddRemove-Biohazard Teamspeak 3 Theme - c:\windows\system32\SpoonUninstall.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet004\services\Akamai] "ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*] "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ . [HKEY_LOCAL_MACHINE\system\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet004\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe c:\windows\SysWOW64\IoctlSvc.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-04-20 19:28:36 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-21 00:28 ComboFix2.txt 2012-04-19 22:52 . Pre-Run: 68,458,037,248 bytes free Post-Run: 68,264,435,712 bytes free . - - End Of File - - D23E50000A7A311E013DECEB84178491
  5. ComboFix 12-04-19.01 - Dadee2 04/19/2012 17:04:35.1.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.6142.4397 [GMT -5:00] Running from: c:\users\Dadee2\Downloads\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\~BrNii3oS0mIizf c:\programdata\~BrNii3oS0mIizfr c:\programdata\BrNii3oS0mIizf c:\programdata\xmlC255.tmp c:\programdata\xmlC4F5.tmp c:\programdata\xmlC64D.tmp c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini c:\windows\Installer\$PatchCache$\Managed\6B07CD9D31EBDD140935E916E7270D58\1.2.5900\pst.ini c:\windows\system32\dds_trash_log.cmd c:\windows\SysWow64\ccrpTmr6.dll . . ((((((((((((((((((((((((( Files Created from 2012-03-19 to 2012-04-19 ))))))))))))))))))))))))))))))) . . 2012-04-19 22:18 . 2012-04-19 22:22 -------- d-----w- c:\users\NeroMediaHomeUser.4\AppData\Local\temp 2012-04-19 22:18 . 2012-04-19 22:18 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-04-19 22:18 . 2012-04-19 22:18 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-04-11 08:00 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-11 08:00 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll 2012-04-11 08:00 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll 2012-04-11 08:00 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-04-11 08:00 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files (x86)\Internet Explorer\PLUGINS\nppdf32.dll 2012-03-31 00:54 . 2012-03-31 00:54 -------- d-----w- c:\windows\RestoreSafeDeleted 2012-03-29 15:58 . 2012-03-29 15:58 -------- d-----w- c:\users\Dadee2\AppData\Roaming\RealNetworks 2012-03-29 12:16 . 2012-03-29 12:16 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll 2012-03-29 12:16 . 2012-03-29 12:16 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll 2012-03-29 12:16 . 2012-03-29 12:16 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll 2012-03-29 12:16 . 2012-03-29 12:16 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll 2012-03-29 12:13 . 2012-03-29 12:13 -------- d-----we c:\windows\system64 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-07 16:15 . 2009-12-01 04:23 270776 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-04-07 16:15 . 2009-12-01 02:18 270776 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-04-07 16:15 . 2009-12-01 02:18 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2012-04-04 20:56 . 2010-05-15 00:44 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-03-09 14:12 . 2012-03-09 14:12 138360 ----a-w- c:\windows\SysWow64\drivers\AnyDVD.sys 2012-03-09 14:12 . 2012-03-09 14:12 138360 ----a-w- c:\windows\system32\drivers\AnyDVD.sys 2012-02-23 02:56 . 2011-01-17 17:33 39184 ----a-w- c:\windows\system32\Partizan.exe 2012-02-23 02:51 . 2011-05-23 03:00 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-17 23:58 . 2010-06-10 03:02 30528 ----a-w- c:\windows\GVTDrv64.sys 2012-02-17 23:57 . 2010-06-10 03:17 25640 ----a-w- c:\windows\gdrv.sys 2012-02-17 06:38 . 2012-03-14 09:27 1112064 ----a-w- c:\windows\system32\rdpcorets.dll 2012-02-17 06:38 . 2012-03-14 09:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll 2012-02-17 05:34 . 2012-03-14 09:27 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll 2012-02-17 04:58 . 2012-03-14 09:27 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-17 04:57 . 2012-03-14 09:27 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys 2012-02-10 06:36 . 2012-03-14 09:27 1544192 ----a-w- c:\windows\system32\DWrite.dll 2012-02-10 05:38 . 2012-03-14 09:27 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll 2012-02-10 04:13 . 2012-02-23 02:00 8008000 ----a-w- c:\windows\system32\nvcuda.dll 2012-02-10 04:13 . 2012-02-23 02:00 7713088 ----a-w- c:\windows\SysWow64\nvwgf2um.dll 2012-02-10 04:13 . 2012-02-23 02:00 68928 ----a-w- c:\windows\system32\OpenCL.dll 2012-02-10 04:13 . 2012-02-23 02:00 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll 2012-02-10 04:13 . 2012-02-23 02:00 5892928 ----a-w- c:\windows\SysWow64\nvcuda.dll 2012-02-10 04:13 . 2012-02-23 02:00 2872640 ----a-w- c:\windows\system32\nvcuvenc.dll 2012-02-10 04:13 . 2012-02-23 02:00 2672448 ----a-w- c:\windows\system32\nvcuvid.dll 2012-02-10 04:13 . 2012-02-23 02:00 25541952 ----a-w- c:\windows\system32\nvoglv64.dll 2012-02-10 04:13 . 2012-02-23 02:00 25222976 ----a-w- c:\windows\system32\nvcompiler.dll 2012-02-10 04:13 . 2012-02-23 02:00 2517312 ----a-w- c:\windows\SysWow64\nvcuvid.dll 2012-02-10 04:13 . 2012-02-23 02:00 2437440 ----a-w- c:\windows\SysWow64\nvcuvenc.dll 2012-02-10 04:13 . 2012-02-23 02:00 19443520 ----a-w- c:\windows\SysWow64\nvoglv32.dll 2012-02-10 04:13 . 2012-02-23 02:00 17642816 ----a-w- c:\windows\system32\nvd3dumx.dll 2012-02-10 04:13 . 2012-02-23 02:00 17543488 ----a-w- c:\windows\SysWow64\nvcompiler.dll 2012-02-10 04:13 . 2012-02-23 02:00 15009600 ----a-w- c:\windows\SysWow64\nvd3dum.dll 2012-02-10 04:13 . 2012-02-23 02:00 13624128 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys 2012-02-10 04:13 . 2011-11-07 19:00 1737536 ----a-w- c:\windows\system32\nvdispco64.dll 2012-02-10 04:13 . 2011-11-07 19:00 1466176 ----a-w- c:\windows\system32\nvgenco64.dll 2012-02-10 04:13 . 2010-04-04 03:55 2301248 ----a-w- c:\windows\SysWow64\nvapi.dll 2012-02-10 04:13 . 2009-09-28 05:12 2660160 ----a-w- c:\windows\system32\nvapi64.dll 2012-02-10 04:13 . 2009-07-13 21:59 9717568 ----a-w- c:\windows\system32\nvwgf2umx.dll 2012-02-10 03:14 . 2011-02-23 06:39 6074176 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-10 03:14 . 2011-02-23 06:39 3089728 ----a-w- c:\windows\system32\nvsvc64.dll 2012-02-10 03:07 . 2011-02-23 06:38 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-02-10 03:07 . 2011-02-23 06:38 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-10 03:07 . 2009-09-28 00:22 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-02-10 02:05 . 2012-02-10 02:05 416064 ----a-w- c:\windows\SysWow64\nvStreaming.exe 2012-02-07 16:02 . 2012-02-07 16:02 1070352 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34 . 2012-03-14 09:27 3145728 ----a-w- c:\windows\system32\win32k.sys 2012-02-01 03:12 . 2009-12-01 02:18 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-02-01 02:23 . 2010-06-10 11:52 25640 ----a-w- c:\windows\etdrv.sys 2012-01-25 06:38 . 2012-03-14 09:27 77312 ----a-w- c:\windows\system32\rdpwsx.dll 2012-01-25 06:38 . 2012-03-14 09:27 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-01-25 06:33 . 2012-03-14 09:27 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2011-11-28 14:14 1547104 ----a-w- c:\program files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll" [2011-11-28 1547104] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UnHackMe Monitor"="c:\program files (x86)\UnHackMe\hackmon.exe" [2012-01-23 594192] "RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-09-26 160328] "Akamai NetSession Interface"="c:\users\Dadee2\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872] "ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "TkBellExe"="c:\program files (x86)\real\realplayer\update\realsched.exe" [2011-11-27 296056] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0utocheck turegopt\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart\0Partizan\0 . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp wsauth . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer] @="Service" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "NBKeyScan"="c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" "Nero MediaHome 4"="c:\program files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe" /AUTORUN "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" "ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" "TkBellExe"="c:\program files (x86)\real\realplayer\update\realsched.exe" -osboot "Garmin Lifetime Updater"=c:\program files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized "RIMBBLaunchAgent.exe"=c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" . R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 136176] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-09-01 1025352] R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x] R3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM10864.sys [x] R3 etdrv;etdrv;c:\windows\etdrv.sys [2012-02-01 25640] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 136176] R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-02-17 30528] R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x] R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x] R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x] R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x] R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x] R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Professional Home 2010c\RpcAgentSrv.exe [2009-08-24 93336] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] R4 vToolbarUpdater;vToolbarUpdater;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe [2011-11-28 855904] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x] S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys [x] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x] S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-04-28 52496] S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-04-28 61200] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776] S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\NServiceEntry.exe [2010-11-05 81920] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 MotoHelper;MotoHelper Service;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-12-06 214896] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-10 2348352] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-10 382272] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-12-17 1394504] S2 wsnm;VMware View Client;c:\program files\VMware\VMware View\Client\bin\wsnm.exe [2011-09-08 494192] S2 wsnm_usbctrl;VMware View USB Control;c:\program files\VMware\VMware View\Client\bin\wsnm_usbctrl.exe [2011-09-08 1125488] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 nvoclk64;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\DRIVERS\nvoclk64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856] S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM10864.sys [x] S3 vmwvusb;VMware View Generic USB Driver;c:\windows\system32\Drivers\vmwvusb.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder . 2012-04-19 c:\windows\Tasks\GlaryInitialize.job - c:\program files (x86)\Glary Utilities\initialize.exe [2012-01-16 01:33] . 2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 22:46] . 2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-02 22:46] . 2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4072682658-3226377195-3274890804-1001Core.job - c:\users\Dadee2\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-08 02:31] . 2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4072682658-3226377195-3274890804-1001UA.job - c:\users\Dadee2\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-08 02:31] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-18 8067616] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp pdlnemsg w39n51 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://my.yahoo.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = 127.0.0.1:9421;192.168.*.*;<local> IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB DPF: {16F67783-7E72-4C39-99C4-4780A8335484} - hxxp://www.syncmyride.com/Own/Modules/UpdateCenter/applets/sync.cab FF - ProfilePath - c:\users\Dadee2\AppData\Roaming\Mozilla\Firefox\Profiles\rej2lse3.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=14652 FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B2401947c-48f1-4340-97d3-3a2aa937696c%7D&mid=59ff73e93822a08274b6fd502658836f-3093bac924fc3c196c30ab126a3c06a51257d089&ds=AVG&v=9.0.0.18.1〈=en&pr=fr&d=2011-09-07%2009%3A15%3A36&sap=ku&q= FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) AddRemove-Biohazard Teamspeak 3 Theme - c:\windows\system32\SpoonUninstall.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet004\services\Akamai] "ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*] "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ . [HKEY_LOCAL_MACHINE\system\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet004\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe c:\windows\SysWOW64\IoctlSvc.exe c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe . ************************************************************************** . Completion time: 2012-04-19 17:52:24 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-19 22:52 . Pre-Run: 68,964,417,536 bytes free Post-Run: 68,738,166,784 bytes free . - - End Of File - - 6429095E5F689739B5620C4E2708E94A
