Jump to content

jvreynol

Members
 View Profile  See their activity

  • Posts

    6

  • Joined

  • Last visited

 Content Type 

Posts posted by jvreynol

    Ad network traffic, slow internet connection

    in Resolved Malware Removal Logs

    Posted

    Hello:

    Here's the latest Combofix.txt log...

    =============================

    ComboFix 12-07-08.03 - Jim 07/09/2012 21:02:06.3.1 - x86

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1756 [GMT -4:00]

    Running from: c:\documents and settings\Jim\Desktop\ComboFix.exe

    Command switches used :: c:\documents and settings\Jim\Desktop\CFScript.txt

    AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

    FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-06-10 to 2012-07-10 )))))))))))))))))))))))))))))))

    .

    .

    2012-07-09 16:18 . 2012-07-09 16:18 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{CAA97406-A117-4F26-BFBC-0011A665FADD}\offreg.dll

    2012-07-07 14:34 . 2012-05-11 14:42 521728 ------w- c:\windows\system32\dllcache\jsdbgui.dll

    2012-07-07 14:33 . 2012-01-11 19:06 3072 ------w- c:\windows\system32\iacenc.dll

    2012-07-07 14:33 . 2012-01-11 19:06 3072 ------w- c:\windows\system32\dllcache\iacenc.dll

    2012-07-06 06:09 . 2012-05-31 03:41 6762896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{CAA97406-A117-4F26-BFBC-0011A665FADD}\mpengine.dll

    2012-07-06 02:52 . 2012-06-02 20:19 45080 ----a-w- c:\windows\system32\wups2.dll

    2012-07-06 02:48 . 2012-07-07 13:33 -------- d-----w- C:\TDSSKiller_Quarantine

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-06-04 22:35 . 2004-08-13 06:41 210968 ----a-w- c:\windows\system32\wuweb.dll

    2012-06-04 22:35 . 2009-08-07 00:23 222448 ----a-w- c:\windows\system32\muweb.dll

    2012-06-02 20:19 . 2007-06-19 01:59 22040 ----a-w- c:\windows\system32\wucltui.dll.mui

    2012-06-02 20:19 . 2007-06-19 01:59 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

    2012-06-02 20:19 . 2004-08-13 06:41 329240 ----a-w- c:\windows\system32\wucltui.dll

    2012-06-02 20:19 . 2004-08-13 06:41 219160 ----a-w- c:\windows\system32\wuaucpl.cpl

    2012-06-02 20:19 . 2004-08-13 06:41 35864 ----a-w- c:\windows\system32\wups.dll

    2012-06-02 20:19 . 2004-02-26 00:35 15384 ----a-w- c:\windows\system32\wuapi.dll.mui

    2012-06-02 20:19 . 2003-07-30 13:00 97304 ----a-w- c:\windows\system32\cdm.dll

    2012-06-02 20:19 . 2003-07-30 13:00 53784 ----a-w- c:\windows\system32\wuauclt.exe

    2012-06-02 20:19 . 2007-06-19 01:59 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui

    2012-06-02 20:19 . 2004-08-13 06:41 577048 ----a-w- c:\windows\system32\wuapi.dll

    2012-06-02 20:19 . 2003-07-30 13:00 1933848 ----a-w- c:\windows\system32\wuaueng.dll

    2012-05-31 13:22 . 2003-03-20 22:18 599040 ----a-w- c:\windows\system32\crypt32.dll

    2012-05-31 03:41 . 2006-04-01 01:54 6762896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

    2012-05-16 15:08 . 2004-02-06 22:05 916992 ----a-w- c:\windows\system32\wininet.dll

    2012-05-15 13:20 . 2003-07-30 13:00 1863168 ----a-w- c:\windows\system32\win32k.sys

    2012-05-11 14:42 . 2003-07-30 13:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

    2012-05-11 14:42 . 2003-07-30 13:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

    2012-05-11 11:38 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec

    2012-05-04 13:16 . 1980-01-01 06:00 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-05-04 12:32 . 1980-01-01 06:00 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe

    2012-05-02 13:46 . 2003-07-30 13:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

    .

    .

    ((((((((((((((((((((((((((((( SnapShot@2012-07-07_14.14.10 )))))))))))))))))))))))))))))))))))))))))

    .

    + 2012-07-09 12:27 . 2012-07-09 12:27 16384 c:\windows\Temp\Perflib_Perfdata_c0.dat

    + 2012-07-09 02:18 . 2012-07-09 02:18 16384 c:\windows\Temp\Perflib_Perfdata_2b0.dat

    + 2012-07-09 02:18 . 2012-07-09 02:18 16384 c:\windows\Temp\Perflib_Perfdata_1b4.dat

    + 2003-07-30 13:00 . 2012-05-11 14:42 67072 c:\windows\SYSTEM32\mshtmled.dll

    + 2006-11-08 02:03 . 2012-05-11 14:42 55296 c:\windows\SYSTEM32\msfeedsbs.dll

    - 2006-11-08 02:03 . 2011-11-04 19:20 55296 c:\windows\SYSTEM32\msfeedsbs.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 25600 c:\windows\SYSTEM32\jsproxy.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 25600 c:\windows\SYSTEM32\jsproxy.dll

    + 2009-07-15 10:31 . 2012-05-11 14:42 12800 c:\windows\SYSTEM32\DLLCACHE\xpshims.dll

    - 2009-07-15 10:31 . 2011-11-04 19:20 12800 c:\windows\SYSTEM32\DLLCACHE\xpshims.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 67072 c:\windows\SYSTEM32\DLLCACHE\mshtmled.dll

    + 2007-05-09 01:20 . 2012-05-11 14:42 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll

    - 2007-05-09 01:20 . 2011-11-04 19:20 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 43520 c:\windows\SYSTEM32\DLLCACHE\licmgr10.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 43520 c:\windows\SYSTEM32\DLLCACHE\licmgr10.dll

    - 2006-05-10 05:25 . 2011-11-04 19:20 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll

    + 2006-05-10 05:25 . 2012-05-11 14:42 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll

    - 2012-07-03 01:41 . 2010-07-05 13:15 26488 c:\windows\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\spcustom.dll

    - 2012-07-03 01:41 . 2010-07-05 13:15 17272 c:\windows\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\spmsg.dll

    - 2012-07-03 01:49 . 2010-07-05 13:15 26488 c:\windows\SoftwareDistribution\Download\a125f3c2923de81c1d8e6a190c228a16\update\spcustom.dll

    - 2012-07-03 01:49 . 2010-07-05 13:15 17272 c:\windows\SoftwareDistribution\Download\a125f3c2923de81c1d8e6a190c228a16\spmsg.dll

    - 2012-07-03 01:50 . 2012-05-15 13:56 30208 c:\windows\SoftwareDistribution\Download\90f2fbbd424fa4d711d022ca4977bb25\update\w32ksign.dll

    - 2012-07-03 01:50 . 2010-07-05 13:15 26488 c:\windows\SoftwareDistribution\Download\90f2fbbd424fa4d711d022ca4977bb25\update\spcustom.dll

    - 2012-07-03 01:50 . 2010-07-05 13:15 17272 c:\windows\SoftwareDistribution\Download\90f2fbbd424fa4d711d022ca4977bb25\spmsg.dll

    - 2012-07-03 01:42 . 2012-04-11 13:53 30208 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\update\w32ksign.dll

    - 2012-07-03 01:42 . 2010-07-05 13:15 26488 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\update\spcustom.dll

    - 2012-07-03 01:42 . 2012-04-11 13:53 16896 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\update\mpsyschk.dll

    - 2012-07-03 01:42 . 2010-07-05 13:15 17272 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\spmsg.dll

    - 2012-07-03 01:49 . 2010-07-05 13:15 26488 c:\windows\SoftwareDistribution\Download\08dc6fdd6e5cdbc939c4d8b98c94c9fd\update\spcustom.dll

    - 2012-07-03 01:49 . 2012-05-05 03:16 16896 c:\windows\SoftwareDistribution\Download\08dc6fdd6e5cdbc939c4d8b98c94c9fd\update\mpsyschk.dll

    - 2012-07-03 01:49 . 2010-07-05 13:15 17272 c:\windows\SoftwareDistribution\Download\08dc6fdd6e5cdbc939c4d8b98c94c9fd\spmsg.dll

    + 2002-01-29 07:47 . 2012-04-26 12:28 12288 c:\windows\Microsoft.NET\Framework\v1.0.3705\zh-CHT\System.Drawing.Resources.dll

    + 2002-01-29 07:47 . 2012-04-26 12:21 12288 c:\windows\Microsoft.NET\Framework\v1.0.3705\zh-CHS\System.Drawing.Resources.dll

    - 2002-06-18 04:10 . 2011-07-05 20:46 86016 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorld.dll

    + 2002-06-18 04:10 . 2012-01-13 21:03 86016 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorld.dll

    + 2002-06-18 04:10 . 2012-01-13 21:03 73728 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorie.dll

    - 2002-06-18 04:10 . 2011-07-05 20:46 73728 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorie.dll

    + 2002-01-29 07:46 . 2012-04-26 12:27 13824 c:\windows\Microsoft.NET\Framework\v1.0.3705\KO\System.Drawing.Resources.dll

    + 2002-01-25 13:02 . 2012-04-26 12:29 24576 c:\windows\Microsoft.NET\Framework\v1.0.3705\JA\System.Drawing.Resources.dll

    - 2002-01-25 13:02 . 2002-01-25 13:02 24576 c:\windows\Microsoft.NET\Framework\v1.0.3705\JA\System.Drawing.Resources.dll

    + 2002-02-18 19:30 . 2012-04-26 12:29 13312 c:\windows\Microsoft.NET\Framework\v1.0.3705\IT\System.Drawing.Resources.dll

    + 2002-02-18 21:05 . 2012-04-26 12:30 13824 c:\windows\Microsoft.NET\Framework\v1.0.3705\FR\System.Drawing.Resources.dll

    + 2002-02-14 12:15 . 2012-04-26 12:21 13312 c:\windows\Microsoft.NET\Framework\v1.0.3705\ES\System.Drawing.Resources.dll

    + 2002-02-23 04:27 . 2012-04-26 12:27 13312 c:\windows\Microsoft.NET\Framework\v1.0.3705\DE\System.Drawing.Resources.dll

    + 2002-06-21 23:31 . 2012-01-13 21:54 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe

    - 2002-06-21 23:31 . 2011-07-06 14:57 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe

    - 2002-06-21 23:31 . 2011-07-06 14:57 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_state.exe

    + 2002-06-21 23:31 . 2012-01-13 21:54 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_state.exe

    + 2012-07-07 14:41 . 2011-11-04 19:20 12800 c:\windows\ie8updates\KB2699988-IE8\xpshims.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 66560 c:\windows\ie8updates\KB2699988-IE8\mshtmled.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 55296 c:\windows\ie8updates\KB2699988-IE8\msfeedsbs.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 43520 c:\windows\ie8updates\KB2699988-IE8\licmgr10.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 25600 c:\windows\ie8updates\KB2699988-IE8\jsproxy.dll

    + 2012-07-07 14:37 . 2012-07-07 14:37 90112 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Drawing.Design\1.0.3300.0__b03f5f7f11d50a3a_45d7c3e0\System.Drawing.Design.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 90112 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Drawing.Design\1.0.3300.0__b03f5f7f11d50a3a_1df2e61e\System.Drawing.Design.dll

    + 2012-07-07 14:36 . 2012-07-07 14:36 61440 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\CustomMarshalers\1.0.3300.0__b03f5f7f11d50a3a_faaf3c27\CustomMarshalers.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 12288 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_zh-CHT_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 12288 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_zh-CHS_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 13824 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_ko_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 24576 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_ja_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    - 2003-08-08 19:42 . 2003-08-08 19:42 24576 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_ja_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:38 . 2012-07-07 14:38 13312 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_it_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 13824 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_fr_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 13312 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_es_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 13312 c:\windows\ASSEMBLY\GAC\System.Drawing.resources\1.0.3300.0_de_b03f5f7f11d50a3a\System.Drawing.Resources.dll

    + 2002-06-12 11:54 . 2012-01-17 05:19 8192 c:\windows\Microsoft.NET\Framework\v1.0.3705\IEExec.exe

    - 2002-06-12 11:54 . 2011-07-12 23:05 8192 c:\windows\Microsoft.NET\Framework\v1.0.3705\IEExec.exe

    - 2003-07-30 13:00 . 2009-12-24 06:59 177664 c:\windows\SYSTEM32\wintrust.dll

    + 2003-07-30 13:00 . 2012-02-29 14:10 177664 c:\windows\SYSTEM32\wintrust.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 105984 c:\windows\SYSTEM32\url.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 105984 c:\windows\SYSTEM32\url.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 206848 c:\windows\SYSTEM32\occache.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 206848 c:\windows\SYSTEM32\occache.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 611840 c:\windows\SYSTEM32\mstime.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 611840 c:\windows\SYSTEM32\mstime.dll

    + 2006-11-08 02:03 . 2012-05-11 14:42 629760 c:\windows\SYSTEM32\msfeeds.dll

    + 2003-07-30 13:00 . 2012-02-29 14:10 148480 c:\windows\SYSTEM32\imagehlp.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 184320 c:\windows\SYSTEM32\iepeers.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 184320 c:\windows\SYSTEM32\iepeers.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 387584 c:\windows\SYSTEM32\iedkcs32.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 387584 c:\windows\SYSTEM32\iedkcs32.dll

    - 2003-07-30 13:00 . 2011-11-04 11:24 174080 c:\windows\SYSTEM32\ie4uinit.exe

    + 2003-07-30 13:00 . 2012-05-11 11:38 174080 c:\windows\SYSTEM32\ie4uinit.exe

    - 2003-08-08 21:27 . 2012-05-08 22:00 335464 c:\windows\SYSTEM32\FNTCACHE.DAT

    + 2003-08-08 21:27 . 2012-07-07 16:06 335464 c:\windows\SYSTEM32\FNTCACHE.DAT

    - 2009-12-24 06:59 . 2009-12-24 06:59 177664 c:\windows\SYSTEM32\DLLCACHE\wintrust.dll

    + 2009-12-24 06:59 . 2012-02-29 14:10 177664 c:\windows\SYSTEM32\DLLCACHE\wintrust.dll

    + 2004-02-06 22:05 . 2012-05-16 15:08 916992 c:\windows\SYSTEM32\DLLCACHE\wininet.dll

    - 2004-02-06 22:05 . 2011-11-04 19:20 916992 c:\windows\SYSTEM32\DLLCACHE\wininet.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 105984 c:\windows\SYSTEM32\DLLCACHE\url.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 105984 c:\windows\SYSTEM32\DLLCACHE\url.dll

    - 2011-08-11 00:15 . 2011-06-24 14:10 139656 c:\windows\SYSTEM32\DLLCACHE\rdpwd.sys

    + 2011-08-11 00:15 . 2012-05-02 13:46 139656 c:\windows\SYSTEM32\DLLCACHE\rdpwd.sys

