username123

It is running ok, malwarebytes scan come up clean.

I ran the kaspersky virus removal tool and it did detect and remove a couple things, but I accidentally closed the window before I copied the log. I could not find a copy of the log anywhere on the c: drive, is there a way to recover it?

It found and rremoved 2 things, thswas all that was in the log: ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK

Combofix log ComboFix 12-07-02.01 - Owner 07/02/2012 13:51:27.1.3 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3835.1859 [GMT -4:00] Running from: c:\users\Owner\Desktop\ComboFix.exe AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Owner\AppData\Local\Temp\libsqlitejdbc-1097905350671404327.lib c:\users\Owner\AppData\Local\Temp\swt-gdip-win32-3448.dll c:\users\Owner\AppData\Local\Temp\swt-win32-3448.dll c:\users\Owner\AppData\Local\Temp\WindowsAPI.dll3028653110324797918.lib . . ((((((((((((((((((((((((( Files Created from 2012-06-02 to 2012-07-02 ))))))))))))))))))))))))))))))) . . 2012-06-28 14:42 . 2012-06-28 14:42 -------- d-----w- C:\TDSSKiller_Quarantine 2012-06-25 20:03 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-25 20:03 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-25 20:03 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-25 20:03 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-25 20:02 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-25 20:02 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-25 20:02 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-25 20:02 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-25 20:02 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-06-14 01:40 . 2012-06-14 01:40 -------- d-----w- C:\5e688b2ba81316da2e36f179622c7d 2012-06-14 00:51 . 2012-04-24 05:37 1462272 ----a-w- c:\windows\system32\crypt32.dll 2012-06-14 00:51 . 2012-04-24 05:37 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-14 00:51 . 2012-04-24 05:37 140288 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-14 00:51 . 2012-04-24 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-14 00:51 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll 2012-06-14 00:51 . 2012-04-24 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-14 00:44 . 2012-04-07 12:31 3216384 ----a-w- c:\windows\system32\msi.dll 2012-06-14 00:44 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\SysWow64\msi.dll 2012-06-14 00:34 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 00:16 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 00:16 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 00:16 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-14 00:13 . 2012-05-01 05:40 209920 ----a-w- c:\windows\system32\profsvc.dll 2012-06-14 00:08 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys 2012-06-13 00:50 . 2012-06-13 23:13 -------- d-----w- c:\windows\system32\drivers\NISx64\1207020.003 2012-06-08 18:51 . 2012-06-08 18:51 -------- d-----w- c:\programdata\Kodak 2012-06-08 18:51 . 2010-09-02 19:31 232960 ----a-w- c:\windows\system32\Spool\prtprocs\x64\EKIJ5000PPR.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-19 02:13 . 2011-08-16 20:43 900 --sha-w- c:\programdata\KGyGaAvL.sys 2012-04-04 19:56 . 2012-03-21 20:40 24904 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZumoDrive"="c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" [2011-05-25 2084] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-30 98304] "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "ZumoDrive"="c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" [2011-05-25 2084] "HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-06-14 587320] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ PdaNet Desktop.lnk - c:\program files (x86)\PdaNet for Android\PdaNetPC.exe [2011-5-18 473616] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320] Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ DPPassFilter scecli Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 CLKMSVC10_C6F09094;CyberLink Product - 2011/03/11 01:08;c:\program files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2010-09-21 245232] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856] R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-09-15 239136] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-16 1255736] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS [2011-01-27 450680] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS [2011-03-15 912504] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [2012-06-19 1161376] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120627.001\IDSvia64.sys [2012-06-18 509088] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [2011-01-27 171128] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [2011-04-21 386168] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2010-09-14 89600] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-10-08 203264] S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-21 103992] S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-04-20 30520] S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-06-14 26680] S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [2011-04-17 130008] S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-10-08 7767552] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-10-08 279040] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-07-14 344616] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-02 39464] S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [2010-09-04 31088] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-05-31 138912] S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2010-09-02 15360] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-03-21 452200] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-10-08 38528] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL *Deregistered* - CLKMDRV10_C6F09094 . Contents of the 'Scheduled Tasks' folder . 2012-06-08 c:\windows\Tasks\HPCeeScheduleForOWNER-HP$.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . 2012-06-10 c:\windows\Tasks\HPCeeScheduleForOwner.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter] @="{D25B32FE-CB96-491A-98FF-AD59DA382D69}" [HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}] 2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter] @="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}" [HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}] 2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter] @="{B3C78E40-6B64-47C3-AE34-60B770881EB8}" [HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}] 2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter] @="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}" [HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}] 2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter] @="{855156F0-2A0F-11DE-8C30-0800200C9A66}" [HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}] 2010-09-23 04:53 2210304 ----a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-09-14 487424] "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896] "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192] "EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2010-09-02 2045440] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.foxnews.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.2.1 . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run-Corel File Shell Monitor - c:\program files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe c:\windows\system32\atibtmon.exe c:\program files (x86)\DigitalPersona\Bin\DPAgent.exe c:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe . ************************************************************************** . Completion time: 2012-07-02 14:18:34 - machine was rebooted ComboFix-quarantined-files.txt 2012-07-02 18:18 . Pre-Run: 653,102,952,448 bytes free Post-Run: 655,518,060,544 bytes free . - - End Of File - - EBA19477B837EFD9FF6DDAA469BF4C13