  6. Here is the rest, first post too long. Malwarebytes Anti-Malware (Trial) 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.18.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Dadee2 :: DADEE2-PC [administrator] Protection: Enabled 4/18/2012 7:01:20 PM mbam-log-2012-04-18 (19-01-20).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 245338 Time elapsed: 23 minute(s), 18 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\sp (TrojanProxy.Agent) -> Quarantined and deleted successfully. Registry Values Detected: 2 HKCU\Software\Microsoft|adver_id (Malware.Trace) -> Data: 0 -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost|netsvc (TrojanProxy.Agent) -> Data: -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\Dadee2\uidsave.dat (Malware.Trace) -> Quarantined and deleted successfully. (end) . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30 Run by Dadee2 at 20:01:29 on 2012-04-18 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.6142.4176 [GMT -5:00] . AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\PROGRA~2\AVG\AVG2012\avgrsa.exe C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Windows\SysWOW64\svchost.exe -k Akamai C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE C:\Program Files (x86)\Motorola Media Link\NServiceEntry.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe C:\Windows\SysWOW64\IoctlSvc.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\VMware\VMware View\Client\bin\wsnm.exe C:\Program Files\VMware\VMware View\Client\bin\wsnm_usbctrl.exe C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe C:\Program Files (x86)\UnHackMe\hackmon.exe C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\WUDFHost.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Users\Dadee2\AppData\Local\Akamai\netsession_win.exe C:\Users\Dadee2\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\AVG\AVG2012\avgtray.exe C:\Program Files (x86)\real\realplayer\Update\realsched.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\taskmgr.exe C:\Users\Dadee2\AppData\Local\Google\Update\1.3.21.111\GoogleCrashHandler.exe C:\Users\Dadee2\AppData\Local\Google\Update\1.3.21.111\GoogleCrashHandler64.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ uInternet Settings,ProxyOverride = 127.0.0.1:9421;192.168.*.*;<local> uURLSearchHooks: H - No File mURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Speckie: {8ce7f568-67fa-4432-ba39-f5afd68e7b8b} - C:\Users\Dadee2\AppData\Roaming\Speckie\bin32\Speckie32.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File {e7df6bff-55a5-4eb7-a673-4ed3e9456d39} EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll uRun: [unHackMe Monitor] C:\Program Files (x86)\UnHackMe\hackmon.exe uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" uRun: [Akamai NetSession Interface] "C:\Users\Dadee2\AppData\Local\Akamai\netsession_win.exe" uRun: [iSUSPM Startup] c:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [TkBellExe] "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Lookup on Merriam Webster - file://C:\Program Files (x86)\ieSpell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://C:\Program Files (x86)\ieSpell\wikipedia.HTM IE: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL IE: {E6846530-6088-4AA3-932F-C6245CE59A4C} - {8CE7F568-67FA-4432-BA39-F5AFD68E7B8B} - C:\Users\Dadee2\AppData\Roaming\Speckie\bin32\Speckie32.dll DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} - hxxp://download.gigabyte.com.tw/object/Dldrv.ocx DPF: {16F67783-7E72-4C39-99C4-4780A8335484} - hxxp://www.syncmyride.com/Own/Modules/UpdateCenter/applets/sync.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 TCP: Interfaces\{8D94E7BD-EBBA-45BD-AD9C-30A53C56D311} : DhcpNameServer = 68.87.85.102 68.87.69.150 TCP: Interfaces\{983BCBC0-E595-4F9E-A695-A21930288ED4} : DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO-X64: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO-X64: Canon Easy-WebPrint EX BHO - No File BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll BHO-X64: RoboForm - No File BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO-X64: Speckie: {8CE7F568-67FA-4432-BA39-F5AFD68E7B8B} - C:\Users\Dadee2\AppData\Roaming\Speckie\bin32\Speckie32.dll BHO-X64: Speckie - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB-X64: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll TB-X64: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File EB-X64: {21347690-EC41-4F9A-8887-1F4AEE672439} - No File mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun-x64: [TkBellExe] "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE-X64: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Dadee2\AppData\Roaming\Mozilla\Firefox\Profiles\rej2lse3.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=14652 FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B2401947c-48f1-4340-97d3-3a2aa937696c%7D&mid=59ff73e93822a08274b6fd502658836f-3093bac924fc3c196c30ab126a3c06a51257d089&ds=AVG&v=9.0.0.18.1〈=en&pr=fr&d=2011-09-07%2009%3A15%3A36&sap=ku&q= FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff4.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - component: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll FF - plugin: C:\Program Files (x86)\Download Manager\npfpdlm.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPcolPM460.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\Dadee2\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?] R0 RapportKE64;RapportKE64;C:\Windows\system32\Drivers\RapportKE64.sys --> C:\Windows\system32\Drivers\RapportKE64.sys [?] R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?] R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?] R1 RapportEI64;RapportEI64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-4-28 52496] R1 RapportPG64;RapportPG64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-4-28 61200] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928] R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 20992] R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776] R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648] R2 cpuz135;cpuz135;\??\C:\Windows\system32\drivers\cpuz135_x64.sys --> C:\Windows\system32\drivers\cpuz135_x64.sys [?] R2 DeviceMonitorService;DeviceMonitorService;C:\Program Files (x86)\Motorola Media Link\NServiceEntry.exe [2010-11-5 81920] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-5-14 654408] R2 MotoHelper;MotoHelper Service;C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-12-6 214896] R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-2-22 2348352] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-2-9 382272] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [2009-12-17 1394504] R2 wsnm;VMware View Client;C:\Program Files\VMware\VMware View\Client\bin\wsnm.exe [2011-9-7 494192] R2 wsnm_usbctrl;VMware View USB Control;C:\Program Files\VMware\VMware View\Client\bin\wsnm_usbctrl.exe [2011-9-7 1125488] R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?] R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?] R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?] R3 nvoclk64;NVIDIA Enthusiasts Platform KDM;C:\Windows\system32\DRIVERS\nvoclk64.sys --> C:\Windows\system32\DRIVERS\nvoclk64.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [2009-10-14 11856] R3 USBPNPA;USB PnP Sound Device Interface;C:\Windows\system32\drivers\CM10864.sys --> C:\Windows\system32\drivers\CM10864.sys [?] R3 vmwvusb;VMware View Generic USB Driver;C:\Windows\system32\Drivers\vmwvusb.sys --> C:\Windows\system32\Drivers\vmwvusb.sys [?] S2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-2 136176] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-5-5 1025352] S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;C:\Windows\system32\drivers\CM10864.sys --> C:\Windows\system32\drivers\CM10864.sys [?] S3 etdrv;etdrv;C:\Windows\etdrv.sys [2010-6-10 25640] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-2 136176] S3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2010-6-9 30528] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?] S3 SandraAgentSrv;SiSoftware Deployment Agent Service;C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2010c\RpcAgentSrv.exe [2010-6-10 93336] S3 TFsExDisk;TFsExDisk;C:\Windows\System32\drivers\TFsExDisk.Sys [2010-7-24 16448] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?] S4 vToolbarUpdater;vToolbarUpdater;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe [2011-11-28 855904] . =============== Created Last 30 ================ . 2012-04-18 23:46:21 711240 ----a-w- C:\Windows\isRS-000.tmp 2012-04-11 08:00:38 81408 ----a-w- C:\Windows\System32\imagehlp.dll 2012-04-11 08:00:38 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys 2012-04-11 08:00:38 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll 2012-04-11 08:00:37 5120 ----a-w- C:\Windows\SysWow64\wmi.dll 2012-04-11 08:00:37 5120 ----a-w- C:\Windows\System32\wmi.dll 2012-04-11 08:00:37 220672 ----a-w- C:\Windows\System32\wintrust.dll 2012-04-11 08:00:37 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll 2012-04-04 05:53:56 182160 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53:56 182160 ----a-w- C:\Program Files (x86)\Internet Explorer\PLUGINS\nppdf32.dll 2012-03-31 00:54:41 -------- d-----w- C:\Windows\RestoreSafeDeleted 2012-03-30 02:05:08 39184 ----a-w- C:\Windows\SysWow64\PARTIZAN.EXE 2012-03-29 15:58:57 -------- d-----w- C:\Users\Dadee2\AppData\Roaming\RealNetworks 2012-03-29 12:16:47 626688 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr80.dll 2012-03-29 12:16:47 548864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp80.dll 2012-03-29 12:16:47 479232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcm80.dll 2012-03-29 12:16:47 43992 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozutils.dll 2012-03-29 12:14:58 0 --sha-w- C:\Windows\System32\dds_trash_log.cmd 2012-03-29 12:13:52 -------- d-----we C:\Windows\system64 . ==================== Find3M ==================== . 