    - 2006-10-17 17:04 . 2011-11-04 19:20 206848 c:\windows\SYSTEM32\DLLCACHE\occache.dll

    + 2006-10-17 17:04 . 2012-05-11 14:42 206848 c:\windows\SYSTEM32\DLLCACHE\occache.dll

    + 2006-05-10 05:25 . 2012-05-11 14:42 611840 c:\windows\SYSTEM32\DLLCACHE\mstime.dll

    - 2006-05-10 05:25 . 2011-11-04 19:20 611840 c:\windows\SYSTEM32\DLLCACHE\mstime.dll

    + 2007-05-09 01:20 . 2012-05-11 14:42 629760 c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll

    + 2012-02-29 14:10 . 2012-02-29 14:10 148480 c:\windows\SYSTEM32\DLLCACHE\imagehlp.dll

    - 2009-07-15 10:31 . 2011-11-04 19:20 247808 c:\windows\SYSTEM32\DLLCACHE\ieproxy.dll

    + 2009-07-15 10:31 . 2012-05-11 14:42 247808 c:\windows\SYSTEM32\DLLCACHE\ieproxy.dll

    + 2003-07-30 13:00 . 2012-05-11 14:42 184320 c:\windows\SYSTEM32\DLLCACHE\iepeers.dll

    - 2003-07-30 13:00 . 2011-11-04 19:20 184320 c:\windows\SYSTEM32\DLLCACHE\iepeers.dll

    + 2010-06-09 23:55 . 2012-05-11 14:42 743424 c:\windows\SYSTEM32\DLLCACHE\iedvtool.dll

    - 2010-06-09 23:55 . 2011-11-04 19:20 743424 c:\windows\SYSTEM32\DLLCACHE\iedvtool.dll

    + 2006-11-07 08:27 . 2012-05-11 14:42 387584 c:\windows\SYSTEM32\DLLCACHE\iedkcs32.dll

    - 2006-11-07 08:27 . 2011-11-04 19:20 387584 c:\windows\SYSTEM32\DLLCACHE\iedkcs32.dll

    - 2006-11-07 08:26 . 2011-11-04 11:24 174080 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe

    + 2006-11-07 08:26 . 2012-05-11 11:38 174080 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe

    - 2011-09-03 10:17 . 2011-09-28 07:06 599040 c:\windows\SYSTEM32\DLLCACHE\crypt32.dll

    + 2011-09-03 10:17 . 2012-05-31 13:22 599040 c:\windows\SYSTEM32\DLLCACHE\crypt32.dll

    - 2012-07-03 01:41 . 2010-07-05 13:16 382840 c:\windows\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\updspapi.dll

    - 2012-07-03 01:41 . 2010-07-05 13:15 755576 c:\windows\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\update\update.exe

    - 2012-07-03 01:41 . 2010-07-05 13:15 231288 c:\windows\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466\spuninst.exe

    - 2012-07-03 01:49 . 2010-07-05 13:16 382840 c:\windows\SoftwareDistribution\Download\a125f3c2923de81c1d8e6a190c228a16\update\updspapi.dll

    - 2012-07-03 01:49 . 2010-07-05 13:15 755576 c:\windows\SoftwareDistribution\Download\a125f3c2923de81c1d8e6a190c228a16\update\update.exe

    - 2012-07-03 01:49 . 2010-07-05 13:15 231288 c:\windows\SoftwareDistribution\Download\a125f3c2923de81c1d8e6a190c228a16\spuninst.exe

    - 2012-07-03 01:50 . 2010-07-05 13:16 382840 c:\windows\SoftwareDistribution\Download\90f2fbbd424fa4d711d022ca4977bb25\update\updspapi.dll

    - 2012-07-03 01:50 . 2010-07-05 13:15 755576 c:\windows\SoftwareDistribution\Download\90f2fbbd424fa4d711d022ca4977bb25\update\update.exe

    - 2012-07-03 01:50 . 2010-07-05 13:15 231288 c:\windows\SoftwareDistribution\Download\90f2fbbd424fa4d711d022ca4977bb25\spuninst.exe

    - 2012-07-03 01:42 . 2010-07-05 13:16 382840 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\update\updspapi.dll

    - 2012-07-03 01:42 . 2010-07-05 13:15 755576 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\update\update.exe

    - 2012-07-03 01:42 . 2010-07-05 13:15 231288 c:\windows\SoftwareDistribution\Download\888bd630a02581b550845dde5f47a0ee\spuninst.exe

    - 2012-07-03 01:49 . 2010-07-05 13:16 382840 c:\windows\SoftwareDistribution\Download\08dc6fdd6e5cdbc939c4d8b98c94c9fd\update\updspapi.dll

    - 2012-07-03 01:49 . 2010-07-05 13:15 755576 c:\windows\SoftwareDistribution\Download\08dc6fdd6e5cdbc939c4d8b98c94c9fd\update\update.exe

    - 2012-07-03 01:49 . 2010-07-05 13:15 231288 c:\windows\SoftwareDistribution\Download\08dc6fdd6e5cdbc939c4d8b98c94c9fd\spuninst.exe

    - 2002-06-12 11:55 . 2004-07-20 01:54 462848 c:\windows\Microsoft.NET\Framework\v1.0.3705\system.drawing.dll

    + 2002-06-12 11:55 . 2012-04-26 12:27 462848 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.Drawing.dll

    - 2002-06-12 03:02 . 2011-07-05 20:44 303104 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorjit.dll

    + 2002-06-12 03:02 . 2012-01-13 20:59 303104 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorjit.dll

    - 2002-06-21 23:31 . 2011-07-06 14:57 200704 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll

    + 2002-06-21 23:31 . 2012-01-13 21:54 200704 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 916992 c:\windows\ie8updates\KB2699988-IE8\wininet.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 105984 c:\windows\ie8updates\KB2699988-IE8\url.dll

    + 2012-07-07 14:41 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2699988-IE8\spuninst\updspapi.dll

    + 2012-07-07 14:41 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2699988-IE8\spuninst\spuninst.exe

    + 2012-07-07 14:41 . 2011-11-04 19:20 206848 c:\windows\ie8updates\KB2699988-IE8\occache.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 611840 c:\windows\ie8updates\KB2699988-IE8\mstime.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 602112 c:\windows\ie8updates\KB2699988-IE8\msfeeds.dll

    + 2012-07-07 14:41 . 2009-03-08 08:35 521216 c:\windows\ie8updates\KB2699988-IE8\jsdbgui.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 247808 c:\windows\ie8updates\KB2699988-IE8\ieproxy.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 184320 c:\windows\ie8updates\KB2699988-IE8\iepeers.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 743424 c:\windows\ie8updates\KB2699988-IE8\iedvtool.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 387584 c:\windows\ie8updates\KB2699988-IE8\iedkcs32.dll

    + 2012-07-07 14:41 . 2011-11-04 11:24 174080 c:\windows\ie8updates\KB2699988-IE8\ie4uinit.exe

    + 2012-07-07 14:39 . 2012-07-07 14:39 851968 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a_e66337af\System.Drawing.dll

    + 2012-07-07 14:37 . 2012-07-07 14:37 847872 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a_3b9338da\System.Drawing.dll

    + 2012-07-07 14:38 . 2012-07-07 14:38 462848 c:\windows\ASSEMBLY\GAC\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a\System.Drawing.dll

    - 2008-09-05 02:14 . 2008-09-05 02:14 462848 c:\windows\ASSEMBLY\GAC\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a\System.Drawing.dll

    + 2012-07-07 14:34 . 2012-02-09 15:43 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22791_x-ww_c8dff154\GdiPlus.dll

    + 2004-01-21 21:20 . 2012-05-11 14:42 1212416 c:\windows\SYSTEM32\urlmon.dll

    - 2004-01-21 21:20 . 2011-11-04 19:20 1212416 c:\windows\SYSTEM32\urlmon.dll

    + 2004-07-07 22:37 . 2012-05-11 14:42 6007808 c:\windows\SYSTEM32\mshtml.dll

    - 2006-10-17 16:57 . 2011-11-04 19:20 2000384 c:\windows\SYSTEM32\iertutil.dll

    + 2006-10-17 16:57 . 2012-05-11 14:42 2000384 c:\windows\SYSTEM32\iertutil.dll

    + 2008-10-14 20:07 . 2012-05-15 13:20 1863168 c:\windows\SYSTEM32\DLLCACHE\win32k.sys

    - 2004-01-21 21:20 . 2011-11-04 19:20 1212416 c:\windows\SYSTEM32\DLLCACHE\urlmon.dll

    + 2004-01-21 21:20 . 2012-05-11 14:42 1212416 c:\windows\SYSTEM32\DLLCACHE\urlmon.dll

    + 2008-10-14 20:07 . 2012-05-04 13:12 2192640 c:\windows\SYSTEM32\DLLCACHE\ntoskrnl.exe

    + 2008-10-14 20:07 . 2012-05-04 12:32 2026496 c:\windows\SYSTEM32\DLLCACHE\ntkrpamp.exe

    + 2008-10-14 20:07 . 2012-05-04 12:32 2069120 c:\windows\SYSTEM32\DLLCACHE\ntkrnlpa.exe

    + 2008-10-14 20:07 . 2012-05-04 13:16 2148352 c:\windows\SYSTEM32\DLLCACHE\ntkrnlmp.exe

    + 2004-07-07 22:37 . 2012-05-11 14:42 6007808 c:\windows\SYSTEM32\DLLCACHE\mshtml.dll

    + 2007-05-09 01:20 . 2012-05-11 14:42 2000384 c:\windows\SYSTEM32\DLLCACHE\iertutil.dll

    - 2007-05-09 01:20 . 2011-11-04 19:20 2000384 c:\windows\SYSTEM32\DLLCACHE\iertutil.dll

    - 2002-06-12 11:54 . 2004-07-20 01:54 2002944 c:\windows\Microsoft.NET\Framework\v1.0.3705\system.windows.forms.dll

    + 2002-06-12 11:54 . 2012-01-17 05:19 2002944 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.Windows.Forms.dll

    + 2002-06-12 11:53 . 2012-01-17 05:20 1200128 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.Web.dll

    - 2002-06-12 11:53 . 2011-07-12 23:04 1200128 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.Web.dll

    + 2002-06-12 11:55 . 2012-01-17 05:19 1179648 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.dll

    - 2002-06-12 11:55 . 2007-12-17 11:59 1179648 c:\windows\Microsoft.NET\Framework\v1.0.3705\system.dll

    + 2002-06-12 03:03 . 2012-01-13 20:59 2281472 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll

    - 2002-06-12 03:03 . 2011-07-05 20:45 2281472 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll

    + 2002-06-12 03:02 . 2012-01-13 20:59 2273280 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorsvr.dll

    + 2002-06-12 11:55 . 2012-01-17 05:19 1998848 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorlib.dll

    - 2002-06-12 11:55 . 2011-07-12 23:05 1998848 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorlib.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 1212416 c:\windows\ie8updates\KB2699988-IE8\urlmon.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 5978112 c:\windows\ie8updates\KB2699988-IE8\mshtml.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 2000384 c:\windows\ie8updates\KB2699988-IE8\iertutil.dll

    + 2008-10-14 20:07 . 2012-05-04 13:12 2192640 c:\windows\Driver Cache\I386\ntoskrnl.exe

    + 2008-10-14 20:07 . 2012-05-04 12:32 2026496 c:\windows\Driver Cache\I386\ntkrpamp.exe

    + 2008-10-14 20:07 . 2012-05-04 12:32 2069120 c:\windows\Driver Cache\I386\ntkrnlpa.exe

    + 2008-10-14 20:07 . 2012-05-04 13:16 2148352 c:\windows\Driver Cache\I386\ntkrnlmp.exe

    + 2012-07-07 14:36 . 2012-07-07 14:36 1855488 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System\1.0.3300.0__b77a5c561934e089_9d8fa910\System.dll

    + 2012-07-07 14:37 . 2012-07-07 14:37 2027520 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Xml\1.0.3300.0__b77a5c561934e089_e8884a34\System.Xml.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 2953216 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Windows.Forms\1.0.3300.0__b77a5c561934e089_e094bce8\System.Windows.Forms.dll

    + 2012-07-07 14:37 . 2012-07-07 14:37 2953216 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Windows.Forms\1.0.3300.0__b77a5c561934e089_bf7b4de4\System.Windows.Forms.dll

    + 2012-07-07 14:39 . 2012-07-07 14:39 1454080 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Design\1.0.3300.0__b03f5f7f11d50a3a_bd399941\System.Design.dll

    + 2012-07-07 14:36 . 2012-07-07 14:36 1454080 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\System.Design\1.0.3300.0__b03f5f7f11d50a3a_7cd32e56\System.Design.dll

    + 2012-07-07 14:36 . 2012-07-07 14:36 3301376 c:\windows\ASSEMBLY\NativeImages1_v1.0.3705\mscorlib\1.0.3300.0__b77a5c561934e089_5597fd86\mscorlib.dll

    + 2012-07-07 14:36 . 2012-07-07 14:36 1179648 c:\windows\ASSEMBLY\GAC\System\1.0.3300.0__b77a5c561934e089\System.dll

    - 2008-09-05 02:14 . 2008-09-05 02:14 1179648 c:\windows\ASSEMBLY\GAC\System\1.0.3300.0__b77a5c561934e089\System.dll

    - 2008-09-05 02:14 . 2008-09-05 02:14 2002944 c:\windows\ASSEMBLY\GAC\System.Windows.Forms\1.0.3300.0__b77a5c561934e089\System.Windows.Forms.dll

    + 2012-07-07 14:36 . 2012-07-07 14:36 2002944 c:\windows\ASSEMBLY\GAC\System.Windows.Forms\1.0.3300.0__b77a5c561934e089\System.Windows.Forms.dll

    - 2012-02-08 22:43 . 2012-02-08 22:43 1200128 c:\windows\ASSEMBLY\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll

    + 2012-07-07 14:36 . 2012-07-07 14:36 1200128 c:\windows\ASSEMBLY\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll

    + 2006-11-08 02:03 . 2012-05-12 00:12 11111424 c:\windows\SYSTEM32\ieframe.dll

    + 2007-05-09 01:20 . 2012-05-12 00:12 11111424 c:\windows\SYSTEM32\DLLCACHE\ieframe.dll

    + 2012-07-07 14:41 . 2011-11-04 19:20 11081728 c:\windows\ie8updates\KB2699988-IE8\ieframe.dll

    .