Logs: 10:38:00.0834 0912 TDSS rootkit removing tool 2.7.42.0 Jun 25 2012 21:18:44 10:38:02.0831 0912 ============================================================ 10:38:02.0831 0912 Current date / time: 2012/06/28 10:38:02.0831 10:38:02.0831 0912 SystemInfo: 10:38:02.0831 0912 10:38:02.0831 0912 OS Version: 6.1.7601 ServicePack: 1.0 10:38:02.0831 0912 Product type: Workstation 10:38:02.0831 0912 ComputerName: OWNER-HP 10:38:02.0831 0912 UserName: Owner 10:38:02.0831 0912 Windows directory: C:\Windows 10:38:02.0831 0912 System windows directory: C:\Windows 10:38:02.0831 0912 Running under WOW64 10:38:02.0831 0912 Processor architecture: Intel x64 10:38:02.0831 0912 Number of processors: 3 10:38:02.0831 0912 Page size: 0x1000 10:38:02.0831 0912 Boot type: Normal boot 10:38:02.0831 0912 ============================================================ 10:38:05.0655 0912 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 10:38:05.0670 0912 ============================================================ 10:38:05.0670 0912 \Device\Harddisk0\DR0: 10:38:05.0670 0912 MBR partitions: 10:38:05.0670 0912 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800 10:38:05.0670 0912 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x5441F000 10:38:05.0670 0912 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x54483000, BlocksNum 0x308F800 10:38:05.0670 0912 \Device\Harddisk0\DR0\Partition3: MBR, Type 0xC, StartLBA 0x57512800, BlocksNum 0x336F0 10:38:05.0670 0912 ============================================================ 10:38:05.0795 0912 C: <-> \Device\Harddisk0\DR0\Partition1 10:38:06.0201 0912 D: <-> \Device\Harddisk0\DR0\Partition2 10:38:06.0357 0912 F: <-> \Device\Harddisk0\DR0\Partition3 10:38:06.0357 0912 ============================================================ 10:38:06.0357 0912 Initialize success 10:38:06.0357 0912 ============================================================ 10:38:48.0335 1412 ============================================================ 10:38:48.0335 1412 Scan started 10:38:48.0335 1412 Mode: Manual; SigCheck; TDLFS; 10:38:48.0335 1412 ============================================================ 10:38:53.0869 1412 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 10:38:54.0112 1412 1394ohci - ok 10:38:54.0207 1412 Accelerometer (7bb93bb5a578984090748f310ed895ef) C:\Windows\system32\DRIVERS\Accelerometer.sys 10:38:54.0278 1412 Accelerometer - ok 10:38:54.0707 1412 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 10:38:54.0757 1412 ACPI - ok 10:38:54.0820 1412 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 10:38:54.0913 1412 AcpiPmi - ok 10:38:55.0092 1412 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 10:38:55.0189 1412 adp94xx - ok 10:38:55.0349 1412 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 10:38:55.0457 1412 adpahci - ok 10:38:55.0588 1412 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 10:38:55.0652 1412 adpu320 - ok 10:38:55.0721 1412 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 10:38:55.0839 1412 AeLookupSvc - ok 10:38:56.0097 1412 AESTFilters (a6fb9db8f1a86861d955fd6975977ae0) C:\Program Files\IDT\WDM\AESTSr64.exe 10:38:56.0161 1412 AESTFilters - ok 10:38:56.0448 1412 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 10:38:56.0630 1412 AFD - ok 10:38:56.0737 1412 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 10:38:56.0793 1412 agp440 - ok 10:38:56.0877 1412 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 10:38:56.0999 1412 ALG - ok 10:38:57.0091 1412 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 10:38:57.0137 1412 aliide - ok 10:38:57.0278 1412 AMD External Events Utility (09fcd2c758f1ad3df931ab9d944fe348) C:\Windows\system32\atiesrxx.exe 10:38:57.0347 1412 AMD External Events Utility - ok 10:38:57.0437 1412 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 10:38:57.0471 1412 amdide - ok 10:38:57.0647 1412 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 10:38:57.0735 1412 AmdK8 - ok 10:39:02.0477 1412 amdkmdag (2e76d0a912ab09ca5586ab23e466a25f) C:\Windows\system32\DRIVERS\atikmdag.sys 10:39:03.0384 1412 amdkmdag - ok 10:39:05.0014 1412 amdkmdap (dd3c0c1b62da0736482501c4bcdcd1f8) C:\Windows\system32\DRIVERS\atikmpag.sys 10:39:05.0207 1412 amdkmdap - ok 10:39:05.0320 1412 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 10:39:05.0417 1412 AmdPPM - ok 10:39:05.0572 1412 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 10:39:05.0679 1412 amdsata - ok 10:39:05.0943 1412 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 10:39:06.0009 1412 amdsbs - ok 10:39:06.0309 1412 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 10:39:06.0504 1412 amdxata - ok 10:39:06.0655 1412 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 10:39:06.0816 1412 AppID - ok 10:39:06.0892 1412 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 10:39:07.0053 1412 AppIDSvc - ok 10:39:07.0142 1412 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 10:39:07.0249 1412 Appinfo - ok 10:39:07.0338 1412 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 10:39:07.0374 1412 arc - ok 10:39:07.0533 1412 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 10:39:07.0603 1412 arcsas - ok 10:39:07.0711 1412 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 10:39:07.0835 1412 AsyncMac - ok 10:39:07.0893 1412 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 10:39:07.0921 1412 atapi - ok 10:39:08.0803 1412 athr (e857eee6b92aaa473ebb3465add8f7e7) C:\Windows\system32\DRIVERS\athrx.sys 10:39:09.0021 1412 athr - ok 10:39:10.0593 1412 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\Windows\system32\drivers\AtiHdmi.sys 10:39:10.0644 1412 AtiHdmiService - ok 10:39:10.0714 1412 AtiPcie (e82e61f46d1336447f4deff8c074f13e) C:\Windows\system32\DRIVERS\AtiPcie64.sys 10:39:10.0763 1412 AtiPcie - ok 10:39:11.0135 1412 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 10:39:11.0285 1412 AudioEndpointBuilder - ok 10:39:11.0303 1412 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 10:39:11.0412 1412 AudioSrv - ok 10:39:11.0623 1412 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 10:39:11.0800 1412 AxInstSV - ok 10:39:11.0972 1412 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 10:39:12.0118 1412 b06bdrv - ok 10:39:12.0330 1412 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 10:39:12.0483 1412 b57nd60a - ok 10:39:12.0716 1412 BBSvc (a2494901e7226b356b8c1005c45f1c5f) C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe 10:39:12.0788 1412 BBSvc - ok 10:39:12.0849 1412 BBUpdate (63b1cbbae4790b5bac98f01bf9449722) C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe 10:39:12.0891 1412 BBUpdate - ok 10:39:13.0721 1412 BCM43XX (0e7a9264576b40638a3fbc804de1ff76) C:\Windows\system32\DRIVERS\bcmwl664.sys 10:39:13.0925 1412 BCM43XX - ok 10:39:14.0454 1412 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 10:39:14.0563 1412 BDESVC - ok 10:39:14.0762 1412 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 10:39:14.0902 1412 Beep - ok 10:39:15.0253 1412 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 10:39:15.0383 1412 BFE - ok 10:39:18.0356 1412 BHDrvx64 (c8ab71a5102d0fc103f6dfc750005137) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120619.001\BHDrvx64.sys 10:39:18.0433 1412 BHDrvx64 - ok 10:39:20.0236 1412 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll 10:39:20.0465 1412 BITS - ok 10:39:20.0724 1412 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 10:39:20.0790 1412 blbdrive - ok 10:39:21.0090 1412 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 10:39:21.0159 1412 bowser - ok 10:39:21.0245 1412 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 10:39:21.0376 1412 BrFiltLo - ok 10:39:21.0434 1412 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 10:39:21.0499 1412 BrFiltUp - ok 10:39:22.0001 1412 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 10:39:22.0171 1412 Browser - ok 10:39:23.0125 1412 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 10:39:23.0311 1412 Brserid - ok 10:39:23.0404 1412 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 10:39:23.0560 1412 BrSerWdm - ok 10:39:23.0671 1412 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 10:39:23.0753 1412 BrUsbMdm - ok 10:39:23.0814 1412 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 10:39:23.0901 1412 BrUsbSer - ok 10:39:24.0106 1412 BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys 10:39:24.0237 1412 BthEnum - ok 10:39:24.0498 1412 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 10:39:24.0608 1412 BTHMODEM - ok 10:39:25.0059 1412 BthPan (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys 10:39:25.0188 1412 BthPan - ok 10:39:27.0017 1412 BTHPORT (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys 10:39:27.0195 1412 BTHPORT - ok 10:39:27.0405 1412 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 10:39:27.0611 1412 bthserv - ok 10:39:28.0080 1412 BTHUSB (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys 10:39:28.0328 1412 BTHUSB - ok 10:39:28.0755 1412 btwampfl (7a2ce8c1bf4daa1f2766e21e9ca11078) C:\Windows\system32\drivers\btwampfl.sys 10:39:28.0869 1412 btwampfl - ok 10:39:28.0995 1412 btwaudio (a75bf6802a967f5aacecc3c67febdf55) C:\Windows\system32\drivers\btwaudio.sys 10:39:29.0102 1412 btwaudio - ok 10:39:29.0219 1412 btwavdt (d895dc213edbda5fcc53aad1f1e0e63b) C:\Windows\system32\drivers\btwavdt.sys 10:39:29.0313 1412 btwavdt - ok 10:39:30.0037 1412 btwdins (692f8648d7686d91e34a65ac698019d8) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe 10:39:30.0143 1412 btwdins - ok 10:39:30.0299 1412 btwl2cap (07096d2bc22ccb6cea5a532df0be8a75) C:\Windows\system32\DRIVERS\btwl2cap.sys 10:39:30.0389 1412 btwl2cap - ok 10:39:30.0495 1412 btwrchid (6d7aa2bde0135599c5f230d69db3b420) C:\Windows\system32\DRIVERS\btwrchid.sys 10:39:30.0528 1412 btwrchid - ok 10:39:30.0818 1412 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 10:39:31.0013 1412 cdfs - ok 10:39:31.0362 1412 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 10:39:31.0468 1412 cdrom - ok 10:39:31.0768 1412 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 10:39:32.0020 1412 CertPropSvc - ok 10:39:32.0387 1412 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 10:39:32.0579 1412 circlass - ok 10:39:33.0817 1412 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 10:39:33.0988 1412 CLFS - ok 10:39:34.0989 1412 CLKMSVC10_C6F09094 (dede5ec7dc09d840d5d74e06ff4de127) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe 10:39:35.0164 1412 CLKMSVC10_C6F09094 - ok 10:39:35.0670 1412 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 10:39:35.0904 1412 clr_optimization_v2.0.50727_32 - ok 10:39:36.0399 1412 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 10:39:36.0564 1412 clr_optimization_v2.0.50727_64 - ok 10:39:38.0165 1412 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 10:39:38.0581 1412 clr_optimization_v4.0.30319_32 - ok 10:39:39.0054 1412 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 10:39:39.0162 1412 clr_optimization_v4.0.30319_64 - ok 10:39:39.0403 1412 clwvd (d68d9f4d53010b7e84d4e80a2e485554) C:\Windows\system32\DRIVERS\clwvd.sys 10:39:39.0485 1412 clwvd - ok 10:39:39.0604 1412 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 10:39:39.0671 1412 CmBatt - ok 10:39:39.0738 1412 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 10:39:39.0779 1412 cmdide - ok 10:39:40.0964 1412 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 10:39:41.0073 1412 CNG - ok 10:39:41.0210 1412 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 10:39:41.0329 1412 Compbatt - ok 10:39:41.0473 1412 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 10:39:41.0633 1412 CompositeBus - ok 10:39:41.0719 1412 COMSysApp - ok 10:39:41.0792 1412 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 10:39:41.0910 1412 crcdisk - ok 10:39:42.0453 1412 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll 10:39:42.0558 1412 CryptSvc - ok 10:39:46.0390 1412 cvhsvc (72794d112cbaff3bc0c29bf7350d4741) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE 10:39:46.0452 1412 cvhsvc - ok 10:39:47.0284 1412 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 10:39:47.0451 1412 DcomLaunch - ok 10:39:48.0225 1412 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 10:39:48.0486 1412 defragsvc - ok 10:39:48.0967 1412 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 10:39:49.0080 1412 DfsC - ok 10:39:49.0901 1412 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 10:39:50.0054 1412 Dhcp - ok 10:39:50.0204 1412 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 10:39:50.0482 1412 discache - ok 10:39:50.0653 1412 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 10:39:50.0985 1412 Disk - ok 10:39:51.0460 1412 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 10:39:51.0759 1412 Dnscache - ok 10:39:52.0111 1412 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 10:39:52.0348 1412 dot3svc - ok 10:39:53.0437 1412 DpHost (eac9d9868d37c8785d12475a9bb65a11) C:\Program Files\DigitalPersona\Bin\DpHostW.exe 10:39:53.0559 1412 DpHost - ok 10:39:54.0065 1412 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 10:39:54.0188 1412 DPS - ok 10:39:54.0322 1412 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 10:39:54.0920 1412 drmkaud - ok 10:39:56.0359 1412 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 10:39:56.0517 1412 DXGKrnl - ok 10:39:56.0820 1412 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 10:39:56.0939 1412 EapHost - ok 10:40:04.0546 1412 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 10:40:04.0897 1412 ebdrv - ok 10:40:05.0789 1412 eeCtrl (ba6420c1f7070ed8f1ba372844f3e1ec) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 10:40:06.0029 1412 eeCtrl - ok 10:40:07.0694 1412 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 10:40:07.0778 1412 EFS - ok 10:40:08.0413 1412 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 10:40:08.0584 1412 ehRecvr - ok 10:40:08.0774 1412 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 10:40:08.0951 1412 ehSched - ok 10:40:09.0434 1412 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 10:40:09.0517 1412 elxstor - ok 10:40:09.0768 1412 EraserUtilRebootDrv (1343df3451bc0c442dc69837c6fba21b) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 10:40:09.0818 1412 EraserUtilRebootDrv - ok 10:40:09.0878 1412 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 10:40:09.0937 1412 ErrDev - ok 10:40:10.0427 1412 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 10:40:10.0578 1412 EventSystem - ok 10:40:10.0752 1412 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 10:40:10.0886 1412 exfat - ok 10:40:11.0051 1412 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 10:40:11.0189 1412 fastfat - ok 10:40:11.0757 1412 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 10:40:11.0914 1412 Fax - ok 10:40:11.0976 1412 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 10:40:12.0030 1412 fdc - ok 10:40:12.0129 1412 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 10:40:12.0278 1412 fdPHost - ok 10:40:12.0410 1412 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 10:40:12.0543 1412 FDResPub - ok 10:40:12.0711 1412 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 10:40:12.0850 1412 FileInfo - ok 10:40:12.0937 1412 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 10:40:13.0068 1412 Filetrace - ok 10:40:13.0112 1412 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 10:40:13.0135 1412 flpydisk - ok 10:40:13.0335 1412 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 10:40:13.0418 1412 FltMgr - ok 10:40:13.0961 1412 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll 10:40:14.0080 1412 FontCache - ok 10:40:14.0238 1412 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 10:40:14.0264 1412 FontCache3.0.0.0 - ok 10:40:14.0371 1412 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 10:40:14.0444 1412 FsDepends - ok 10:40:14.0521 1412 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 10:40:14.0566 1412 Fs_Rec - ok 10:40:14.0682 1412 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 10:40:14.0713 1412 fvevol - ok 10:40:14.0772 1412 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 10:40:14.0807 1412 gagp30kx - ok 10:40:15.0058 1412 GameConsoleService (d154305de6090e6e84e525f84bb08a06) C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe 10:40:15.0123 1412 GameConsoleService - ok 10:40:15.0540 1412 GamesAppService (c403c5db49a0f9aaf4f2128edc0106d8) C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe 10:40:15.0635 1412 GamesAppService - ok 10:40:16.0109 1412 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 10:40:16.0243 1412 gpsvc - ok 10:40:16.0450 1412 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 10:40:16.0566 1412 hcw85cir - ok 10:40:16.0768 1412 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 10:40:16.0830 1412 HdAudAddService - ok 10:40:16.0889 1412 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 10:40:16.0936 1412 HDAudBus - ok 10:40:16.0978 1412 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 10:40:17.0023 1412 HidBatt - ok 10:40:17.0258 1412 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 10:40:17.0333 1412 HidBth - ok 10:40:17.0393 1412 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 10:40:17.0468 1412 HidIr - ok 10:40:17.0558 1412 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 10:40:17.0679 1412 hidserv - ok 10:40:17.0761 1412 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys 10:40:17.0816 1412 HidUsb - ok 10:40:18.0129 1412 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 10:40:18.0315 1412 hkmsvc - ok 10:40:18.0584 1412 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 10:40:18.0676 1412 HomeGroupListener - ok 10:40:18.0747 1412 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 10:40:18.0789 1412 HomeGroupProvider - ok 10:40:18.0948 1412 HP Support Assistant Service (13bb1114451c63bfb41ba7daa4d70a29) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe 10:40:18.0968 1412 HP Support Assistant Service - ok 10:40:19.0231 1412 HP Wireless Assistant Service (c930128c8f8ff03d8f8c42b570920d56) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe 10:40:19.0264 1412 HP Wireless Assistant Service - ok 10:40:19.0644 1412 HPClientSvc (3dc11a802353401332d49c3cbfbbe5fc) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe 10:40:19.0707 1412 HPClientSvc - ok 10:40:19.0914 1412 HPDrvMntSvc.exe (c958976c7daaf47084a33ebbc6e28b84) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe 10:40:19.0939 1412 HPDrvMntSvc.exe - ok 10:40:19.0965 1412 hpdskflt (0193c30760032cc044ef47a1919f20dc) C:\Windows\system32\DRIVERS\hpdskflt.sys 10:40:19.0987 1412 hpdskflt - ok 10:40:20.0627 1412 hpqwmiex (09fbd4c4db2fd84b9ab1c5bfdcc95559) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe 10:40:20.0716 1412 hpqwmiex - ok 10:40:20.0840 1412 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 10:40:20.0916 1412 HpSAMD - ok 10:40:21.0041 1412 hpsrv (65a2b4b003d733c6faa16f22212bb86d) C:\Windows\system32\Hpservice.exe 10:40:21.0091 1412 hpsrv - ok 10:40:21.0226 1412 HPWMISVC (171000873eb522e5ea3dd4c4e0b689b2) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe 10:40:21.0253 1412 HPWMISVC - ok 10:40:21.0845 1412 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 10:40:21.0989 1412 HTTP - ok 10:40:22.0057 1412 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 10:40:22.0089 1412 hwpolicy - ok 10:40:22.0169 1412 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 10:40:22.0205 1412 i8042prt - ok 10:40:22.0333 1412 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 10:40:22.0402 1412 iaStorV - ok 10:40:23.0204 1412 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 10:40:23.0341 1412 idsvc - ok 10:40:24.0393 1412 IDSVia64 (ce0bf35c79e03bb89da6b14fac838605) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120622.001\IDSvia64.sys 10:40:24.0451 1412 IDSVia64 - ok 10:40:27.0418 1412 igfx (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys 10:40:27.0751 1412 igfx - ok 10:40:28.0005 1412 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 10:40:28.0039 1412 iirsp - ok 10:40:28.0281 1412 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 10:40:28.0421 1412 IKEEXT - ok 10:40:28.0464 1412 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 10:40:28.0498 1412 intelide - ok 10:40:28.0617 1412 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 10:40:28.0724 1412 intelppm - ok 10:40:28.0818 1412 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 10:40:28.0957 1412 IPBusEnum - ok 10:40:29.0064 1412 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 10:40:29.0202 1412 IpFilterDriver - ok 10:40:29.0535 1412 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 10:40:29.0677 1412 iphlpsvc - ok 10:40:29.0762 1412 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 10:40:29.0860 1412 IPMIDRV - ok 10:40:29.0959 1412 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 10:40:30.0062 1412 IPNAT - ok 10:40:30.0103 1412 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 10:40:30.0125 1412 IRENUM - ok 10:40:30.0198 1412 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 10:40:30.0231 1412 isapnp - ok 10:40:30.0329 1412 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 10:40:30.0409 1412 iScsiPrt - ok 10:40:30.0438 1412 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 10:40:30.0463 1412 kbdclass - ok 10:40:30.0554 1412 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 10:40:30.0633 1412 kbdhid - ok 10:40:30.0735 1412 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 10:40:30.0771 1412 KeyIso - ok 10:40:30.0940 1412 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 10:40:30.0998 1412 KSecDD - ok 10:40:31.0075 1412 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 10:40:31.0113 1412 KSecPkg - ok 10:40:31.0157 1412 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 10:40:31.0274 1412 ksthunk - ok 10:40:32.0214 1412 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 10:40:32.0351 1412 KtmRm - ok 10:40:32.0771 1412 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll 10:40:32.0895 1412 LanmanServer - ok 10:40:33.0031 1412 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 10:40:33.0162 1412 LanmanWorkstation - ok 10:40:33.0233 1412 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 10:40:33.0336 1412 lltdio - ok 10:40:34.0202 1412 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 10:40:34.0342 1412 lltdsvc - ok 10:40:34.0376 1412 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 10:40:34.0460 1412 lmhosts - ok 10:40:34.0593 1412 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 10:40:34.0639 1412 LSI_FC - ok 10:40:34.0781 1412 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 10:40:34.0888 1412 LSI_SAS - ok 10:40:35.0076 1412 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 10:40:35.0173 1412 LSI_SAS2 - ok 10:40:35.0224 1412 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 10:40:35.0261 1412 LSI_SCSI - ok 10:40:35.0331 1412 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 10:40:35.0431 1412 luafv - ok 10:40:35.0559 1412 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 10:40:35.0611 1412 Mcx2Svc - ok 10:40:35.0704 1412 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 10:40:35.0764 1412 megasas - ok 10:40:36.0157 1412 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 10:40:36.0227 1412 MegaSR - ok 10:40:36.0283 1412 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 10:40:36.0393 1412 MMCSS - ok 10:40:36.0418 1412 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 10:40:36.0491 1412 Modem - ok 10:40:36.0536 1412 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 10:40:36.0615 1412 monitor - ok 10:40:36.0720 1412 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 10:40:36.0762 1412 mouclass - ok 10:40:36.0828 1412 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 10:40:36.0887 1412 mouhid - ok 10:40:37.0135 1412 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 10:40:37.0170 1412 mountmgr - ok 10:40:37.0459 1412 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 10:40:37.0539 1412 mpio - ok 10:40:37.0645 1412 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 10:40:37.0764 1412 mpsdrv - ok 10:40:38.0997 1412 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll 10:40:39.0164 1412 MpsSvc - ok 10:40:39.0357 1412 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 10:40:39.0427 1412 MRxDAV - ok 10:40:39.0713 1412 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 10:40:39.0808 1412 mrxsmb - ok 10:40:40.0377 1412 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 10:40:40.0467 1412 mrxsmb10 - ok 10:40:40.0632 1412 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 10:40:40.0667 1412 mrxsmb20 - ok 10:40:40.0737 1412 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 10:40:40.0778 1412 msahci - ok 10:40:41.0012 1412 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 10:40:41.0058 1412 msdsm - ok 10:40:41.0364 1412 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 10:40:41.0437 1412 MSDTC - ok 10:40:41.0525 1412 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 10:40:41.0610 1412 Msfs - ok 10:40:41.0637 1412 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 10:40:41.0741 1412 mshidkmdf - ok 10:40:41.0799 1412 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 10:40:41.0831 1412 msisadrv - ok 10:40:42.0054 1412 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 10:40:42.0196 1412 MSiSCSI - ok 10:40:42.0204 1412 msiserver - ok 10:40:42.0272 1412 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 10:40:42.0383 1412 MSKSSRV - ok 10:40:42.0430 1412 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 10:40:42.0547 1412 MSPCLOCK - ok 10:40:42.0568 1412 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 10:40:42.0667 1412 MSPQM - ok 10:40:43.0006 1412 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 10:40:43.0054 1412 MsRPC - ok 10:40:43.0167 1412 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 10:40:43.0200 1412 mssmbios - ok 10:40:43.0270 1412 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 10:40:43.0384 1412 MSTEE - ok 10:40:43.0451 1412 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 10:40:43.0512 1412 MTConfig - ok 10:40:43.0573 1412 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 10:40:43.0606 1412 Mup - ok 10:40:44.0203 1412 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 10:40:44.0349 1412 napagent - ok 10:40:44.0797 1412 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 10:40:44.0882 1412 NativeWifiP - ok 10:40:45.0532 1412 NAVENG (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120625.002\ENG64.SYS 10:40:45.0595 1412 NAVENG - ok 10:40:48.0318 1412 NAVEX15 (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120625.002\EX64.SYS 10:40:48.0435 1412 NAVEX15 - ok 10:40:49.0503 1412 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 10:40:49.0562 1412 NDIS - ok 10:40:49.0614 1412 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 10:40:49.0724 1412 NdisCap - ok 10:40:49.0768 1412 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 10:40:49.0850 1412 NdisTapi - ok 10:40:49.0931 1412 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 10:40:50.0039 1412 Ndisuio - ok 10:40:50.0338 1412 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 10:40:50.0472 1412 NdisWan - ok 10:40:50.0614 1412 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 10:40:50.0718 1412 NDProxy - ok 10:40:50.0846 1412 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 10:40:50.0975 1412 NetBIOS - ok 10:40:51.0246 1412 