2012-04-07 16:15:34 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2012-04-07 16:15:34 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe 2012-04-07 16:15:28 75136 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe 2012-04-04 20:56:40 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-03-09 14:12:44 138360 ----a-w- C:\Windows\SysWow64\drivers\AnyDVD.sys 2012-03-09 14:12:44 138360 ----a-w- C:\Windows\System32\drivers\AnyDVD.sys 2012-03-06 06:53:37 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-03-06 05:59:47 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-03-06 05:59:41 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-02-28 06:56:48 2311168 ----a-w- C:\Windows\System32\jscript9.dll 2012-02-28 06:49:56 1390080 ----a-w- C:\Windows\System32\wininet.dll 2012-02-28 06:48:57 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-02-28 06:42:55 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-02-28 01:18:55 1799168 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-02-28 01:11:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-02-28 01:11:07 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-02-28 01:03:16 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-02-23 02:56:29 39184 ----a-w- C:\Windows\System32\Partizan.exe 2012-02-23 02:51:32 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-17 23:58:03 30528 ----a-w- C:\Windows\GVTDrv64.sys 2012-02-17 23:57:43 25640 ----a-w- C:\Windows\gdrv.sys 2012-02-17 06:38:27 1112064 ----a-w- C:\Windows\System32\rdpcorets.dll 2012-02-17 06:38:26 1031680 ----a-w- C:\Windows\System32\rdpcore.dll 2012-02-17 05:34:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll 2012-02-17 04:58:24 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-02-17 04:57:32 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll 2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll 2012-02-10 03:14:04 6074176 ----a-w- C:\Windows\System32\nvcpl.dll 2012-02-10 03:14:01 3089728 ----a-w- C:\Windows\System32\nvsvc64.dll 2012-02-10 03:07:00 889664 ----a-w- C:\Windows\System32\nvvsvc.exe 2012-02-10 03:07:00 63296 ----a-w- C:\Windows\System32\nvshext.dll 2012-02-10 03:07:00 118080 ----a-w- C:\Windows\System32\nvmctray.dll 2012-02-10 02:05:44 416064 ----a-w- C:\Windows\SysWow64\nvStreaming.exe 2012-02-07 16:02:40 1070352 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34:34 3145728 ----a-w- C:\Windows\System32\win32k.sys 2012-02-01 03:12:44 282864 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2012-02-01 02:23:43 25640 ----a-w- C:\Windows\etdrv.sys 2012-01-25 06:38:39 77312 ----a-w- C:\Windows\System32\rdpwsx.dll 2012-01-25 06:38:38 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll 2012-01-25 06:33:30 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe . ============= FINISH: 20:02:02.65 ===============
  7. Thank you so much for your help! Here is the requested logs. 18:41:26.0693 5528 TDSS rootkit removing tool 2.7.29.0 Apr 18 2012 16:44:20 18:41:27.0119 5528 ============================================================ 18:41:27.0119 5528 Current date / time: 2012/04/18 18:41:27.0119 18:41:27.0119 5528 SystemInfo: 18:41:27.0119 5528 18:41:27.0119 5528 OS Version: 6.1.7601 ServicePack: 1.0 18:41:27.0119 5528 Product type: Workstation 18:41:27.0119 5528 ComputerName: DADEE2-PC 18:41:27.0119 5528 UserName: Dadee2 18:41:27.0119 5528 Windows directory: C:\Windows 18:41:27.0119 5528 System windows directory: C:\Windows 18:41:27.0119 5528 Running under WOW64 18:41:27.0119 5528 Processor architecture: Intel x64 18:41:27.0119 5528 Number of processors: 4 18:41:27.0119 5528 Page size: 0x1000 18:41:27.0119 5528 Boot type: Normal boot 18:41:27.0119 5528 ============================================================ 18:41:28.0788 5528 Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 18:41:28.0798 5528 Drive \Device\Harddisk0\DR0 - Size: 0x4A85C4DE00 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 18:41:28.0803 5528 Drive \Device\Harddisk2\DR2 - Size: 0xF2000000 (3.78 Gb), SectorSize: 0x200, Cylinders: 0x1ED, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 18:41:28.0806 5528 \Device\Harddisk1\DR1: 18:41:28.0806 5528 MBR partitions: 18:41:28.0806 5528 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x2542D800 18:41:28.0806 5528 \Device\Harddisk0\DR0: 18:41:28.0806 5528 MBR partitions: 18:41:28.0806 5528 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x118EFE22 18:41:28.0823 5528 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x118EFEA0, BlocksNum 0x13B393CF 18:41:28.0823 5528 \Device\Harddisk2\DR2: 18:41:28.0824 5528 MBR partitions: 18:41:28.0824 5528 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x20, BlocksNum 0x78FFE0 18:41:29.0054 5528 C: <-> \Device\Harddisk1\DR1\Partition0 18:41:29.0076 5528 E: <-> \Device\Harddisk0\DR0\Partition0 18:41:29.0102 5528 F: <-> \Device\Harddisk0\DR0\Partition1 18:41:29.0102 5528 Initialize success 18:41:29.0102 5528 ============================================================ 18:42:46.0747 5856 ============================================================ 18:42:46.0747 5856 Scan started 18:42:46.0747 5856 Mode: Manual; SigCheck; TDLFS; 18:42:46.0747 5856 ============================================================ 18:42:47.0694 5856 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 18:42:47.0768 5856 1394ohci - ok 18:42:47.0844 5856 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 18:42:47.0858 5856 ACPI - ok 18:42:47.0910 5856 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 18:42:48.0235 5856 AcpiPmi - ok 18:42:48.0308 5856 ADIHdAudAddService - ok 18:42:48.0464 5856 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 18:42:48.0474 5856 AdobeARMservice - ok 18:42:48.0535 5856 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 18:42:48.0553 5856 adp94xx - ok 18:42:48.0577 5856 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 18:42:48.0589 5856 adpahci - ok 18:42:48.0604 5856 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 18:42:48.0615 5856 adpu320 - ok 18:42:48.0669 5856 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 18:42:48.0787 5856 AeLookupSvc - ok 18:42:48.0859 5856 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 18:42:48.0897 5856 AFD - ok 18:42:48.0942 5856 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 18:42:48.0954 5856 agp440 - ok 18:42:49.0163 5856 Akamai (1125c7d9fb8898015829c387c1bc87c7) c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll 18:42:49.0163 5856 Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll. md5: 1125c7d9fb8898015829c387c1bc87c7 18:42:49.0169 5856 Akamai ( HiddenFile.Multi.Generic ) - warning 18:42:49.0169 5856 Akamai - detected HiddenFile.Multi.Generic (1) 18:42:49.0183 5856 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 18:42:49.0444 5856 ALG - ok 18:42:49.0494 5856 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 18:42:49.0504 5856 aliide - ok 18:42:49.0518 5856 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 18:42:49.0528 5856 amdide - ok 18:42:49.0578 5856 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 18:42:49.0633 5856 AmdK8 - ok 18:42:49.0688 5856 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 18:42:49.0715 5856 AmdPPM - ok 18:42:49.0764 5856 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 18:42:49.0774 5856 amdsata - ok 18:42:49.0794 5856 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 18:42:49.0805 5856 amdsbs - ok 18:42:49.0854 5856 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 18:42:49.0862 5856 amdxata - ok 18:42:49.0938 5856 AnyDVD (a98662af1f4fe95e0b1daf75b98cfae3) C:\Windows\system32\Drivers\AnyDVD.sys 18:42:49.0959 5856 AnyDVD - ok 18:42:50.0010 5856 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 18:42:50.0267 5856 AppID - ok 18:42:50.0314 5856 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 18:42:50.0362 5856 AppIDSvc - ok 18:42:50.0415 5856 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 18:42:50.0463 5856 Appinfo - ok 18:42:50.0692 5856 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll 18:42:50.0723 5856 AppMgmt - ok 18:42:50.0764 5856 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 18:42:50.0773 5856 arc - ok 18:42:50.0789 5856 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 18:42:50.0799 5856 arcsas - ok 18:42:50.0912 5856 AsIO (85b756463ab0c000f816260d49923cde) C:\Windows\syswow64\drivers\AsIO.sys 18:42:50.0924 5856 AsIO - ok 18:42:50.0943 5856 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 18:42:50.0995 5856 AsyncMac - ok 18:42:51.0042 5856 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 18:42:51.0049 5856 atapi - ok 18:42:51.0112 5856 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 18:42:51.0173 5856 AudioEndpointBuilder - ok 18:42:51.0197 5856 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 18:42:51.0227 5856 AudioSrv - ok 18:42:51.0410 5856 AVG Security Toolbar Service (3a457c2f798cad79cd30224e723e01fb) C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe 18:42:51.0440 5856 AVG Security Toolbar Service - ok 18:42:51.0587 5856 AVGIDSAgent (6d440ff3f44ca72edfd6176c6d6a89c0) C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe 18:42:51.0683 5856 AVGIDSAgent - ok 18:42:51.0944 5856 AVGIDSDriver (e29ea1a0ec7ab9fa2dc7e75a03f12a4f) C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys 18:42:51.0954 5856 AVGIDSDriver - ok 18:42:52.0025 5856 AVGIDSEH (f823d184b8e8ffb8da3ead45dbf5bd6a) C:\Windows\system32\DRIVERS\AVGIDSEH.Sys 18:42:52.0034 5856 AVGIDSEH - ok 18:42:52.0048 5856 AVGIDSFilter (ed2b25bd7fe35d1944211968842d30da) C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys 18:42:52.0057 5856 AVGIDSFilter - ok 18:42:52.0069 5856 Avgldx64 (979cf8912449a10b987218bff80a1fa3) C:\Windows\system32\DRIVERS\avgldx64.sys 18:42:52.0083 5856 Avgldx64 - ok 18:42:52.0142 5856 Avgmfx64 (36b1a5843695766eac714daffc5b84d1) C:\Windows\system32\DRIVERS\avgmfx64.sys 18:42:52.0149 5856 Avgmfx64 - ok 18:42:52.0208 5856 Avgrkx64 (1102239fb724527f1febbbbccf6bf313) C:\Windows\system32\DRIVERS\avgrkx64.sys 18:42:52.0215 5856 Avgrkx64 - ok 18:42:52.0233 5856 Avgtdia (11f36d3ea82d9db9aa05a476a210551b) C:\Windows\system32\DRIVERS\avgtdia.sys 18:42:52.0248 5856 Avgtdia - ok 18:42:52.0297 5856 avgwd (6699ece24fe4b3f752a66c66a602ee86) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe 18:42:52.0308 5856 avgwd - ok 18:42:52.0362 5856 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 18:42:52.0437 5856 AxInstSV - ok 18:42:52.0490 5856 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 18:42:52.0542 5856 b06bdrv - ok 18:42:52.0600 5856 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 18:42:52.0640 5856 b57nd60a - ok 18:42:52.0796 5856 BBSvc (01a24b415926bb5f772dbe12459d97de) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE 18:42:52.0808 5856 BBSvc - ok 18:42:52.0858 5856 BBUpdate (785de7abda13309d6065305542829e76) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE 18:42:52.0871 5856 BBUpdate - ok 18:42:52.0923 5856 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 18:42:52.0937 5856 BDESVC - ok 18:42:53.0176 5856 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 18:42:53.0224 5856 Beep - ok 18:42:53.0276 5856 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 18:42:53.0318 5856 BFE - ok 18:42:53.0522 5856 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll 18:42:53.0584 5856 BITS - ok 18:42:53.0633 5856 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 18:42:53.0669 5856 blbdrive - ok 18:42:53.0734 5856 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 18:42:53.0756 5856 bowser - ok 18:42:53.0774 5856 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 18:42:53.0842 5856 BrFiltLo - ok 18:42:53.0864 5856 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 18:42:53.0874 5856 BrFiltUp - ok 18:42:53.0929 5856 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 18:42:53.0976 5856 Browser - ok 18:42:54.0002 5856 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 18:42:54.0064 5856 Brserid - ok 18:42:54.0078 5856 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 18:42:54.0108 5856 BrSerWdm - ok 18:42:54.0134 5856 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 18:42:54.0162 5856 BrUsbMdm - ok 18:42:54.0188 5856 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 18:42:54.0419 5856 BrUsbSer - ok 18:42:54.0444 5856 BTCFilterService - ok 18:42:54.0513 5856 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 18:42:54.0541 5856 BTHMODEM - ok 18:42:54.0611 5856 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 18:42:54.0658 5856 bthserv - ok 18:42:54.0698 5856 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 18:42:54.0739 5856 cdfs - ok 18:42:54.0797 5856 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 18:42:54.0827 5856 cdrom - ok 18:42:54.0872 5856 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 18:42:54.0913 5856 CertPropSvc - ok 18:42:54.0942 5856 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 18:42:54.0978 5856 circlass - ok 18:42:55.0022 5856 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 