    -- Snapshot reset to current date --

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 68856]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ehTray"="c:\windows\ehome\ehtray.exe" [2008-04-14 50176]

    "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]

    "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]

    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-07 335872]

    "AsioReg"="CTASIO.DLL" [2003-02-20 110592]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]

    "Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-02-17 86102]

    "CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 49152]

    "CTDVDDet"="c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 45056]

    "tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2007-03-07 1773568]

    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-03 122939]

    "CTHelper"="CTHELPER.EXE" [2003-02-20 28672]

    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]

    "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-08 524288]

    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]

    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]

    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]

    .

    c:\documents and settings\Jim\Start Menu\Programs\Startup\

    GoZone iSync.lnk - c:\program files\GoZone\GoZone_iSync.exe [2010-3-26 431608]

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

    BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

    @="Service"

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

    backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk

    backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk

    backup=c:\windows\pss\Google Updater.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk

    backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk

    backup=c:\windows\pss\Service Manager.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^Jim^Start Menu^Programs^Startup^Webshots.lnk]

    path=c:\documents and settings\Jim\Start Menu\Programs\Startup\Webshots.lnk

    backup=c:\windows\pss\Webshots.lnkStartup

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

    2011-08-31 01:57 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    2012-01-16 22:22 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

    2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    2011-07-05 22:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]

    2006-05-08 09:17 81920 ----a-w- c:\progra~1\Sony\SONICS~1\SSAAD.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    2007-05-21 12:30 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

    2006-04-15 20:14 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]

    2003-08-19 06:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upromise Tray]

    2009-04-14 22:37 139264 ----a-w- c:\program files\Upromise\UpromiseTray.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upromise Update]

    2009-04-13 21:50 96136 ----a-w- c:\program files\Upromise\dca-ua.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

    "AOL ACS"=2 (0x2)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]

    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

    "EnableFirewall"= 0 (0x0)

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=

    "c:\\Program Files\\Support.com\\bin\\tgcmd.exe"=

    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

    "c:\\Program Files\\Savings Bond Wizard\\SBWizard.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

    "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

    "c:\\Program Files\\iTunes\\iTunes.exe"=

    .

    R0 SymDS;Symantec Data Store;c:\windows\SYSTEM32\DRIVERS\N360\0502010.003\symds.sys [4/23/2012 11:03 PM 340088]

    R0 SymEFA;Symantec Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\N360\0502010.003\symefa.sys [4/23/2012 11:03 PM 744568]

    R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20120619.001\BHDrvx86.sys [6/18/2012 8:01 PM 821920]

    R1 SymIRON;Symantec Iron Driver;c:\windows\SYSTEM32\DRIVERS\N360\0502010.003\ironx86.sys [4/23/2012 11:03 PM 136312]

    R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\5.2.1.3\ccsvchst.exe [4/23/2012 11:03 PM 130008]

    R2 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/2/2012 10:04 PM 106656]

    R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20120705.001\IDSXpx86.sys [7/5/2012 11:13 PM 369632]

    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/6/2009 5:57 PM 133104]

    S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

    S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/6/2009 5:57 PM 133104]

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-06-19 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]

    .

    2012-07-09 c:\windows\Tasks\GlaryInitialize.job

    - c:\program files\Glary Utilities\initialize.exe [2011-09-09 13:26]

    .

    2012-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc7170fa92ab76.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 21:56]

    .

    2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 21:56]

    .

    2012-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1093819779-2537581792-1553126955-1008Core.job

    - c:\documents and settings\Jim\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-07-07 14:27]

    .

    2012-07-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1093819779-2537581792-1553126955-1008UA.job

    - c:\documents and settings\Jim\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-07-07 14:27]

    .

    2012-07-09 c:\windows\Tasks\MP Scheduled Scan.job

    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]

    .

    2012-07-10 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

    - c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]

    .

    2004-10-19 c:\windows\Tasks\Symantec NetDetect.job

    - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-10-19 22:38]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = about:blank

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uInternet Connection Wizard,ShellNext = iexplore

    uInternet Settings,ProxyOverride = *.local

    uSearchAssistant = hxxp://www.google.com/ie

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

    Trusted Zone: kyw1060.com\www

    Trusted Zone: mcafee.com

    Trusted Zone: microsoft.com\*.windowsupdate

    Trusted Zone: phillies.com\www

    Trusted Zone: windowsupdate.com

    TCP: DhcpNameServer = 192.168.1.1

    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB

    DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab

    DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://69.126.199.53:81/activex/AMC.cab

    FF - ProfilePath - c:\documents and settings\Jim\Application Data\Mozilla\Firefox\Profiles\bl6vfl0c.default\

    FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

    FF - prefs.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - Ext: Symantec Intrusion Prevention: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn

    FF - user.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    .

    .

    **************************************************************************

    .

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2012-07-09 21:16

    Windows 5.1.2600 Service Pack 3 NTFS

    .

    scanning hidden processes ...

    .

    scanning hidden autostart entries ...

    .

    scanning hidden files ...

    .

    scan completed successfully

    hidden files: 0

    .

    **************************************************************************

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\N360]

    "ImagePath"="\"c:\program files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\5.2.1.3\diMaster.dll\" /prefetch:1"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-1093819779-2537581792-1553126955-1008\Software\Microsoft\SystemCertificates\AddressBook*]

    @Allowed: (Read) (RestrictedCode)

    @Allowed: (Read) (RestrictedCode)

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    .

    - - - - - - - > 'explorer.exe'(5788)

    c:\windows\system32\WININET.dll

    c:\windows\system32\ieframe.dll

    c:\windows\system32\webcheck.dll

    .

    Completion time: 2012-07-09 21:20:07

    ComboFix-quarantined-files.txt 2012-07-10 01:19

    .

    Pre-Run: 7,392,165,888 bytes free

    Post-Run: 7,366,688,768 bytes free

    .

    - - End Of File - - 9298674DE200920B69320342B6111242

    Ad network traffic, slow internet connection

    in Resolved Malware Removal Logs

    Posted

    OK. Completed step 1.

    Here's the combo fix log for step 2.

    ============================

    ComboFix 12-07-07.02 - Jim 07/07/2012 9:49.2.1 - x86

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1845 [GMT -4:00]

    Running from: c:\documents and settings\Jim\Desktop\ComboFix.exe

    AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

    FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\documents and settings\Jim\Application Data\PriceGong

    c:\documents and settings\Jim\Application Data\PriceGong\Data\1.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\a.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\b.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\c.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\d.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\e.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\f.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\g.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\h.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\i.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\J.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\k.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\l.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\m.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\mru.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\n.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\o.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\p.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\q.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\r.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\s.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\t.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\u.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\v.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\w.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\x.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\y.xml

    c:\documents and settings\Jim\Application Data\PriceGong\Data\z.xml

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-06-07 to 2012-07-07 )))))))))))))))))))))))))))))))

    .

    .

    2012-07-06 06:09 . 2012-05-31 03:41 6762896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{CAA97406-A117-4F26-BFBC-0011A665FADD}\mpengine.dll

    2012-07-06 02:52 . 2012-06-02 20:19 45080 ----a-w- c:\windows\system32\wups2.dll

    2012-07-06 02:48 . 2012-07-07 13:33 -------- d-----w- C:\TDSSKiller_Quarantine

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-06-04 22:35 . 2004-08-13 06:41 210968 ----a-w- c:\windows\system32\wuweb.dll

    2012-06-04 22:35 . 2009-08-07 00:23 222448 ----a-w- c:\windows\system32\muweb.dll

    2012-06-02 20:19 . 2007-06-19 01:59 22040 ----a-w- c:\windows\system32\wucltui.dll.mui

    2012-06-02 20:19 . 2007-06-19 01:59 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

    2012-06-02 20:19 . 2004-08-13 06:41 329240 ----a-w- c:\windows\system32\wucltui.dll

    2012-06-02 20:19 . 2004-08-13 06:41 219160 ----a-w- c:\windows\system32\wuaucpl.cpl

    2012-06-02 20:19 . 2004-08-13 06:41 35864 ----a-w- c:\windows\system32\wups.dll

    2012-06-02 20:19 . 2004-02-26 00:35 15384 ----a-w- c:\windows\system32\wuapi.dll.mui

    2012-06-02 20:19 . 2003-07-30 13:00 97304 ----a-w- c:\windows\system32\cdm.dll

    2012-06-02 20:19 . 2003-07-30 13:00 53784 ----a-w- c:\windows\system32\wuauclt.exe

    2012-06-02 20:19 . 2007-06-19 01:59 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui

    2012-06-02 20:19 . 2004-08-13 06:41 577048 ----a-w- c:\windows\system32\wuapi.dll

    2012-06-02 20:19 . 2003-07-30 13:00 1933848 ----a-w- c:\windows\system32\wuaueng.dll

    2012-05-31 03:41 . 2006-04-01 01:54 6762896 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 68856]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ehTray"="c:\windows\ehome\ehtray.exe" [2008-04-14 50176]

    "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 28672]

    "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]

    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-09-07 335872]

    "AsioReg"="CTASIO.DLL" [2003-02-20 110592]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]

    "Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-02-17 86102]

    "CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 49152]

    "CTDVDDet"="c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 45056]

    "tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2007-03-07 1773568]

    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-03 122939]

    "CTHelper"="CTHELPER.EXE" [2003-02-20 28672]

    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]

    "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-08 524288]

    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]

    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]

    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]

    .

    c:\documents and settings\Jim\Start Menu\Programs\Startup\

    GoZone iSync.lnk - c:\program files\GoZone\GoZone_iSync.exe [2010-3-26 431608]

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

    BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

    @="Service"

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

    backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk

    backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk

    backup=c:\windows\pss\Google Updater.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk

    backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk

    backup=c:\windows\pss\Service Manager.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^Jim^Start Menu^Programs^Startup^Webshots.lnk]

    path=c:\documents and settings\Jim\Start Menu\Programs\Startup\Webshots.lnk

    backup=c:\windows\pss\Webshots.lnkStartup

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

    2011-08-31 01:57 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    2012-01-16 22:22 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

    2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    2011-07-05 22:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]

    2006-05-08 09:17 81920 ----a-w- c:\progra~1\Sony\SONICS~1\SSAAD.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    2007-05-21 12:30 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

    2006-04-15 20:14 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]

    2003-08-19 06:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upromise Tray]

    2009-04-14 22:37 139264 ----a-w- c:\program files\Upromise\UpromiseTray.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upromise Update]

    2009-04-13 21:50 96136 ----a-w- c:\program files\Upromise\dca-ua.exe

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - 37158808

    *Deregistered* - 37158808

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-06-19 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]

    .

    2012-07-06 c:\windows\Tasks\GlaryInitialize.job

    - c:\program files\Glary Utilities\initialize.exe [2011-09-09 13:26]

    .

    2012-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc7170fa92ab76.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 21:56]

    .

    2012-07-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-06 21:56]

    .

    2012-07-06 c:\windows\Tasks\MP Scheduled Scan.job

    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]

    .

    2012-07-07 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

    - c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]

    .

    2004-10-19 c:\windows\Tasks\Symantec NetDetect.job

    - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-10-19 22:38]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = about:blank

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uInternet Connection Wizard,ShellNext = iexplore

    uInternet Settings,ProxyOverride = *.local

    uSearchAssistant = hxxp://www.google.com/ie

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

    Trusted Zone: kyw1060.com\www

    Trusted Zone: mcafee.com

    Trusted Zone: microsoft.com\*.windowsupdate

    Trusted Zone: phillies.com\www

    Trusted Zone: windowsupdate.com

    TCP: DhcpNameServer = 192.168.1.1

    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB

    DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab

    DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://69.126.199.53:81/activex/AMC.cab

    FF - ProfilePath - c:\documents and settings\Jim\Application Data\Mozilla\Firefox\Profiles\bl6vfl0c.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource=3&q={searchTerms}

    FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

    FF - prefs.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - Ext: Symantec Intrusion Prevention: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn

    FF - user.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - user.js: extensions.incredibar_i.newTab - false

    FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyoApz4U8&loc=IB_TB&i=26&search=

    FF - user.js: extensions.incredibar_i.id - 606540c60000000000000007e9484568

    FF - user.js: extensions.incredibar_i.hardId - 606540c60000000000000007e9484568

    FF - user.js: extensions.incredibar_i.instlDay - 15341

    FF - user.js: extensions.incredibar_i.vrsn - 1.5.3.27

    FF - user.js: extensions.incredibar_i.vrsni - 1.5.3.27

    FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.3.2711:23

    FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

    FF - user.js: extensions.incredibar_i.prdct - incredibar

    FF - user.js: extensions.incredibar_i.aflt - orgnl

    FF - user.js: extensions.incredibar_i.smplGrp - none

    FF - user.js: extensions.incredibar_i.tlbrId - base

    FF - user.js: extensions.incredibar_i.instlRef -

    FF - user.js: extensions.incredibar_i.dfltLng -

    FF - user.js: extensions.incredibar_i.excTlbr - false

    FF - user.js: extensions.incredibar_i.ms_url_id -

    FF - user.js: extensions.incredibar_i.upn2 - 6OyoApz4U8

    FF - user.js: extensions.incredibar_i.upn2n - 92260656017641888

    FF - user.js: extensions.incredibar_i.productid - 26

    FF - user.js: extensions.incredibar_i.installerproductid - 26

    FF - user.js: extensions.incredibar_i.did - 10589

    FF - user.js: extensions.incredibar_i.ppd -

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-10 - (no file)

    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

    HKCU-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe

    MSConfigStartUp-ViewMgr - c:\program files\Viewpoint\Viewpoint Manager\ViewMgr_.exe

    .

    .

    .

    **************************************************************************

    .

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2012-07-07 10:14

    Windows 5.1.2600 Service Pack 3 NTFS

    .

    scanning hidden processes ...

    .

    scanning hidden autostart entries ...

    .

    scanning hidden files ...

    .

    scan completed successfully

    hidden files: 0

    .