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 10:40:51.0366 1412 NetBT - ok 10:40:51.0430 1412 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 10:40:51.0480 1412 Netlogon - ok 10:40:52.0493 1412 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 10:40:52.0642 1412 Netman - ok 10:40:53.0688 1412 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 10:40:53.0806 1412 netprofm - ok 10:40:54.0144 1412 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 10:40:54.0220 1412 NetTcpPortSharing - ok 10:40:58.0587 1412 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys 10:40:58.0853 1412 netw5v64 - ok 10:40:59.0032 1412 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 10:40:59.0066 1412 nfrd960 - ok 10:40:59.0339 1412 NIS (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe 10:40:59.0371 1412 NIS - ok 10:40:59.0470 1412 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 10:40:59.0594 1412 NlaSvc - ok 10:40:59.0954 1412 NOBU (5839a8027d6d324a7cd494051a96628c) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe 10:41:00.0133 1412 NOBU - ok 10:41:00.0347 1412 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 10:41:00.0427 1412 Npfs - ok 10:41:00.0454 1412 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 10:41:00.0581 1412 nsi - ok 10:41:00.0603 1412 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 10:41:00.0715 1412 nsiproxy - ok 10:41:01.0009 1412 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 10:41:01.0096 1412 Ntfs - ok 10:41:01.0250 1412 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 10:41:01.0353 1412 Null - ok 10:41:01.0422 1412 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 10:41:01.0471 1412 nvraid - ok 10:41:01.0555 1412 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 10:41:01.0594 1412 nvstor - ok 10:41:01.0655 1412 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 10:41:01.0692 1412 nv_agp - ok 10:41:01.0722 1412 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 10:41:01.0776 1412 ohci1394 - ok 10:41:01.0905 1412 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 10:41:01.0951 1412 ose - ok 10:41:02.0635 1412 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 10:41:02.0851 1412 osppsvc - ok 10:41:03.0061 1412 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 10:41:03.0156 1412 p2pimsvc - ok 10:41:03.0227 1412 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 10:41:03.0276 1412 p2psvc - ok 10:41:03.0372 1412 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 10:41:03.0409 1412 Parport - ok 10:41:03.0446 1412 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys 10:41:03.0495 1412 partmgr - ok 10:41:03.0563 1412 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 10:41:03.0636 1412 PcaSvc - ok 10:41:03.0692 1412 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 10:41:03.0736 1412 pci - ok 10:41:03.0776 1412 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 10:41:03.0809 1412 pciide - ok 10:41:03.0853 1412 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 10:41:03.0895 1412 pcmcia - ok 10:41:03.0925 1412 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 10:41:03.0973 1412 pcw - ok 10:41:04.0101 1412 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 10:41:04.0223 1412 PEAUTH - ok 10:41:04.0358 1412 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 10:41:04.0434 1412 PerfHost - ok 10:41:04.0694 1412 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 10:41:04.0830 1412 pla - ok 10:41:04.0916 1412 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 10:41:05.0006 1412 PlugPlay - ok 10:41:05.0107 1412 pneteth (fe74ba87cdaa80ac9261f49167f0608a) C:\Windows\system32\DRIVERS\pneteth.sys 10:41:05.0177 1412 pneteth - ok 10:41:05.0239 1412 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 10:41:05.0290 1412 PNRPAutoReg - ok 10:41:05.0348 1412 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 10:41:05.0390 1412 PNRPsvc - ok 10:41:05.0489 1412 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 10:41:05.0619 1412 PolicyAgent - ok 10:41:05.0669 1412 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 10:41:05.0772 1412 Power - ok 10:41:05.0838 1412 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 10:41:05.0955 1412 PptpMiniport - ok 10:41:05.0993 1412 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 10:41:06.0046 1412 Processor - ok 10:41:06.0115 1412 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll 10:41:06.0191 1412 ProfSvc - ok 10:41:06.0239 1412 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 10:41:06.0272 1412 ProtectedStorage - ok 10:41:06.0423 1412 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 10:41:06.0516 1412 Psched - ok 10:41:06.0684 1412 PSI_SVC_2 (f036cfb275d0c55f4e45fbbf5f98b3c8) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe 10:41:06.0717 1412 PSI_SVC_2 - ok 10:41:07.0091 1412 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 10:41:07.0224 1412 ql2300 - ok 10:41:08.0109 1412 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 10:41:08.0148 1412 ql40xx - ok 10:41:08.0337 1412 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 10:41:08.0409 1412 QWAVE - ok 10:41:08.0458 1412 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 10:41:08.0506 1412 QWAVEdrv - ok 10:41:08.0542 1412 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 10:41:08.0646 1412 RasAcd - ok 10:41:08.0794 1412 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 10:41:08.0906 1412 RasAgileVpn - ok 10:41:09.0051 1412 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 10:41:09.0191 1412 RasAuto - ok 10:41:09.0491 1412 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 10:41:09.0606 1412 Rasl2tp - ok 10:41:09.0736 1412 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 10:41:09.0852 1412 RasMan - ok 10:41:10.0022 1412 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 10:41:10.0135 1412 RasPppoe - ok 10:41:10.0221 1412 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 10:41:10.0326 1412 RasSstp - ok 10:41:10.0561 1412 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 10:41:10.0689 1412 rdbss - ok 10:41:10.0776 1412 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 10:41:10.0841 1412 rdpbus - ok 10:41:10.0912 1412 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 10:41:11.0028 1412 RDPCDD - ok 10:41:11.0072 1412 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 10:41:11.0188 1412 RDPENCDD - ok 10:41:11.0225 1412 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 10:41:11.0308 1412 RDPREFMP - ok 10:41:11.0364 1412 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys 10:41:11.0446 1412 RDPWD - ok 10:41:11.0689 1412 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 10:41:11.0732 1412 rdyboost - ok 10:41:11.0822 1412 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 10:41:11.0919 1412 RemoteAccess - ok 10:41:11.0973 1412 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 10:41:12.0058 1412 RemoteRegistry - ok 10:41:12.0142 1412 RFCOMM (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys 10:41:12.0201 1412 RFCOMM - ok 10:41:12.0394 1412 RoxioNow Service (c1568e17039b2ec2b73a4f880ddd51e5) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe 10:41:12.0446 1412 RoxioNow Service - ok 10:41:12.0510 1412 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 10:41:12.0635 1412 RpcEptMapper - ok 10:41:12.0712 1412 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 10:41:12.0790 1412 RpcLocator - ok 10:41:12.0902 1412 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 10:41:12.0980 1412 RpcSs - ok 10:41:13.0192 1412 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 10:41:13.0310 1412 rspndr - ok 10:41:13.0464 1412 RSUSBSTOR (3ceee53bbf8ba284ff44585cec0162fe) C:\Windows\system32\Drivers\RtsUStor.sys 10:41:13.0512 1412 RSUSBSTOR - ok 10:41:13.0651 1412 RTL8167 (16d4e350420baa7e63e16e3fc033e1f5) C:\Windows\system32\DRIVERS\Rt64win7.sys 10:41:13.0735 1412 RTL8167 - ok 10:41:13.0840 1412 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 10:41:13.0893 1412 SamSs - ok 10:41:13.0966 1412 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 10:41:14.0003 1412 sbp2port - ok 10:41:14.0056 1412 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 10:41:14.0146 1412 SCardSvr - ok 10:41:14.0206 1412 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 10:41:14.0305 1412 scfilter - ok 10:41:14.0511 1412 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 10:41:14.0676 1412 Schedule - ok 10:41:14.0775 1412 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 10:41:14.0842 1412 SCPolicySvc - ok 10:41:14.0906 1412 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys 10:41:14.0958 1412 sdbus - ok 10:41:15.0113 1412 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 10:41:15.0239 1412 SDRSVC - ok 10:41:15.0322 1412 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 10:41:15.0399 1412 secdrv - ok 10:41:15.0454 1412 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 10:41:15.0578 1412 seclogon - ok 10:41:15.0637 1412 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 10:41:15.0759 1412 SENS - ok 10:41:15.0822 1412 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 10:41:15.0894 1412 SensrSvc - ok 10:41:15.0942 1412 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 10:41:15.0996 1412 Serenum - ok 10:41:16.0053 1412 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 10:41:16.0091 1412 Serial - ok 10:41:16.0137 1412 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 10:41:16.0188 1412 sermouse - ok 10:41:16.0259 1412 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 10:41:16.0389 1412 SessionEnv - ok 10:41:16.0451 1412 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 10:41:16.0541 1412 sffdisk - ok 10:41:16.0605 1412 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 10:41:16.0729 1412 sffp_mmc - ok 10:41:16.0771 1412 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 10:41:16.0826 1412 sffp_sd - ok 10:41:16.0875 1412 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 10:41:16.0910 1412 sfloppy - ok 10:41:17.0051 1412 Sftfs (c6cc9297bd53e5229653303e556aa539) C:\Windows\system32\DRIVERS\Sftfslh.sys 10:41:17.0098 1412 Sftfs - ok 10:41:17.0318 1412 sftlist (13693b6354dd6e72dc5131da7d764b90) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe 10:41:17.0362 1412 sftlist - ok 10:41:17.0602 1412 Sftplay (390aa7bc52cee43f6790cdea1e776703) C:\Windows\system32\DRIVERS\Sftplaylh.sys 10:41:17.0665 1412 Sftplay - ok 10:41:17.0723 1412 Sftredir (617e29a0b0a2807466560d4c4e338d3e) C:\Windows\system32\DRIVERS\Sftredirlh.sys 10:41:17.0752 1412 Sftredir - ok 10:41:17.0778 1412 Sftvol (8f571f016fa1976f445147e9e6c8ae9b) C:\Windows\system32\DRIVERS\Sftvollh.sys 10:41:17.0807 1412 Sftvol - ok 10:41:17.0984 1412 sftvsa (c3cddd18f43d44ab713cf8c4916f7696) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe 10:41:18.0019 1412 sftvsa - ok 10:41:18.0111 1412 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 10:41:18.0220 1412 SharedAccess - ok 10:41:18.0325 1412 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 10:41:18.0456 1412 ShellHWDetection - ok 10:41:18.0679 1412 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 10:41:18.0717 1412 SiSRaid2 - ok 10:41:18.0777 1412 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 10:41:18.0814 1412 SiSRaid4 - ok 10:41:19.0122 1412 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe 10:41:19.0191 1412 SkypeUpdate - ok 10:41:19.0252 1412 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 10:41:19.0371 1412 Smb - ok 10:41:19.0432 1412 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 10:41:19.0506 1412 SNMPTRAP - ok 10:41:19.0546 1412 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 10:41:19.0579 1412 spldr - ok 10:41:19.0713 1412 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 10:41:19.0814 1412 Spooler - ok 10:41:20.0597 1412 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 10:41:20.0896 1412 sppsvc - ok 10:41:21.0186 1412 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 10:41:21.0270 1412 sppuinotify - ok 10:41:21.0555 1412 SRTSP (90ef30c3867bcde4579c01a6d6e75a7a) C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS 10:41:21.0597 1412 SRTSP - ok 10:41:21.0619 1412 SRTSPX (c513e8a5e7978da49077f5484344ee1b) C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS 10:41:21.0634 1412 SRTSPX - ok 10:41:21.0738 1412 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 10:41:21.0829 1412 srv - ok 10:41:22.0079 1412 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 10:41:22.0162 1412 srv2 - ok 10:41:22.0279 1412 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS 10:41:22.0353 1412 SrvHsfHDA - ok 10:41:22.0696 1412 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS 10:41:22.0815 1412 SrvHsfV92 - ok 10:41:23.0230 1412 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS 10:41:23.0281 1412 SrvHsfWinac - ok 10:41:23.0364 1412 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 10:41:23.0460 1412 srvnet - ok 10:41:23.0606 1412 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 10:41:23.0734 1412 SSDPSRV - ok 10:41:23.0860 1412 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 10:41:23.0935 1412 SstpSvc - ok 10:41:24.0230 1412 STacSV (b00068ba94f5f306911b14b425aaeb56) C:\Program Files\IDT\WDM\STacSV64.exe 10:41:24.0298 1412 STacSV - ok 10:41:24.0347 1412 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 10:41:24.0396 1412 stexstor - ok 10:41:24.0840 1412 STHDA (da40d9c9ccb9836d6abd1706935a2277) C:\Windows\system32\DRIVERS\stwrt64.sys 10:41:24.0940 1412 STHDA - ok 10:41:25.0087 1412 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 10:41:25.0188 1412 stisvc - ok 10:41:25.0220 1412 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 10:41:25.0252 1412 swenum - ok 10:41:25.0408 1412 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 10:41:25.0532 1412 swprv - ok 10:41:25.0712 1412 SymDS (6160145c7a87fc7672e8e3b886888176) C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS 10:41:25.0754 1412 SymDS - ok 10:41:25.0915 1412 SymEFA (96aeed40d4d3521568b42027687e69e0) C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS 10:41:25.0979 1412 SymEFA - ok 10:41:26.0086 1412 SymEvent (21a1c2d694c3cf962d31f5e873ab3d6f) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 10:41:26.0123 1412 SymEvent - ok 10:41:26.0181 1412 SymIRON (bd0d711d8cbfcaa19ca123306eaf53a5) C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS 10:41:26.0214 1412 SymIRON - ok 10:41:26.0363 1412 SymNetS (a6adb3d83023f8daa0f7b6fda785d83b) C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS 10:41:26.0405 1412 SymNetS - ok 10:41:26.0712 1412 SynTP (961cfac2a5318e212f459d651f28e0a4) C:\Windows\system32\DRIVERS\SynTP.sys 10:41:26.0839 1412 SynTP - ok 10:41:27.0254 1412 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 10:41:27.0363 1412 SysMain - ok 10:41:27.0562 1412 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 10:41:27.0616 1412 TabletInputService - ok 10:41:27.0667 1412 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 10:41:27.0772 1412 TapiSrv - ok 10:41:27.0804 1412 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 10:41:27.0907 1412 TBS - ok 10:41:28.0238 1412 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys 10:41:28.0340 1412 Tcpip - ok 10:41:29.0248 1412 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys 10:41:29.0327 1412 TCPIP6 - ok 10:41:29.0520 1412 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 10:41:29.0624 1412 tcpipreg - ok 10:41:29.0660 1412 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 10:41:29.0753 1412 TDPIPE - ok 10:41:29.0824 1412 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 10:41:29.0883 1412 TDTCP - ok 10:41:29.0954 1412 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 10:41:30.0047 1412 tdx - ok 10:41:30.0118 1412 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 10:41:30.0153 1412 TermDD - ok 10:41:30.0292 1412 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 10:41:30.0444 1412 TermService - ok 10:41:30.0486 1412 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 10:41:30.0550 1412 Themes - ok 10:41:30.0598 1412 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 10:41:30.0687 1412 THREADORDER - ok 10:41:30.0746 1412 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 10:41:30.0833 1412 TrkWks - ok 10:41:31.0056 1412 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 10:41:31.0168 1412 TrustedInstaller - ok 10:41:31.0219 1412 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 10:41:31.0319 1412 tssecsrv - ok 10:41:31.0391 1412 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 10:41:31.0432 1412 TsUsbFlt - ok 10:41:31.0529 1412 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 10:41:31.0625 1412 tunnel - ok 10:41:31.0727 1412 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 10:41:31.0770 1412 uagp35 - ok 10:41:31.0996 1412 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 10:41:32.0118 1412 udfs - ok 10:41:32.0199 1412 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 10:41:32.0256 1412 UI0Detect - ok 10:41:32.0344 1412 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 10:41:32.0379 1412 uliagpkx - ok 10:41:32.0434 1412 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 10:41:32.0510 1412 umbus - ok 10:41:32.0589 1412 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 10:41:32.0647 1412 UmPass - ok 10:41:32.0991 1412 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 10:41:33.0117 1412 upnphost - ok 10:41:33.0225 1412 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 10:41:33.0313 1412 usbccgp - ok 10:41:33.0397 1412 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 10:41:33.0489 1412 usbcir - ok 10:41:33.0513 1412 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 10:41:33.0562 1412 usbehci - ok 10:41:33.0639 1412 usbfilter (dc2b306861f42eeeb92ef525f4119f08) C:\Windows\system32\DRIVERS\usbfilter.sys 10:41:33.0699 1412 usbfilter - ok 10:41:33.0788 1412 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 10:41:33.0847 1412 usbhub - ok 10:41:33.0900 1412 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys 10:41:33.0963 1412 usbohci - ok 10:41:34.0028 1412 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 10:41:34.0103 1412 usbprint - ok 10:41:34.0148 1412 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 10:41:34.0246 1412 usbscan - ok 10:41:34.0371 1412 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\drivers\USBSTOR.SYS 10:41:34.0487 1412 USBSTOR - ok 10:41:34.0514 1412 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 10:41:34.0570 1412 usbuhci - ok 10:41:34.0744 1412 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys 10:41:34.0793 1412 usbvideo - ok 10:41:34.0880 1412 usb_rndisx (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys 10:41:34.0929 1412 usb_rndisx - ok 10:41:34.0972 1412 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 10:41:35.0083 1412 UxSms - ok 10:41:35.0130 1412 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 10:41:35.0163 1412 VaultSvc - ok 10:41:36.0521 1412 vcsFPService (2662f24c7aee2a32cebdec907a5366f1) C:\Windows\system32\vcsFPService.exe 10:41:36.0670 1412 vcsFPService - ok 10:41:37.0548 1412 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 10:41:37.0580 1412 vdrvroot - ok 10:41:37.0820 1412 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 10:41:37.0950 1412 vds - ok 10:41:38.0171 1412 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 10:41:38.0241 1412 vga - ok 10:41:38.0260 1412 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 10:41:38.0383 1412 VgaSave - ok 10:41:38.0597 1412 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 10:41:38.0666 1412 vhdmp - ok 10:41:38.0733 1412 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 10:41:38.0776 1412 viaide - ok 10:41:38.0845 1412 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 10:41:38.0892 1412 volmgr - ok 10:41:39.0049 1412 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 10:41:39.0095 1412 volmgrx - ok 10:41:39.0239 1412 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 10:41:39.0285 1412 volsnap - ok 10:41:39.0485 1412 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 10:41:39.0525 1412 vsmraid - ok 10:41:40.0471 1412 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 10:41:40.0647 1412 VSS - ok 10:41:41.0129 1412 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 10:41:41.0189 1412 vwifibus - ok 10:41:41.0244 1412 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 10:41:41.0297 1412 vwififlt - ok 10:41:41.0554 1412 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 10:41:41.0683 1412 W32Time - ok 10:41:41.0740 1412 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 10:41:41.0805 1412 WacomPen - ok 10:41:41.0854 1412 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 10:41:41.0954 1412 WANARP - ok 10:41:41.0982 1412 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 10:41:42.0061 1412 Wanarpv6 - ok 10:41:42.0567 1412 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 10:41:42.0750 1412 WatAdminSvc - ok 10:41:43.0267 1412 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 10:41:43.0386 1412 wbengine - ok 10:41:44.0326 1412 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 10:41:44.0404 1412 WbioSrvc - ok 10:41:44.0713 1412 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 10:41:44.0796 1412 wcncsvc - ok 10:41:44.0964 1412 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 10:41:45.0323 1412 WcsPlugInService - ok 10:41:45.0662 1412 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 10:41:45.0700 1412 Wd - ok 10:41:46.0555 1412 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 10:41:46.0680 1412 Wdf01000 - ok 10:41:46.0866 1412 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 10:41:46.0994 1412 WdiServiceHost - ok 10:41:47.0001 1412 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 10:41:47.0035 1412 WdiSystemHost - ok 10:41:47.0129 1412 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 10:41:47.0207 1412 WebClient - ok 10:41:47.0271 1412 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 10:41:47.0380 1412 Wecsvc - ok 10:41:47.0417 1412 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 10:41:47.0571 1412 wercplsupport - ok 10:41:47.0655 1412 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 10:41:47.0756 1412 WerSvc - ok 10:41:47.0909 1412 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 10:41:48.0000 1412 WfpLwf - ok 10:41:48.0102 1412 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 10:41:48.0135 1412 WIMMount - ok 10:41:48.0176 1412 WinDefend - ok 10:41:48.0193 1412 WinHttpAutoProxySvc - ok 10:41:48.0400 1412 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 10:41:48.0575 1412 Winmgmt - ok 10:41:49.0422 1412 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 10:41:49.0632 1412 WinRM - ok 10:41:49.0963 1412 WinUSB (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys 10:41:50.0021 1412 WinUSB - ok 10:41:50.0169 1412 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 10:41:50.0244 1412 Wlansvc - ok 10:41:51.0748 1412 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 10:41:51.0870 1412 wlidsvc - ok 10:41:52.0466 1412 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 10:41:52.0588 1412 WmiAcpi - ok 10:41:52.0717 1412 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 10:41:52.0803 1412 wmiApSrv - ok 10:41:52.0866 1412 WMPNetworkSvc - ok 10:41:52.0892 1412 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 10:41:52.0950 1412 WPCSvc - ok 10:41:53.0011 1412 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 10:41:53.0084 1412 WPDBusEnum - ok 10:41:53.0112 1412 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 10:41:53.0205 1412 ws2ifsl - ok 10:41:53.0255 1412 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll 10:41:53.0322 1412 wscsvc - ok 10:41:53.0330 1412 WSearch - ok 10:41:53.0626 1412 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll 10:41:53.0731 1412 wuauserv - ok 10:41:54.0128 1412 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 10:41:54.0267 1412 WudfPf - ok 10:41:54.0343 1412 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 10:41:54.0468 1412 WUDFRd - ok 10:41:54.0539 1412 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 10:41:54.0624 1412 wudfsvc - ok 10:41:54.0690 1412 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 10:41:54.0793 1412 WwanSvc - ok 10:41:54.0966 1412 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys 10:41:55.0082 1412 yukonw7 - ok 10:41:55.0151 1412 MBR (0x1B8) (e3e91e98346c8b0475259c238728e9e3) \Device\Harddisk0\DR0 10:41:55.0195 1412 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected 10:41:55.0195 1412 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0) 10:41:55.0326 1412 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 10:41:55.0326 1412 \Device\Harddisk0\DR0 - detected TDSS File System (1) 10:41:55.0348 1412 Boot (0x1200) (59289c2b48e375dded0bbbd04edd3b99) \Device\Harddisk0\DR0\Partition0 10:41:55.0358 1412 \Device\Harddisk0\DR0\Partition0 - ok 10:41:55.0457 1412 Boot (0x1200) (31b7528e894dd44a2d13f1fbb17edbf6) \Device\Harddisk0\DR0\Partition1 10:41:55.0627 1412 \Device\Harddisk0\DR0\Partition1 - ok 10:41:55.0693 1412 Boot (0x1200) (ece4f927bcdb5482a95bfaf7384b3603) \Device\Harddisk0\DR0\Partition2 10:41:55.0729 1412 \Device\Harddisk0\DR0\Partition2 - ok 10:41:55.0820 1412 Boot (0x1200) (f22c95416878215ea58f71b74cca52c4) \Device\Harddisk0\DR0\Partition3 10:41:55.0822 1412 \Device\Harddisk0\DR0\Partition3 - ok 10:41:55.0823 1412 ============================================================ 10:41:55.0823 1412 Scan finished 10:41:55.0823 1412 ============================================================ 10:41:55.0854 5956 Detected object count: 2 10:41:55.0854 5956 Actual detected object count: 2 10:42:13.0562 5956 \Device\Harddisk0\DR0\# - copied to quarantine 10:42:13.0563 5956 \Device\Harddisk0\DR0 - copied to quarantine 10:42:13.0662 5956 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 10:42:13.0669 5956 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine 10:42:13.0679 5956 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine 10:42:13.0691 5956 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine 10:42:13.0718 5956 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine 10:42:13.0735 5956 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine 10:42:13.0740 5956 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine 10:42:13.0744 5956 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine 10:42:13.0750 5956 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine 10:42:13.0756 5956 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine 10:42:13.0763 5956 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine 10:42:13.0769 5956 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine 10:42:13.0807 5956 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot 10:42:13.0871 5956 \Device\Harddisk0\DR0 - ok 10:42:17.0896 5956 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure 10:42:17.0897 5956 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 10:42:17.0898 5956 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 10:43:54.0138 3788 Deinitialize success Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.28.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Owner :: OWNER-HP [administrator] 6/28/2012 10:53:20 AM mbam-log-2012-06-28 (10-53-20).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213808 Time elapsed: 15 minute(s), 39 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. (end)