18:42:55.0036 5856 CLFS - ok 18:42:55.0113 5856 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 18:42:55.0123 5856 clr_optimization_v2.0.50727_32 - ok 18:42:55.0184 5856 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 18:42:55.0193 5856 clr_optimization_v2.0.50727_64 - ok 18:42:55.0292 5856 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 18:42:55.0302 5856 clr_optimization_v4.0.30319_32 - ok 18:42:55.0317 5856 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 18:42:55.0327 5856 clr_optimization_v4.0.30319_64 - ok 18:42:55.0403 5856 CM1083264 (0a89f75bb756604bbd995f2a0c8144f3) C:\Windows\system32\drivers\CM10864.sys 18:42:55.0477 5856 CM1083264 - ok 18:42:55.0709 5856 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 18:42:55.0743 5856 CmBatt - ok 18:42:55.0786 5856 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 18:42:55.0796 5856 cmdide - ok 18:42:55.0803 5856 cmuda3 - ok 18:42:55.0867 5856 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 18:42:55.0904 5856 CNG - ok 18:42:55.0918 5856 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 18:42:55.0929 5856 Compbatt - ok 18:42:55.0981 5856 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 18:42:56.0009 5856 CompositeBus - ok 18:42:56.0016 5856 COMSysApp - ok 18:42:56.0077 5856 cpuz135 (c08063f052308b6f5882482615387f30) C:\Windows\system32\drivers\cpuz135_x64.sys 18:42:56.0086 5856 cpuz135 - ok 18:42:56.0103 5856 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 18:42:56.0114 5856 crcdisk - ok 18:42:56.0169 5856 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll 18:42:56.0221 5856 CryptSvc - ok 18:42:56.0287 5856 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys 18:42:56.0333 5856 CSC - ok 18:42:56.0451 5856 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll 18:42:56.0502 5856 CscService - ok 18:42:56.0536 5856 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 18:42:56.0611 5856 DcomLaunch - ok 18:42:56.0664 5856 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 18:42:56.0714 5856 defragsvc - ok 18:42:57.0043 5856 DeviceMonitorService (893a82d118833a850459dd470ffa48d9) C:\Program Files (x86)\Motorola Media Link\NServiceEntry.exe 18:42:57.0069 5856 DeviceMonitorService ( UnsignedFile.Multi.Generic ) - warning 18:42:57.0069 5856 DeviceMonitorService - detected UnsignedFile.Multi.Generic (1) 18:42:57.0139 5856 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 18:42:57.0186 5856 DfsC - ok 18:42:57.0219 5856 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 18:42:57.0248 5856 Dhcp - ok 18:42:57.0304 5856 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 18:42:57.0329 5856 discache - ok 18:42:57.0341 5856 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 18:42:57.0348 5856 Disk - ok 18:42:57.0407 5856 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 18:42:57.0442 5856 Dnscache - ok 18:42:57.0494 5856 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 18:42:57.0538 5856 dot3svc - ok 18:42:57.0588 5856 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 18:42:57.0636 5856 DPS - ok 18:42:57.0678 5856 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 18:42:57.0704 5856 drmkaud - ok 18:42:57.0762 5856 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 18:42:57.0792 5856 DXGKrnl - ok 18:42:57.0846 5856 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 18:42:57.0893 5856 EapHost - ok 18:42:57.0963 5856 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 18:42:58.0264 5856 ebdrv - ok 18:42:58.0312 5856 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 18:42:58.0332 5856 EFS - ok 18:42:58.0411 5856 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 18:42:58.0472 5856 ehRecvr - ok 18:42:58.0513 5856 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 18:42:58.0583 5856 ehSched - ok 18:42:58.0621 5856 ElbyCDIO (a05fc7eca0966ebb70e4d17b855a853b) C:\Windows\system32\Drivers\ElbyCDIO.sys 18:42:58.0634 5856 ElbyCDIO - ok 18:42:58.0691 5856 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 18:42:58.0718 5856 elxstor - ok 18:42:58.0769 5856 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 18:42:58.0804 5856 ErrDev - ok 18:42:58.0872 5856 etdrv (84486624268e078255bc7aa47f0960bc) C:\Windows\etdrv.sys 18:42:58.0882 5856 etdrv - ok 18:42:58.0939 5856 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 18:42:58.0989 5856 EventSystem - ok 18:42:59.0014 5856 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 18:42:59.0062 5856 exfat - ok 18:42:59.0107 5856 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 18:42:59.0149 5856 fastfat - ok 18:42:59.0202 5856 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 18:42:59.0474 5856 Fax - ok 18:42:59.0498 5856 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 18:42:59.0523 5856 fdc - ok 18:42:59.0548 5856 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 18:42:59.0579 5856 fdPHost - ok 18:42:59.0593 5856 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 18:42:59.0646 5856 FDResPub - ok 18:42:59.0689 5856 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 18:42:59.0698 5856 FileInfo - ok 18:42:59.0709 5856 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 18:42:59.0756 5856 Filetrace - ok 18:42:59.0784 5856 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 18:42:59.0793 5856 flpydisk - ok 18:42:59.0859 5856 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 18:42:59.0871 5856 FltMgr - ok 18:42:59.0964 5856 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll 18:43:00.0006 5856 FontCache - ok 18:43:00.0123 5856 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 18:43:00.0131 5856 FontCache3.0.0.0 - ok 18:43:00.0141 5856 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 18:43:00.0149 5856 FsDepends - ok 18:43:00.0197 5856 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 18:43:00.0206 5856 Fs_Rec - ok 18:43:00.0277 5856 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 18:43:00.0289 5856 fvevol - ok 18:43:00.0308 5856 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 18:43:00.0318 5856 gagp30kx - ok 18:43:00.0364 5856 gdrv (7907e14f9bcf3a4689c9a74a1a873cb6) C:\Windows\gdrv.sys 18:43:00.0373 5856 gdrv - ok 18:43:00.0437 5856 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 18:43:00.0739 5856 gpsvc - ok 18:43:00.0883 5856 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 18:43:00.0893 5856 gupdate - ok 18:43:00.0901 5856 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 18:43:00.0908 5856 gupdatem - ok 18:43:00.0979 5856 GVTDrv64 (8126331fbd4ed29eb3b356f9c905064d) C:\Windows\GVTDrv64.sys 18:43:00.0991 5856 GVTDrv64 - ok 18:43:01.0007 5856 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 18:43:01.0038 5856 hcw85cir - ok 18:43:01.0088 5856 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 18:43:01.0103 5856 HdAudAddService - ok 18:43:01.0173 5856 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 18:43:01.0202 5856 HDAudBus - ok 18:43:01.0233 5856 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 18:43:01.0262 5856 HidBatt - ok 18:43:01.0289 5856 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 18:43:01.0322 5856 HidBth - ok 18:43:01.0349 5856 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 18:43:01.0363 5856 HidIr - ok 18:43:01.0411 5856 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 18:43:01.0467 5856 hidserv - ok 18:43:01.0497 5856 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 18:43:01.0521 5856 HidUsb - ok 18:43:01.0566 5856 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 18:43:01.0618 5856 hkmsvc - ok 18:43:01.0666 5856 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 18:43:01.0901 5856 HomeGroupListener - ok 18:43:01.0948 5856 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 18:43:01.0982 5856 HomeGroupProvider - ok 18:43:02.0006 5856 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 18:43:02.0016 5856 HpSAMD - ok 18:43:02.0088 5856 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 18:43:02.0151 5856 HTTP - ok 18:43:02.0199 5856 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 18:43:02.0207 5856 hwpolicy - ok 18:43:02.0266 5856 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 18:43:02.0274 5856 i8042prt - ok 18:43:02.0322 5856 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 18:43:02.0338 5856 iaStorV - ok 18:43:02.0484 5856 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 18:43:02.0507 5856 IDriverT ( UnsignedFile.Multi.Generic ) - warning 18:43:02.0507 5856 IDriverT - detected UnsignedFile.Multi.Generic (1) 18:43:02.0606 5856 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 18:43:02.0636 5856 idsvc - ok 18:43:02.0683 5856 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 18:43:02.0696 5856 iirsp - ok 18:43:02.0796 5856 IJPLMSVC (a06efd4965f8a3f97a8c9a291d032678) C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE 18:43:02.0813 5856 IJPLMSVC - ok 18:43:02.0874 5856 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 18:43:02.0917 5856 IKEEXT - ok 18:43:03.0183 5856 IntcAzAudAddService (f04d22d7a49a1b2210dbadf0b803e870) C:\Windows\system32\drivers\RTKVHD64.sys 18:43:03.0238 5856 IntcAzAudAddService - ok 18:43:03.0289 5856 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 18:43:03.0299 5856 intelide - ok 18:43:03.0316 5856 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 18:43:03.0344 5856 intelppm - ok 18:43:03.0388 5856 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 18:43:03.0438 5856 IPBusEnum - ok 18:43:03.0483 5856 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 18:43:03.0527 5856 IpFilterDriver - ok 18:43:03.0634 5856 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 18:43:03.0721 5856 iphlpsvc - ok 18:43:03.0816 5856 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 18:43:03.0842 5856 IPMIDRV - ok 18:43:03.0869 5856 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 18:43:03.0916 5856 IPNAT - ok 18:43:03.0944 5856 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 18:43:03.0989 5856 IRENUM - ok 18:43:04.0043 5856 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 18:43:04.0053 5856 isapnp - ok 18:43:04.0109 5856 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 18:43:04.0122 5856 iScsiPrt - ok 18:43:04.0383 5856 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 18:43:04.0392 5856 kbdclass - ok 18:43:04.0409 5856 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\drivers\kbdhid.sys 18:43:04.0418 5856 kbdhid - ok 18:43:04.0478 5856 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 18:43:04.0487 5856 KeyIso - ok 18:43:04.0506 5856 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 18:43:04.0516 5856 KSecDD - ok 18:43:04.0574 5856 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 18:43:04.0584 5856 KSecPkg - ok 18:43:04.0643 5856 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 18:43:04.0693 5856 ksthunk - ok 18:43:04.0742 5856 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 18:43:04.0793 5856 KtmRm - ok 18:43:04.0848 5856 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll 18:43:04.0893 5856 LanmanServer - ok 18:43:04.0937 5856 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 18:43:04.0984 5856 LanmanWorkstation - ok 18:43:05.0018 5856 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 18:43:05.0067 5856 lltdio - ok 18:43:05.0109 5856 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 18:43:05.0139 5856 lltdsvc - ok 18:43:05.0151 5856 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 18:43:05.0176 5856 lmhosts - ok 18:43:05.0196 5856 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 18:43:05.0206 5856 LSI_FC - ok 18:43:05.0236 5856 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 18:43:05.0246 5856 LSI_SAS - ok 18:43:05.0266 5856 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 18:43:05.0274 5856 LSI_SAS2 - ok 18:43:05.0299 5856 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 18:43:05.0308 5856 LSI_SCSI - ok 18:43:05.0587 5856 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 18:43:05.0636 5856 luafv - ok 18:43:05.0706 5856 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 18:43:05.0716 5856 Mcx2Svc - ok 18:43:05.0739 5856 