    **************************************************************************

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\N360]

    "ImagePath"="\"c:\program files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\5.2.1.3\diMaster.dll\" /prefetch:1"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NET CLR Data]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NET CLR Networking]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NET Data Provider for Oracle]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NET Data Provider for SqlServer]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\.NETFramework]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Abiosdsk]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\abp480n5]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ABP480N5.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ACPI]

    "ImagePath"="System32\DRIVERS\ACPI.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ACPIEC]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\adpu160m]

    "ImagePath"="\SystemRoot\System32\DRIVERS\adpu160m.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aeaudio]

    "ImagePath"="system32\drivers\aeaudio.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aec]

    "ImagePath"="system32\drivers\aec.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AFD]

    "ImagePath"="\SystemRoot\System32\drivers\afd.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\agp440]

    "ImagePath"="\SystemRoot\System32\DRIVERS\agp440.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\agpCPQ]

    "ImagePath"="\SystemRoot\System32\DRIVERS\agpCPQ.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Aha154x]

    "ImagePath"="\SystemRoot\System32\DRIVERS\aha154x.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aic78u2]

    "ImagePath"="\SystemRoot\System32\DRIVERS\aic78u2.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aic78xx]

    "ImagePath"="\SystemRoot\System32\DRIVERS\aic78xx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Alerter]

    "ServiceDll"="%SystemRoot%\system32\alrsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ALG]

    "ImagePath"="%SystemRoot%\System32\alg.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AliIde]

    "ImagePath"="\SystemRoot\System32\DRIVERS\aliide.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\alim1541]

    "ImagePath"="\SystemRoot\System32\DRIVERS\alim1541.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\amdagp]

    "ImagePath"="\SystemRoot\System32\DRIVERS\amdagp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\amsint]

    "ImagePath"="\SystemRoot\System32\DRIVERS\amsint.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AOL ACS]

    "ImagePath"="c:\progra~1\COMMON~1\AOL\ACS\acsd.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Apple Mobile Device]

    "ImagePath"="\"c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AppMgmt]

    "ServiceDll"="%SystemRoot%\System32\appmgmts.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Arp1394]

    "ImagePath"="System32\DRIVERS\arp1394.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\asc]

    "ImagePath"="\SystemRoot\System32\DRIVERS\asc.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\asc3350p]

    "ImagePath"="\SystemRoot\System32\DRIVERS\asc3350p.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\asc3550]

    "ImagePath"="\SystemRoot\System32\DRIVERS\asc3550.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASP.NET]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASP.NET_1.1.4322]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASP.NET_2.0.50727]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\aspnet_state]

    "ImagePath"="%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AsyncMac]

    "ImagePath"="system32\DRIVERS\asyncmac.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\atapi]

    "ImagePath"="System32\DRIVERS\atapi.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Atdisk]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ati HotKey Poller]

    "ImagePath"="%SystemRoot%\System32\Ati2evxx.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ati2mtag]

    "ImagePath"="System32\DRIVERS\ati2mtag.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\atinevxx]

    "ImagePath"="System32\DRIVERS\atinevxx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ATITUNEP]

    "ImagePath"="System32\DRIVERS\atineuxx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ativraxx]

    "ImagePath"="System32\DRIVERS\atinraxx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ATIXSAudio]

    "ImagePath"="System32\DRIVERS\atinesxx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Atmarpc]

    "ImagePath"="System32\DRIVERS\atmarpc.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\AudioSrv]

    "ServiceDll"="%SystemRoot%\System32\audiosrv.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\audstub]

    "ImagePath"="System32\DRIVERS\audstub.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\BattC]

    "MofImagePath"="System32\Drivers\battc.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\BCMModem]

    "ImagePath"="System32\DRIVERS\BCMSM.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Beep]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\BHDrvx86]

    "ImagePath"="\??\c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20120619.001\BHDrvx86.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\BITS]

    "ServiceDll"="%systemroot%\system32\qmgr.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Bonjour Service]

    "ImagePath"="\"c:\program files\Bonjour\mDNSResponder.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Browser]

    "ServiceDll"="%SystemRoot%\System32\browser.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\bvrp_pci]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\catchme]

    "ImagePath"="\??\c:\docume~1\Jim\LOCALS~1\Temp\catchme.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\cbidf]

    "ImagePath"="\SystemRoot\System32\DRIVERS\cbidf2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\cbidf2k]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CCDECODE]

    "ImagePath"="System32\DRIVERS\CCDECODE.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\cd20xrnt]

    "ImagePath"="\SystemRoot\System32\DRIVERS\cd20xrnt.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cdaudio]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cdfs]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cdrom]

    "ImagePath"="System32\DRIVERS\cdrom.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Changer]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CiSvc]

    "ImagePath"="%SystemRoot%\system32\cisvc.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ClipSrv]

    "ImagePath"="%SystemRoot%\system32\clipsrv.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\clr_optimization_v2.0.50727_32]

    "ImagePath"="c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CmdIde]

    "ImagePath"="\SystemRoot\System32\DRIVERS\cmdide.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\COMSysApp]

    "ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ContentFilter]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ContentIndex]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Cpqarray]

    "ImagePath"="\SystemRoot\System32\DRIVERS\cpqarray.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Creative Service for CDROM Access]

    "ImagePath"="c:\windows\System32\CTsvcCDA.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\CryptSvc]

    "ServiceDll"="%SystemRoot%\System32\cryptsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ctac32k]

    "ImagePath"="System32\drivers\ctac32k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ctaud2k]

    "ImagePath"="system32\drivers\ctaud2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ctdvda2k]

    "ImagePath"="System32\drivers\ctdvda2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ctprxy2k]

    "ImagePath"="System32\drivers\ctprxy2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ctsfm2k]

    "ImagePath"="System32\drivers\ctsfm2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dac2w2k]

    "ImagePath"="\SystemRoot\System32\DRIVERS\dac2w2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dac960nt]

    "ImagePath"="\SystemRoot\System32\DRIVERS\dac960nt.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DcomLaunch]

    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DgiVecp]

    "ImagePath"="\??\c:\windows\system32\Drivers\DgiVecp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Dhcp]

    "ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Disk]

    "ImagePath"="System32\DRIVERS\disk.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmadmin]

    "ImagePath"="%SystemRoot%\System32\dmadmin.exe /com"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmboot]

    "ImagePath"="System32\drivers\dmboot.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmio]

    "ImagePath"="System32\drivers\dmio.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmload]

    "ImagePath"="System32\drivers\dmload.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dmserver]

    "ServiceDll"="%SystemRoot%\System32\dmserver.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DMusic]

    "ImagePath"="system32\drivers\DMusic.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Dnscache]

    "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Dot3svc]

    "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dpti2o]

    "ImagePath"="\SystemRoot\System32\DRIVERS\dpti2o.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\drmkaud]

    "ImagePath"="system32\drivers\drmkaud.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\drvmcdb]

    "ImagePath"="system32\drivers\drvmcdb.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\drvncdb]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\drvnddm]

    "ImagePath"="system32\drivers\drvnddm.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DSBrokerService]

    "ImagePath"="\"c:\program files\DellSupport\brkrsvc.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\DSproct]

    "ImagePath"="\??\c:\program files\DellSupport\GTAction\triggers\DSproct.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\dsunidrv]

    "ImagePath"="system32\DRIVERS\dsunidrv.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\E100B]

    "ImagePath"="System32\DRIVERS\e100b325.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EapHost]

    "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\eeCtrl]

    "ImagePath"="\??\c:\program files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ehSched]

    "ImagePath"="c:\windows\ehome\ehSched.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EL90XBC]

    "ImagePath"="System32\DRIVERS\el90xbc5.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\emupia]

    "ImagePath"="System32\drivers\emupia2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EraserUtilRebootDrv]

    "ImagePath"="\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ERSvc]

    "ServiceDll"="%SystemRoot%\System32\ersvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EUSBMSD]

    "ImagePath"="System32\DRIVERS\EUSBMSD.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Eventlog]

    "ImagePath"="%SystemRoot%\system32\services.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\EventSystem]

    "ServiceDll"="c:\windows\System32\es.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fastfat]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FastUserSwitchingCompatibility]

    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fdc]

    "ImagePath"="System32\DRIVERS\fdc.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fips]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Flpydisk]

    "ImagePath"="System32\DRIVERS\flpydisk.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FltMgr]

    "ImagePath"="system32\drivers\fltmgr.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\FontCache3.0.0.0]

    "ImagePath"="c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Fs_Rec]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ftdisk]

    "ImagePath"="System32\DRIVERS\ftdisk.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\GEARAspiWDM]

    "ImagePath"="System32\Drivers\GEARAspiWDM.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Gpc]

    "ImagePath"="System32\DRIVERS\msgpc.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\gupdate]

    "ImagePath"="\"c:\program files\Google\Update\GoogleUpdate.exe\" /svc"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\gupdatem]

    "ImagePath"="\"c:\program files\Google\Update\GoogleUpdate.exe\" /medsvc"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\gusvc]

    "ImagePath"="\"c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ha10kx2k]

    "ImagePath"="System32\drivers\ha10kx2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\hap16v2k]

    "ImagePath"="System32\drivers\hap16v2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\helpsvc]

    "ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HidIr]

    "ImagePath"="System32\DRIVERS\hidir.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HidServ]

    "ServiceDll"="%SystemRoot%\System32\hidserv.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HidUsb]

    "ImagePath"="System32\DRIVERS\hidusb.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\hkmsvc]

    "ServiceDll"="%SystemRoot%\System32\kmsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\hpn]

    "ImagePath"="\SystemRoot\System32\DRIVERS\hpn.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HTTP]

    "ImagePath"="System32\Drivers\HTTP.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\HTTPFilter]

    "ServiceDll"="%SystemRoot%\System32\w3ssl.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\i2omgmt]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\i2omp]

    "ImagePath"="\SystemRoot\System32\DRIVERS\i2omp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\i8042prt]

    "ImagePath"="System32\DRIVERS\i8042prt.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IDriverT]

    "ImagePath"="\"c:\program files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\idsvc]

    "ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IDSxpx86]

    "ImagePath"="\??\c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20120705.001\IDSxpx86.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ILADFtmi]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Imapi]

    "ImagePath"="System32\DRIVERS\imapi.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ImapiService]

    "ImagePath"="%systemroot%\system32\imapi.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\inetaccs]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ini910u]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ini910u.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Inport]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IntelIde]

    "ImagePath"="\SystemRoot\System32\DRIVERS\intelide.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\intelppm]

    "ImagePath"="System32\DRIVERS\intelppm.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ip6Fw]

    "ImagePath"="system32\drivers\ip6fw.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IpFilterDriver]

    "ImagePath"="System32\DRIVERS\ipfltdrv.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IpInIp]

    "ImagePath"="System32\DRIVERS\ipinip.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IpNat]

    "ImagePath"="System32\DRIVERS\ipnat.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\iPod Service]

    "ImagePath"="\"c:\program files\iPod\bin\iPodService.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IPSec]

    "ImagePath"="system32\DRIVERS\ipsec.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IrBus]

    "ImagePath"="System32\DRIVERS\IrBus.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\IRENUM]

    "ImagePath"="System32\DRIVERS\irenum.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ISAPISearch]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\isapnp]

    "ImagePath"="System32\DRIVERS\isapnp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\JavaQuickStarterService]

    "ImagePath"="\"c:\program files\Java\jre7\bin\jqs.exe\" -service -config \"c:\program files\Java\jre7\lib\deploy\jqs\jqs.conf\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Kbdclass]

    "ImagePath"="System32\DRIVERS\kbdclass.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\kbdhid]

    "ImagePath"="System32\DRIVERS\kbdhid.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\kmixer]

    "ImagePath"="system32\drivers\kmixer.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\KSecDD]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lanmanserver]

    "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lanmanworkstation]

    "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\lbrtfdc]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ldap]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\LexBceS]

    "ImagePath"="c:\windows\system32\LEXBCES.EXE"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\LicenseService]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\LmHosts]

    "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MDM]

    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Messenger]

    "ServiceDll"="%SystemRoot%\System32\msgsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mnmdd]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mnmsrvc]

    "ImagePath"="c:\windows\System32\mnmsrvc.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Modem]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MODEMCSA]

    "ImagePath"="system32\drivers\MODEMCSA.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Mouclass]

    "ImagePath"="System32\DRIVERS\mouclass.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mouhid]

    "ImagePath"="System32\DRIVERS\mouhid.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MountMgr]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mraid35x]

    "ImagePath"="\SystemRoot\System32\DRIVERS\mraid35x.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRxDAV]

    "ImagePath"="System32\DRIVERS\mrxdav.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MRxSmb]

    "ImagePath"="System32\DRIVERS\mrxsmb.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSCSPTISRV]

    "ImagePath"="\"c:\program files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSDTC]

    "ImagePath"="c:\windows\System32\msdtc.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSDTC Bridge 3.0.0.0]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Msfs]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSIServer]

    "ImagePath"="%systemroot%\system32\msiexec.exe /V"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSKSSRV]

    "ImagePath"="system32\drivers\MSKSSRV.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSPCLOCK]

    "ImagePath"="system32\drivers\MSPCLOCK.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSPQM]

    "ImagePath"="system32\drivers\MSPQM.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mssmbios]

    "ImagePath"="System32\DRIVERS\mssmbios.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSSQL$MICROSOFTBCM]

    "ImagePath"="c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe -sMICROSOFTBCM"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSSQLServerADHelper]

    "ImagePath"="c:\program files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MSTEE]

    "ImagePath"="system32\drivers\MSTEE.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Mup]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MVDCODEC]

    "ImagePath"="System32\DRIVERS\atinmdxx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\N360]

    "ImagePath"="\"c:\program files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\5.2.1.3\diMaster.dll\" /prefetch:1"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NABTSFEC]

    "ImagePath"="System32\DRIVERS\NABTSFEC.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\napagent]

    "ServiceDll"="%SystemRoot%\System32\qagentrt.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NAVENG]

    "ImagePath"="\??\c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20120706.036\NAVENG.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NAVEX15]

    "ImagePath"="\??\c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20120706.036\NAVEX15.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NDIS]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NdisIP]

    "ImagePath"="System32\DRIVERS\NdisIP.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NdisTapi]

    "ImagePath"="System32\DRIVERS\ndistapi.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ndisuio]

    "ImagePath"="System32\DRIVERS\ndisuio.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NdisWan]

    "ImagePath"="System32\DRIVERS\ndiswan.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NDProxy]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetBIOS]

    "ImagePath"="System32\DRIVERS\netbios.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetBT]

    "ImagePath"="System32\DRIVERS\netbt.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetDDE]

    "ImagePath"="%SystemRoot%\system32\netdde.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetDDEdsdm]

    "ImagePath"="%SystemRoot%\system32\netdde.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Netlogon]

    "ImagePath"="%SystemRoot%\system32\lsass.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Netman]

    "ServiceDll"="%SystemRoot%\System32\netman.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetSvc]

    "ImagePath"="c:\program files\Intel\NCS\Sync\NetSvc.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NetTcpPortSharing]

    "ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NIC1394]

    "ImagePath"="System32\DRIVERS\nic1394.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Nla]

    "ServiceDll"="%SystemRoot%\System32\mswsock.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Npfs]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ntfs]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NtLmSsp]

    "ImagePath"="%SystemRoot%\System32\lsass.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NtmsSvc]

    "ServiceDll"="%SystemRoot%\system32\ntmssvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Null]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\nv]

    "ImagePath"="System32\DRIVERS\nv4_mini.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NwlnkFlt]

    "ImagePath"="System32\DRIVERS\nwlnkflt.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NwlnkFwd]

    "ImagePath"="System32\DRIVERS\nwlnkfwd.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ohci1394]

    "ImagePath"="System32\DRIVERS\ohci1394.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\omci]

    "ImagePath"="System32\DRIVERS\omci.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ose]

    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ossrv]

    "ImagePath"="system32\drivers\ctoss2k.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Outlook]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\P3]

    "ImagePath"="System32\DRIVERS\p3.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PACSPTISVR]

    "ImagePath"="\"c:\program files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Parport]

    "ImagePath"="System32\DRIVERS\parport.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PartMgr]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ParVdm]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCDCODEC]

    "ImagePath"="System32\DRIVERS\atinpdxx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCI]

    "ImagePath"="System32\DRIVERS\pci.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCIDump]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCIIde]

    "ImagePath"="System32\DRIVERS\pciide.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Pcmcia]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDCOMP]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDFRAME]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDRELI]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PDRFRAME]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\perc2]

    "ImagePath"="\SystemRoot\System32\DRIVERS\perc2.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\perc2hib]