I am going to disinfect it, I will not be able to run TDSSkiller until tomorrow. I will post the log tomorrow as soon as I do. Thanks.

This PC is mainly used for Netflix/Youtube and some online shopping, no banking or other activity that contains personal info. Can you tell how likely is it based on the infection that it won't be secure after disinfection?

I'm posting on behalf oy of mom who started using malwarebytes at my urging. Malware bytes keeps decting 2 trojans, but when I restart the computer to complete removal it freezes and has to be manually turned off and back on to finish restarting. I'm not sure if the trojans are causing the restart problems and are just refusing to be removed, or if there is a software problem causing the computer to freeze during restart and preventing removal. DDS and Malwarebytes logs below. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by Owner at 18:15:26 on 2012-06-25 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3835.1688 [GMT -4:00] . AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files\IDT\WDM\STacSV64.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\Hpservice.exe C:\Windows\system32\vcsFPService.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\System32\spoolsv.exe C:\Program Files\DigitalPersona\Bin\DpHostW.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\IDT\WDM\AESTSr64.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe -netsvcs C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe C:\Program Files\DigitalPersona\Bin\DPAgent.exe C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\SysWOW64\RunDll32.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingApp.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingBar.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingSurrogate.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingSurrogate.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingSurrogate.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11f_ActiveX.exe C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe C:\Windows\system32\wuauclt.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\vssvc.exe C:\Windows\System32\svchost.exe -k swprv C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\DllHost.exe . ============== Pseudo HJT Report =============== . uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc-rel&channel=us uSearch Bar = hxxp://www.google.com/ie uSearch Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.foxnews.com/ uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll" uRun: [ZumoDrive] C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe mRun: [ZumoDrive] "C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe StartupFolder: C:\Users\Owner\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\PDANET~1.LNK - C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab TCP: DhcpNameServer = 8.8.8.8 TCP: Interfaces\{2FDA006A-7FF4-42BD-A473-6170B0732933}\3416D607D275966496 : DhcpNameServer = 10.128.128.128 TCP: Interfaces\{2FDA006A-7FF4-42BD-A473-6170B0732933}\B4F4140313 : DhcpNameServer = 67.20.47.9 67.20.47.7 67.20.47.8 TCP: Interfaces\{B0391C71-D4E5-4064-B7A3-607DB673E71C} : DhcpNameServer = 8.8.8.8 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll LSA: Notification Packages = DPPassFilter scecli BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll BHO-X64: Symantec NCO BHO - No File BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL BHO-X64: Symantec Intrusion Prevention - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll" mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe mRun-x64: [ZumoDrive] "C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS [?] R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS [?] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [2012-6-18 1161376] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120622.001\IDSviA64.sys [2012-6-18 509088] R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [?] R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1207020.003\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1207020.003\SYMNETS.SYS [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-3-11 89600] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992] R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896] R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?] R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-6-14 26680] R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe [2012-6-12 130008] R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568] R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.EXE [2012-2-10 240408] R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys --> C:\Windows\system32\drivers\btwampfl.sys [?] R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-5-31 138912] R3 pneteth;PdaNet Broadband;C:\Windows\system32\DRIVERS\pneteth.sys --> C:\Windows\system32\DRIVERS\pneteth.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?] R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?] R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?] R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?] S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.EXE [2012-2-10 193816] S2 CLKMSVC10_C6F09094;CyberLink Product - 2011/03/11 01:08:09;C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2011-3-11 245232] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856] S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?] S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?] . =============== Created Last 30 ================ . 2012-06-25 20:03:18 2622464 ----a-w- C:\Windows\System32\wucltux.dll 2012-06-25 20:02:51 99840 ----a-w- C:\Windows\System32\wudriver.dll 2012-06-25 20:02:18 36864 ----a-w- C:\Windows\System32\wuapp.exe 2012-06-25 20:02:18 186752 ----a-w- C:\Windows\System32\wuwebv.dll 2012-06-18 18:21:45 20480 ----a-w- C:\Windows\svchost.exe 2012-06-14 01:40:50 -------- d-----w- C:\5e688b2ba81316da2e36f179622c7d 2012-06-14 00:51:13 1462272 ----a-w- C:\Windows\System32\crypt32.dll 2012-06-14 00:51:12 184320 ----a-w- C:\Windows\System32\cryptsvc.dll 2012-06-14 00:51:12 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll 2012-06-14 00:51:12 140288 ----a-w- C:\Windows\System32\cryptnet.dll 2012-06-14 00:51:12 1158656 ----a-w- C:\Windows\SysWow64\crypt32.dll 2012-06-14 00:51:12 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll 2012-06-14 00:44:48 3216384 ----a-w- C:\Windows\System32\msi.dll 2012-06-14 00:44:48 2342400 ----a-w- C:\Windows\SysWow64\msi.dll 2012-06-14 00:34:48 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-06-14 00:16:52 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe 2012-06-14 00:16:52 77312 ----a-w- C:\Windows\System32\rdpwsx.dll 2012-06-14 00:16:52 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll 2012-06-14 00:13:18 209920 ----a-w- C:\Windows\System32\profsvc.dll 2012-06-14 00:08:01 3146752 ----a-w- C:\Windows\System32\win32k.sys 2012-06-13 00:50:42 912504 ----a-w- C:\Windows\System32\drivers\NISx64\1207020.003\symefa64.sys 2012-06-13 00:50:42 744568 ----a-w- C:\Windows\System32\drivers\NISx64\1207020.003\srtsp64.sys 2012-06-13 00:50:42 450680 ----a-w- C:\Windows\System32\drivers\NISx64\1207020.003\symds64.sys 2012-06-13 00:50:42 40568 ----a-w- C:\Windows\System32\drivers\NISx64\1207020.003\srtspx64.sys 2012-06-13 00:50:42 386168 ----a-w- C:\Windows\System32\drivers\NISx64\1207020.003\symnets.sys 2012-06-13 00:50:42 171128 ----a-w- C:\Windows\System32\drivers\NISx64\1207020.003\ironx64.sys 2012-06-13 00:50:18 -------- d-----w- C:\Windows\System32\drivers\NISx64\1207020.003 2012-06-08 18:51:07 -------- d-----w- C:\ProgramData\Kodak 2012-06-08 18:51:00 232960 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\EKIJ5000PPR.dll . ==================== Find3M ==================== . 2012-05-19 02:13:13 900 --sha-w- C:\ProgramData\KGyGaAvL.sys 2012-05-18 02:06:48 2311680 ----a-w- C:\Windows\System32\jscript9.dll 2012-05-18 01:59:14 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-05-18 01:58:39 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-05-18 01:55:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-05-18 01:51:30 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-05-17 22:45:37 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-05-17 22:35:47 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-05-17 22:35:39 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-05-17 22:29:45 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-05-17 22:24:45 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-04-04 19:56:40 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-03-30 11:35:47 1918320 ----a-w- C:\Windows\System32\drivers\tcpip.sys . ============= FINISH: 18:16:51.08 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 5/16/2011 3:17:43 PM System Uptime: 6/25/2012 5:40:46 PM (1 hours ago) . Motherboard: Hewlett-Packard | | 1641 Processor: AMD Phenom II P860 Triple-Core Processor | Socket S1G4 | 800/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 674 GiB total, 608.337 GiB free. D: is FIXED (NTFS) - 24 GiB total, 3.549 GiB free. E: is CDROM () F: is FIXED (FAT32) - 0 GiB total, 0.087 GiB free. H: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP185: 5/27/2012 6:22:40 PM - Windows Backup RP186: 5/27/2012 7:45:11 PM - Windows Update RP187: 5/29/2012 6:50:22 PM - Windows Update RP188: 5/30/2012 4:13:36 PM - Windows Update RP189: 5/30/2012 4:39:07 PM - Windows Update RP190: 6/1/2012 7:32:09 PM - Windows Update RP191: 6/1/2012 10:11:26 PM - Windows Update RP192: 6/3/2012 7:35:50 PM - Windows Update RP193: 6/3/2012 8:05:16 PM - Windows Update RP194: 6/4/2012 5:35:44 PM - Windows Backup RP195: 6/6/2012 10:10:59 PM - Windows Update RP196: 6/6/2012 10:37:03 PM - Windows Update RP197: 6/8/2012 2:45:00 PM - Windows Update RP198: 6/8/2012 6:48:24 PM - Windows Update RP199: 6/10/2012 11:18:30 AM - Windows Update RP200: 6/10/2012 1:01:17 PM - Windows Update RP201: 6/11/2012 8:00:24 PM - Windows Backup RP202: 6/12/2012 8:34:32 PM - Windows Update RP203: 6/13/2012 9:37:09 PM - Windows Update RP204: 6/13/2012 11:13:26 PM - Windows Update RP205: 6/17/2012 11:23:25 AM - Windows Update RP206: 6/18/2012 1:50:48 PM - Windows Backup RP207: 6/18/2012 7:21:53 PM - Windows Update RP208: 6/25/2012 4:01:35 PM - Windows Update RP209: 6/25/2012 4:49:31 PM - Windows Update RP210: 6/25/2012 5:59:53 PM - Windows Backup . ==== Installed Programs ====================== . Adobe AIR Adobe Reader 9.5.1 MUI Adobe Shockwave Player 11.5 Agatha Christie - Peril at End House Bejeweled 2 Deluxe Bing Bar Bing Rewards Client Installer Blackhawk Striker 2 Blasterball 3 Blio Bounce Symphony Build-a-lot 2 Cake Mania Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Chuzzle Deluxe Contents Corel PaintShop Photo Pro X3 Corel VideoStudio Pro X3 CyberLink DVD Suite D3DX10 DeviceIO Diner Dash 2 Restaurant Rescue Dora's World Adventure DVD Menu Pack for HP MediaSmart Video Energy Star Digital Logo Escape Rosecliff Island ESU for Microsoft Windows 7 Farm Frenzy FATE Fences Pro Final Drive Nitro Heroes of Hellas 2 - Olympia Hewlett-Packard ACLM.NET v1.1.2.0 HP CloudDrive HP Customer Experience Enhancements HP Documentation HP DVB-T TV Tuner 8.0.64.43 HP Game Console HP Games HP MediaSmart DVD HP MediaSmart Music HP MediaSmart Photo HP MediaSmart Video HP MediaSmart Webcam HP MediaSmart/TouchSmart Netflix HP MovieStore HP Photo Creations HP Power Manager HP Quick Launch HP Setup HP Setup Manager HP Software Framework HP Support Assistant Hulu Desktop ICA IDT Audio IPM_PSP_Pro IPM_VS_Pro ISCOM Java 6 Update 25 Jewel Quest Solitaire 2 Junk Mail filter update LabelPrint Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft Office 2010 Microsoft Office Click-to-Run 2010 Microsoft Office Starter 2010 - English Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft WSE 3.0 Runtime Movie Theme Pack for HP MediaSmart Video MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Mystery P.I. - The London Caper Norton Internet Security Norton Online Backup PdaNet for Android 2.45 Penguins! PhotoNow! PictureMover Plants vs. Zombies PlayReady PC Runtime x86 Poker Superstars III Polar Bowler Polar Golfer Power2Go PowerDirector PSPPContent PSPPRO_DCRAW PureHD Realtek Ethernet Controller Driver For Windows 7 Realtek USB 2.0 Card Reader Recovery Manager RoxioNow Player Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Setup Share Skype Click to Call Skype™ 5.8 Times Reader Unity Web Player Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update Installer for WildTangent Games App VIO Virtual Families Virtual Villagers 4 - The Tree of Life VSClassic VSPro Wheel of Fortune 2 WildTangent Games App (HP Games) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mail Windows Live Messenger Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Windows Media Encoder 9 Series Zuma Deluxe . ==== Event Viewer Messages From Past Week ======== . 6/25/2012 5:45:57 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service. 6/25/2012 4:49:55 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2676562). 6/25/2012 4:49:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2709715). 6/25/2012 4:49:51 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB2679255). 6/25/2012 3:56:02 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting. 6/25/2012 3:47:36 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service. 6/18/2012 6:16:00 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NIS service. 6/18/2012 3:16:35 PM, Error: Disk [11] - The driver detected a controller error on \...\DR1. . ==== End Of File =========================== Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.25.10 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Owner :: OWNER-HP [administrator] 6/25/2012 6:26:28 PM mbam-log-2012-06-25 (18-38-09).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213698 Time elapsed: 11 minute(s), 18 second(s) Memory Processes Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> 2956 -> No action taken. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> No action taken. (end)

I ran otcleanit and uninstalled combofix. Everything is running fine. Thanks for all your help!

eset log C:\FRST\Quarantine\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U\80000000.@ a variant of Win32/Sirefef.FA trojan C:\FRST\Quarantine\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U\800000cb.@ probably a variant of Win32/Agent.TEO trojan C:\Qoobox\Quarantine\C\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\y66jd7st.default\extensions\{0ee7986d-1ae1-49ff-a47e-ede12a1cdc41}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan C:\Qoobox\Quarantine\C\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\y66jd7st.default\extensions\{739e5045-3e93-44f7-95bf-81a18c6f6715}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan C:\Qoobox\Quarantine\C\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\y66jd7st.default\extensions\{d25b6369-9c10-4b75-b820-d5f1a6a17408}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1X60AT7H\firstload_com[1].htm HTML/Hoax.FastDownload.C.Gen application C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1X60AT7H\hotelshopbooknow_biz[1].htm HTML/Iframe.B.Gen virus C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1X60AT7H\mx_nan_a[1].htm HTML/Iframe.B.Gen virus C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1X60AT7H\mx_nan_a[2].htm HTML/Iframe.B.Gen virus C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30LBSPYD\cute-sleepy-kittens-meowing[1].htm HTML/ScrInject.B.Gen virus C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\67KTF39W\celebritybabycraze_com[1].htm JS/Kryptik.PH trojan

Not having any problems. I ran Hijackthis as administrator. Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 4:50:05 PM, on 6/15/2012 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16446) Boot mode: Normal Running processes: c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Windows\RtHDVCpl.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Launch Manager\LManager.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Owner\AppData\Local\Temp\RtkBtMnt.exe C:\Users\Owner\AppData\Local\Workspace\workspaceupdate.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1008&m=aspire_5735 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [skytel] Skytel.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [starfield Updater] "C:\Users\Owner\AppData\Local\Workspace\workspaceupdate.exe" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Apache2.2 - Unknown owner - c:\xampp\apache\bin\httpd.exe (file missing) O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: File Backup Service (File Backup) - Starfield Technologies - C:\Program Files\Workspace\offSyncService.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - c:\xampp\filezillaftp\filezillaserver.exe (file missing) O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: mysql - Unknown owner - c:\xampp\mysql\bin\mysqld.exe (file missing) O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe -- End of file - 10260 bytes Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.06.15.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Owner :: OWNER-PC [administrator] 6/15/2012 2:41:01 PM mbam-log-2012-06-15 (14-41-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 200870 Time elapsed: 11 minute(s), 2 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Everything seems to be ok now, no problems. ComboFix 12-06-13.05 - Owner 06/13/2012 22:17:40.3.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1976.1056 [GMT -4:00] Running from: c:\users\Owner\Desktop\ComboFix.exe Command switches used :: c:\users\Owner\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Resident AV is active . . . ((((((((((((((((((((((((( Files Created from 2012-05-14 to 2012-06-14 ))))))))))))))))))))))))))))))) . . 2012-06-14 02:31 . 2012-06-14 02:32 -------- d-----w- c:\users\Owner\AppData\Local\temp 2012-06-14 02:31 . 2012-06-14 02:31 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-06-14 02:31 . 2012-06-14 02:31 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-13 22:20 . 2012-06-13 22:20 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{06BC3FE9-7BE4-4DFC-A41E-9757832A873D}\offreg.dll 2012-06-13 22:01 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{06BC3FE9-7BE4-4DFC-A41E-9757832A873D}\mpengine.dll 2012-06-08 20:05 . 2012-06-08 20:06 -------- d-----w- C:\FRST 2012-06-08 16:09 . 2012-06-08 16:09 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-06-08 16:09 . 2012-06-08 16:09 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-06-08 02:25 . 2012-06-08 02:25 -------- d-----w- c:\users\Owner\SyncFolder 2012-06-08 02:24 . 2012-06-08 02:36 -------- d-----w- c:\program files\MyPC Backup 2012-06-05 17:57 . 2012-06-05 17:57 -------- d-----w- c:\programdata\HitmanPro 2012-06-05 17:57 . 2012-06-05 17:57 -------- d-----w- c:\program files\HitmanPro 2012-06-05 17:54 . 2012-06-05 17:54 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2012-06-01 15:02 . 2012-06-01 15:02 -------- d-sh--w- c:\windows\system32\%APPDATA% 2012-05-22 16:53 . 2012-05-22 16:55 -------- d-----w- c:\programdata\Knowledge Adventure 2012-05-22 16:53 . 2012-05-22 16:53 -------- d-----w- c:\program files\Common Files\SWF Studio 2012-05-22 16:53 . 2012-05-22 16:53 -------- d-----w- c:\program files\JumpStart 2012-05-22 16:53 . 2012-05-22 16:53 -------- d-----w- c:\program files\Common Files\Knowledge Adventure . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-01 14:36 . 2012-04-03 17:43 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-06-01 14:36 . 2011-12-13 12:26 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-04 19:56 . 2011-04-18 17:33 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-03 08:16 . 2012-05-12 06:14 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-12 06:14 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-04-02 13:36 . 2012-05-12 06:14 2044928 ----a-w- c:\windows\system32\win32k.sys 2012-03-30 12:39 . 2012-05-12 06:15 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-03-20 23:28 . 2012-05-12 06:15 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys 2012-06-08 16:09 . 2011-05-17 15:37 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-06-17 16:40 . 2011-06-17 16:40 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-15 00:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off0] @="{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}" [HKEY_CLASSES_ROOT\CLSID\{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}] 2012-05-18 11:54 1070352 ----a-w- c:\program files\Workspace\offsyncext.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off1] @="{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}" [HKEY_CLASSES_ROOT\CLSID\{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}] 2012-05-18 11:54 1070352 ----a-w- c:\program files\Workspace\offsyncext.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-21 68856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "Starfield Updater"="c:\users\Owner\AppData\Local\Workspace\WorkspaceUpdate.exe" [2012-02-01 34496] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040] "RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456] "Skytel"="Skytel.exe" [2007-11-21 1826816] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-15 526896] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-06-17 30192] "Acer Assist Launcher"="c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568] "Acer Product Registration"="c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792] "EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2009-07-31 1626112] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 136216] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 171032] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 71189191 *NewlyCreated* - ASWMBR *NewlyCreated* - WS2IFSL *Deregistered* - 71189191 *Deregistered* - aswMBR . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2012-06-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 16:55] . 2012-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 16:55] . 2012-06-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2782296849-3073254760-3789230479-1000Core.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-05 02:47] . 2012-06-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2782296849-3073254760-3789230479-1000UA.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-05 02:47] . 2012-05-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-22 18:32] . 2012-06-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-22 18:32] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.mail.com/ mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1008&m=aspire_5735 TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\y66jd7st.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.mail.com/ FF - prefs.js: network.proxy.type - 0 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-13 22:32 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(4120) c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll c:\program files\Workspace\offsyncext.dll . Completion time: 2012-06-13 22:36:25 ComboFix-quarantined-files.txt 2012-06-14 02:36 ComboFix2.txt 2012-06-12 19:54 ComboFix3.txt 2011-12-30 21:28 . Pre-Run: 11,748,519,936 bytes free Post-Run: 11,964,424,192 bytes free . - - End Of File - - 0BC4A276184C838D7A7466605A7E890A