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 18:43:05.0751 5856 megasas - ok 18:43:05.0771 5856 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 18:43:05.0784 5856 MegaSR - ok 18:43:05.0906 5856 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe 18:43:05.0916 5856 Microsoft Office Groove Audit Service - ok 18:43:05.0941 5856 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 18:43:05.0988 5856 MMCSS - ok 18:43:06.0027 5856 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 18:43:06.0076 5856 Modem - ok 18:43:06.0129 5856 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 18:43:06.0158 5856 monitor - ok 18:43:06.0176 5856 motandroidusb - ok 18:43:06.0184 5856 motccgp - ok 18:43:06.0194 5856 motccgpfl - ok 18:43:06.0218 5856 MotDev - ok 18:43:06.0228 5856 motmodem - ok 18:43:06.0279 5856 MotoHelper (9dfd34e6841c460b5d992a1c5327ae69) C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe 18:43:06.0291 5856 MotoHelper - ok 18:43:06.0298 5856 MotoSwitchService - ok 18:43:06.0308 5856 Motousbnet - ok 18:43:06.0317 5856 motusbdevice - ok 18:43:06.0386 5856 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 18:43:06.0394 5856 mouclass - ok 18:43:06.0457 5856 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 18:43:06.0484 5856 mouhid - ok 18:43:06.0538 5856 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 18:43:06.0547 5856 mountmgr - ok 18:43:06.0596 5856 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 18:43:06.0607 5856 mpio - ok 18:43:06.0853 5856 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 18:43:06.0879 5856 mpsdrv - ok 18:43:06.0941 5856 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll 18:43:07.0006 5856 MpsSvc - ok 18:43:07.0059 5856 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 18:43:07.0094 5856 MRxDAV - ok 18:43:07.0139 5856 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 18:43:07.0167 5856 mrxsmb - ok 18:43:07.0216 5856 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 18:43:07.0227 5856 mrxsmb10 - ok 18:43:07.0237 5856 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 18:43:07.0246 5856 mrxsmb20 - ok 18:43:07.0298 5856 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 18:43:07.0309 5856 msahci - ok 18:43:07.0327 5856 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 18:43:07.0338 5856 msdsm - ok 18:43:07.0393 5856 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 18:43:07.0428 5856 MSDTC - ok 18:43:07.0479 5856 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 18:43:07.0504 5856 Msfs - ok 18:43:07.0519 5856 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 18:43:07.0564 5856 mshidkmdf - ok 18:43:07.0617 5856 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 18:43:07.0624 5856 msisadrv - ok 18:43:07.0686 5856 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 18:43:07.0713 5856 MSiSCSI - ok 18:43:07.0719 5856 msiserver - ok 18:43:07.0738 5856 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 18:43:07.0784 5856 MSKSSRV - ok 18:43:07.0807 5856 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 18:43:07.0854 5856 MSPCLOCK - ok 18:43:08.0064 5856 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 18:43:08.0112 5856 MSPQM - ok 18:43:08.0162 5856 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 18:43:08.0176 5856 MsRPC - ok 18:43:08.0226 5856 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 18:43:08.0233 5856 mssmbios - ok 18:43:08.0254 5856 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 18:43:08.0299 5856 MSTEE - ok 18:43:08.0326 5856 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 18:43:08.0337 5856 MTConfig - ok 18:43:08.0393 5856 MTsensor (6936198f2cc25b39cf5262436c80df46) C:\Windows\system32\DRIVERS\ASACPI.sys 18:43:08.0403 5856 MTsensor - ok 18:43:08.0424 5856 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 18:43:08.0433 5856 Mup - ok 18:43:08.0497 5856 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 18:43:08.0562 5856 napagent - ok 18:43:08.0588 5856 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 18:43:08.0626 5856 NativeWifiP - ok 18:43:08.0666 5856 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 18:43:08.0697 5856 NDIS - ok 18:43:08.0714 5856 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 18:43:08.0743 5856 NdisCap - ok 18:43:08.0758 5856 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 18:43:08.0783 5856 NdisTapi - ok 18:43:08.0884 5856 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 18:43:08.0912 5856 Ndisuio - ok 18:43:08.0966 5856 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 18:43:09.0016 5856 NdisWan - ok 18:43:09.0083 5856 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 18:43:09.0108 5856 NDProxy - ok 18:43:09.0437 5856 Nero BackItUp Scheduler 3 (40d7d0a208ee863bca8d89e299216f15) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe 18:43:09.0467 5856 Nero BackItUp Scheduler 3 - ok 18:43:09.0632 5856 Nero BackItUp Scheduler 4.0 (7d2633295eb6ff2b938185874884059d) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe 18:43:09.0663 5856 Nero BackItUp Scheduler 4.0 - ok 18:43:09.0766 5856 NeroMediaHomeService.4 (2cfe312b910c43e30a6f3d16e24cc2a3) C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe 18:43:09.0777 5856 NeroMediaHomeService.4 - ok 18:43:09.0827 5856 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 18:43:09.0871 5856 NetBIOS - ok 18:43:09.0923 5856 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 18:43:09.0950 5856 NetBT - ok 18:43:10.0005 5856 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 18:43:10.0012 5856 Netlogon - ok 18:43:10.0076 5856 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 18:43:10.0130 5856 Netman - ok 18:43:10.0158 5856 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 18:43:10.0211 5856 netprofm - ok 18:43:10.0323 5856 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 18:43:10.0335 5856 NetTcpPortSharing - ok 18:43:10.0555 5856 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 18:43:10.0568 5856 nfrd960 - ok 18:43:10.0620 5856 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 18:43:10.0666 5856 NlaSvc - ok 18:43:10.0842 5856 NMIndexingService (eba1b4bf2e2375abdadedb649f283541) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe 18:43:10.0868 5856 NMIndexingService - ok 18:43:10.0925 5856 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 18:43:10.0948 5856 Npfs - ok 18:43:11.0002 5856 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 18:43:11.0035 5856 nsi - ok 18:43:11.0051 5856 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 18:43:11.0096 5856 nsiproxy - ok 18:43:11.0163 5856 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 18:43:11.0207 5856 Ntfs - ok 18:43:11.0312 5856 nTuneService - ok 18:43:11.0365 5856 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 18:43:11.0392 5856 Null - ok 18:43:11.0621 5856 nvlddmkm (9c1996dd3c0469bc8933321f15709f5a) C:\Windows\system32\DRIVERS\nvlddmkm.sys 18:43:12.0077 5856 nvlddmkm - ok 18:43:12.0146 5856 nvoclk64 (8c1d181480796d7d3366a9381fd7782d) C:\Windows\system32\DRIVERS\nvoclk64.sys 18:43:12.0160 5856 nvoclk64 - ok 18:43:12.0221 5856 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 18:43:12.0231 5856 nvraid - ok 18:43:12.0276 5856 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 18:43:12.0287 5856 nvstor - ok 18:43:12.0346 5856 nvsvc (34e5498528bb3d5a951f889f8756ad26) C:\Windows\system32\nvvsvc.exe 18:43:12.0376 5856 nvsvc - ok 18:43:12.0472 5856 nvUpdatusService (cd0bfaa6872cfe38c908d313ae17c350) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe 18:43:12.0526 5856 nvUpdatusService - ok 18:43:12.0583 5856 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 18:43:12.0593 5856 nv_agp - ok 18:43:12.0705 5856 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 18:43:12.0720 5856 odserv - ok 18:43:12.0768 5856 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 18:43:12.0797 5856 ohci1394 - ok 18:43:12.0842 5856 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 18:43:12.0853 5856 ose - ok 18:43:13.0098 5856 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 18:43:13.0132 5856 p2pimsvc - ok 18:43:13.0182 5856 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 18:43:13.0200 5856 p2psvc - ok 18:43:13.0270 5856 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 18:43:13.0280 5856 Parport - ok 18:43:13.0287 5856 Partizan - ok 18:43:13.0341 5856 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 18:43:13.0350 5856 partmgr - ok 18:43:13.0366 5856 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 18:43:13.0405 5856 PcaSvc - ok 18:43:13.0452 5856 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 18:43:13.0462 5856 pci - ok 18:43:13.0518 5856 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 18:43:13.0526 5856 pciide - ok 18:43:13.0546 5856 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 18:43:13.0557 5856 pcmcia - ok 18:43:13.0622 5856 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 18:43:13.0631 5856 pcw - ok 18:43:13.0687 5856 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 18:43:13.0753 5856 PEAUTH - ok 18:43:13.0820 5856 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll 18:43:13.0876 5856 PeerDistSvc - ok 18:43:13.0971 5856 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 18:43:14.0001 5856 PerfHost - ok 18:43:14.0071 5856 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 18:43:14.0375 5856 pla - ok 18:43:14.0443 5856 PLFlash DeviceIoControl Service (875e4e0661f3a5994df9e5e3a0a4f96b) C:\Windows\SysWOW64\IoctlSvc.exe 18:43:14.0468 5856 PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - warning 18:43:14.0468 5856 PLFlash DeviceIoControl Service - detected UnsignedFile.Multi.Generic (1) 18:43:14.0526 5856 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 18:43:14.0612 5856 PlugPlay - ok 18:43:14.0653 5856 PnkBstrA - ok 18:43:14.0701 5856 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 18:43:14.0731 5856 PNRPAutoReg - ok 18:43:14.0765 5856 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 18:43:14.0776 5856 PNRPsvc - ok 18:43:14.0805 5856 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 18:43:14.0867 5856 PolicyAgent - ok 18:43:14.0917 5856 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 18:43:14.0963 5856 Power - ok 18:43:15.0030 5856 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 18:43:15.0073 5856 PptpMiniport - ok 18:43:15.0115 5856 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 18:43:15.0148 5856 Processor - ok 18:43:15.0266 5856 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll 18:43:15.0331 5856 ProfSvc - ok 18:43:15.0562 5856 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 18:43:15.0571 5856 ProtectedStorage - ok 18:43:15.0623 5856 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 18:43:15.0650 5856 Psched - ok 18:43:15.0690 5856 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 18:43:15.0735 5856 ql2300 - ok 18:43:15.0757 5856 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 18:43:15.0767 5856 ql40xx - ok 18:43:15.0825 5856 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 18:43:15.0841 5856 QWAVE - ok 18:43:15.0862 5856 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 18:43:15.0895 5856 QWAVEdrv - ok 18:43:16.0071 5856 RapportEI64 (26e1ac6f302c16a07c0577770d0ec3cd) C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys 18:43:16.0083 5856 RapportEI64 - ok 18:43:16.0152 5856 RapportKE64 (0b6dab824ea1a0b1728395ee69aa31e9) C:\Windows\system32\Drivers\RapportKE64.sys 18:43:16.0161 5856 RapportKE64 - ok 18:43:16.0233 5856 RapportPG64 (f7e75548cf5ed4af1a45c07af4f229df) C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys 18:43:16.0243 5856 RapportPG64 - ok 18:43:16.0263 5856 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 18:43:16.0291 5856 RasAcd - ok 18:43:16.0350 5856 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 18:43:16.0376 5856 RasAgileVpn - ok 18:43:16.0388 5856 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 18:43:16.0433 5856 RasAuto - ok 18:43:16.0480 5856 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 18:43:16.0525 5856 Rasl2tp - ok 18:43:16.0572 5856 