    "ImagePath"="\SystemRoot\System32\DRIVERS\perc2hib.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfDisk]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfNet]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfOS]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PerfProc]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PfModNT]

    "ImagePath"="\??\c:\windows\System32\drivers\PfModNT.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PlugPlay]

    "ImagePath"="%SystemRoot%\system32\services.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PolicyAgent]

    "ImagePath"="%SystemRoot%\system32\lsass.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PptpMiniport]

    "ImagePath"="System32\DRIVERS\raspptp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Processor]

    "ImagePath"="System32\DRIVERS\processr.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ProtectedStorage]

    "ImagePath"="%SystemRoot%\system32\lsass.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PSched]

    "ImagePath"="System32\DRIVERS\psched.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ptilink]

    "ImagePath"="System32\DRIVERS\ptilink.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PxHelp20]

    "ImagePath"="System32\DRIVERS\PxHelp20.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql1080]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ql1080.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Ql10wnt]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ql10wnt.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql12160]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ql12160.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql1240]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ql1240.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ql1280]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ql1280.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasAcd]

    "ImagePath"="System32\DRIVERS\rasacd.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasAuto]

    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Rasl2tp]

    "ImagePath"="System32\DRIVERS\rasl2tp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasMan]

    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RasPppoe]

    "ImagePath"="System32\DRIVERS\raspppoe.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Raspti]

    "ImagePath"="System32\DRIVERS\raspti.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Rdbss]

    "ImagePath"="System32\DRIVERS\rdbss.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPCDD]

    "ImagePath"="System32\DRIVERS\RDPCDD.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPDD]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rdpdr]

    "ImagePath"="System32\DRIVERS\rdpdr.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPNP]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDPWD]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RDSessMgr]

    "ImagePath"="c:\windows\system32\sessmgr.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\redbook]

    "ImagePath"="System32\DRIVERS\redbook.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RemoteAccess]

    "ServiceDll"="%SystemRoot%\System32\mprdim.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RemoteRegistry]

    "ServiceDll"="%SystemRoot%\system32\regsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RpcLocator]

    "ImagePath"="%SystemRoot%\System32\locator.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RpcSs]

    "ServiceDll"="%SystemRoot%\System32\rpcss.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\RSVP]

    "ImagePath"="%SystemRoot%\System32\rsvp.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SamSs]

    "ImagePath"="%SystemRoot%\system32\lsass.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SCardSvr]

    "ImagePath"="%SystemRoot%\System32\SCardSvr.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Schedule]

    "ServiceDll"="%SystemRoot%\system32\schedsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ScsiPort]

    "ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Secdrv]

    "ImagePath"="System32\DRIVERS\secdrv.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\seclogon]

    "ServiceDll"="%SystemRoot%\System32\seclogon.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SENS]

    "ServiceDll"="%SystemRoot%\system32\sens.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\serenum]

    "ImagePath"="System32\DRIVERS\serenum.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Serial]

    "ImagePath"="System32\DRIVERS\serial.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ServiceModelEndpoint 3.0.0.0]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ServiceModelOperation 3.0.0.0]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ServiceModelService 3.0.0.0]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Sfloppy]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SharedAccess]

    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ShellHWDetection]

    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Simbad]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sisagp]

    "ImagePath"="\SystemRoot\System32\DRIVERS\sisagp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SLIP]

    "ImagePath"="System32\DRIVERS\SLIP.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SMSvcHost 3.0.0.0]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\smwdm]

    "ImagePath"="system32\drivers\smwdm.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Sparrow]

    "ImagePath"="\SystemRoot\System32\DRIVERS\sparrow.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\splitter]

    "ImagePath"="system32\drivers\splitter.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Spooler]

    "ImagePath"="%SystemRoot%\system32\spoolsv.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sprtsvc_dellsupportcenter]

    "ImagePath"="c:\program files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SPTISRV]

    "ImagePath"="\"c:\program files\Common Files\Sony Shared\AVLib\SPTISRV.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SQLAgent$MICROSOFTBCM]

    "ImagePath"="c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sr]

    "ImagePath"="System32\DRIVERS\sr.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\srservice]

    "ServiceDll"="%SystemRoot%\system32\srsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SRTSP]

    "ImagePath"="\SystemRoot\System32\Drivers\N360\0502010.003\SRTSP.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SRTSPX]

    "ImagePath"="\SystemRoot\system32\drivers\N360\0502010.003\SRTSPX.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Srv]

    "ImagePath"="System32\DRIVERS\srv.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sscdbhk5]

    "ImagePath"="system32\drivers\sscdbhk5.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SSDPSRV]

    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SSPORT]

    "ImagePath"="\??\c:\windows\system32\Drivers\SSPORT.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ssrtln]

    "ImagePath"="system32\drivers\ssrtln.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SSScsiSV]

    "ImagePath"="c:\program files\Common Files\Sony Shared\AVLib\SSScsiSV.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\stisvc]

    "ServiceDll"="%SystemRoot%\system32\wiaservc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\streamip]

    "ImagePath"="System32\DRIVERS\StreamIP.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\swenum]

    "ImagePath"="System32\DRIVERS\swenum.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\swmidi]

    "ImagePath"="system32\drivers\swmidi.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SwPrv]

    "ImagePath"="c:\windows\System32\dllhost.exe /Processid:{31124A66-23E8-4EF6-B153-51C109B001D1}"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\swwd]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\symc810]

    "ImagePath"="\SystemRoot\System32\DRIVERS\symc810.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\symc8xx]

    "ImagePath"="\SystemRoot\System32\DRIVERS\symc8xx.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SymDS]

    "ImagePath"="system32\drivers\N360\0502010.003\SYMDS.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SymEFA]

    "ImagePath"="system32\drivers\N360\0502010.003\SYMEFA.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SymEvent]

    "ImagePath"="\??\c:\windows\system32\Drivers\SYMEVENT.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SYMFW]

    "ImagePath"="\SystemRoot\System32\Drivers\N360\0308000.029\SYMFW.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SYMIDS]

    "ImagePath"="\SystemRoot\System32\Drivers\N360\0308000.029\SYMIDS.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SymIRON]

    "ImagePath"="\SystemRoot\system32\drivers\N360\0502010.003\Ironx86.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SYMNDIS]

    "ImagePath"="\SystemRoot\System32\Drivers\N360\0308000.029\SYMNDIS.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SYMTDI]

    "ImagePath"="\SystemRoot\System32\Drivers\N360\0502010.003\SYMTDI.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sym_hi]

    "ImagePath"="\SystemRoot\System32\DRIVERS\sym_hi.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sym_u3]

    "ImagePath"="\SystemRoot\System32\DRIVERS\sym_u3.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\sysaudio]

    "ImagePath"="system32\drivers\sysaudio.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\SysmonLog]

    "ImagePath"="%SystemRoot%\system32\smlogsvc.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TapiSrv]

    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip]

    "ImagePath"="System32\DRIVERS\tcpip.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TDPIPE]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TDTCP]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TermDD]

    "ImagePath"="System32\DRIVERS\termdd.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TermService]

    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsnboio]

    "ImagePath"="system32\dla\tfsnboio.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsncofs]

    "ImagePath"="system32\dla\tfsncofs.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsndrct]

    "ImagePath"="system32\dla\tfsndrct.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsndres]

    "ImagePath"="system32\dla\tfsndres.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsnifs]

    "ImagePath"="system32\dla\tfsnifs.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsnopio]

    "ImagePath"="system32\dla\tfsnopio.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsnpool]

    "ImagePath"="system32\dla\tfsnpool.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsnudf]

    "ImagePath"="system32\dla\tfsnudf.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\tfsnudfa]

    "ImagePath"="system32\dla\tfsnudfa.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Themes]

    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TlntSvr]

    "ImagePath"="c:\windows\System32\tlntsvr.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TosIde]

    "ImagePath"="\SystemRoot\System32\DRIVERS\toside.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TrkWks]

    "ServiceDll"="%SystemRoot%\system32\trkwks.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TSDDD]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Udfs]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ultra]

    "ImagePath"="\SystemRoot\System32\DRIVERS\ultra.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\UMWdf]

    "ImagePath"="c:\windows\system32\wdfmgr.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Update]

    "ImagePath"="System32\DRIVERS\update.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\upnphost]

    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\UPS]

    "ImagePath"="%SystemRoot%\System32\ups.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usb]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\USBAAPL]

    "ImagePath"="System32\Drivers\usbaapl.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbccgp]

    "ImagePath"="System32\DRIVERS\usbccgp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbehci]

    "ImagePath"="System32\DRIVERS\usbehci.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbhub]

    "ImagePath"="System32\DRIVERS\usbhub.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbprint]

    "ImagePath"="System32\DRIVERS\usbprint.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbscan]

    "ImagePath"="System32\DRIVERS\usbscan.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\USBSTOR]

    "ImagePath"="System32\DRIVERS\USBSTOR.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\usbuhci]

    "ImagePath"="System32\DRIVERS\usbuhci.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VgaSave]

    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\viaagp]

    "ImagePath"="\SystemRoot\System32\DRIVERS\viaagp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ViaIde]

    "ImagePath"="\SystemRoot\System32\DRIVERS\viaide.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VolSnap]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VSS]

    "ImagePath"="%SystemRoot%\System32\vssvc.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\VxD]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\w32time]

    "ServiceDll"="%systemroot%\system32\w32time.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\W3SVC]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Wanarp]

    "ImagePath"="System32\DRIVERS\wanarp.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wanatw]

    "ImagePath"="System32\DRIVERS\wanatw4.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WANMiniportService]

    "ImagePath"="\"c:\windows\wanmpsvc.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WDICA]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wdmaud]

    "ImagePath"="system32\drivers\wdmaud.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WebClient]

    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WinDefend]

    "ImagePath"="\"c:\program files\Windows Defender\MsMpEng.exe\""

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Windows Workflow Foundation 3.0.0.0]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\winmgmt]

    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Winsock]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WinSock2]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WinTrust]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WMConnectCDS]

    "ImagePath"="c:\program files\Windows Media Connect 2\wmccds.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WMDM PMSP Service]

    "ImagePath"="c:\windows\System32\MsPMSPSv.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WmdmPmSN]

    "ServiceDll"="c:\windows\system32\mspmsnsv.dll"

    --

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Wmi]

    "ServiceDll"="%SystemRoot%\System32\advapi32.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WmiApRpl]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WmiApSrv]

    "ImagePath"="c:\windows\System32\wbem\wmiapsrv.exe"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WpdUsb]

    "ImagePath"="System32\Drivers\wpdusb.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WS2IFSL]

    "ImagePath"="\SystemRoot\System32\drivers\ws2ifsl.sys"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wscsvc]

    "ServiceDll"="%SYSTEMROOT%\system32\wscsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WSTCODEC]

    "ImagePath"="System32\DRIVERS\WSTCODEC.SYS"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\wuauserv]

    "ServiceDll"="c:\windows\system32\wuauserv.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\WZCSVC]

    "ServiceDll"="%SystemRoot%\System32\wzcsvc.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\xmlprov]

    "ServiceDll"="%SystemRoot%\System32\xmlprov.dll"

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{17EF01C9-1C47-4CA4-ACF6-0A5EA2E949EC}]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{6DCA1335-2A4E-4A19-8A3E-D37C25D931A8}]

    .

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{CE910A3A-E4CB-42EF-B86F-01A2AE78491A}]

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-1093819779-2537581792-1553126955-1008\Software\Microsoft\SystemCertificates\AddressBook*]

    @Allowed: (Read) (RestrictedCode)

    @Allowed: (Read) (RestrictedCode)

    .

    Completion time: 2012-07-07 10:19:00

    ComboFix-quarantined-files.txt 2012-07-07 14:18

    .

    Pre-Run: 5,734,383,616 bytes free

    Post-Run: 7,126,237,184 bytes free

    .

    - - End Of File - - 413B84DF0CEC6A246662D95B7593A3AC

    Ad network traffic, slow internet connection

    in Resolved Malware Removal Logs

    Posted

    =============

    DDS Logs - DDS.txt

    ===============

    .

    DDS (Ver_2011-08-26.01) - NTFSx86

    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.0.0

    Run by Jim at 5:05:18 on 2012-07-06

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1912 [GMT -4:00]

    .

    AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

    FW: Norton Security Suite *Enabled*

    .

    ============== Running Processes ===============

    .

    C:\WINDOWS\System32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe -k DcomLaunch

    svchost.exe

    C:\Program Files\Windows Defender\MsMpEng.exe

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\LEXPPS.EXE

    svchost.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\WINDOWS\System32\CTsvcCDA.exe

    C:\WINDOWS\ehome\ehSched.exe

    C:\Program Files\Java\jre7\bin\jqs.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    C:\WINDOWS\System32\svchost.exe -k imgsvc

    C:\WINDOWS\wanmpsvc.exe

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\BCMSMMSG.exe

    C:\WINDOWS\System32\DSentry.exe

    C:\WINDOWS\ehome\ehmsas.exe

    C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe

    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

    C:\Program Files\Dell AIO Printer A940\dlbabmon.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe

    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    C:\Program Files\QuickTime\QTTask.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Support.com\bin\tgcmd.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = about:blank

    uSearch Page = hxxp://www.google.com

    uDefault_Page_URL = hxxp://www.dell.com

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language

    uInternet Connection Wizard,ShellNext = iexplore

    uInternet Settings,ProxyOverride = *.local

    uSearchAssistant = hxxp://www.google.com/ie

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

    BHO: Savevid Toolbar: {23cd218f-af09-443f-bbb1-adb89fd5986d} - c:\progra~1\wi0498~1\datamngr\toolbar\savevidX.dll

    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

    BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton security suite\engine\5.2.1.3\coIEPlg.dll

    BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton security suite\engine\5.2.1.3\ips\IPSBHO.DLL

    BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll

    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll

    BHO: DCA BHO: {b49699fc-1665-4414-a1cb-c4a2a4a13eec} - c:\program files\upromise\dca-bho.dll

    BHO: Upromise TurboSaver: {edc0f17f-f4b7-47e4-b73e-887faeb376fa} - c:\program files\upromise\upromisetoolbar.dll

    TB: Upromise TurboSaver: {06e58e5e-f8cb-4049-991e-a41c03bd419e} - c:\program files\upromise\upromisetoolbar.dll

    TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton security suite\engine\5.2.1.3\coIEPlg.dll

    TB: Savevid Toolbar: {23cd218f-af09-443f-bbb1-adb89fd5986d} - c:\progra~1\wi0498~1\datamngr\toolbar\savevidX.dll

    TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll

    TB: !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - No File

    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

    TB: {4E7BD74F-2B8D-469E-95BA-ED6DB186BE32} - No File

    TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

    TB: {00000000-0000-0000-0000-000000000000} - No File

    TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

    EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

    uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

    uRunOnce: [shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100429 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 2.8; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

    mRun: [ehTray] c:\windows\ehome\ehtray.exe

    mRun: [ATIModeChange] Ati2mdxx.exe

    mRun: [bCMSMMSG] BCMSMMSG.exe

    mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

    mRun: [AsioReg] REGSVR32.EXE /S CTASIO.DLL

    mRun: [updReg] c:\windows\UpdReg.EXE

    mRun: [DVDSentry] c:\windows\system32\DSentry.exe

    mRun: [Dell AIO Printer A940] "c:\program files\dell aio printer a940\dlbabmgr.exe"

    mRun: [CTSysVol] c:\program files\creative\sbaudigy2\surround mixer\CTSysVol.exe

    mRun: [CTDVDDet] c:\program files\creative\sbaudigy2\dvdaudio\CTDVDDet.EXE

    mRun: [tgcmd] c:\program files\support.com\bin\tgcmd.exe /server /startmonitor /deaf

    mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

    mRun: [CTHelper] CTHELPER.EXE

    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

    mRun: [samsung PanelMgr] c:\windows\samsung\panelmgr\SSMMgr.exe /autorun

    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

    StartupFolder: c:\docume~1\jim\startm~1\programs\startup\gozone~1.lnk - c:\program files\gozone\GoZone_iSync.exe

    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - c:\program files\upromise\upromisetoolbar.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

    Trusted Zone: kyw1060.com\www

    Trusted Zone: mcafee.com

    Trusted Zone: microsoft.com\*.windowsupdate

    Trusted Zone: phillies.com\www

    Trusted Zone: windowsupdate.com

    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB

    DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab

    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB

    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

    DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab

    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab

    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1077755673359

    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1077755629062

    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-170-windows-i586.cab

    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab

    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://samsclubus.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab

    DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-170-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.5/installer.exe

    DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://69.126.199.53:81/activex/AMC.cab

    TCP: DhcpNameServer = 192.168.1.1

    TCP: Interfaces\{CE910A3A-E4CB-42EF-B86F-01A2AE78491A} : DhcpNameServer = 192.168.1.1

    Notify: WRNotifier - WRLogonNTF.dll

    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - c:\documents and settings\jim\application data\mozilla\firefox\profiles\bl6vfl0c.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource=3&q={searchTerms}

    FF - prefs.js: browser.search.selectedEngine - Search

    FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

    FF - prefs.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\ipsffplgn\components\IPSFFPl.dll

    FF - plugin: c:\program files\canon\mycamera download plugin\NPCIG.dll

    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

    FF - plugin: c:\program files\google\google updater\1.2.567.20382\npCIDetect5.dll

    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

    FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll

    FF - plugin: c:\program files\java\jre7\bin\new_plugin\npdeployJava1.dll

    FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll

    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    FF - Ext: Symantec Intrusion Prevention: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\IPSFFPlgn

    .

    ---- FIREFOX POLICIES ----

    .

    FF - user.js: browser.search.selectedEngine - Search

    FF - user.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - user.js: extensions.incredibar_i.newTab - false

    FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyoApz4U8&loc=IB_TB&i=26&search=

    FF - user.js: extensions.incredibar_i.id - 606540c60000000000000007e9484568

    FF - user.js: extensions.incredibar_i.hardId - 606540c60000000000000007e9484568

    FF - user.js: extensions.incredibar_i.instlDay - 15341

    FF - user.js: extensions.incredibar_i.vrsn - 1.5.3.27

    FF - user.js: extensions.incredibar_i.vrsni - 1.5.3.27

    FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.3.2711:23:06

    FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

    FF - user.js: extensions.incredibar_i.prdct - incredibar

    FF - user.js: extensions.incredibar_i.aflt - orgnl

    FF - user.js: extensions.incredibar_i.smplGrp - none

    FF - user.js: extensions.incredibar_i.tlbrId - base

    FF - user.js: extensions.incredibar_i.instlRef -

    FF - user.js: extensions.incredibar_i.dfltLng -

    FF - user.js: extensions.incredibar_i.excTlbr - false

    FF - user.js: extensions.incredibar_i.ms_url_id -

    FF - user.js: extensions.incredibar_i.upn2 - 6OyoApz4U8

    FF - user.js: extensions.incredibar_i.upn2n - 92260656017641888

    FF - user.js: extensions.incredibar_i.productid - 26

    FF - user.js: extensions.incredibar_i.installerproductid - 26

    FF - user.js: extensions.incredibar_i.did - 10589

    FF - user.js: extensions.incredibar_i.ppd -

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0502010.003\symds.sys [2012-4-23 340088]

    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0502010.003\symefa.sys [2012-4-23 744568]

    R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\bashdefs\20120619.001\BHDrvx86.sys [2012-6-18 821920]

    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0502010.003\ironx86.sys [2012-4-23 136312]

    R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\5.2.1.3\ccsvchst.exe [2012-4-23 130008]

    R2 WinDefend;Windows Defender Service;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-6-2 106656]

    R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\ipsdefs\20120705.001\IDSXpx86.sys [2012-7-5 369632]

    R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20120705.018\NAVENG.SYS [2012-7-6 87928]

    R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20120705.018\NAVEX15.SYS [2012-7-6 1589752]

    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-8-6 133104]

    S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys --> c:\windows\system32\drivers\SSPORT.sys [?]

    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-8-6 133104]

    .

    =============== Created Last 30 ================

    .

    2012-07-06 06:09:13 6762896 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{caa97406-a117-4f26-bfbc-0011a665fadd}\mpengine.dll

    2012-07-06 02:48:53 -------- d-----w- C:\TDSSKiller_Quarantine

    .

    ==================== Find3M ====================

    .

    2012-06-04 22:35:26 222448 ----a-w- c:\windows\system32\muweb.dll

    2012-06-02 20:19:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui

    2012-06-02 20:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl

    2012-06-02 20:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

    2012-06-02 20:19:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui

    2012-06-02 20:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui

    .

    ============= FINISH: 5:07:52.62 ===============

    ==========

    Attach.txt

    ==========

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2011-08-26.01)

    .

    Microsoft Windows XP Professional

    Boot Device: \Device\HarddiskVolume2

    Install Date: 11/15/2003 3:55:47 PM

    System Uptime: 7/6/2012 5:01:44 AM (0 hours ago)

    .

    Motherboard: Dell Computer Corp. | | 0M2035

    Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

    .

    ==== Disk Partitions =========================

    .

    A: is Removable

    C: is FIXED (NTFS) - 112 GiB total, 1.46 GiB free.

    D: is CDROM ()

    E: is CDROM ()

    F: is Removable

    .

    ==== Disabled Device Manager Items =============

    .

    ==== System Restore Points ===================

    .

    RP212: 7/5/2012 11:13:04 PM - Software Distribution Service 3.0

    RP213: 7/6/2012 2:09:04 AM - Software Distribution Service 3.0

    .

    ==== Installed Programs ======================

    .

    .

    ABBYY FineReader 5.0 Sprint

    Adobe Atmosphere Player for Acrobat and Adobe Reader

    Adobe Flash Player 10 ActiveX

    Adobe Flash Player 10 Plugin

    Adobe Photoshop Elements 2.0

    Adobe Reader 8.3.1

    Adobe Shockwave Player

    America Online (Choose which version to remove)

    AnswerWorks 5.0 English Runtime

    AOL Coach Version 1.0(Build:20030807.3)

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    ATI Control Panel

    ATI Display Driver

    ATIMCEE

    AXIS Media Control Embedded

    Backyard Football

    Banctec Service Agreement

    BCM V.92 56K Modem

    Bonjour

    Business Contact Manager for Outlook 2003

    CANON iMAGE GATEWAY MyCamera Download Plugin

    CANON iMAGE GATEWAY Task for ZoomBrowser EX

    Canon MOV Decoder

    Canon MOV Encoder

    Canon MovieEdit Task for ZoomBrowser EX

    Canon Utilities Digital Photo Professional 3.10

    Canon Utilities EOS Sample Music

    Canon Utilities EOS Utility

    Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX

    Canon Utilities Movie Uploader for YouTube

    Canon Utilities PhotoStitch

    Canon Utilities Picture Style Editor

    Canon Utilities ZoomBrowser EX

    Canon ZoomBrowser EX Memory Card Utility

    Classic PhoneTools

    Compatibility Pack for the 2007 Office system

    Creative MediaSource

    DAO

    Dell AIO Printer A940

    Dell Networking Guide

    Dell Picture Studio - Dell Image Expert

    Dell Solution Center

    Dell Support Center

    DellSupport

    Desktop Doctor

    DS21Patch

    DVDSentry

    EarthLink Setup Files

    ESET Online Scanner v3

    exPressit S.E. 2.1

    Family Tree Maker 2005

    Family Tree Maker 9.0

    Garmin Communicator Plugin

    Garmin POI Loader

    Garmin VoiceStudio v2.10

    GemMaster Mystic

    Glary Utilities 2.37.0.1260

    Google Earth

    Google Toolbar for Internet Explorer

    Google Update Helper

    Google Updater

    GoZone iSync

    Greeting Card Factory Deluxe 2.0

    GTK+ 1.3.0-20030717-1 runtime environment

    Help and Support Customization

    HighMAT Extension to Microsoft Windows XP CD Writing Wizard

    HiJackThis

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

    Hotfix for Windows Internet Explorer 7 (KB947864)

    Hotfix for Windows Media Format SDK (KB902344)

    Hotfix for Windows XP (KB2158563)

    Hotfix for Windows XP (KB2443685)

    Hotfix for Windows XP (KB2570791)

    Hotfix for Windows XP (KB2633952)

    Hotfix for Windows XP (KB952287)

    Hotfix for Windows XP (KB954550-v5)

    Hotfix for Windows XP (KB961118)

    Hotfix for Windows XP (KB970653-v3)

    Hotfix for Windows XP (KB976098-v2)

    Hotfix for Windows XP (KB979306)

    Hotfix for Windows XP (KB981793)

    Intel® PRO Network Connections Drivers

    Intel® PROSet

    iPod for Windows 2006-03-23

    iTunes

    Java Auto Updater

    Java 7

    LAME v3.98.2 for Audacity

    Learn2 Player (Uninstall Only)

    LiveUpdate 1.90 (Symantec Corporation)

    Malwarebytes Anti-Malware version 1.61.0.1400

    Managed DirectX (0901)

    Microsoft .NET Framework 1.0 Hotfix (KB2572066)

    Microsoft .NET Framework 1.0 Hotfix (KB953295)

    Microsoft .NET Framework 1.0 Hotfix (KB979904)

    Microsoft .NET Framework 1.1

    Microsoft .NET Framework 1.1 Security Update (KB2656353)

    Microsoft .NET Framework 1.1 Security Update (KB2656370)

    Microsoft .NET Framework 1.1 Security Update (KB979906)

    Microsoft .NET Framework 2.0 Service Pack 2

    Microsoft .NET Framework 3.0 Service Pack 2

    Microsoft .NET Framework 3.5 SP1

    Microsoft Base Smart Card Cryptographic Service Provider Package

    Microsoft Data Access Components KB870669

    Microsoft Internationalized Domain Names Mitigation APIs

    Microsoft Money 2004

    Microsoft Money 2004 System Pack

    Microsoft National Language Support Downlevel APIs

    Microsoft Office File Validation Add-In

    Microsoft Office Small Business Edition 2003

    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

    Microsoft Windows Journal Viewer

    MobileMe Control Panel

    Modem Helper

    Mozilla Firefox (3.6.25)

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    MSXML 6.0 Parser (KB933579)

    Norton Security Suite

    OpenMG AAC Add-on Module 1.0.00

    OpenMG Limited Patch 4.5-06-05-12-01

    OpenMG Secure Module 4.5.01

    Otto

    Paint Shop Pro 7

    Pdf995

    Picasa 3

    PowerDVD

    Quicken 2011

    QuickTime

    Reader Rabbit's Preschool

    RealPlayer

    RollerCoaster Tycoon 2

    RollerCoaster Tycoon 2: Wacky Worlds

    Samsung CLP-310 Series

    Savings Bond Wizard

    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

    Security Update for Microsoft Windows (KB2564958)

    Security Update for Step By Step Interactive Training (KB898458)

    Security Update for Step By Step Interactive Training (KB923723)

    Security Update for Windows Internet Explorer 7 (KB928090)

    Security Update for Windows Internet Explorer 7 (KB929969)

    Security Update for Windows Internet Explorer 7 (KB931768)

    Security Update for Windows Internet Explorer 7 (KB933566)

    Security Update for Windows Internet Explorer 7 (KB937143)

    Security Update for Windows Internet Explorer 7 (KB938127)

    Security Update for Windows Internet Explorer 7 (KB939653)

    Security Update for Windows Internet Explorer 7 (KB942615)

    Security Update for Windows Internet Explorer 7 (KB944533)

    Security Update for Windows Internet Explorer 7 (KB950759)

    Security Update for Windows Internet Explorer 7 (KB953838)

    Security Update for Windows Internet Explorer 7 (KB956390)

    Security Update for Windows Internet Explorer 7 (KB958215)

    Security Update for Windows Internet Explorer 7 (KB960714)

    Security Update for Windows Internet Explorer 7 (KB961260)

    Security Update for Windows Internet Explorer 7 (KB963027)

    Security Update for Windows Internet Explorer 7 (KB969897)

    Security Update for Windows Internet Explorer 8 (KB2183461)

    Security Update for Windows Internet Explorer 8 (KB2360131)

    Security Update for Windows Internet Explorer 8 (KB2416400)

    Security Update for Windows Internet Explorer 8 (KB2482017)

    Security Update for Windows Internet Explorer 8 (KB2497640)

    Security Update for Windows Internet Explorer 8 (KB2510531)

    Security Update for Windows Internet Explorer 8 (KB2530548)

    Security Update for Windows Internet Explorer 8 (KB2544521)

    Security Update for Windows Internet Explorer 8 (KB2559049)

    Security Update for Windows Internet Explorer 8 (KB2618444)

    Security Update for Windows Internet Explorer 8 (KB969897)

    Security Update for Windows Internet Explorer 8 (KB971961)

    Security Update for Windows Internet Explorer 8 (KB972260)

    Security Update for Windows Internet Explorer 8 (KB974455)

    Security Update for Windows Internet Explorer 8 (KB976325)

    Security Update for Windows Internet Explorer 8 (KB978207)

    Security Update for Windows Internet Explorer 8 (KB981332)

    Security Update for Windows Internet Explorer 8 (KB982381)

    Security Update for Windows Media Player (KB2378111)

    Security Update for Windows Media Player (KB911564)

    Security Update for Windows Media Player (KB952069)

    Security Update for Windows Media Player (KB954155)

    Security Update for Windows Media Player (KB968816)

    Security Update for Windows Media Player (KB973540)

    Security Update for Windows Media Player (KB975558)

    Security Update for Windows Media Player (KB978695)

    Security Update for Windows Media Player 10 (KB911565)

    Security Update for Windows Media Player 10 (KB917734)

    Security Update for Windows Media Player 10 (KB936782)

    Security Update for Windows Media Player 6.4 (KB925398)

    Security Update for Windows XP (KB2079403)

    Security Update for Windows XP (KB2115168)

    Security Update for Windows XP (KB2121546)