The computer seems to be acting ok. Logs below. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-06-13 14:13:00 ----------------------------- 14:13:00.878 OS Version: Windows 6.0.6002 Service Pack 2 14:13:00.878 Number of processors: 2 586 0xF0D 14:13:00.878 ComputerName: OWNER-PC UserName: Owner 14:13:03.452 Initialize success 14:14:38.383 AVAST engine defs: 12061300 14:16:35.929 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 14:16:35.929 Disk 0 Vendor: WDC_WD1600BEVT-22ZCT0 11.01A11 Size: 152627MB BusType: 3 14:16:35.960 Disk 0 MBR read successfully 14:16:35.976 Disk 0 MBR scan 14:16:36.022 Disk 0 unknown MBR code 14:16:36.038 Disk 0 Partition 1 00 27 Hidden NTFS WinRE MSDOS5.0 10000 MB offset 2048 14:16:36.069 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 71317 MB offset 20482048 14:16:36.132 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 71308 MB offset 166539264 14:16:36.147 Disk 0 scanning sectors +312578048 14:16:36.272 Disk 0 scanning C:\Windows\system32\drivers 14:17:04.009 Service scanning 14:17:48.703 Modules scanning 14:17:56.066 Disk 0 trace - called modules: 14:17:56.144 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys 14:17:56.144 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8516a9a8] 14:17:56.160 3 CLASSPNP.SYS[87fa38b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84f738d8] 14:17:58.125 AVAST engine scan C:\Windows 14:18:13.023 AVAST engine scan C:\Windows\system32 14:25:21.914 AVAST engine scan C:\Windows\system32\drivers 14:25:54.175 AVAST engine scan C:\Users\Owner 14:57:23.424 AVAST engine scan C:\ProgramData 15:05:50.299 Scan finished successfully 17:50:49.765 Disk 0 MBR has been saved successfully to "C:\Users\Owner\Desktop\MBR.dat" 17:50:49.781 The log file has been saved successfully to "C:\Users\Owner\Desktop\aswMBR.txt" 14:11:16.0905 3856 TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16 14:11:19.0026 3856 ============================================================ 14:11:19.0026 3856 Current date / time: 2012/06/13 14:11:19.0026 14:11:19.0027 3856 SystemInfo: 14:11:19.0027 3856 14:11:19.0027 3856 OS Version: 6.0.6002 ServicePack: 2.0 14:11:19.0027 3856 Product type: Workstation 14:11:19.0027 3856 ComputerName: OWNER-PC 14:11:19.0028 3856 UserName: Owner 14:11:19.0028 3856 Windows directory: C:\Windows 14:11:19.0028 3856 System windows directory: C:\Windows 14:11:19.0028 3856 Processor architecture: Intel x86 14:11:19.0028 3856 Number of processors: 2 14:11:19.0028 3856 Page size: 0x1000 14:11:19.0028 3856 Boot type: Normal boot 14:11:19.0028 3856 ============================================================ 14:11:28.0341 3856 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 14:11:28.0341 3856 ============================================================ 14:11:28.0341 3856 \Device\Harddisk0\DR0: 14:11:28.0341 3856 MBR partitions: 14:11:28.0341 3856 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1388800, BlocksNum 0x8B4A800 14:11:28.0341 3856 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9ED3000, BlocksNum 0x8B46000 14:11:28.0341 3856 ============================================================ 14:11:28.0794 3856 C: <-> \Device\Harddisk0\DR0\Partition0 14:11:28.0887 3856 D: <-> \Device\Harddisk0\DR0\Partition1 14:11:28.0887 3856 ============================================================ 14:11:28.0887 3856 Initialize success 14:11:28.0887 3856 ============================================================ 14:11:31.0711 5700 ============================================================ 14:11:31.0711 5700 Scan started 14:11:31.0711 5700 Mode: Manual; 14:11:31.0711 5700 ============================================================ 14:11:32.0678 5700 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys 14:11:32.0694 5700 ACPI - ok 14:11:32.0756 5700 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys 14:11:32.0787 5700 adp94xx - ok 14:11:32.0850 5700 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys 14:11:32.0881 5700 adpahci - ok 14:11:32.0928 5700 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys 14:11:32.0943 5700 adpu160m - ok 14:11:32.0990 5700 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys 14:11:32.0990 5700 adpu320 - ok 14:11:33.0021 5700 AeLookupSvc (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll 14:11:33.0021 5700 AeLookupSvc - ok 14:11:33.0084 5700 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys 14:11:33.0115 5700 AFD - ok 14:11:33.0146 5700 AgereModemAudio (efbc44fbd75e4f80bd927aebf6e7eade) C:\Windows\system32\agrsmsvc.exe 14:11:33.0146 5700 AgereModemAudio - ok 14:11:33.0302 5700 AgereSoftModem (38325c6aa8eae011897d61ce48ec6435) C:\Windows\system32\DRIVERS\AGRSM.sys 14:11:33.0349 5700 AgereSoftModem - ok 14:11:33.0380 5700 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys 14:11:33.0380 5700 agp440 - ok 14:11:33.0396 5700 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 14:11:33.0411 5700 aic78xx - ok 14:11:33.0427 5700 ALG (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe 14:11:33.0427 5700 ALG - ok 14:11:33.0458 5700 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys 14:11:33.0458 5700 aliide - ok 14:11:33.0489 5700 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys 14:11:33.0489 5700 amdagp - ok 14:11:33.0505 5700 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys 14:11:33.0520 5700 amdide - ok 14:11:33.0536 5700 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys 14:11:33.0536 5700 AmdK7 - ok 14:11:33.0567 5700 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys 14:11:33.0567 5700 AmdK8 - ok 14:11:33.0567 5700 Apache2.2 - ok 14:11:33.0598 5700 Appinfo (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll 14:11:33.0598 5700 Appinfo - ok 14:11:33.0645 5700 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys 14:11:33.0645 5700 arc - ok 14:11:33.0676 5700 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys 14:11:33.0692 5700 arcsas - ok 14:11:33.0864 5700 aspnet_state (776acefa0ca9df0faa51a5fb2f435705) C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 14:11:33.0910 5700 aspnet_state - ok 14:11:33.0957 5700 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 14:11:33.0957 5700 AsyncMac - ok 14:11:34.0035 5700 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys 14:11:34.0035 5700 atapi - ok 14:11:34.0191 5700 athr (600efe56f37adbd65a0fb076b50d1b8d) C:\Windows\system32\DRIVERS\athr.sys 14:11:34.0238 5700 athr - ok 14:11:34.0332 5700 AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll 14:11:34.0332 5700 AudioEndpointBuilder - ok 14:11:34.0347 5700 Audiosrv (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll 14:11:34.0347 5700 Audiosrv - ok 14:11:34.0394 5700 b57nd60x (502f1c30bd50b32d00ce4dcaecc3d3c7) C:\Windows\system32\DRIVERS\b57nd60x.sys 14:11:34.0425 5700 b57nd60x - ok 14:11:34.0456 5700 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 14:11:34.0456 5700 Beep - ok 14:11:34.0550 5700 BFE (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll 14:11:34.0566 5700 BFE - ok 14:11:34.0768 5700 BITS (93952506c6d67330367f7e7934b6a02f) C:\Windows\system32\qmgr.dll 14:11:34.0815 5700 BITS - ok 14:11:34.0846 5700 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys 14:11:34.0862 5700 blbdrive - ok 14:11:34.0924 5700 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys 14:11:34.0924 5700 bowser - ok 14:11:34.0971 5700 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 14:11:34.0971 5700 BrFiltLo - ok 14:11:34.0987 5700 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 14:11:34.0987 5700 BrFiltUp - ok 14:11:35.0096 5700 BridgeMP (b1564976d98e91fc764d5dc28a0297da) C:\Windows\system32\DRIVERS\bridge.sys 14:11:35.0096 5700 BridgeMP - ok 14:11:35.0143 5700 Browser (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll 14:11:35.0143 5700 Browser - ok 14:11:35.0174 5700 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 14:11:35.0174 5700 Brserid - ok 14:11:35.0190 5700 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 14:11:35.0190 5700 BrSerWdm - ok 14:11:35.0221 5700 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 14:11:35.0221 5700 BrUsbMdm - ok 14:11:35.0236 5700 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 14:11:35.0236 5700 BrUsbSer - ok 14:11:35.0268 5700 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys 14:11:35.0268 5700 BTHMODEM - ok 14:11:35.0377 5700 BUNAgentSvc (09e6affae6c0e9158bf05c7d08d0107a) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe 14:11:35.0377 5700 BUNAgentSvc - ok 14:11:35.0455 5700 catchme - ok 14:11:35.0470 5700 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 14:11:35.0470 5700 cdfs - ok 14:11:35.0517 5700 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys 14:11:35.0517 5700 cdrom - ok 14:11:35.0580 5700 CertPropSvc (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll 14:11:35.0595 5700 CertPropSvc - ok 14:11:35.0611 5700 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys 14:11:35.0611 5700 circlass - ok 14:11:35.0689 5700 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys 14:11:35.0704 5700 CLFS - ok 14:11:35.0954 5700 clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 14:11:36.0032 5700 clr_optimization_v2.0.50727_32 - ok 14:11:36.0360 5700 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 14:11:36.0375 5700 clr_optimization_v4.0.30319_32 - ok 14:11:36.0406 5700 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys 14:11:36.0406 5700 CmBatt - ok 14:11:36.0422 5700 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys 14:11:36.0422 5700 cmdide - ok 14:11:36.0438 5700 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys 14:11:36.0438 5700 Compbatt - ok 14:11:36.0453 5700 COMSysApp - ok 14:11:36.0469 5700 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys 14:11:36.0469 5700 crcdisk - ok 14:11:36.0484 5700 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys 14:11:36.0484 5700 Crusoe - ok 14:11:36.0547 5700 CryptSvc (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll 14:11:36.0562 5700 CryptSvc - ok 14:11:36.0672 5700 DcomLaunch (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll 14:11:36.0687 5700 DcomLaunch - ok 14:11:36.0750 5700 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys 14:11:36.0750 5700 DfsC - ok 14:11:37.0015 5700 DFSR (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe 14:11:37.0093 5700 DFSR - ok 14:11:37.0764 5700 Dhcp (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll 14:11:37.0795 5700 Dhcp - ok 14:11:37.0873 5700 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys 14:11:37.0873 5700 disk - ok 14:11:37.0904 5700 DKbFltr (73baf270d24fe726b9cd7f80bb17a23d) C:\Windows\system32\DRIVERS\DKbFltr.sys 14:11:37.0920 5700 DKbFltr - ok 14:11:37.0951 5700 Dnscache (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll 14:11:37.0982 5700 Dnscache - ok 14:11:38.0060 5700 dot3svc (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll 14:11:38.0107 5700 dot3svc - ok 14:11:38.0169 5700 DPS (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll 14:11:38.0169 5700 DPS - ok 14:11:38.0247 5700 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 14:11:38.0247 5700 drmkaud - ok 14:11:38.0356 5700 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys 14:11:38.0388 5700 DXGKrnl - ok 14:11:38.0419 5700 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys 14:11:38.0434 5700 E1G60 - ok 14:11:38.0466 5700 EapHost (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll 14:11:38.0481 5700 EapHost - ok 14:11:38.0528 5700 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys 14:11:38.0544 5700 Ecache - ok 14:11:38.0762 5700 eDataSecurity Service (2ce2ddcb1a41ed4488a2a8b98d286b3d) C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe 14:11:38.0871 5700 eDataSecurity Service - ok 14:11:39.0152 5700 ehRecvr (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe 14:11:39.0230 5700 ehRecvr - ok 14:11:39.0261 5700 ehSched (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe 14:11:39.0261 5700 ehSched - ok 14:11:39.0277 5700 ehstart (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll 14:11:39.0292 5700 ehstart - ok 14:11:39.0370 5700 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys 14:11:39.0386 5700 elxstor - ok 14:11:39.0480 5700 EMDMgmt (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll 14:11:39.0495 5700 EMDMgmt - ok 14:11:39.0542 5700 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys 14:11:39.0542 5700 ErrDev - ok 14:11:39.0651 5700 ETService (a51fd9df23720485991f56741bbefcfb) C:\Program Files\Acer\Empowering Technology\Service\ETService.exe 14:11:39.0651 5700 ETService - ok 14:11:39.0760 5700 EventSystem (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll 14:11:39.0807 5700 EventSystem - ok 14:11:39.0854 5700 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys 14:11:39.0854 5700 exfat - ok 14:11:39.0916 5700 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys 14:11:39.0948 5700 fastfat - ok 14:11:39.0963 5700 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys 14:11:39.0979 5700 fdc - ok 14:11:40.0010 5700 fdPHost (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll 14:11:40.0010 5700 fdPHost - ok 14:11:40.0026 5700 FDResPub (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll 14:11:40.0041 5700 FDResPub - ok 14:11:40.0244 5700 File Backup (ed59ad1c8db2f26324051b035ae56cdd) C:\Program Files\Workspace\offSyncService.exe 14:11:40.0322 5700 File Backup - ok 14:11:40.0338 5700 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 14:11:40.0338 5700 FileInfo - ok 14:11:40.0353 5700 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 14:11:40.0353 5700 Filetrace - ok 14:11:40.0369 5700 FileZilla Server - ok 14:11:40.0400 5700 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 14:11:40.0400 5700 flpydisk - ok 14:11:40.0447 5700 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys 14:11:40.0462 5700 FltMgr - ok 14:11:40.0634 5700 FontCache (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll 14:11:40.0696 5700 FontCache - ok 14:11:40.0946 5700 FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe 14:11:40.0977 5700 FontCache3.0.0.0 - ok 14:11:41.0024 5700 Fs_Rec (b972a66758577e0bfd1de0f91aaa27b5) C:\Windows\system32\drivers\Fs_Rec.sys 14:11:41.0055 5700 Fs_Rec - ok 14:11:41.0086 5700 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys 14:11:41.0086 5700 gagp30kx - ok 14:11:41.0180 5700 GoogleDesktopManager-051210-111108 (9f5f2f0fb0a7f5aa9f16b9a7b6dad89f) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 14:11:41.0180 5700 GoogleDesktopManager-051210-111108 - ok 14:11:41.0320 5700 gpsvc (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll 14:11:41.0383 5700 gpsvc - ok 14:11:41.0430 5700 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe 14:11:41.0430 5700 gupdate - ok 14:11:41.0476 5700 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe 14:11:41.0476 5700 gupdatem - ok 14:11:41.0539 5700 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 14:11:41.0570 5700 gusvc - ok 14:11:41.0913 5700 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 14:11:41.0944 5700 HdAudAddService - ok 14:11:42.0038 5700 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys 14:11:42.0085 5700 HDAudBus - ok 14:11:42.0116 5700 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 14:11:42.0116 5700 HidBth - ok 14:11:42.0147 5700 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 14:11:42.0147 5700 HidIr - ok 14:11:42.0210 5700 hidserv (84067081f3318162797385e11a8f0582) C:\Windows\System32\hidserv.dll 14:11:42.0210 5700 hidserv - ok 14:11:42.0256 5700 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys 14:11:42.0256 5700 HidUsb - ok 14:11:42.0303 5700 hkmsvc (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll 14:11:42.0334 5700 hkmsvc - ok 14:11:42.0350 5700 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys 14:11:42.0366 5700 HpCISSs - ok 14:11:42.0459 5700 hpqcxs08 (5eaacbb733c8c360247239f6874b14b4) C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll 14:11:42.0506 5700 hpqcxs08 - ok 14:11:42.0537 5700 hpqddsvc (8fe93079a7c053dafe9a0e5753e3d698) C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll 14:11:42.0568 5700 hpqddsvc - ok 14:11:42.0600 5700 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS 14:11:42.0631 5700 HSFHWAZL - ok 14:11:42.0771 5700 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS 14:11:42.0834 5700 HSF_DPV - ok 14:11:42.0927 5700 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys 14:11:42.0990 5700 HTTP - ok 14:11:43.0021 5700 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys 14:11:43.0021 5700 i2omp - ok 14:11:43.0068 5700 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 14:11:43.0130 5700 i8042prt - ok 14:11:43.0192 5700 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys 14:11:43.0192 5700 iaStorV - ok 14:11:43.0458 5700 idsvc (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 14:11:43.0582 5700 idsvc - ok 14:11:44.0690 5700 igfx (8266ae06df974e5ba047b3e9e9e70b3f) C:\Windows\system32\DRIVERS\igdkmd32.sys 14:11:44.0940 5700 igfx - ok 14:11:45.0111 5700 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 14:11:45.0111 5700 iirsp - ok 14:11:45.0205 5700 IKEEXT (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll 14:11:45.0236 5700 IKEEXT - ok 14:11:45.0267 5700 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys 14:11:45.0408 5700 int15 - ok 14:11:45.0657 5700 IntcAzAudAddService (23ebcee9aaa4d6c88728791fab462456) C:\Windows\system32\drivers\RTKVHDA.sys 14:11:45.0751 5700 IntcAzAudAddService - ok 14:11:46.0890 5700 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys 14:11:46.0890 5700 intelide - ok 14:11:46.0921 5700 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 14:11:46.0921 5700 intelppm - ok 14:11:46.0968 5700 IPBusEnum (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll 14:11:46.0999 5700 IPBusEnum - ok 14:11:47.0030 5700 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 14:11:47.0030 5700 IpFilterDriver - ok 14:11:47.0108 5700 iphlpsvc (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll 14:11:47.0124 5700 iphlpsvc - ok 14:11:47.0124 5700 IpInIp - ok 14:11:47.0155 5700 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys 14:11:47.0155 5700 IPMIDRV - ok 14:11:47.0186 5700 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 14:11:47.0233 5700 IPNAT - ok 14:11:47.0248 5700 irda (e50a95179211b12946f7e035d60af560) C:\Windows\system32\DRIVERS\irda.sys 14:11:47.0248 5700 irda - ok 14:11:47.0264 5700 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 14:11:47.0280 5700 IRENUM - ok 14:11:47.0311 5700 Irmon (cbb0d940221a281bcfeaea695bd1cda5) C:\Windows\System32\irmon.dll 14:11:47.0311 5700 Irmon - ok 14:11:47.0342 5700 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys 14:11:47.0342 5700 isapnp - ok 14:11:47.0404 5700 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys 14:11:47.0451 5700 iScsiPrt - ok 14:11:47.0467 5700 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 14:11:47.0467 5700 iteatapi - ok 14:11:47.0498 5700 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 14:11:47.0498 5700 iteraid - ok 14:11:47.0514 5700 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 14:11:47.0514 5700 kbdclass - ok 14:11:47.0545 5700 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys 14:11:47.0545 5700 kbdhid - ok 14:11:47.0576 5700 KeyIso (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe 14:11:47.0576 5700 KeyIso - ok 14:11:47.0716 5700 KSecDD (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys 14:11:47.0732 5700 KSecDD - ok 14:11:47.0826 5700 KtmRm (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll 14:11:47.0826 5700 KtmRm - ok 14:11:47.0888 5700 LanmanServer (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\System32\srvsvc.dll 14:11:47.0904 5700 LanmanServer - ok 14:11:47.0950 5700 LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:\Windows\System32\wkssvc.dll 14:11:47.0966 5700 LanmanWorkstation - ok 14:11:48.0075 5700 LightScribeService (793ff718477345cd5d232c50bed1e452) C:\Program Files\Common Files\LightScribe\LSSrvc.exe 14:11:48.0075 5700 LightScribeService - ok 14:11:48.0138 5700 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 14:11:48.0138 5700 lltdio - ok 14:11:48.0200 5700 lltdsvc (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll 14:11:48.0262 5700 lltdsvc - ok 14:11:48.0278 5700 lmhosts (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll 14:11:48.0278 5700 lmhosts - ok 14:11:48.0325 5700 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys 14:11:48.0340 5700 LSI_FC - ok 14:11:48.0372 5700 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys 14:11:48.0387 5700 LSI_SAS - ok 14:11:48.0418 5700 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys 14:11:48.0434 5700 LSI_SCSI - ok 14:11:48.0450 5700 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 14:11:48.0465 5700 luafv - ok 14:11:48.0543 5700 McAfee SiteAdvisor Service (6c3d154fff0a97a6c3d9f78d60c41655) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe 14:11:48.0559 5700 McAfee SiteAdvisor Service - ok 14:11:48.0684 5700 mcmscsvc (cb3a8976de2f65349322da7627cea223) C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe 14:11:48.0699 5700 mcmscsvc - ok 14:11:49.0058 5700 McNASvc (c69e71e00b30b60556d3e096699bd423) c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe 14:11:49.0136 5700 McNASvc - ok 14:11:49.0276 5700 McODS (21456f3051cbefd1f2d60d8b9ab9c6ee) C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe 14:11:49.0292 5700 McODS - ok 14:11:49.0339 5700 McProxy (8cf3da0be6094c34d7c4a85493e60547) c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe 14:11:49.0354 5700 McProxy - ok 14:11:49.0386 5700 McShield (33734abfa52ec8d096a1254d645e9b4f) C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe 14:11:49.0386 5700 McShield - ok 14:11:49.0495 5700 McSysmon (fd47df2bcc3544df65b01ad6b6062430) C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe 14:11:49.0526 5700 McSysmon - ok 14:11:49.0666 5700 Mcx2Svc (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll 14:11:49.0698 5700 Mcx2Svc - ok 14:11:49.0760 5700 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys 14:11:49.0760 5700 megasas - ok 14:11:49.0807 5700 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys 14:11:49.0822 5700 MegaSR - ok 14:11:49.0869 5700 mfeavfk (c97cbfd71c1c215150a3b3e55f77a7a3) C:\Windows\system32\drivers\mfeavfk.sys 14:11:49.0869 5700 mfeavfk - ok 14:11:49.0900 5700 mfebopk (5447338b83a1a2354fb2fea7604387fd) C:\Windows\system32\drivers\mfebopk.sys 14:11:49.0900 5700 mfebopk - ok 14:11:49.0947 5700 mfehidk (6c9a6ed60b8fc3baf72fe1b1d096445b) C:\Windows\system32\drivers\mfehidk.sys 14:11:49.0963 5700 mfehidk - ok 14:11:49.0994 5700 mferkdk (a551154b51d6a93fccf70fc4e8eaf4bd) C:\Windows\system32\drivers\mferkdk.sys 14:11:49.0994 5700 mferkdk - ok 14:11:50.0025 5700 mfesmfk (299a86b780c9627aaa24e74292363ed2) C:\Windows\system32\drivers\mfesmfk.sys 14:11:50.0025 5700 mfesmfk - ok 14:11:50.0072 5700 MMCSS (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll 14:11:50.0072 5700 MMCSS - ok 14:11:50.0103 5700 MobilityService - ok 14:11:50.0119 5700 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 14:11:50.0134 5700 Modem - ok 14:11:50.0150 5700 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 14:11:50.0150 5700 monitor - ok 14:11:50.0197 5700 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 14:11:50.0197 5700 mouclass - ok 14:11:50.0228 5700 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 14:11:50.0228 5700 mouhid - ok 14:11:50.0244 5700 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 14:11:50.0259 5700 MountMgr - ok 14:11:50.0353 5700 MozillaMaintenance (6380ff81dd4d78b23398752d2f46ea43) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 14:11:50.0431 5700 MozillaMaintenance - ok 14:11:50.0478 5700 MPFP (96cf5286bc370b558735a7b891232d92) C:\Windows\system32\Drivers\Mpfp.sys 14:11:50.0493 5700 MPFP - ok 14:11:50.0634 5700 MpfService (346f30f1ff73553aa466f4ae7948da00) C:\Program Files\McAfee\MPF\MPFSrv.exe 14:11:50.0634 5700 MpfService - ok 14:11:50.0680 5700 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys 14:11:50.0680 5700 mpio - ok 14:11:50.0727 5700 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 14:11:50.0727 5700 mpsdrv - ok 14:11:50.0836 5700 MpsSvc (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll 14:11:50.0883 5700 MpsSvc - ok 14:11:50.0899 5700 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 14:11:50.0899 5700 Mraid35x - ok 14:11:50.0961 5700 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys 14:11:51.0086 5700 MRxDAV - ok 14:11:51.0164 5700 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys 14:11:51.0180 5700 mrxsmb - ok 14:11:51.0242 5700 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys 14:11:51.0258 5700 mrxsmb10 - ok 14:11:51.0304 5700 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 14:11:51.0304 5700 mrxsmb20 - ok 14:11:51.0351 5700 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys 14:11:51.0351 5700 msahci - ok 14:11:51.0398 5700 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys 14:11:51.0414 5700 msdsm - ok 14:11:51.0460 5700 MSDTC (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe 14:11:51.0507 5700 MSDTC - ok 14:11:51.0538 5700 