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 18:43:16.0602 5856 RasMan - ok 18:43:16.0835 5856 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 18:43:16.0861 5856 RasPppoe - ok 18:43:16.0873 5856 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 18:43:16.0918 5856 RasSstp - ok 18:43:16.0993 5856 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 18:43:17.0041 5856 rdbss - ok 18:43:17.0062 5856 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 18:43:17.0088 5856 rdpbus - ok 18:43:17.0113 5856 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 18:43:17.0160 5856 RDPCDD - ok 18:43:17.0210 5856 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys 18:43:17.0222 5856 RDPDR - ok 18:43:17.0246 5856 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 18:43:17.0287 5856 RDPENCDD - ok 18:43:17.0317 5856 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 18:43:17.0341 5856 RDPREFMP - ok 18:43:17.0421 5856 RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys 18:43:17.0465 5856 RdpVideoMiniport - ok 18:43:17.0520 5856 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys 18:43:17.0573 5856 RDPWD - ok 18:43:17.0631 5856 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 18:43:17.0642 5856 rdyboost - ok 18:43:17.0651 5856 RegGuard - ok 18:43:17.0722 5856 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 18:43:17.0750 5856 RemoteAccess - ok 18:43:17.0806 5856 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 18:43:18.0051 5856 RemoteRegistry - ok 18:43:18.0098 5856 RimUsb (ad42432d22940b4215177be113e4919c) C:\Windows\system32\Drivers\RimUsb_AMD64.sys 18:43:18.0108 5856 RimUsb - ok 18:43:18.0170 5856 RimVSerPort (4aafffa67ac4dfa3d9985d78573887e2) C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys 18:43:18.0208 5856 RimVSerPort - ok 18:43:18.0233 5856 ROOTMODEM (388d3dd1a6457280f3badba9f3acd6b1) C:\Windows\system32\Drivers\RootMdm.sys 18:43:18.0278 5856 ROOTMODEM - ok 18:43:18.0307 5856 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 18:43:18.0350 5856 RpcEptMapper - ok 18:43:18.0397 5856 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 18:43:18.0407 5856 RpcLocator - ok 18:43:18.0470 5856 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 18:43:18.0498 5856 RpcSs - ok 18:43:18.0563 5856 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 18:43:18.0590 5856 rspndr - ok 18:43:18.0655 5856 RTL8167 (f65f171165fbb613f7aa3cc78e8cab42) C:\Windows\system32\DRIVERS\Rt64win7.sys 18:43:18.0691 5856 RTL8167 - ok 18:43:18.0750 5856 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys 18:43:18.0780 5856 s3cap - ok 18:43:18.0830 5856 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 18:43:18.0837 5856 SamSs - ok 18:43:18.0986 5856 SANDRA (5efbbfcc6adac121c8e2fe76641ed329) C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2010c\WNt500x64\Sandra.sys 18:43:18.0995 5856 SANDRA - ok 18:43:19.0016 5856 SandraAgentSrv (6e72b22d71a62b7c9162361e5fd0de9d) C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home 2010c\RpcAgentSrv.exe 18:43:19.0040 5856 SandraAgentSrv ( UnsignedFile.Multi.Generic ) - warning 18:43:19.0040 5856 SandraAgentSrv - detected UnsignedFile.Multi.Generic (1) 18:43:19.0283 5856 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 18:43:19.0292 5856 sbp2port - ok 18:43:19.0352 5856 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 18:43:19.0401 5856 SCardSvr - ok 18:43:19.0450 5856 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 18:43:19.0492 5856 scfilter - ok 18:43:19.0557 5856 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 18:43:19.0627 5856 Schedule - ok 18:43:19.0681 5856 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 18:43:19.0706 5856 SCPolicySvc - ok 18:43:19.0758 5856 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 18:43:19.0791 5856 SDRSVC - ok 18:43:19.0858 5856 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 18:43:19.0883 5856 secdrv - ok 18:43:19.0940 5856 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 18:43:19.0983 5856 seclogon - ok 18:43:20.0016 5856 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 18:43:20.0051 5856 SENS - ok 18:43:20.0068 5856 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 18:43:20.0082 5856 SensrSvc - ok 18:43:20.0131 5856 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 18:43:20.0156 5856 Serenum - ok 18:43:20.0188 5856 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 18:43:20.0197 5856 Serial - ok 18:43:20.0248 5856 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 18:43:20.0273 5856 sermouse - ok 18:43:20.0616 5856 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 18:43:20.0661 5856 SessionEnv - ok 18:43:20.0707 5856 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 18:43:20.0736 5856 sffdisk - ok 18:43:20.0760 5856 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 18:43:20.0791 5856 sffp_mmc - ok 18:43:20.0816 5856 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 18:43:20.0847 5856 sffp_sd - ok 18:43:20.0880 5856 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 18:43:20.0890 5856 sfloppy - ok 18:43:20.0972 5856 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 18:43:21.0022 5856 SharedAccess - ok 18:43:21.0088 5856 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 18:43:21.0118 5856 ShellHWDetection - ok 18:43:21.0141 5856 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 18:43:21.0150 5856 SiSRaid2 - ok 18:43:21.0175 5856 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 18:43:21.0185 5856 SiSRaid4 - ok 18:43:21.0205 5856 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 18:43:21.0250 5856 Smb - ok 18:43:21.0296 5856 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 18:43:21.0327 5856 SNMPTRAP - ok 18:43:21.0368 5856 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 18:43:21.0376 5856 spldr - ok 18:43:21.0440 5856 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 18:43:21.0482 5856 Spooler - ok 18:43:21.0790 5856 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 18:43:21.0878 5856 sppsvc - ok 18:43:21.0896 5856 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 18:43:21.0940 5856 sppuinotify - ok 18:43:22.0020 5856 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 18:43:22.0057 5856 srv - ok 18:43:22.0071 5856 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 18:43:22.0086 5856 srv2 - ok 18:43:22.0097 5856 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 18:43:22.0106 5856 srvnet - ok 18:43:22.0136 5856 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 18:43:22.0181 5856 SSDPSRV - ok 18:43:22.0212 5856 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 18:43:22.0238 5856 SstpSvc - ok 18:43:22.0342 5856 Steam Client Service - ok 18:43:22.0517 5856 Stereo Service (8544a200c40447e465f06e58687428bb) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe 18:43:22.0532 5856 Stereo Service - ok 18:43:22.0582 5856 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 18:43:22.0593 5856 stexstor - ok 18:43:22.0652 5856 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 18:43:22.0698 5856 stisvc - ok 18:43:22.0746 5856 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys 18:43:22.0755 5856 storflt - ok 18:43:23.0016 5856 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys 18:43:23.0027 5856 storvsc - ok 18:43:23.0075 5856 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 18:43:23.0086 5856 swenum - ok 18:43:23.0106 5856 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 18:43:23.0168 5856 swprv - ok 18:43:23.0180 5856 Synth3dVsc - ok 18:43:23.0252 5856 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 18:43:23.0311 5856 SysMain - ok 18:43:23.0362 5856 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 18:43:23.0392 5856 TabletInputService - ok 18:43:23.0447 5856 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 18:43:23.0498 5856 TapiSrv - ok 18:43:23.0543 5856 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 18:43:23.0570 5856 TBS - ok 18:43:23.0665 5856 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys 18:43:23.0718 5856 Tcpip - ok 18:43:23.0753 5856 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys 18:43:23.0783 5856 TCPIP6 - ok 18:43:23.0852 5856 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 18:43:23.0893 5856 tcpipreg - ok 18:43:23.0937 5856 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 18:43:23.0965 5856 TDPIPE - ok 18:43:24.0220 5856 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 18:43:24.0242 5856 TDTCP - ok 18:43:24.0287 5856 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 18:43:24.0313 5856 tdx - ok 18:43:24.0365 5856 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 18:43:24.0373 5856 TermDD - ok 18:43:24.0440 5856 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 18:43:24.0498 5856 TermService - ok 18:43:24.0540 5856 TFsExDisk (48d9d00c2e0e72c3d4f52772c80355f6) C:\Windows\System32\Drivers\TFsExDisk.sys 18:43:24.0550 5856 TFsExDisk - ok 18:43:24.0598 5856 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 18:43:24.0640 5856 Themes - ok 18:43:24.0683 5856 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 18:43:24.0708 5856 THREADORDER - ok 18:43:24.0760 5856 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 18:43:24.0786 5856 TrkWks - ok 18:43:24.0880 5856 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 18:43:24.0906 5856 TrustedInstaller - ok 18:43:24.0943 5856 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 18:43:24.0986 5856 tssecsrv - ok 18:43:25.0043 5856 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 18:43:25.0058 5856 TsUsbFlt - ok 18:43:25.0067 5856 tsusbhub - ok 18:43:25.0198 5856 TuneUp.Defrag (43fd686e33b4b9192bc1b7f589e4b184) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe 18:43:25.0226 5856 TuneUp.Defrag - ok 18:43:25.0469 5856 TuneUp.UtilitiesSvc (d301475352ba7a63704a94291fe9d632) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe 18:43:25.0510 5856 TuneUp.UtilitiesSvc - ok 18:43:25.0569 5856 TuneUpUtilitiesDrv (dcc94c51d27c7ec0dadeca8f64c94fcf) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys 18:43:25.0580 5856 TuneUpUtilitiesDrv - ok 18:43:25.0781 5856 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 18:43:25.0841 5856 tunnel - ok 18:43:25.0880 5856 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 18:43:25.0892 5856 uagp35 - ok 18:43:25.0959 5856 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 18:43:26.0004 5856 udfs - ok 18:43:26.0057 5856 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 18:43:26.0069 5856 UI0Detect - ok 18:43:26.0125 5856 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 18:43:26.0137 5856 uliagpkx - ok 18:43:26.0206 5856 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 18:43:26.0232 5856 umbus - ok 18:43:26.0276 5856 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 18:43:26.0309 5856 UmPass - ok 18:43:26.0361 5856 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll 18:43:26.0396 5856 UmRdpService - ok 18:43:26.0734 5856 UpdateCenterService - ok 18:43:26.0756 5856 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 18:43:26.0786 5856 upnphost - ok 18:43:26.0842 5856 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys 18:43:26.0870 5856 usbaudio - ok 18:43:26.0926 5856 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 18:43:26.0939 5856 usbccgp - ok 18:43:27.0006 5856 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 18:43:27.0017 5856 usbcir - ok 18:43:27.0069 5856 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 18:43:27.0097 5856 usbehci - ok 18:43:27.0154 5856 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 18:43:27.0184 5856 usbhub - ok 18:43:27.0237 5856 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys 18:43:27.0247 5856 usbohci - ok 18:43:27.0337 5856 USBPNPA (0a89f75bb756604bbd995f2a0c8144f3) C:\Windows\system32\drivers\CM10864.sys 18:43:27.0356 5856 USBPNPA - ok 18:43:27.0407 5856 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 18:43:27.0436 5856 usbprint - ok 18:43:27.0482 5856 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 18:43:27.0511 5856 usbscan - ok 18:43:27.0571 5856 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 