    Security Update for Windows XP (KB2160329)

    Security Update for Windows XP (KB2229593)

    Security Update for Windows XP (KB2259922)

    Security Update for Windows XP (KB2279986)

    Security Update for Windows XP (KB2286198)

    Security Update for Windows XP (KB2296011)

    Security Update for Windows XP (KB2296199)

    Security Update for Windows XP (KB2347290)

    Security Update for Windows XP (KB2360937)

    Security Update for Windows XP (KB2387149)

    Security Update for Windows XP (KB2393802)

    Security Update for Windows XP (KB2412687)

    Security Update for Windows XP (KB2419632)

    Security Update for Windows XP (KB2423089)

    Security Update for Windows XP (KB2436673)

    Security Update for Windows XP (KB2440591)

    Security Update for Windows XP (KB2443105)

    Security Update for Windows XP (KB2476490)

    Security Update for Windows XP (KB2476687)

    Security Update for Windows XP (KB2478960)

    Security Update for Windows XP (KB2478971)

    Security Update for Windows XP (KB2479628)

    Security Update for Windows XP (KB2479943)

    Security Update for Windows XP (KB2481109)

    Security Update for Windows XP (KB2483185)

    Security Update for Windows XP (KB2485376)

    Security Update for Windows XP (KB2485663)

    Security Update for Windows XP (KB2503658)

    Security Update for Windows XP (KB2503665)

    Security Update for Windows XP (KB2506212)

    Security Update for Windows XP (KB2506223)

    Security Update for Windows XP (KB2507618)

    Security Update for Windows XP (KB2507938)

    Security Update for Windows XP (KB2508272)

    Security Update for Windows XP (KB2508429)

    Security Update for Windows XP (KB2509553)

    Security Update for Windows XP (KB2511455)

    Security Update for Windows XP (KB2524375)

    Security Update for Windows XP (KB2535512)

    Security Update for Windows XP (KB2536276-v2)

    Security Update for Windows XP (KB2536276)

    Security Update for Windows XP (KB2544893-v2)

    Security Update for Windows XP (KB2544893)

    Security Update for Windows XP (KB2555917)

    Security Update for Windows XP (KB2562937)

    Security Update for Windows XP (KB2566454)

    Security Update for Windows XP (KB2567680)

    Security Update for Windows XP (KB2570222)

    Security Update for Windows XP (KB2570947)

    Security Update for Windows XP (KB2584146)

    Security Update for Windows XP (KB2585542)

    Security Update for Windows XP (KB2592799)

    Security Update for Windows XP (KB2598479)

    Security Update for Windows XP (KB2603381)

    Security Update for Windows XP (KB2618451)

    Security Update for Windows XP (KB2619339)

    Security Update for Windows XP (KB2620712)

    Security Update for Windows XP (KB2624667)

    Security Update for Windows XP (KB2631813)

    Security Update for Windows XP (KB2633171)

    Security Update for Windows XP (KB2639417)

    Security Update for Windows XP (KB2646524)

    Security Update for Windows XP (KB923561)

    Security Update for Windows XP (KB923689)

    Security Update for Windows XP (KB938464)

    Security Update for Windows XP (KB941569)

    Security Update for Windows XP (KB946648)

    Security Update for Windows XP (KB950760)

    Security Update for Windows XP (KB950762)

    Security Update for Windows XP (KB950974)

    Security Update for Windows XP (KB951066)

    Security Update for Windows XP (KB951376-v2)

    Security Update for Windows XP (KB951376)

    Security Update for Windows XP (KB951698)

    Security Update for Windows XP (KB951748)

    Security Update for Windows XP (KB952004)

    Security Update for Windows XP (KB952954)

    Security Update for Windows XP (KB953839)

    Security Update for Windows XP (KB954211)

    Security Update for Windows XP (KB954459)

    Security Update for Windows XP (KB954600)

    Security Update for Windows XP (KB955069)

    Security Update for Windows XP (KB956391)

    Security Update for Windows XP (KB956572)

    Security Update for Windows XP (KB956744)

    Security Update for Windows XP (KB956802)

    Security Update for Windows XP (KB956803)

    Security Update for Windows XP (KB956841)

    Security Update for Windows XP (KB956844)

    Security Update for Windows XP (KB957095)

    Security Update for Windows XP (KB957097)

    Security Update for Windows XP (KB958644)

    Security Update for Windows XP (KB958687)

    Security Update for Windows XP (KB958690)

    Security Update for Windows XP (KB958869)

    Security Update for Windows XP (KB959426)

    Security Update for Windows XP (KB960225)

    Security Update for Windows XP (KB960715)

    Security Update for Windows XP (KB960803)

    Security Update for Windows XP (KB960859)

    Security Update for Windows XP (KB961371)

    Security Update for Windows XP (KB961373)

    Security Update for Windows XP (KB961501)

    Security Update for Windows XP (KB968537)

    Security Update for Windows XP (KB969059)

    Security Update for Windows XP (KB969898)

    Security Update for Windows XP (KB969947)

    Security Update for Windows XP (KB970238)

    Security Update for Windows XP (KB970430)

    Security Update for Windows XP (KB971468)

    Security Update for Windows XP (KB971486)

    Security Update for Windows XP (KB971557)

    Security Update for Windows XP (KB971633)

    Security Update for Windows XP (KB971657)

    Security Update for Windows XP (KB972270)

    Security Update for Windows XP (KB973346)

    Security Update for Windows XP (KB973354)

    Security Update for Windows XP (KB973507)

    Security Update for Windows XP (KB973525)

    Security Update for Windows XP (KB973869)

    Security Update for Windows XP (KB973904)

    Security Update for Windows XP (KB974112)

    Security Update for Windows XP (KB974318)

    Security Update for Windows XP (KB974392)

    Security Update for Windows XP (KB974571)

    Security Update for Windows XP (KB975025)

    Security Update for Windows XP (KB975467)

    Security Update for Windows XP (KB975560)

    Security Update for Windows XP (KB975561)

    Security Update for Windows XP (KB975562)

    Security Update for Windows XP (KB975713)

    Security Update for Windows XP (KB977165)

    Security Update for Windows XP (KB977816)

    Security Update for Windows XP (KB977914)

    Security Update for Windows XP (KB978037)

    Security Update for Windows XP (KB978251)

    Security Update for Windows XP (KB978262)

    Security Update for Windows XP (KB978338)

    Security Update for Windows XP (KB978542)

    Security Update for Windows XP (KB978601)

    Security Update for Windows XP (KB978706)

    Security Update for Windows XP (KB979309)

    Security Update for Windows XP (KB979482)

    Security Update for Windows XP (KB979559)

    Security Update for Windows XP (KB979683)

    Security Update for Windows XP (KB979687)

    Security Update for Windows XP (KB980195)

    Security Update for Windows XP (KB980218)

    Security Update for Windows XP (KB980232)

    Security Update for Windows XP (KB980436)

    Security Update for Windows XP (KB981322)

    Security Update for Windows XP (KB981852)

    Security Update for Windows XP (KB981957)

    Security Update for Windows XP (KB981997)

    Security Update for Windows XP (KB982132)

    Security Update for Windows XP (KB982214)

    Security Update for Windows XP (KB982665)

    Security Update for Windows XP (KB982802)

    SmartMusic 2012a

    Sonic MyDVD

    Sonic PrimeTime

    Sonic RecordNow!

    Sonic UDF Reader

    Sonic Update Manager

    SonicStage 4.0

    Sound Blaster Audigy 2

    The GIMP 1.2.5-20030729-1

    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

    Update for Windows Internet Explorer 8 (KB971930)

    Update for Windows Internet Explorer 8 (KB976662)

    Update for Windows Internet Explorer 8 (KB976749)

    Update for Windows Internet Explorer 8 (KB980182)

    Update for Windows XP (KB2141007)

    Update for Windows XP (KB2345886)

    Update for Windows XP (KB2467659)

    Update for Windows XP (KB2541763)

    Update for Windows XP (KB2607712)

    Update for Windows XP (KB2641690)

    Update for Windows XP (KB951072-v2)

    Update for Windows XP (KB951978)

    Update for Windows XP (KB955759)

    Update for Windows XP (KB955839)

    Update for Windows XP (KB967715)

    Update for Windows XP (KB968389)

    Update for Windows XP (KB971029)

    Update for Windows XP (KB971737)

    Update for Windows XP (KB973687)

    Update for Windows XP (KB973815)

    Upromise TurboSaver (remove only)

    VoiceOver Kit

    WD Diagnostics

    WebFldrs XP

    Webshots Desktop

    Windows Defender

    Windows Defender Signatures

    Windows Genuine Advantage Notifications (KB905474)

    Windows Genuine Advantage v1.3.0254.0

    Windows Genuine Advantage Validation Tool (KB892130)

    Windows Imaging Component

    Windows Internet Explorer 7

    Windows Internet Explorer 8

    Windows Media Connect

    Windows Media Format Runtime

    Windows Media Format SDK Hotfix - KB891122

    Windows Media Player 10

    Windows Presentation Foundation

    Windows XP Service Pack 3

    XML Paper Specification Shared Components Pack 1.0

    Xvid 1.2.2 final uninstall

    Zoo Tycoon Expanded

    .

    ==== Event Viewer Messages From Past Week ========

    .

    7/6/2012 5:02:54 AM, error: Print [19] - Sharing printer failed + 1722, Printer PDF995 share name Printer.

    7/4/2012 10:10:47 PM, error: Service Control Manager [7000] - The SupportSoft Sprocket Service (dellsupportcenter) service failed to start due to the following error: The system cannot find the file specified.

    7/4/2012 10:10:47 PM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified.

    7/4/2012 10:10:47 PM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified.

    7/4/2012 10:06:29 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the w32time service.

    7/4/2012 10:05:56 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.

    7/3/2012 8:43:27 AM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: %%2149896199

    7/3/2012 8:27:07 AM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.

    7/3/2012 5:37:01 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the RasMan service.

    .

    ==== End Of File ===========================

    Ad network traffic, slow internet connection

    in Resolved Malware Removal Logs

    Posted

    Decided to try to clean per your instructions...multiple replies due to post too long...

    TDSSKiller Log

    ============

    22:46:43.0687 4576 TDSS rootkit removing tool 2.7.44.0 Jul 2 2012 20:01:08

    22:46:45.0687 4576 ============================================================

    22:46:45.0687 4576 Current date / time: 2012/07/05 22:46:45.0687

    22:46:45.0687 4576 SystemInfo:

    22:46:45.0687 4576

    22:46:45.0687 4576 OS Version: 5.1.2600 ServicePack: 3.0

    22:46:45.0687 4576 Product type: Workstation

    22:46:45.0687 4576 ComputerName: REYNOLDS

    22:46:45.0687 4576 UserName: Jim

    22:46:45.0687 4576 Windows directory: C:\WINDOWS

    22:46:45.0687 4576 System windows directory: C:\WINDOWS

    22:46:45.0687 4576 Processor architecture: Intel x86

    22:46:45.0687 4576 Number of processors: 1

    22:46:45.0687 4576 Page size: 0x1000

    22:46:45.0687 4576 Boot type: Normal boot

    22:46:45.0687 4576 ============================================================

    22:46:48.0468 4576 Drive \Device\Harddisk0\DR0 - Size: 0x1BF08EB000 (111.76 Gb), SectorSize: 0x200, Cylinders: 0x38FD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

    22:46:48.0625 4576 ============================================================

    22:46:48.0625 4576 \Device\Harddisk0\DR0:

    22:46:48.0625 4576 MBR partitions:

    22:46:48.0625 4576 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0xFB04, BlocksNum 0xDF741B9

    22:46:48.0625 4576 ============================================================

    22:46:48.0687 4576 C: <-> \Device\Harddisk0\DR0\Partition0

    22:46:48.0687 4576 ============================================================

    22:46:48.0687 4576 Initialize success

    22:46:48.0687 4576 ============================================================

    22:47:15.0031 5896 ============================================================

    22:47:15.0031 5896 Scan started

    22:47:15.0031 5896 Mode: Manual; SigCheck; TDLFS;

    22:47:15.0031 5896 ============================================================

    22:47:15.0453 5896 Abiosdsk - ok

    22:47:15.0500 5896 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS

    22:47:18.0062 5896 abp480n5 - ok

    22:47:18.0109 5896 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

    22:47:18.0390 5896 ACPI - ok

    22:47:18.0421 5896 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

    22:47:18.0625 5896 ACPIEC - ok

    22:47:18.0640 5896 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\System32\DRIVERS\adpu160m.sys

    22:47:18.0859 5896 adpu160m - ok

    22:47:18.0906 5896 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys

    22:47:18.0984 5896 aeaudio - ok

    22:47:19.0031 5896 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

    22:47:19.0203 5896 aec - ok

    22:47:19.0250 5896 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

    22:47:19.0312 5896 AFD - ok

    22:47:19.0375 5896 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\System32\DRIVERS\agp440.sys

    22:47:19.0562 5896 agp440 - ok

    22:47:19.0593 5896 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\System32\DRIVERS\agpCPQ.sys

    22:47:19.0781 5896 agpCPQ - ok

    22:47:19.0812 5896 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\System32\DRIVERS\aha154x.sys

    22:47:19.0953 5896 Aha154x - ok

    22:47:19.0984 5896 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\System32\DRIVERS\aic78u2.sys

    22:47:20.0187 5896 aic78u2 - ok

    22:47:20.0203 5896 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\System32\DRIVERS\aic78xx.sys

    22:47:20.0390 5896 aic78xx - ok

    22:47:20.0437 5896 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll

    22:47:20.0625 5896 Alerter - ok

    22:47:20.0656 5896 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe

    22:47:20.0843 5896 ALG - ok

    22:47:20.0875 5896 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\System32\DRIVERS\aliide.sys

    22:47:21.0078 5896 AliIde - ok

    22:47:21.0109 5896 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\System32\DRIVERS\alim1541.sys

    22:47:21.0296 5896 alim1541 - ok

    22:47:21.0343 5896 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\System32\DRIVERS\amdagp.sys

    22:47:21.0640 5896 amdagp - ok

    22:47:21.0671 5896 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\System32\DRIVERS\amsint.sys

    22:47:21.0781 5896 amsint - ok

    22:47:22.0015 5896 AOL ACS (73d675514f148b1e69429e1d95e22adc) C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

    22:47:22.0187 5896 AOL ACS ( UnsignedFile.Multi.Generic ) - warning

    22:47:22.0187 5896 AOL ACS - detected UnsignedFile.Multi.Generic (1)

    22:47:22.0250 5896 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    22:47:22.0265 5896 Apple Mobile Device - ok

    22:47:22.0421 5896 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll

    22:47:22.0593 5896 AppMgmt - ok

    22:47:22.0671 5896 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

    22:47:22.0875 5896 Arp1394 - ok

    22:47:22.0890 5896 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\System32\DRIVERS\asc.sys

    22:47:23.0125 5896 asc - ok

    22:47:23.0140 5896 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\System32\DRIVERS\asc3350p.sys