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 14:11:51.0538 5700 Msfs - ok 14:11:51.0601 5700 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 14:11:51.0601 5700 msisadrv - ok 14:11:51.0663 5700 MSiSCSI (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll 14:11:51.0679 5700 MSiSCSI - ok 14:11:51.0694 5700 msiserver - ok 14:11:52.0116 5700 MSK80Service (a05de3535884270b8d292dcbdd6ded20) C:\Program Files\McAfee\MSK\MskSrver.exe 14:11:52.0131 5700 MSK80Service - ok 14:11:52.0225 5700 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 14:11:52.0225 5700 MSKSSRV - ok 14:11:52.0240 5700 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 14:11:52.0240 5700 MSPCLOCK - ok 14:11:52.0256 5700 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 14:11:52.0256 5700 MSPQM - ok 14:11:52.0318 5700 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys 14:11:52.0334 5700 MsRPC - ok 14:11:52.0365 5700 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 14:11:52.0365 5700 mssmbios - ok 14:11:52.0381 5700 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 14:11:52.0381 5700 MSTEE - ok 14:11:52.0412 5700 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys 14:11:52.0443 5700 Mup - ok 14:11:52.0459 5700 mysql - ok 14:11:53.0582 5700 napagent (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll 14:11:53.0660 5700 napagent - ok 14:11:53.0738 5700 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys 14:11:53.0785 5700 NativeWifiP - ok 14:11:53.0894 5700 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys 14:11:53.0910 5700 NDIS - ok 14:11:53.0941 5700 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 14:11:53.0956 5700 NdisTapi - ok 14:11:53.0972 5700 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 14:11:53.0972 5700 Ndisuio - ok 14:11:54.0019 5700 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys 14:11:54.0034 5700 NdisWan - ok 14:11:54.0066 5700 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 14:11:54.0066 5700 NDProxy - ok 14:11:54.0097 5700 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 14:11:54.0112 5700 NetBIOS - ok 14:11:54.0175 5700 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys 14:11:54.0175 5700 netbt - ok 14:11:54.0222 5700 Netlogon (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe 14:11:54.0237 5700 Netlogon - ok 14:11:54.0300 5700 Netman (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll 14:11:54.0331 5700 Netman - ok 14:11:55.0080 5700 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 14:11:55.0173 5700 NetMsmqActivator - ok 14:11:55.0189 5700 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 14:11:55.0189 5700 NetPipeActivator - ok 14:11:55.0766 5700 netprofm (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll 14:11:55.0813 5700 netprofm - ok 14:11:55.0828 5700 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 14:11:55.0828 5700 NetTcpActivator - ok 14:11:55.0844 5700 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 14:11:55.0844 5700 NetTcpPortSharing - ok 14:11:56.0140 5700 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 14:11:56.0218 5700 nfrd960 - ok 14:11:56.0265 5700 NlaSvc (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll 14:11:56.0296 5700 NlaSvc - ok 14:11:56.0359 5700 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys 14:11:56.0359 5700 Npfs - ok 14:11:56.0390 5700 NSCIRDA (6d8d2e5652fc2442c810c5d8be784148) C:\Windows\system32\DRIVERS\nscirda.sys 14:11:56.0390 5700 NSCIRDA - ok 14:11:56.0421 5700 nsi (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll 14:11:56.0421 5700 nsi - ok 14:11:56.0437 5700 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 14:11:56.0437 5700 nsiproxy - ok 14:11:56.0920 5700 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys 14:11:57.0045 5700 Ntfs - ok 14:11:57.0108 5700 NTIBackupSvc (cb76f68ba0d57c5d25b538981b1c611c) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe 14:11:57.0108 5700 NTIBackupSvc - ok 14:11:57.0170 5700 NTIDrvr (2757d2ba59aee155209e24942ab127c9) C:\Windows\system32\DRIVERS\NTIDrvr.sys 14:11:57.0170 5700 NTIDrvr - ok 14:11:57.0404 5700 NTISchedulerSvc (df1c10a75df7e50195fc417f88a33227) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe 14:11:57.0498 5700 NTISchedulerSvc - ok 14:11:57.0529 5700 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 14:11:57.0529 5700 ntrigdigi - ok 14:11:58.0184 5700 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\Windows\system32\DRIVERS\NuidFltr.sys 14:11:58.0215 5700 NuidFltr - ok 14:11:58.0246 5700 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 14:11:58.0246 5700 Null - ok 14:11:58.0309 5700 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys 14:11:58.0324 5700 nvraid - ok 14:11:58.0371 5700 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys 14:11:58.0371 5700 nvstor - ok 14:11:58.0434 5700 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys 14:11:58.0434 5700 nv_agp - ok 14:11:58.0449 5700 NwlnkFlt - ok 14:11:58.0465 5700 NwlnkFwd - ok 14:11:58.0980 5700 odserv (84de1dd996b48b05ace31ad015fa108a) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 14:11:59.0058 5700 odserv - ok 14:11:59.0104 5700 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys 14:11:59.0104 5700 ohci1394 - ok 14:11:59.0198 5700 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 14:11:59.0276 5700 ose - ok 14:12:00.0290 5700 p2pimsvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll 14:12:00.0368 5700 p2pimsvc - ok 14:12:00.0384 5700 p2psvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll 14:12:00.0399 5700 p2psvc - ok 14:12:01.0257 5700 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 14:12:01.0257 5700 Parport - ok 14:12:01.0304 5700 partmgr (b9c2b89f08670e159f7181891e449cd9) C:\Windows\system32\drivers\partmgr.sys 14:12:01.0304 5700 partmgr - ok 14:12:01.0320 5700 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 14:12:01.0320 5700 Parvdm - ok 14:12:01.0366 5700 PcaSvc (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll 14:12:01.0366 5700 PcaSvc - ok 14:12:01.0429 5700 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys 14:12:01.0476 5700 pci - ok 14:12:01.0522 5700 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys 14:12:01.0522 5700 pciide - ok 14:12:01.0569 5700 pcmcia (b7c5a8769541900f6dfa6fe0c5e4d513) C:\Windows\system32\DRIVERS\pcmcia.sys 14:12:01.0616 5700 pcmcia - ok 14:12:02.0287 5700 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 14:12:02.0334 5700 PEAUTH - ok 14:12:02.0630 5700 pla (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll 14:12:02.0755 5700 pla - ok 14:12:03.0301 5700 PlugPlay (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll 14:12:03.0332 5700 PlugPlay - ok 14:12:03.0441 5700 PNRPAutoReg (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll 14:12:03.0457 5700 PNRPAutoReg - ok 14:12:03.0472 5700 PNRPsvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll 14:12:03.0488 5700 PNRPsvc - ok 14:12:04.0018 5700 PolicyAgent (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll 14:12:04.0096 5700 PolicyAgent - ok 14:12:04.0174 5700 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 14:12:04.0174 5700 PptpMiniport - ok 14:12:04.0237 5700 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys 14:12:04.0237 5700 Processor - ok 14:12:04.0315 5700 ProfSvc (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll 14:12:04.0362 5700 ProfSvc - ok 14:12:04.0393 5700 ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe 14:12:04.0408 5700 ProtectedStorage - ok 14:12:05.0376 5700 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys 14:12:05.0376 5700 PSched - ok 14:12:05.0422 5700 PSDFilter (1dcbb35090cc4b2bd3d661e6089523c6) C:\Windows\system32\DRIVERS\psdfilter.sys 14:12:05.0422 5700 PSDFilter - ok 14:12:05.0454 5700 PSDNServ (e26e46d619469964ac3609620f443867) C:\Windows\system32\DRIVERS\PSDNServ.sys 14:12:05.0454 5700 PSDNServ - ok 14:12:05.0485 5700 psdvdisk (3e1d134af2806867d06047c4cc33cc65) C:\Windows\system32\DRIVERS\PSDVdisk.sys 14:12:05.0485 5700 psdvdisk - ok 14:12:06.0390 5700 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys 14:12:06.0452 5700 ql2300 - ok 14:12:06.0499 5700 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 14:12:06.0546 5700 ql40xx - ok 14:12:06.0608 5700 QWAVE (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll 14:12:06.0655 5700 QWAVE - ok 14:12:06.0670 5700 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 14:12:06.0670 5700 QWAVEdrv - ok 14:12:06.0686 5700 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys 14:12:06.0702 5700 RasAcd - ok 14:12:06.0748 5700 RasAuto (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll 14:12:06.0764 5700 RasAuto - ok 14:12:06.0795 5700 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 14:12:06.0795 5700 Rasl2tp - ok 14:12:06.0858 5700 RasMan (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll 14:12:06.0904 5700 RasMan - ok 14:12:06.0951 5700 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys 14:12:06.0951 5700 RasPppoe - ok 14:12:07.0014 5700 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys 14:12:07.0029 5700 RasSstp - ok 14:12:07.0092 5700 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys 14:12:07.0123 5700 rdbss - ok 14:12:07.0170 5700 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 14:12:07.0170 5700 RDPCDD - ok 14:12:07.0216 5700 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys 14:12:07.0232 5700 rdpdr - ok 14:12:07.0248 5700 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 14:12:07.0248 5700 RDPENCDD - ok 14:12:07.0326 5700 RDPWD (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys 14:12:07.0341 5700 RDPWD - ok 14:12:07.0404 5700 RemoteAccess (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll 14:12:07.0419 5700 RemoteAccess - ok 14:12:07.0482 5700 RemoteRegistry (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll 14:12:07.0497 5700 RemoteRegistry - ok 14:12:07.0528 5700 RpcLocator (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe 14:12:07.0528 5700 RpcLocator - ok 14:12:07.0653 5700 RpcSs (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\System32\rpcss.dll 14:12:07.0669 5700 RpcSs - ok 14:12:07.0716 5700 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 14:12:07.0716 5700 rspndr - ok 14:12:07.0762 5700 RTSTOR (9ea88492b1dab90dce43a6f2c0e133bd) C:\Windows\system32\drivers\RTSTOR.SYS 14:12:07.0809 5700 RTSTOR - ok 14:12:07.0872 5700 SamSs (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe 14:12:07.0872 5700 SamSs - ok 14:12:07.0918 5700 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 14:12:07.0918 5700 sbp2port - ok 14:12:07.0981 5700 SCardSvr (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll 14:12:07.0996 5700 SCardSvr - ok 14:12:08.0090 5700 Schedule (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll 14:12:08.0121 5700 Schedule - ok 14:12:08.0184 5700 SCPolicySvc (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll 14:12:08.0199 5700 SCPolicySvc - ok 14:12:08.0230 5700 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys 14:12:08.0230 5700 sdbus - ok 14:12:08.0293 5700 SDRSVC (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll 14:12:08.0308 5700 SDRSVC - ok 14:12:08.0340 5700 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 14:12:08.0340 5700 secdrv - ok 14:12:08.0355 5700 seclogon (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll 14:12:08.0371 5700 seclogon - ok 14:12:08.0386 5700 SENS (a9bbab5759771e523f55563d6cbe140f) C:\Windows\system32\sens.dll 14:12:08.0402 5700 SENS - ok 14:12:08.0433 5700 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys 14:12:08.0433 5700 Serenum - ok 14:12:08.0464 5700 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys 14:12:08.0480 5700 Serial - ok 14:12:08.0511 5700 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 14:12:08.0511 5700 sermouse - ok 14:12:08.0574 5700 SessionEnv (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll 14:12:08.0589 5700 SessionEnv - ok 14:12:08.0605 5700 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys 14:12:08.0605 5700 sffdisk - ok 14:12:08.0636 5700 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys 14:12:08.0636 5700 sffp_mmc - ok 14:12:08.0667 5700 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys 14:12:08.0667 5700 sffp_sd - ok 14:12:08.0683 5700 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 14:12:08.0698 5700 sfloppy - ok 14:12:08.0761 5700 SharedAccess (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll 14:12:08.0776 5700 SharedAccess - ok 14:12:08.0839 5700 ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll 14:12:08.0870 5700 ShellHWDetection - ok 14:12:08.0886 5700 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys 14:12:08.0901 5700 sisagp - ok 14:12:08.0964 5700 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys 14:12:08.0964 5700 SiSRaid2 - ok 14:12:08.0995 5700 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys 14:12:09.0057 5700 SiSRaid4 - ok 14:12:09.0463 5700 slsvc (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe 14:12:09.0572 5700 slsvc - ok 14:12:09.0728 5700 SLUINotify (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll 14:12:09.0744 5700 SLUINotify - ok 14:12:09.0868 5700 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys 14:12:09.0868 5700 Smb - ok 14:12:09.0931 5700 SNMPTRAP (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe 14:12:09.0931 5700 SNMPTRAP - ok 14:12:09.0993 5700 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 14:12:09.0993 5700 spldr - ok 14:12:10.0056 5700 Spooler (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe 14:12:10.0071 5700 Spooler - ok 14:12:10.0165 5700 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys 14:12:10.0165 5700 srv - ok 14:12:10.0227 5700 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys 14:12:10.0274 5700 srv2 - ok 14:12:10.0321 5700 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys 14:12:10.0336 5700 srvnet - ok 14:12:10.0383 5700 SSDPSRV (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll 14:12:10.0399 5700 SSDPSRV - ok 14:12:10.0430 5700 SstpSvc (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll 14:12:10.0430 5700 SstpSvc - ok 14:12:10.0539 5700 stisvc (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll 14:12:10.0555 5700 stisvc - ok 14:12:10.0602 5700 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 14:12:10.0602 5700 swenum - ok 14:12:10.0680 5700 swprv (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll 14:12:10.0695 5700 swprv - ok 14:12:10.0726 5700 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 14:12:10.0742 5700 Symc8xx - ok 14:12:10.0773 5700 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 14:12:10.0773 5700 Sym_hi - ok 14:12:10.0789 5700 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 14:12:10.0789 5700 Sym_u3 - ok 14:12:10.0851 5700 SynTP (4c9bb4b3b9eac26211484c30b914c6dc) C:\Windows\system32\DRIVERS\SynTP.sys 14:12:10.0867 5700 SynTP - ok 14:12:10.0960 5700 SysMain (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll 14:12:10.0992 5700 SysMain - ok 14:12:11.0038 5700 TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll 14:12:11.0070 5700 TabletInputService - ok 14:12:11.0132 5700 TapiSrv (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll 14:12:11.0194 5700 TapiSrv - ok 14:12:11.0226 5700 TBS (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll 14:12:11.0241 5700 TBS - ok 14:12:11.0428 5700 Tcpip (27d470dabc77bc60d0a3b0e4deb6cb91) C:\Windows\system32\drivers\tcpip.sys 14:12:11.0460 5700 Tcpip - ok 14:12:11.0491 5700 Tcpip6 (27d470dabc77bc60d0a3b0e4deb6cb91) C:\Windows\system32\DRIVERS\tcpip.sys 14:12:11.0506 5700 Tcpip6 - ok 14:12:11.0569 5700 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys 14:12:11.0631 5700 tcpipreg - ok 14:12:11.0662 5700 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 14:12:11.0678 5700 TDPIPE - ok 14:12:11.0725 5700 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 14:12:11.0725 5700 TDTCP - ok 14:12:11.0787 5700 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys 14:12:11.0787 5700 tdx - ok 14:12:11.0850 5700 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys 14:12:11.0865 5700 TermDD - ok 14:12:11.0974 5700 TermService (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll 14:12:11.0990 5700 TermService - ok 14:12:12.0255 5700 Themes (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll 14:12:12.0271 5700 Themes - ok 14:12:12.0552 5700 THREADORDER (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll 14:12:12.0567 5700 THREADORDER - ok 14:12:13.0082 5700 TrkWks (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll 14:12:13.0129 5700 TrkWks - ok 14:12:13.0207 5700 TrueSight (f69641efdb19acb4753b0155f7fdeed5) c:\windows\system32\drivers\TrueSight.sys 14:12:13.0254 5700 TrueSight - ok 14:12:13.0675 5700 TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe 14:12:13.0675 5700 TrustedInstaller - ok 14:12:13.0815 5700 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 14:12:13.0815 5700 tssecsrv - ok 14:12:13.0862 5700 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 14:12:13.0862 5700 tunmp - ok 14:12:13.0924 5700 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys 14:12:13.0924 5700 tunnel - ok 14:12:13.0971 5700 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys 14:12:13.0971 5700 uagp35 - ok 14:12:14.0002 5700 UBHelper (f763e070843ee2803de1395002b42938) C:\Windows\system32\drivers\UBHelper.sys 14:12:14.0002 5700 UBHelper - ok 14:12:14.0080 5700 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys 14:12:14.0096 5700 udfs - ok 14:12:14.0158 5700 UI0Detect (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe 14:12:14.0158 5700 UI0Detect - ok 14:12:14.0236 5700 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys 14:12:14.0236 5700 uliagpkx - ok 14:12:14.0299 5700 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys 14:12:14.0424 5700 uliahci - ok 14:12:14.0548 5700 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 14:12:14.0595 5700 UlSata - ok 14:12:14.0626 5700 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 14:12:14.0720 5700 ulsata2 - ok 14:12:15.0328 5700 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 14:12:15.0344 5700 umbus - ok 14:12:15.0438 5700 upnphost (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll 14:12:15.0469 5700 upnphost - ok 14:12:15.0531 5700 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys 14:12:15.0594 5700 usbaudio - ok 14:12:15.0625 5700 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 14:12:15.0640 5700 usbccgp - ok 14:12:15.0672 5700 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 14:12:15.0703 5700 usbcir - ok 14:12:15.0750 5700 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys 14:12:15.0750 5700 usbehci - ok 14:12:15.0921 5700 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys 14:12:15.0984 5700 usbhub - ok 14:12:16.0015 5700 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys 14:12:16.0030 5700 usbohci - ok 14:12:16.0062 5700 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys 14:12:16.0062 5700 usbprint - ok 14:12:16.0124 5700 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys 14:12:16.0124 5700 usbscan - ok 14:12:16.0171 5700 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS 14:12:16.0171 5700 USBSTOR - ok 14:12:16.0202 5700 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys 14:12:16.0218 5700 usbuhci - ok 14:12:16.0249 5700 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys 14:12:16.0264 5700 usbvideo - ok 14:12:16.0311 5700 UxSms (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll 14:12:16.0327 5700 UxSms - ok 14:12:16.0420 5700 vds (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe 14:12:16.0452 5700 vds - ok 14:12:16.0483 5700 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys 14:12:16.0483 5700 vga - ok 14:12:16.0514 5700 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 14:12:16.0514 5700 VgaSave - ok 14:12:16.0545 5700 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys 14:12:16.0545 5700 viaagp - ok 14:12:16.0592 5700 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys 14:12:16.0592 5700 ViaC7 - ok 14:12:16.0623 5700 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys 14:12:16.0623 5700 viaide - ok 14:12:16.0654 5700 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 14:12:16.0654 5700 volmgr - ok 14:12:17.0247 5700 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys 14:12:17.0263 5700 volmgrx - ok 14:12:17.0325 5700 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys 14:12:17.0341 5700 volsnap - ok 14:12:17.0403 5700 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys 14:12:17.0419 5700 vsmraid - ok 14:12:17.0575 5700 VSS (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe 14:12:17.0606 5700 VSS - ok 14:12:17.0668 5700 W32Time (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll 14:12:17.0684 5700 W32Time - ok 14:12:17.0746 5700 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 14:12:17.0746 5700 WacomPen - ok 14:12:17.0793 5700 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 14:12:17.0793 5700 Wanarp - ok 14:12:17.0809 5700 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 14:12:17.0809 5700 Wanarpv6 - ok 14:12:17.0871 5700 wcncsvc (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll 14:12:17.0887 5700 wcncsvc - ok 14:12:17.0934 5700 WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll 14:12:17.0934 5700 WcsPlugInService - ok 14:12:17.0965 5700 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys 14:12:17.0965 5700 Wd - ok 14:12:18.0027 5700 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 14:12:18.0058 5700 Wdf01000 - ok 14:12:18.0090 5700 WdiServiceHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll 14:12:18.0105 5700 WdiServiceHost - ok 14:12:18.0121 5700 WdiSystemHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll 14:12:18.0121 5700 WdiSystemHost - ok 14:12:18.0199 5700 WebClient (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll 14:12:18.0214 5700 WebClient - ok 14:12:18.0308 5700 Wecsvc (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll 14:12:18.0339 5700 Wecsvc - ok 14:12:18.0370 5700 wercplsupport (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll 14:12:18.0386 5700 wercplsupport - ok 14:12:18.0448 5700 WerSvc (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll 14:12:18.0464 5700 WerSvc - ok 14:12:18.0542 5700 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS 14:12:18.0573 5700 winachsf - ok 14:12:18.0667 5700 WinDefend (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll 14:12:18.0698 5700 WinDefend - ok 14:12:18.0745 5700 WinHttpAutoProxySvc - ok 14:12:18.0838 5700 Winmgmt (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll 14:12:18.0854 5700 Winmgmt - ok 14:12:19.0026 5700 WinRM (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll 14:12:19.0072 5700 WinRM - ok 14:12:19.0197 5700 Wlansvc (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll 14:12:19.0213 5700 Wlansvc - ok 14:12:19.0291 5700 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys 14:12:19.0291 5700 WmiAcpi - ok 14:12:19.0431 5700 wmiApSrv (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe 14:12:19.0447 5700 wmiApSrv - ok 14:12:19.0618 5700 WMPNetworkSvc (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe 14:12:19.0650 5700 WMPNetworkSvc - ok 14:12:19.0681 5700 WPCSvc (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll 14:12:19.0696 5700 WPCSvc - ok 14:12:19.0743 5700 WPDBusEnum (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll 14:12:19.0759 5700 WPDBusEnum - ok 14:12:19.0837 5700 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys 14:12:19.0899 5700 WpdUsb - ok 14:12:20.0133 5700 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 14:12:20.0164 5700 WPFFontCache_v0400 - ok 14:12:20.0196 5700 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 14:12:20.0196 5700 ws2ifsl - ok 14:12:20.0242 5700 wscsvc (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\system32\wscsvc.dll 14:12:20.0274 5700 wscsvc - ok 14:12:20.0274 5700 WSearch - ok 14:12:20.0554 5700 wuauserv (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll 14:12:20.0632 5700 wuauserv - ok 14:12:20.0820 5700 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 14:12:20.0820 5700 WUDFRd - ok 14:12:20.0898 5700 wudfsvc (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll 14:12:20.0913 5700 wudfsvc - ok 14:12:20.0991 5700 yukonwlh (3e1c915c6291ab5d1cfca680e1bd6bad) C:\Windows\system32\DRIVERS\yk60x86.sys 14:12:21.0054 5700 yukonwlh - ok 14:12:21.0085 5700 MBR (0x1B8) (6fc6f9186c07bca94e140f63bfe6e9b4) \Device\Harddisk0\DR0 14:12:26.0077 5700 \Device\Harddisk0\DR0 - ok 14:12:26.0592 5700 Boot (0x1200) (dd7135c8c40ba84eeecd3600268e932e) \Device\Harddisk0\DR0\Partition0 14:12:26.0592 5700 \Device\Harddisk0\DR0\Partition0 - ok 14:12:26.0623 5700 Boot (0x1200) (44cc9adfe5beddbea61922cfb7321598) \Device\Harddisk0\DR0\Partition1 14:12:26.0638 5700 \Device\Harddisk0\DR0\Partition1 - ok 14:12:26.0638 5700 ============================================================ 14:12:26.0638 5700 Scan finished 14:12:26.0638 5700 ============================================================ 14:12:26.0654 5328 Detected object count: 0 14:12:26.0654 5328 Actual detected object count: 0 14:12:57.0058 4596 Deinitialize success