18:43:27.0615 5856 USBSTOR - ok 18:43:27.0685 5856 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 18:43:27.0912 5856 usbuhci - ok 18:43:27.0957 5856 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 18:43:28.0006 5856 UxSms - ok 18:43:28.0055 5856 UxTuneUp (eb4e0df599d6b7b307ee804689908f8f) C:\Windows\System32\uxtuneup.dll 18:43:28.0064 5856 UxTuneUp - ok 18:43:28.0121 5856 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 18:43:28.0130 5856 VaultSvc - ok 18:43:28.0185 5856 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 18:43:28.0192 5856 vdrvroot - ok 18:43:28.0252 5856 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 18:43:28.0295 5856 vds - ok 18:43:28.0316 5856 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 18:43:28.0330 5856 vga - ok 18:43:28.0346 5856 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 18:43:28.0386 5856 VgaSave - ok 18:43:28.0437 5856 VGPU - ok 18:43:28.0501 5856 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 18:43:28.0514 5856 vhdmp - ok 18:43:28.0569 5856 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 18:43:28.0579 5856 viaide - ok 18:43:28.0634 5856 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys 18:43:28.0644 5856 vmbus - ok 18:43:28.0700 5856 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys 18:43:28.0729 5856 VMBusHID - ok 18:43:28.0792 5856 vmwvusb (f9d116ef357c1026b4f6bf670541426a) C:\Windows\system32\Drivers\vmwvusb.sys 18:43:28.0806 5856 vmwvusb - ok 18:43:28.0862 5856 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 18:43:28.0871 5856 volmgr - ok 18:43:28.0910 5856 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 18:43:28.0924 5856 volmgrx - ok 18:43:29.0140 5856 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 18:43:29.0152 5856 volsnap - ok 18:43:29.0170 5856 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 18:43:29.0181 5856 vsmraid - ok 18:43:29.0262 5856 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 18:43:29.0339 5856 VSS - ok 18:43:29.0495 5856 vToolbarUpdater (8a603dabd6a7fa5f31e2b6e562e0ebdf) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe 18:43:29.0524 5856 vToolbarUpdater - ok 18:43:29.0550 5856 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 18:43:29.0579 5856 vwifibus - ok 18:43:29.0632 5856 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 18:43:29.0662 5856 W32Time - ok 18:43:29.0684 5856 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 18:43:29.0695 5856 WacomPen - ok 18:43:29.0717 5856 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 18:43:29.0761 5856 WANARP - ok 18:43:29.0766 5856 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 18:43:29.0791 5856 Wanarpv6 - ok 18:43:29.0865 5856 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 18:43:29.0906 5856 WatAdminSvc - ok 18:43:29.0984 5856 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 18:43:30.0044 5856 wbengine - ok 18:43:30.0074 5856 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 18:43:30.0089 5856 WbioSrvc - ok 18:43:30.0149 5856 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 18:43:30.0425 5856 wcncsvc - ok 18:43:30.0452 5856 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 18:43:30.0482 5856 WcsPlugInService - ok 18:43:30.0509 5856 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 18:43:30.0519 5856 Wd - ok 18:43:30.0547 5856 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 18:43:30.0575 5856 Wdf01000 - ok 18:43:30.0587 5856 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 18:43:30.0622 5856 WdiServiceHost - ok 18:43:30.0627 5856 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 18:43:30.0640 5856 WdiSystemHost - ok 18:43:30.0664 5856 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 18:43:30.0697 5856 WebClient - ok 18:43:30.0731 5856 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 18:43:30.0765 5856 Wecsvc - ok 18:43:30.0780 5856 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 18:43:30.0830 5856 wercplsupport - ok 18:43:30.0880 5856 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 18:43:30.0927 5856 WerSvc - ok 18:43:30.0967 5856 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 18:43:30.0992 5856 WfpLwf - ok 18:43:31.0017 5856 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 18:43:31.0029 5856 WIMMount - ok 18:43:31.0096 5856 WinDefend - ok 18:43:31.0106 5856 WinHttpAutoProxySvc - ok 18:43:31.0227 5856 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 18:43:31.0255 5856 Winmgmt - ok 18:43:31.0345 5856 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 18:43:31.0629 5856 WinRM - ok 18:43:31.0692 5856 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 18:43:31.0706 5856 WinUsb - ok 18:43:31.0766 5856 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 18:43:31.0814 5856 Wlansvc - ok 18:43:31.0977 5856 wlidsvc (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 18:43:32.0034 5856 wlidsvc - ok 18:43:32.0064 5856 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 18:43:32.0085 5856 WmiAcpi - ok 18:43:32.0181 5856 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 18:43:32.0212 5856 wmiApSrv - ok 18:43:32.0245 5856 WMPNetworkSvc - ok 18:43:32.0266 5856 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 18:43:32.0281 5856 WPCSvc - ok 18:43:32.0334 5856 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 18:43:32.0359 5856 WPDBusEnum - ok 18:43:32.0417 5856 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 18:43:32.0461 5856 ws2ifsl - ok 18:43:32.0489 5856 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll 18:43:32.0519 5856 wscsvc - ok 18:43:32.0541 5856 WSearch - ok 18:43:32.0906 5856 wsnm (d50cd7e45963f42f54b045bfb22a41ef) C:\Program Files\VMware\VMware View\Client\bin\wsnm.exe 18:43:32.0931 5856 wsnm - ok 18:43:32.0959 5856 wsnm_usbctrl (0872b00981a1d64abed903023d2d7f26) C:\Program Files\VMware\VMware View\Client\bin\wsnm_usbctrl.exe 18:43:32.0991 5856 wsnm_usbctrl - ok 18:43:33.0084 5856 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll 18:43:33.0169 5856 wuauserv - ok 18:43:33.0236 5856 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 18:43:33.0280 5856 WudfPf - ok 18:43:33.0320 5856 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 18:43:33.0346 5856 WUDFRd - ok 18:43:33.0404 5856 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 18:43:33.0430 5856 wudfsvc - ok 18:43:33.0486 5856 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 18:43:33.0521 5856 WwanSvc - ok 18:43:33.0581 5856 yukonw7 (64f88af327aa74e03658ae32b48ccb8b) C:\Windows\system32\DRIVERS\yk62x64.sys 18:43:33.0626 5856 yukonw7 - ok 18:43:33.0661 5856 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1 18:43:33.0785 5856 \Device\Harddisk1\DR1 - ok 18:43:33.0804 5856 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 18:43:33.0894 5856 \Device\Harddisk0\DR0 - ok 18:43:33.0899 5856 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR2 18:43:35.0904 5856 \Device\Harddisk2\DR2 - ok 18:43:35.0922 5856 Boot (0x1200) (cc53956482498f3c406dcdbd943576b6) \Device\Harddisk1\DR1\Partition0 18:43:35.0924 5856 \Device\Harddisk1\DR1\Partition0 - ok 18:43:35.0957 5856 Boot (0x1200) (6b4b55ecbd74a23351508f59b5875467) \Device\Harddisk0\DR0\Partition0 18:43:35.0959 5856 \Device\Harddisk0\DR0\Partition0 - ok 18:43:35.0961 5856 Boot (0x1200) (00aeb2ebf3b5e5e1625a2f8fc7e397a5) \Device\Harddisk0\DR0\Partition1 18:43:35.0962 5856 \Device\Harddisk0\DR0\Partition1 - ok 18:43:35.0967 5856 Boot (0x1200) (3428213964066d6f95283cb8d25e247e) \Device\Harddisk2\DR2\Partition0 18:43:35.0970 5856 \Device\Harddisk2\DR2\Partition0 - ok 18:43:35.0971 5856 ============================================================ 18:43:35.0971 5856 Scan finished 18:43:35.0971 5856 ============================================================ 18:43:35.0981 1232 Detected object count: 5 18:43:35.0982 1232 Actual detected object count: 5 18:43:55.0266 1232 Akamai ( HiddenFile.Multi.Generic ) - skipped by user 18:43:55.0268 1232 Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip 18:43:55.0269 1232 DeviceMonitorService ( UnsignedFile.Multi.Generic ) - skipped by user 18:43:55.0269 1232 DeviceMonitorService ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:43:55.0270 1232 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user 18:43:55.0270 1232 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:43:55.0273 1232 PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - skipped by user 18:43:55.0273 1232 PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:43:55.0275 1232 SandraAgentSrv ( UnsignedFile.Multi.Generic ) - skipped by user 18:43:55.0275 1232 SandraAgentSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:44:08.0543 5440 Deinitialize success
  8. I had a rootkit virus and after much work, I think I have gotten it all. I have found the instructions and unhidden all my files, but now when I click my orb, I don't have my programs available. Here are my logs: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30 Run by Dadee2 at 20:29:44 on 2012-04-17 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.6142.4367 [GMT -5:00] . AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\PROGRA~2\AVG\AVG2012\avgrsa.exe C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\AUDIODG.EXE C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Windows\SysWOW64\svchost.exe -k Akamai C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE C:\Program Files (x86)\Motorola Media Link\NServiceEntry.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\UnHackMe\hackmon.exe C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe C:\Windows\SysWOW64\IoctlSvc.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\VMware\VMware View\Client\bin\wsnm.exe C:\Program Files\VMware\VMware View\Client\bin\wsnm_usbctrl.exe C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\WUDFHost.exe C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Users\Dadee2\AppData\Local\Akamai\netsession_win.exe C:\Users\Dadee2\AppData\Local\Akamai\netsession_win.exe C:\Windows\system32\taskmgr.exe C:\Program Files (x86)\AVG\AVG2012\avgtray.exe C:\Program Files (x86)\real\realplayer\Update\realsched.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\sppsvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ uInternet Settings,ProxyOverride = 127.0.0.1:9421;192.168.*.*;<local> uURLSearchHooks: H - No File mURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Speckie: {8ce7f568-67fa-4432-ba39-f5afd68e7b8b} - C:\Users\Dadee2\AppData\Roaming\Speckie\bin32\Speckie32.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File {e7df6bff-55a5-4eb7-a673-4ed3e9456d39} EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll uRun: [unHackMe Monitor] C:\Program Files (x86)\UnHackMe\hackmon.exe uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" uRun: [Akamai NetSession Interface] "C:\Users\Dadee2\AppData\Local\Akamai\netsession_win.exe" uRun: [iSUSPM Startup] c:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun: [TkBellExe] "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Lookup on Merriam Webster - file://C:\Program Files (x86)\ieSpell\Merriam Webster.HTM IE: Lookup on Wikipedia - file://C:\Program Files (x86)\ieSpell\wikipedia.HTM IE: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL IE: {E6846530-6088-4AA3-932F-C6245CE59A4C} - {8CE7F568-67FA-4432-BA39-F5AFD68E7B8B} - C:\Users\Dadee2\AppData\Roaming\Speckie\bin32\Speckie32.dll DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} - hxxp://download.gigabyte.com.tw/object/Dldrv.ocx DPF: {16F67783-7E72-4C39-99C4-4780A8335484} - hxxp://www.syncmyride.com/Own/Modules/UpdateCenter/applets/sync.