Wow i just realized I attached the log and didn't paste it, that's strike two I guess..... ComboFix 12-06-12.01 - Owner 06/12/2012 15:26:07.2.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1976.1194 [GMT -4:00] Running from: c:\users\Owner\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Resident AV is active . . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\SwSys1.bmp c:\windows\SwSys2.bmp . Infected copy of c:\windows\system32\Services.exe was found and disinfected Restored copy from - c:\windows\ERDNT\cache\services.exe . . ((((((((((((((((((((((((( Files Created from 2012-05-12 to 2012-06-12 ))))))))))))))))))))))))))))))) . . 2012-06-12 19:41 . 2012-06-12 19:41 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-06-12 19:41 . 2012-06-12 19:41 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-08 20:05 . 2012-06-08 20:06 -------- d-----w- C:\FRST 2012-06-08 16:09 . 2012-06-08 16:09 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-06-08 16:09 . 2012-06-08 16:09 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-06-08 02:25 . 2012-06-08 02:25 -------- d-----w- c:\users\Owner\SyncFolder 2012-06-08 02:24 . 2012-06-08 02:36 -------- d-----w- c:\program files\MyPC Backup 2012-06-05 17:57 . 2012-06-05 17:57 -------- d-----w- c:\programdata\HitmanPro 2012-06-05 17:57 . 2012-06-05 17:57 -------- d-----w- c:\program files\HitmanPro 2012-06-05 17:54 . 2012-06-05 17:54 111872 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2012-06-01 15:02 . 2012-06-01 15:02 -------- d-sh--w- c:\windows\system32\%APPDATA% 2012-05-22 16:53 . 2012-05-22 16:55 -------- d-----w- c:\programdata\Knowledge Adventure 2012-05-22 16:53 . 2012-05-22 16:53 -------- d-----w- c:\program files\Common Files\SWF Studio 2012-05-22 16:53 . 2012-05-22 16:53 -------- d-----w- c:\program files\JumpStart 2012-05-22 16:53 . 2012-05-22 16:53 -------- d-----w- c:\program files\Common Files\Knowledge Adventure . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-01 14:36 . 2012-04-03 17:43 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-06-01 14:36 . 2011-12-13 12:26 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-05-08 16:40 . 2012-06-01 11:32 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{156AFE6E-1D28-499A-89B7-FAC1497F2106}\mpengine.dll 2012-04-04 19:56 . 2011-04-18 17:33 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-03 08:16 . 2012-05-12 06:14 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-12 06:14 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-04-02 13:36 . 2012-05-12 06:14 2044928 ----a-w- c:\windows\system32\win32k.sys 2012-03-30 12:39 . 2012-05-12 06:15 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-03-20 23:28 . 2012-05-12 06:15 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys 2012-06-08 16:09 . 2011-05-17 15:37 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-06-17 16:40 . 2011-06-17 16:40 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-15 00:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off0] @="{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}" [HKEY_CLASSES_ROOT\CLSID\{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}] 2012-05-18 11:54 1070352 ----a-w- c:\program files\Workspace\offsyncext.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off1] @="{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}" [HKEY_CLASSES_ROOT\CLSID\{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}] 2012-05-18 11:54 1070352 ----a-w- c:\program files\Workspace\offsyncext.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-21 68856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "Starfield Updater"="c:\users\Owner\AppData\Local\Workspace\WorkspaceUpdate.exe" [2012-02-01 34496] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040] "RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456] "Skytel"="Skytel.exe" [2007-11-21 1826816] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-15 526896] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-06-17 30192] "Acer Assist Launcher"="c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568] "Acer Product Registration"="c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792] "EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2009-07-31 1626112] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 136216] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 171032] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2012-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 16:55] . 2012-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-09 16:55] . 2012-06-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2782296849-3073254760-3789230479-1000Core.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-05 02:47] . 2012-06-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2782296849-3073254760-3789230479-1000UA.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-05 02:47] . 2012-05-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-22 18:32] . 2012-06-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-22 18:32] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.mail.com/ mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp32&d=1008&m=aspire_5735 TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\y66jd7st.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.mail.com/ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . ShellIconOverlayIdentifiers-{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d} - (no file) HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-12 15:46 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(3684) c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll c:\program files\Workspace\offsyncext.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\agrsmsvc.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe c:\program files\Acer\Empowering Technology\Service\ETService.exe c:\program files\Workspace\offSyncService.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\McAfee\SiteAdvisor\McSACore.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\windows\system32\rundll32.exe c:\acer\Mobility Center\MobilityService.exe c:\program files\McAfee\MPF\MPFSrv.exe c:\program files\McAfee\MSK\MskSrver.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\windows\system32\wbem\unsecapp.exe c:\progra~1\mcafee.com\agent\mcagent.exe c:\windows\system32\igfxsrvc.exe c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe c:\windows\system32\WerCon.exe c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\progra~1\mcafee\msc\mcuimgr.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Completion time: 2012-06-12 15:54:36 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-12 19:53 ComboFix2.txt 2011-12-30 21:28 . Pre-Run: 11,382,685,696 bytes free Post-Run: 11,222,568,960 bytes free . - - End Of File - - 403BC589AD9C32F11833E9D5803BB957