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 TCP: Interfaces\{8D94E7BD-EBBA-45BD-AD9C-30A53C56D311} : DhcpNameServer = 68.87.85.102 68.87.69.150 TCP: Interfaces\{983BCBC0-E595-4F9E-A695-A21930288ED4} : DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO-X64: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO-X64: Canon Easy-WebPrint EX BHO - No File BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll BHO-X64: RoboForm - No File BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO-X64: Speckie: {8CE7F568-67FA-4432-BA39-F5AFD68E7B8B} - C:\Users\Dadee2\AppData\Roaming\Speckie\bin32\Speckie32.dll BHO-X64: Speckie - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB-X64: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll TB-X64: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll TB-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File EB-X64: {21347690-EC41-4F9A-8887-1F4AEE672439} - No File mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" mRun-x64: [TkBellExe] "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE-X64: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE-X64: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Dadee2\AppData\Roaming\Mozilla\Firefox\Profiles\rej2lse3.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=14652 FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B2401947c-48f1-4340-97d3-3a2aa937696c%7D&mid=59ff73e93822a08274b6fd502658836f-3093bac924fc3c196c30ab126a3c06a51257d089&ds=AVG&v=9.0.0.18.1〈=en&pr=fr&d=2011-09-07%2009%3A15%3A36&sap=ku&q= FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff4.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - component: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll FF - plugin: C:\Program Files (x86)\Download Manager\npfpdlm.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPcolPM460.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npicaN.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\Dadee2\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?] R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?] R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?] R2 cpuz135;cpuz135;\??\C:\Windows\system32\drivers\cpuz135_x64.sys --> C:\Windows\system32\drivers\cpuz135_x64.sys [?] R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?] R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;C:\Windows\system32\drivers\CM10864.sys --> C:\Windows\system32\drivers\CM10864.sys [?] S3 etdrv;etdrv;C:\Windows\etdrv.sys [2010-6-10 25640] S3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2010-6-9 30528] . =============== Created Last 30 ================ . 2012-04-11 08:00:38 81408 ----a-w- C:\Windows\System32\imagehlp.dll 2012-04-11 08:00:38 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys 2012-04-11 08:00:38 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll 2012-04-11 08:00:37 5120 ----a-w- C:\Windows\SysWow64\wmi.dll 2012-04-11 08:00:37 5120 ----a-w- C:\Windows\System32\wmi.dll 2012-04-11 08:00:37 220672 ----a-w- C:\Windows\System32\wintrust.dll 2012-04-11 08:00:37 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll 2012-04-04 05:53:56 182160 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53:56 182160 ----a-w- C:\Program Files (x86)\Internet Explorer\PLUGINS\nppdf32.dll 2012-03-31 00:54:41 -------- d-----w- C:\Windows\RestoreSafeDeleted 2012-03-30 02:05:08 39184 ----a-w- C:\Windows\SysWow64\PARTIZAN.EXE 2012-03-29 15:58:57 -------- d-----w- C:\Users\Dadee2\AppData\Roaming\RealNetworks 2012-03-29 12:16:47 626688 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr80.dll 2012-03-29 12:16:47 548864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp80.dll 2012-03-29 12:16:47 479232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcm80.dll 2012-03-29 12:16:47 43992 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozutils.dll 2012-03-29 12:14:58 0 --sha-w- C:\Windows\System32\dds_trash_log.cmd 2012-03-29 12:13:52 -------- d-----we C:\Windows\system64 . ==================== Find3M ==================== . 2012-04-07 16:15:34 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2012-04-07 16:15:34 270776 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe 2012-04-07 16:15:28 75136 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe 2012-03-09 14:12:44 138360 ----a-w- C:\Windows\SysWow64\drivers\AnyDVD.sys 2012-03-09 14:12:44 138360 ----a-w- C:\Windows\System32\drivers\AnyDVD.sys 2012-03-06 06:53:37 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-03-06 05:59:47 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-03-06 05:59:41 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-02-28 06:56:48 2311168 ----a-w- C:\Windows\System32\jscript9.dll 2012-02-28 06:49:56 1390080 ----a-w- C:\Windows\System32\wininet.dll 2012-02-28 06:48:57 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-02-28 06:42:55 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-02-28 01:18:55 1799168 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-02-28 01:11:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-02-28 01:11:07 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-02-28 01:03:16 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-02-23 02:56:29 39184 ----a-w- C:\Windows\System32\Partizan.exe 2012-02-23 02:51:32 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-17 23:58:03 30528 ----a-w- C:\Windows\GVTDrv64.sys 2012-02-17 23:57:43 25640 ----a-w- C:\Windows\gdrv.sys 2012-02-17 06:38:27 1112064 ----a-w- C:\Windows\System32\rdpcorets.dll 2012-02-17 06:38:26 1031680 ----a-w- C:\Windows\System32\rdpcore.dll 2012-02-17 05:34:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll 2012-02-17 04:58:24 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-02-17 04:57:32 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll 2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll 2012-02-10 03:14:04 6074176 ----a-w- C:\Windows\System32\nvcpl.dll 2012-02-10 03:14:01 3089728 ----a-w- C:\Windows\System32\nvsvc64.dll 2012-02-10 03:07:00 889664 ----a-w- C:\Windows\System32\nvvsvc.exe 2012-02-10 03:07:00 63296 ----a-w- C:\Windows\System32\nvshext.dll 2012-02-10 03:07:00 118080 ----a-w- C:\Windows\System32\nvmctray.dll 2012-02-10 02:05:44 416064 ----a-w- C:\Windows\SysWow64\nvStreaming.exe 2012-02-07 16:02:40 1070352 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34:34 3145728 ----a-w- C:\Windows\System32\win32k.sys 2012-02-01 03:12:44 282864 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2012-02-01 02:23:43 25640 ----a-w- C:\Windows\etdrv.sys 2012-01-25 06:38:39 77312 ----a-w- C:\Windows\System32\rdpwsx.dll 2012-01-25 06:38:38 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll 2012-01-25 06:33:30 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe . ============= FINISH: 20:32:39.46 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume2 Install Date: 11/30/2009 5:58:26 PM System Uptime: 4/17/2012 8:23:06 PM (0 hours ago) . Motherboard: Gigabyte Technology Co., Ltd. | | GA-MA785GM-US2H Processor: AMD Phenom II X4 B40 Processor | Socket M2 | 3150/210mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 298 GiB total, 63.663 GiB free. D: is CDROM () E: is FIXED (NTFS) - 140 GiB total, 49.207 GiB free. F: is FIXED (NTFS) - 158 GiB total, 84.458 GiB free. G: is CDROM () H: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP281: 3/30/2012 11:23:07 PM - Configured Microsoft Office Enterprise 2007 RP282: 4/7/2012 12:00:01 AM - Scheduled Checkpoint RP283: 4/11/2012 3:00:13 AM - Windows Update RP284: 4/16/2012 9:32:28 PM - Configured Microsoft Office Enterprise 2007 . ==== Installed Programs ====================== . . Update for Microsoft Office 2007 (KB2508958) @BIOS Ver.2.06 µTorrent 7-Zip 9.22beta Acrobat.com Adobe AIR Adobe Flash Player 11 Plugin Adobe Reader X (10.1.3) Advertising Center AI RoboForm (All Users) Akamai NetSession Interface Akamai NetSession Interface Service AnyDVD Articulate Studio '09 Pro Audacity 1.3.13 (Unicode) Auslogics Disk Defrag Avery Wizard 4.0 Battlefield 3™ Battlefield: Bad Company™ 2 Battlelog Web Plugins Bing Bar Biohazard Teamspeak 3 Theme BlackBerry Desktop Software 6.1 Call of Duty Modern Warfare 2 Call of Duty® - World at War Call of Duty® - World at War 1.1 Patch Call of Duty® - World at War 1.2 Patch Call of Duty® - World at War 1.4 Patch Call of Duty® - World at War 1.5 Patch Call of Duty® - World at War 1.6 Patch Call of Duty® - World at War 1.7 Patch Call of Duty® 4 - Modern Warfare Call of Duty® 4 - Modern Warfare 1.1 Patch Call of Duty® 4 - Modern Warfare 1.2 Patch Call of Duty® 4 - Modern Warfare 1.3 Patch Call of Duty® 4 - Modern Warfare 1.4 Patch Call of Duty® 4 - Modern Warfare 1.5 Multiplayer Patch Call of Duty® 4 - Modern Warfare 1.5 Patch Call of Duty® 4 - Modern Warfare 1.6 Patch Call of Duty® 4 - Modern Warfare 1.7 Patch Call of Duty: Black Ops Call of Duty: Black Ops - Multiplayer Canon Easy-WebPrint EX Canon Inkjet Printer/Scanner/Fax Extended Survey Program Canon MP Navigator EX 3.0 Canon MP490 series User Registration Canon Utilities My Printer Canon Utilities Solution Menu Cisco Connect Citrix XenApp Plugin for Hosted Apps CloneDVD2 Combined Community Codec Pack 2009-09-09 CrossLoop 2.60 DMIView B8.0717.01 DolbyFiles Download Manager 2.3.10 Easy Tune 6 B10.0427.1 ESN Sonar FileZilla Client 3.3.2.1 Garmin City Navigator North America NT 2012.30 Update Garmin Lifetime Updater Glary Utilities 2.42.0.1389 Google Chrome Google Earth Plug-in Google Update Helper HOMEFRONT Host OpenAL (ADI) ImagXpress Internet TV for Windows Media Center Java Auto Updater Java 6 Update 30 Junk Mail filter update Logitech Harmony Remote Software 7 Malwarebytes' Anti-Malware Medal of Honor Menu Templates - Starter Kit MergeModules Microsoft Choice Guard Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Live Add-in 1.5 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 MotoHelper 2.1.32 Driver 5.4.0 MotoHelper MergeModules MOTOROLA MEDIA LINK Motorola Software Update Movie Templates - Starter Kit Mozilla Firefox 4.0b6 (x86 en-US) Mozilla Firefox 9.0.1 (x86 en-US) MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 8 Nero 9 Nero BurnRights Nero ControlCenter Nero CoverDesigner Nero Disc Copy Gadget Nero DiscSpeed Nero DriveSpeed Nero InfoTool Nero Installer Nero MediaHome 4 Nero MediaHome 4 Help Nero PhotoSnap Nero Recode Nero Rescue Agent Nero ShowTime Nero StartSmart Nero Vision Nero WaveEditor NeroBurningROM NeroExpress neroxml NVIDIA Performance NVIDIA PhysX NVIDIA Stereoscopic 3D Driver NVIDIA System Monitor NVIDIA System Update Origin PC Wizard 2010.1.94 PunkBuster Services QuickTime Alternative 1.47 Rapport RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek Ethernet Controller Driver Realtek High Definition Audio Driver RegRun Reanimator Remote Control USB Driver Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition SoundTrax Steam System Requirements Lab System Requirements Lab CYRI TINT Helper Plugins for TeamSpeak 3 TINT Standard BETA B3 TS Notifier TuneUp Utilities TuneUp Utilities Language Pack (en-US) UnHackMe 5.99 release Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2598306) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Update Manager B09.0908.1 Visual C++ 8.0 Runtime Setup Package (x64) Visual Studio 2008 x64 Redistributables Visual Zip Password Recovery Processor VLC media player 2.0.1 WinAVI Video Converter Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Movie Maker Windows Live Photo Gallery Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Media Player Firefox Plugin XviD MPEG-4 Video Codec . ==== Event Viewer Messages From Past Week ======== . 4/17/2012 8:30:27 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting. 4/17/2012 8:26:05 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly. 4/17/2012 8:25:24 PM, Error: Service Control Manager [7034] - The Nero MediaHome 4 Service service terminated unexpectedly. It has done this 3 time(s). 4/17/2012 8:25:10 PM, Error: Service Control Manager [7031] - The Nero MediaHome 4 Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 1 milliseconds: Restart the service. 4/17/2012 8:24:48 PM, Error: Service Control Manager [7031] - The Nero MediaHome 4 Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1 milliseconds: Restart the service. 4/17/2012 8:23:55 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Partizan 4/16/2012 9:44:16 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect. 4/16/2012 9:44:16 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/16/2012 8:27:49 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2. . ==== End Of File ===========================
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.