Sorry I did not reply sooner, I was gone all weekend. I ran combo fix the log is attached. Malwarebytes scans come up clean and my computer is running fine. It looks like combofix detected and repaired one file. I forgot to disable macafee and it popped up with a registery change warning which I allowed. Thanks for all your help thus far! combofixlog.txt

Fix log below. Just ran malwarebytes and it came up clean. Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 08-06-2012 04 Ran by SYSTEM at 2012-06-08 15:07:27 Run:1 Running from H:\ ============================================== C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f} moved successfully. C:\Users\Owner\AppData\Local\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f} moved successfully. ==== End of Fixlog ====

Here is the farbar log. Malwarebytes is still detecting the same three infections today. Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 08-06-2012 04 Ran by SYSTEM at 08-06-2012 12:05:50 Running from H:\ Windows Vista Home Premium Service Pack 1 (X86) OS Language: English(US) The current controlset is ControlSet003 ========================== Registry (Whitelisted) ============= HKLM\...\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1049896 2008-04-25] (Synaptics, Inc.) HKLM\...\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [40048 2007-03-08] (Adobe Systems Incorporated) HKLM\...\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey [582992 2007-08-03] (McAfee, Inc.) HKLM\...\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [34040 2008-04-06] () HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x] HKLM\...\Run: [skytel] Skytel.exe [x] HKLM\...\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe [809480 2008-09-10] (Dritek System Inc.) HKLM\...\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [526896 2008-05-14] (Egis Incorporated) HKLM\...\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [409600 2008-06-11] (Acer Inc.) HKLM\...\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2011-06-17] (Google) HKLM\...\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe [1261568 2007-11-19] () HKLM\...\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup [3387392 2007-11-26] (Leader Technologies) HKLM\...\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.) HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [417792 2009-09-04] (Apple Inc.) HKLM\...\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe [1626112 2009-07-31] (Eastman Kodak Company) HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [136216 2010-08-25] (Intel Corporation) HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [171032 2010-08-25] (Intel Corporation) HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [170520 2010-08-25] (Intel Corporation) HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" [x] HKU\Owner\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [68856 2008-12-21] (Google Inc.) HKU\Owner\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation) HKU\Owner\...\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-08-04] (Google Inc.) HKU\Owner\...\Run: [starfield Updater] "C:\Users\Owner\AppData\Local\Workspace\workspaceupdate.exe" [34496 2012-02-01] () HKU\Owner\...\Policies\system: [LogonHoursAction] 2 HKU\Owner\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ================================ Services (Whitelisted) ================== 2 BUNAgentSvc; "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe" [16384 2008-03-03] (NewTech Infosystems, Inc.) 2 eDataSecurity Service; "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe" [500784 2008-05-14] (Egis Incorporated) 2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2008-03-21] () 2 Eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [21504 2008-01-20] (Microsoft Corporation) 2 File Backup; C:\Program Files\Workspace\offSyncService.exe [1188624 2012-02-21] (Starfield Technologies) 3 GoogleDesktopManager-051210-111108; "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [30192 2011-06-17] (Google) 2 Irmon; C:\Windows\System32\irmon.dll [17920 2006-11-02] (Microsoft Corporation) 2 McAfee SiteAdvisor Service; "C:\Program Files\McAfee\SiteAdvisor\McSACore.exe" [95200 2012-01-13] (McAfee, Inc.) 2 mcmscsvc; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [767976 2008-01-09] (McAfee, Inc.) 3 McODS; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [378184 2007-11-07] (McAfee, Inc.) 2 McShield; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [144704 2007-07-24] (McAfee, Inc.) 3 McSysmon; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [695624 2007-12-05] (McAfee, Inc.) 2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe -p [110592 2007-12-06] () 3 MozillaMaintenance; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [129976 2012-04-28] (Mozilla Foundation) 2 MpfService; "C:\Program Files\McAfee\MPF\MPFSrv.exe" [856864 2007-07-18] (McAfee, Inc.) 2 MSK80Service; "C:\Program Files\McAfee\MSK\MskSrver.exe" [23880 2007-11-26] (McAfee, Inc.) 4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [124240 2010-03-18] (Microsoft Corporation) 4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation) 4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation) 4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation) 2 NTIBackupSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [50424 2008-04-06] (NewTech InfoSystems, Inc.) 2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] () 2 Apache2.2; "c:\xampp\apache\bin\httpd.exe" -k runservice [x] 2 FileZilla Server; "c:\xampp\filezillaftp\filezillaserver.exe" [x] 2 McNASvc; "c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe" [x] 2 McProxy; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [x] 2 mysql; c:\xampp\mysql\bin\mysqld.exe --defaults-file=c:\xampp\mysql\bin\my.ini mysql [x] ========================== Drivers (Whitelisted) ============= 3 AgereSoftModem; C:\Windows\System32\DRIVERS\AGRSM.sys [1202560 2008-02-29] (Agere Systems) 3 DKbFltr; C:\Windows\System32\DRIVERS\DKbFltr.sys [21264 2006-11-02] (Dritek System Inc.) 2 int15; \??\C:\Windows\system32\drivers\int15.sys [15392 2008-03-21] (Acer, Inc.) 2 irda; C:\Windows\System32\DRIVERS\irda.sys [95744 2008-01-20] (Microsoft Corporation) 3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [79304 2007-11-22] (McAfee, Inc.) 3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [35240 2007-11-22] (McAfee, Inc.) 1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [201320 2007-11-22] (McAfee, Inc.) 3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [33832 2007-11-22] (McAfee, Inc.) 3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [40488 2007-12-02] (McAfee, Inc.) 1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [125728 2007-07-13] (McAfee, Inc.) 3 NSCIRDA; C:\Windows\System32\DRIVERS\nscirda.sys [30720 2008-01-20] (National Semiconductor Corporation) 3 NTIDrvr; C:\Windows\System32\DRIVERS\NTIDrvr.sys [14848 2008-01-30] (NewTech Infosystems, Inc.) 3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-08] (Microsoft Corporation) 0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [18992 2008-05-14] (Egis Incorporated) 2 PSDNServ; C:\Windows\System32\DRIVERS\PSDNServ.sys [16944 2008-05-14] (Egis Incorporated) 2 psdvdisk; C:\Windows\System32\DRIVERS\PSDVdisk.sys [60464 2008-05-14] (Egis Incorporated) 3 RTSTOR; C:\Windows\System32\drivers\RTSTOR.SYS [61440 2008-08-12] (Realtek Semiconductor Corp.) 3 TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [111872 2012-06-05] () 0 UBHelper; C:\Windows\System32\Drivers\UBHelper.sys [13824 2008-01-30] (NewTech Infosystems Corporation) 3 catchme; \??\C:\Users\Owner\AppData\Local\Temp\catchme.sys [x] 3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x] 3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x] 3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x] ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-06-08 12:05 - 2012-06-08 12:05 - 00000000 ____D C:\FRST 2012-06-08 08:01 - 2012-06-08 08:01 - 00008212 ____A C:\Windows\mfebcdata 2012-06-08 06:02 - 2012-06-08 06:02 - 00870790 ____A C:\Users\Owner\Desktop\FRST.exe 2012-06-07 20:02 - 2012-06-07 20:02 - 00015873 ____A C:\Users\Owner\Desktop\Attach.txt 2012-06-07 20:02 - 2012-06-07 20:02 - 00012311 ____A C:\Users\Owner\Desktop\DDS.txt 2012-06-07 18:25 - 2012-06-07 18:25 - 00000000 ____D C:\Users\Owner\SyncFolder 2012-06-07 18:24 - 2012-06-07 18:36 - 00000000 ____D C:\Program Files\MyPC Backup 2012-06-07 14:32 - 2012-06-06 12:29 - 00965222 ____A C:\Windows\ntbtlog.txt 2012-06-07 04:56 - 2012-06-07 04:56 - 00002592 ____A C:\Users\Owner\Desktop\mbam-log-2012-06-07 (08-42-52).txt 2012-06-06 16:16 - 2012-06-06 16:16 - 00017957 ____A C:\Users\Owner\Desktop\virusus.jpg 2012-06-06 15:03 - 2012-06-07 16:25 - 2072891392 __ASH C:\hiberfil.sys 2012-06-06 07:14 - 2012-06-06 15:58 - 00000000 ___SD C:\32788R22FWJFW 2012-06-06 06:58 - 2012-06-06 07:01 - 00119126 ____A C:\TDSSKiller.2.7.36.0_06.06.2012_10.58.46_log.txt 2012-06-06 06:57 - 2012-06-06 06:58 - 00000348 ____A C:\TDSSKiller.2.6.25.0_06.06.2012_10.57.57_log.txt 2012-06-05 10:25 - 2012-06-05 10:26 - 00119126 ____A C:\TDSSKiller.2.7.38.0_05.06.2012_14.25.27_log.txt 2012-06-05 10:23 - 2012-06-05 10:24 - 00000348 ____A C:\TDSSKiller.2.6.25.0_05.06.2012_14.23.33_log.txt 2012-06-05 09:57 - 2012-06-05 09:57 - 00000000 ____D C:\Users\All Users\HitmanPro 2012-06-05 09:57 - 2012-06-05 09:57 - 00000000 ____D C:\Program Files\HitmanPro 2012-06-05 09:54 - 2012-06-05 09:54 - 00111872 ____A C:\Windows\System32\Drivers\TrueSight.sys 2012-06-05 09:54 - 2012-06-05 09:54 - 00000000 ____D C:\Users\Owner\Desktop\RK_Quarantine 2012-06-05 09:36 - 2012-06-05 09:36 - 02804712 ____A (Symantec Corporation) C:\Users\Owner\Desktop\NPE(1).exe 2012-06-01 07:02 - 2012-06-01 07:02 - 00000000 __SHD C:\Windows\System32\%APPDATA% 2012-05-25 19:08 - 2012-05-25 19:09 - 00145544 ____A C:\Windows\Minidump\Mini052512-01.dmp 2012-05-25 10:55 - 2012-05-25 10:55 - 00000000 ____D C:\Users\Owner\Desktop\web-design-marketing-for-small-business-4kq4l1jn3ang 2012-05-25 10:54 - 2012-05-25 10:54 - 20481575 ____A C:\Users\Owner\Desktop\web-design-marketing-for-small-business-4kq4l1jn3ang.zip 2012-05-24 05:19 - 2012-05-24 05:19 - 00173214 ____A C:\Users\Owner\Documents\hatching info charts.pdf 2012-05-22 08:53 - 2012-05-22 08:55 - 00000000 ____D C:\Users\All Users\Knowledge Adventure 2012-05-22 08:53 - 2012-05-22 08:53 - 00001880 ____A C:\Users\Public\Desktop\JumpStart Advanced Preschool.lnk 2012-05-22 08:53 - 2012-05-22 08:53 - 00000000 ____D C:\Program Files\JumpStart 2012-05-22 08:53 - 2012-05-22 08:53 - 00000000 ____D C:\Program Files\Common Files\SWF Studio 2012-05-22 08:53 - 2012-05-22 08:53 - 00000000 ____D C:\Program Files\Common Files\Knowledge Adventure 2012-05-16 10:25 - 2012-05-16 10:26 - 00013399 ____A C:\Users\Owner\Documents\Lollipops and Rainbows.docx 2012-05-11 22:15 - 2012-03-30 04:39 - 00905600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-05-11 22:15 - 2012-03-20 15:28 - 00053120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-05-11 22:15 - 2012-03-01 06:46 - 00219648 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll 2012-05-11 22:15 - 2012-03-01 06:46 - 00160768 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll 2012-05-11 22:15 - 2012-02-29 06:08 - 01172480 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll 2012-05-11 22:15 - 2012-02-29 05:44 - 00683008 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll 2012-05-11 22:15 - 2012-02-29 05:41 - 01069056 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2012-05-11 22:14 - 2012-04-03 00:16 - 03602816 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe 2012-05-11 22:14 - 2012-04-03 00:16 - 03550080 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-05-11 22:14 - 2012-04-02 05:36 - 02044928 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-05-10 07:21 - 2012-05-10 10:48 - 00011495 ____A C:\Users\Owner\Documents\rent notice may.docx ============ 3 Months Modified Files and Folders =============== 2012-06-08 08:02 - 2006-11-02 04:47 - 00003216 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2012-06-08 08:02 - 2006-11-02 04:47 - 00003216 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2012-06-08 08:01 - 2012-06-08 08:01 - 00008212 ____A C:\Windows\mfebcdata 2012-06-08 08:01 - 2008-10-22 20:01 - 01468445 ____A C:\Windows\WindowsUpdate.log 2012-06-08 08:01 - 2008-04-30 01:37 - 00029068 ____A C:\Windows\System32\Config.MPF 2012-06-08 08:01 - 2006-11-02 05:01 - 00032586 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2012-06-08 08:01 - 2006-11-02 05:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-06-08 07:34 - 2010-02-09 08:55 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2012-06-08 07:13 - 2011-08-04 18:47 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2782296849-3073254760-3789230479-1000UA.job 2012-06-08 06:03 - 2006-11-02 02:33 - 00791000 ____A C:\Windows\System32\PerfStringBackup.INI 2012-06-08 06:02 - 2012-06-08 06:02 - 00870790 ____A C:\Users\Owner\Desktop\FRST.exe 2012-06-08 04:34 - 2010-02-09 08:55 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2012-06-08 02:13 - 2011-08-04 18:47 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2782296849-3073254760-3789230479-1000Core.job 2012-06-07 20:14 - 2011-09-03 07:51 - 00002663 ____A C:\Users\Owner\Desktop\Microsoft Office OneNote 2007.lnk 2012-06-07 20:02 - 2012-06-07 20:02 - 00015873 ____A C:\Users\Owner\Desktop\Attach.txt 2012-06-07 20:02 - 2012-06-07 20:02 - 00012311 ____A C:\Users\Owner\Desktop\DDS.txt 2012-06-07 18:36 - 2012-06-07 18:24 - 00000000 ____D C:\Program Files\MyPC Backup 2012-06-07 18:36 - 2011-12-27 06:46 - 00000000 ___RD C:\Users\Owner\AppData\Local\MicrosoftNT 2012-06-07 18:25 - 2012-06-07 18:25 - 00000000 ____D C:\Users\Owner\SyncFolder 2012-06-07 18:25 - 2008-12-21 06:02 - 00000000 ____D C:\users\Owner 2012-06-07 16:26 - 2012-02-01 07:58 - 00056892 ____A C:\Users\Owner\Documents\WorkspaceUpdate.log 2012-06-07 16:25 - 2012-06-06 15:03 - 2072891392 __ASH C:\hiberfil.sys 2012-06-07 16:25 - 2012-02-01 07:58 - 00013766 ____A C:\Windows\offSyncService.log 2012-06-07 16:25 - 2008-10-22 20:14 - 00000000 ____A C:\Windows\System32\LogConfigTemp.xml 2012-06-07 16:25 - 2008-04-30 01:54 - 00000147 ____A C:\Windows\System32\agent.log 2012-06-07 16:25 - 2008-01-20 18:47 - 09774182 ____A C:\Windows\PFRO.log 2012-06-07 16:23 - 2011-12-20 10:29 - 00000000 ____D C:\Users\Owner\AppData\Local\NPE 2012-06-07 14:51 - 2012-02-01 07:55 - 00446446 ____A C:\Users\Owner\Documents\workspaceinstall.log 2012-06-07 05:04 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\schemas 2012-06-07 04:56 - 2012-06-07 04:56 - 00002592 ____A C:\Users\Owner\Desktop\mbam-log-2012-06-07 (08-42-52).txt 2012-06-07 04:42 - 2011-12-20 19:04 - 00000594 ____A C:\rkill.log 2012-06-06 16:16 - 2012-06-06 16:16 - 00017957 ____A C:\Users\Owner\Desktop\virusus.jpg 2012-06-06 15:58 - 2012-06-06 07:14 - 00000000 ___SD C:\32788R22FWJFW 2012-06-06 12:29 - 2012-06-07 14:32 - 00965222 ____A C:\Windows\ntbtlog.txt 2012-06-06 07:01 - 2012-06-06 06:58 - 00119126 ____A C:\TDSSKiller.2.7.36.0_06.06.2012_10.58.46_log.txt 2012-06-06 06:58 - 2012-06-06 06:57 - 00000348 ____A C:\TDSSKiller.2.6.25.0_06.06.2012_10.57.57_log.txt 2012-06-06 06:51 - 2006-11-02 04:37 - 00000000 ____D C:\Windows\Performance 2012-06-05 18:58 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\MSAgent 2012-06-05 18:18 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Cursors 2012-06-05 16:51 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Globalization 2012-06-05 13:14 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Branding 2012-06-05 13:13 - 2011-02-08 21:26 - 00000000 __SHD C:\Users\Owner\AppData\Local\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f} 2012-06-05 10:26 - 2012-06-05 10:25 - 00119126 ____A C:\TDSSKiller.2.7.38.0_05.06.2012_14.25.27_log.txt 2012-06-05 10:24 - 2012-06-05 10:23 - 00000348 ____A C:\TDSSKiller.2.6.25.0_05.06.2012_14.23.33_log.txt 2012-06-05 09:57 - 2012-06-05 09:57 - 00000000 ____D C:\Users\All Users\HitmanPro 2012-06-05 09:57 - 2012-06-05 09:57 - 00000000 ____D C:\Program Files\HitmanPro 2012-06-05 09:57 - 2011-12-20 10:32 - 07245976 ____A (SurfRight B.V.) C:\Users\Owner\Desktop\HitmanPro35.exe 2012-06-05 09:54 - 2012-06-05 09:54 - 00111872 ____A C:\Windows\System32\Drivers\TrueSight.sys 2012-06-05 09:54 - 2012-06-05 09:54 - 00000000 ____D C:\Users\Owner\Desktop\RK_Quarantine 2012-06-05 09:47 - 2010-01-22 04:56 - 00000000 ____D C:\Program Files\Mozilla Firefox 2012-06-05 09:36 - 2012-06-05 09:36 - 02804712 ____A (Symantec Corporation) C:\Users\Owner\Desktop\NPE(1).exe 2012-06-05 09:06 - 2010-03-23 09:55 - 00000000 ____D C:\Users\Owner\.gimp-2.6 2012-06-02 06:09 - 2008-12-31 09:49 - 00052736 ____A C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-06-01 16:30 - 2011-12-22 20:01 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps 2012-06-01 09:25 - 2011-02-09 05:07 - 00007680 ____A C:\Users\Owner\Desktop\mortgage.xls 2012-06-01 07:02 - 2012-06-01 07:02 - 00000000 __SHD C:\Windows\System32\%APPDATA% 2012-06-01 06:41 - 2008-04-29 23:25 - 00000000 ____D C:\Users\All Users\Adobe 2012-06-01 06:36 - 2012-04-03 09:43 - 00419488 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2012-06-01 06:36 - 2011-12-13 04:26 - 00070304 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2012-06-01 03:27 - 2008-04-30 01:36 - 00000348 ____A C:\Windows\Tasks\McQcTask.job 2012-05-31 19:07 - 2010-03-23 10:06 - 00000000 ____D C:\Users\Owner\AppData\Roaming\gtk-2.0 2012-05-25 19:09 - 2012-05-25 19:08 - 00145544 ____A C:\Windows\Minidump\Mini052512-01.dmp 2012-05-25 19:08 - 2011-04-21 05:16 - 170400765 ____A C:\Windows\MEMORY.DMP 2012-05-25 19:08 - 2009-07-21 21:01 - 00000000 ____D C:\Windows\Minidump 2012-05-25 10:55 - 2012-05-25 10:55 - 00000000 ____D C:\Users\Owner\Desktop\web-design-marketing-for-small-business-4kq4l1jn3ang 2012-05-25 10:54 - 2012-05-25 10:54 - 20481575 ____A C:\Users\Owner\Desktop\web-design-marketing-for-small-business-4kq4l1jn3ang.zip 2012-05-24 19:22 - 2012-02-01 07:55 - 00000000 ____D C:\Users\Owner\AppData\Local\Workspace 2012-05-24 05:19 - 2012-05-24 05:19 - 00173214 ____A C:\Users\Owner\Documents\hatching info charts.pdf 2012-05-23 16:59 - 2011-06-21 09:20 - 00010752 ____A C:\Users\Owner\Desktop\Birthdays.xls 2012-05-22 08:55 - 2012-05-22 08:53 - 00000000 ____D C:\Users\All Users\Knowledge Adventure 2012-05-22 08:53 - 2012-05-22 08:53 - 00001880 ____A C:\Users\Public\Desktop\JumpStart Advanced Preschool.lnk 2012-05-22 08:53 - 2012-05-22 08:53 - 00000000 ____D C:\Program Files\JumpStart 2012-05-22 08:53 - 2012-05-22 08:53 - 00000000 ____D C:\Program Files\Common Files\SWF Studio 2012-05-22 08:53 - 2012-05-22 08:53 - 00000000 ____D C:\Program Files\Common Files\Knowledge Adventure 2012-05-18 03:54 - 2012-02-01 07:58 - 00000150 ____A C:\Users\Owner\Documents\offSyncService.log 2012-05-18 03:54 - 2012-02-01 07:58 - 00000000 ____D C:\Program Files\Workspace 2012-05-18 03:54 - 2012-02-01 07:58 - 00000000 ____D C:\Program Files\Starfield 2012-05-16 10:43 - 2008-12-21 06:02 - 00000000 ____D C:\Program Files\Google 2012-05-16 10:26 - 2012-05-16 10:25 - 00013399 ____A C:\Users\Owner\Documents\Lollipops and Rainbows.docx 2012-05-16 10:08 - 2011-09-03 07:37 - 00002733 ____A C:\Users\Owner\Desktop\Microsoft Office Word 2007.lnk 2012-05-14 21:00 - 2008-04-30 01:36 - 00000356 ____A C:\Windows\Tasks\McDefragTask.job 2012-05-12 00:09 - 2006-11-02 03:18 - 00000000 ____D C:\Windows\Microsoft.NET 2012-05-11 23:47 - 2006-11-02 04:47 - 00413616 ____N C:\Windows\System32\FNTCACHE.DAT 2012-05-11 23:45 - 2011-04-18 09:33 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2012-05-11 23:43 - 2006-11-02 04:37 - 00000000 ____D C:\Program Files\Windows Journal 2012-05-11 23:19 - 2006-11-02 02:24 - 55656824 ____N (Microsoft Corporation) C:\Windows\System32\mrt.exe 2012-05-11 23:01 - 2006-11-02 04:37 - 00000000 ____D C:\Windows\System32\XPSViewer 2012-05-10 10:48 - 2012-05-10 07:21 - 00011495 ____A C:\Users\Owner\Documents\rent notice may.docx 2012-05-08 06:02 - 2010-05-24 04:04 - 00000000 ____D C:\Users\Owner\Documents\New House 2012-05-07 09:10 - 2011-07-18 05:18 - 00000000 ____D C:\Users\Owner\.bluefish 2012-05-01 03:31 - 2011-12-31 05:37 - 00000870 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-04-28 04:05 - 2012-04-28 04:05 - 00000000 ____D C:\Users\All Users\Mozilla 2012-04-28 04:05 - 2012-04-28 04:05 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2012-04-27 16:44 - 2012-04-27 16:44 - 00033755 ____A C:\Users\Owner\Documents\hatching calender.png 2012-04-27 16:43 - 2012-04-27 16:43 - 00141111 ____A C:\Users\Owner\Documents\hatching calendar back.png 2012-04-27 16:42 - 2012-04-27 16:42 - 00341452 ____A C:\Users\Owner\Documents\hatching calendar back.xcf 2012-04-27 13:22 - 2012-04-27 13:22 - 00144851 ____A C:\Users\Owner\Documents\hatching calender.xcf 2012-04-27 07:45 - 2012-04-27 07:45 - 00011410 ____A C:\Users\Owner\Documents\incubator plan.ods 2012-04-22 16:23 - 2012-04-19 06:15 - 00006885 ____A C:\Users\Owner\Desktop\chickens and vworker template.txt 2012-04-09 08:28 - 2012-04-09 08:28 - 00123693 ____A C:\Users\Owner\Downloads\20120404154416.pdf 2012-04-05 12:49 - 2012-04-05 12:49 - 00011240 ____A C:\Users\Owner\Documents\PO Box 249.docx 2012-04-05 05:26 - 2011-03-05 10:39 - 00000000 ___SD C:\Users\Owner\Documents\My Web Sites 2012-04-04 16:13 - 2011-06-08 12:28 - 00000000 ____D C:\Users\Owner\AppData\Roaming\FileZilla 2012-04-04 11:56 - 2011-04-18 09:33 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-04-03 00:16 - 2012-05-11 22:14 - 03602816 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe 2012-04-03 00:16 - 2012-05-11 22:14 - 03550080 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2012-04-02 05:36 - 2012-05-11 22:14 - 02044928 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-03-31 14:53 - 2012-03-31 14:53 - 00000000 ____D C:\Users\Owner\Documents\riley 2012-03-31 14:52 - 2012-03-29 06:18 - 00000000 ____D C:\Users\Owner\Documents\99 designs 2012-03-30 04:39 - 2012-05-11 22:15 - 00905600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-03-29 09:11 - 2012-03-29 09:11 - 00000000 ____D C:\Users\Owner\AppData\Roaming\inkscape 2012-03-29 09:11 - 2012-03-29 08:55 - 00000000 ____D C:\Program Files\Inkscape 2012-03-29 09:09 - 2012-03-29 09:09 - 00000768 ____A C:\Users\Public\Desktop\Inkscape.lnk 2012-03-23 05:59 - 2011-04-22 10:59 - 00001867 ____A C:\InstallHelper.log 2012-03-23 05:54 - 2012-03-23 05:54 - 00001874 ____A C:\Users\Public\Desktop\eBay Turbo Lister 2.lnk 2012-03-23 05:54 - 2011-04-22 10:57 - 00000000 ____D C:\Users\All Users\eBay 2012-03-22 05:51 - 2009-09-23 06:29 - 00000000 ____D C:\Users\Owner\AppData\Roaming\skypePM 2012-03-22 05:51 - 2009-09-23 06:27 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype 2012-03-20 15:28 - 2012-05-11 22:15 - 00053120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys 2012-03-18 07:03 - 2012-03-18 07:03 - 02482604 ____A C:\Users\Owner\Documents\zombie2target.xcf 2012-03-18 07:02 - 2012-03-18 07:02 - 02179002 ____A C:\Users\Owner\Documents\zombietarget.xcf 2012-03-16 04:31 - 2011-08-07 11:00 - 00009216 ____A C:\Users\Owner\Desktop\Gale invoice.xls 2012-03-15 07:01 - 2009-03-31 04:55 - 00000000 ____D C:\Users\Owner\Documents\other stuff 2012-03-12 07:34 - 2009-02-26 17:55 - 00000000 ____D C:\Users\Owner\Documents\LOGAN C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f} C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\@ C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\L C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U\00000001.@ C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U\80000000.@ C:\Windows\Installer\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U\800000cb.@ C:\Users\Owner\AppData\Local\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f} C:\Users\Owner\AppData\Local\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\@ C:\Users\Owner\AppData\Local\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\L C:\Users\Owner\AppData\Local\{cced714b-348e-29ba-f6a1-1cacf2a4ea0f}\U ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe [2009-08-20 11:54] - [2009-04-10 22:27] - 0279552 ____A (Microsoft Corporation) 8737764F4FD36D6808EE80578409C843 C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 22% Total physical RAM: 1976.12 MB Available physical RAM: 1540.35 MB Total Pagefile: 1734.46 MB Available Pagefile: 1603.98 MB Total Virtual: 2047.88 MB Available Virtual: 1974.32 MB ======================= Partitions ========================= 1 Drive c: (ACER) (Fixed) (Total:69.65 GB) (Free:9.92 GB) NTFS ==>[Drive with boot components (obtained from BCD)] 2 Drive d: (DATA) (Fixed) (Total:69.64 GB) (Free:69.55 GB) NTFS 4 Drive f: (PQSERVICE) (Fixed) (Total:9.76 GB) (Free:1.62 GB) FAT32 6 Drive h: () (Removable) (Total:3.73 GB) (Free:2.9 GB) FAT32 7 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ---------- ------- ------- --- --- Disk 0 Online 149 GB 0 B Disk 1 No Media 0 B 0 B Disk 2 Online 3824 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 OEM 10 GB 1024 KB Partition 2 Primary 70 GB 10 GB Partition 3 Primary 70 GB 79 GB ====================================================================================================== Disk: 0 Partition 1 Type : 27 Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 5 F PQSERVICE FAT32 Partition 10 GB Healthy Hidden ====================================================================================================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 C ACER NTFS Partition 70 GB Healthy ====================================================================================================== Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 D DATA NTFS Partition 70 GB Healthy ====================================================================================================== Partitions of Disk 2: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 3820 MB 4032 KB ====================================================================================================== Disk: 2 Partition 1 Type : 0C Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 4 H FAT32 Removable 3820 MB Healthy ====================================================================================================== ========================================================== Last Boot: 2012-06-08 04:34 ======================= End Of Log ==========================

Malwarebytes keeps detecting three infections: Trojan.Small, Trojan.Sirefef and Rootkit.0Access but after I click remove, restart the computer, and scan again, they keep coming back. I'm at a loss. Norton Power eraser says services.exe in infected and I have to reinstall WIndows. God I hope not..... DDS, Attach and Malwarebytes log attached Attach.txt DDS.txt mbam-log-2012-06-07 (08-42-52).txt