    22:47:23.0234 5896 asc3350p - ok

    22:47:23.0265 5896 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\System32\DRIVERS\asc3550.sys

    22:47:23.0484 5896 asc3550 - ok

    22:47:23.0593 5896 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

    22:47:23.0656 5896 aspnet_state - ok

    22:47:23.0687 5896 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

    22:47:23.0875 5896 AsyncMac - ok

    22:47:23.0937 5896 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

    22:47:24.0109 5896 atapi - ok

    22:47:24.0125 5896 Atdisk - ok

    22:47:24.0187 5896 Ati HotKey Poller (0715fd85c9dbbc18346a7da07873d298) C:\WINDOWS\System32\Ati2evxx.exe

    22:47:24.0265 5896 Ati HotKey Poller - ok

    22:47:24.0359 5896 ati2mtag (2d30381d718228d2841cf962e9e86499) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

    22:47:24.0468 5896 ati2mtag - ok

    22:47:24.0500 5896 atinevxx (d335e45bfa1bf0bf93a8d3c15d1fc0e1) C:\WINDOWS\system32\DRIVERS\atinevxx.sys

    22:47:24.0546 5896 atinevxx - ok

    22:47:24.0609 5896 ATITUNEP (4e09c36d16c5c310e9e8065385e743c2) C:\WINDOWS\system32\DRIVERS\atineuxx.sys

    22:47:24.0640 5896 ATITUNEP - ok

    22:47:24.0671 5896 ativraxx (866332d193898755dc955a4ad111ac89) C:\WINDOWS\system32\DRIVERS\atinraxx.sys

    22:47:24.0718 5896 ativraxx - ok

    22:47:24.0734 5896 ATIXSAudio (2bf5f72ad56964451b2e7b22aae389d1) C:\WINDOWS\system32\DRIVERS\atinesxx.sys

    22:47:24.0781 5896 ATIXSAudio - ok

    22:47:24.0812 5896 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

    22:47:25.0015 5896 Atmarpc - ok

    22:47:25.0046 5896 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll

    22:47:25.0250 5896 AudioSrv - ok

    22:47:25.0281 5896 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

    22:47:25.0484 5896 audstub - ok

    22:47:25.0593 5896 BCMModem (41347688046d49cde0f6d138a534f73d) C:\WINDOWS\system32\DRIVERS\BCMSM.sys

    22:47:25.0781 5896 BCMModem - ok

    22:47:25.0843 5896 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

    22:47:26.0078 5896 Beep - ok

    22:47:26.0359 5896 BHDrvx86 (a9e111a358ac5f7eba7ac61e43fc6725) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20120619.001\BHDrvx86.sys

    22:47:26.0484 5896 BHDrvx86 - ok

    22:47:26.0546 5896 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll

    22:47:26.0843 5896 BITS - ok

    22:47:26.0953 5896 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe

    22:47:26.0984 5896 Bonjour Service - ok

    22:47:27.0031 5896 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll

    22:47:27.0250 5896 Browser - ok

    22:47:27.0296 5896 bvrp_pci - ok

    22:47:27.0359 5896 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\System32\DRIVERS\cbidf2k.sys

    22:47:27.0671 5896 cbidf - ok

    22:47:27.0687 5896 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

    22:47:27.0906 5896 cbidf2k - ok

    22:47:27.0937 5896 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

    22:47:28.0140 5896 CCDECODE - ok

    22:47:28.0171 5896 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\System32\DRIVERS\cd20xrnt.sys

    22:47:28.0250 5896 cd20xrnt - ok

    22:47:28.0296 5896 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

    22:47:28.0500 5896 Cdaudio - ok

    22:47:28.0531 5896 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

    22:47:28.0718 5896 Cdfs - ok

    22:47:28.0750 5896 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

    22:47:28.0937 5896 Cdrom - ok

    22:47:28.0953 5896 Changer - ok

    22:47:29.0000 5896 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe

    22:47:29.0187 5896 CiSvc - ok

    22:47:29.0234 5896 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe

    22:47:29.0406 5896 ClipSrv - ok

    22:47:29.0515 5896 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

    22:47:29.0578 5896 clr_optimization_v2.0.50727_32 - ok

    22:47:29.0609 5896 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\System32\DRIVERS\cmdide.sys

    22:47:29.0828 5896 CmdIde - ok

    22:47:29.0859 5896 COMSysApp - ok

    22:47:29.0906 5896 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\System32\DRIVERS\cpqarray.sys

    22:47:30.0125 5896 Cpqarray - ok

    22:47:30.0171 5896 Creative Service for CDROM Access (3c8b6609712f4ff78e521f6dcfc4032b) C:\WINDOWS\System32\CTsvcCDA.exe

    22:47:30.0187 5896 Creative Service for CDROM Access ( UnsignedFile.Multi.Generic ) - warning

    22:47:30.0187 5896 Creative Service for CDROM Access - detected UnsignedFile.Multi.Generic (1)

    22:47:30.0234 5896 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll

    22:47:30.0406 5896 CryptSvc - ok

    22:47:30.0453 5896 ctac32k (4c638290979600ae2ae329d1608ad2ec) C:\WINDOWS\system32\drivers\ctac32k.sys

    22:47:30.0500 5896 ctac32k - ok

    22:47:30.0562 5896 ctaud2k (cf5662375781f741513c169cd4094100) C:\WINDOWS\system32\drivers\ctaud2k.sys

    22:47:30.0625 5896 ctaud2k - ok

    22:47:30.0687 5896 ctdvda2k (437f2b31ba8b6b264d38b4fe6682faec) C:\WINDOWS\system32\drivers\ctdvda2k.sys

    22:47:30.0765 5896 ctdvda2k - ok

    22:47:30.0812 5896 ctprxy2k (678849d1af0750f68dbdc185252d5926) C:\WINDOWS\system32\drivers\ctprxy2k.sys

    22:47:30.0828 5896 ctprxy2k - ok

    22:47:30.0875 5896 ctsfm2k (3a076ebfbbbd6879a78863944980da32) C:\WINDOWS\system32\drivers\ctsfm2k.sys

    22:47:30.0906 5896 ctsfm2k - ok

    22:47:30.0937 5896 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\System32\DRIVERS\dac2w2k.sys

    22:47:31.0156 5896 dac2w2k - ok

    22:47:31.0187 5896 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\System32\DRIVERS\dac960nt.sys

    22:47:31.0406 5896 dac960nt - ok

    22:47:31.0484 5896 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll

    22:47:31.0578 5896 DcomLaunch - ok

    22:47:31.0593 5896 DgiVecp - ok

    22:47:31.0671 5896 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll

    22:47:31.0859 5896 Dhcp - ok

    22:47:31.0921 5896 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

    22:47:32.0093 5896 Disk - ok

    22:47:32.0109 5896 dmadmin - ok

    22:47:32.0203 5896 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

    22:47:32.0406 5896 dmboot - ok

    22:47:32.0453 5896 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

    22:47:32.0640 5896 dmio - ok

    22:47:32.0656 5896 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

    22:47:32.0875 5896 dmload - ok

    22:47:32.0937 5896 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll

    22:47:33.0093 5896 dmserver - ok

    22:47:33.0140 5896 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

    22:47:33.0312 5896 DMusic - ok

    22:47:33.0359 5896 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll

    22:47:33.0453 5896 Dnscache - ok

    22:47:33.0500 5896 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll

    22:47:33.0687 5896 Dot3svc - ok

    22:47:33.0718 5896 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\System32\DRIVERS\dpti2o.sys

    22:47:33.0937 5896 dpti2o - ok

    22:47:34.0000 5896 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

    22:47:34.0187 5896 drmkaud - ok

    22:47:34.0234 5896 drvmcdb (b15f9e526ba511a48b1b1b8537815740) C:\WINDOWS\system32\drivers\drvmcdb.sys

    22:47:34.0265 5896 drvmcdb ( UnsignedFile.Multi.Generic ) - warning

    22:47:34.0265 5896 drvmcdb - detected UnsignedFile.Multi.Generic (1)

    22:47:34.0296 5896 drvnddm (b295700e684ed1984db1d6be40354421) C:\WINDOWS\system32\drivers\drvnddm.sys

    22:47:34.0296 5896 drvnddm ( UnsignedFile.Multi.Generic ) - warning

    22:47:34.0296 5896 drvnddm - detected UnsignedFile.Multi.Generic (1)

    22:47:34.0406 5896 DSBrokerService (fe80901578e7e3da70299a5aeb2b7fbd) C:\Program Files\DellSupport\brkrsvc.exe

    22:47:34.0421 5896 DSBrokerService - ok

    22:47:34.0484 5896 DSproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys

    22:47:34.0500 5896 DSproct ( UnsignedFile.Multi.Generic ) - warning

    22:47:34.0500 5896 DSproct - detected UnsignedFile.Multi.Generic (1)

    22:47:34.0531 5896 dsunidrv (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys

    22:47:34.0578 5896 dsunidrv - ok

    22:47:34.0640 5896 E100B (95974e66d3de4951d29e28e8bc0b644c) C:\WINDOWS\system32\DRIVERS\e100b325.sys

    22:47:34.0765 5896 E100B - ok

    22:47:34.0812 5896 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll

    22:47:35.0015 5896 EapHost - ok

    22:47:35.0156 5896 eeCtrl (fce87ba643d5e9a8b6e0378508d1b22d) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys

    22:47:35.0265 5896 eeCtrl - ok

    22:47:35.0343 5896 ehSched (f6d494d609d52a0e9596756c5540a978) C:\WINDOWS\ehome\ehSched.exe

    22:47:35.0515 5896 ehSched - ok

    22:47:35.0562 5896 EL90XBC (6e883bf518296a40959131c2304af714) C:\WINDOWS\system32\DRIVERS\el90xbc5.sys

    22:47:35.0796 5896 EL90XBC - ok

    22:47:35.0859 5896 emupia (f7511cf63ef82f7227c03028a3abadb5) C:\WINDOWS\system32\drivers\emupia2k.sys

    22:47:35.0906 5896 emupia - ok

    22:47:35.0953 5896 EraserUtilRebootDrv (115dc729465a8c386615207f28875255) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

    22:47:35.0968 5896 EraserUtilRebootDrv - ok

    22:47:36.0015 5896 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll

    22:47:36.0218 5896 ERSvc - ok

    22:47:36.0265 5896 EUSBMSD (3dc945a9abbfb2ecf268eed276e05fec) C:\WINDOWS\system32\DRIVERS\EUSBMSD.SYS

    22:47:36.0296 5896 EUSBMSD - ok

    22:47:36.0359 5896 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

    22:47:36.0406 5896 Eventlog - ok

    22:47:36.0453 5896 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\System32\es.dll

    22:47:36.0531 5896 EventSystem - ok

    22:47:36.0562 5896 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

    22:47:36.0765 5896 Fastfat - ok

    22:47:36.0812 5896 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

    22:47:36.0921 5896 FastUserSwitchingCompatibility - ok

    22:47:36.0984 5896 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

    22:47:37.0156 5896 Fdc - ok

    22:47:37.0187 5896 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

    22:47:37.0421 5896 Fips - ok

    22:47:37.0468 5896 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

    22:47:37.0640 5896 Flpydisk - ok

    22:47:37.0703 5896 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

    22:47:37.0875 5896 FltMgr - ok

    22:47:38.0000 5896 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

    22:47:38.0015 5896 FontCache3.0.0.0 - ok

    22:47:38.0062 5896 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

    22:47:38.0265 5896 Fs_Rec - ok

    22:47:38.0328 5896 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

    22:47:38.0531 5896 Ftdisk - ok

    22:47:38.0578 5896 GEARAspiWDM (5ae3a887ece5bbb72cfab273c2fd1cfa) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

    22:47:38.0609 5896 GEARAspiWDM - ok

    22:47:38.0687 5896 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

    22:47:38.0859 5896 Gpc - ok

    22:47:38.0968 5896 gupdate (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe

    22:47:38.0984 5896 gupdate - ok

    22:47:39.0000 5896 gupdatem (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe

    22:47:39.0031 5896 gupdatem - ok

    22:47:39.0109 5896 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    22:47:39.0125 5896 gusvc - ok

    22:47:39.0234 5896 ha10kx2k (f24dd43adc784177b28984043bc022ab) C:\WINDOWS\system32\drivers\ha10kx2k.sys

    22:47:39.0312 5896 ha10kx2k - ok

    22:47:39.0328 5896 hap16v2k (ff65c807ea641ff7310a61be4dec6479) C:\WINDOWS\system32\drivers\hap16v2k.sys

    22:47:39.0359 5896 hap16v2k - ok

    22:47:39.0453 5896 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll

    22:47:39.0625 5896 helpsvc - ok

    22:47:39.0687 5896 HidIr (bb1a6fb7d35a91e599973fa74a619056) C:\WINDOWS\system32\DRIVERS\hidir.sys

    22:47:39.0859 5896 HidIr - ok

    22:47:39.0906 5896 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll

    22:47:40.0078 5896 HidServ - ok

    22:47:40.0125 5896 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

    22:47:40.0281 5896 HidUsb - ok

    22:47:40.0343 5896 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll

    22:47:40.0515 5896 hkmsvc - ok

    22:47:40.0546 5896 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\System32\DRIVERS\hpn.sys

    22:47:40.0750 5896 hpn - ok

    22:47:40.0812 5896 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

    22:47:40.0859 5896 HTTP - ok

    22:47:40.0890 5896 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll

    22:47:41.0078 5896 HTTPFilter - ok

    22:47:41.0109 5896 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys

    22:47:41.0281 5896 i2omgmt - ok

    22:47:41.0312 5896 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\System32\DRIVERS\i2omp.sys

    22:47:41.0703 5896 i2omp - ok

    22:47:41.0750 5896 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

    22:47:41.0921 5896 i8042prt - ok

    22:47:42.0078 5896 IDriverT (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    22:47:42.0109 5896 IDriverT ( UnsignedFile.Multi.Generic ) - warning

    22:47:42.0109 5896 IDriverT - detected UnsignedFile.Multi.Generic (1)

    22:47:42.0296 5896 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

    22:47:42.0390 5896 idsvc - ok

    22:47:42.0593 5896 IDSxpx86 (eeebf3616db90124c1c57019d39aa9a2) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20120704.001\IDSxpx86.sys

    22:47:42.0625 5896 IDSxpx86 - ok

    22:47:42.0750 5896 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

    22:47:42.0953 5896 Imapi - ok

    22:47:43.0015 5896 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe

    22:47:43.0187 5896 ImapiService - ok

    22:47:43.0234 5896 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\System32\DRIVERS\ini910u.sys

    22:47:43.0468 5896 ini910u - ok

    22:47:43.0500 5896 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\System32\DRIVERS\intelide.sys

    22:47:43.0671 5896 IntelIde - ok

    22:47:43.0734 5896 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

    22:47:43.0921 5896 intelppm - ok

    22:47:43.0968 5896 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

    22:47:44.0156 5896 Ip6Fw - ok

    22:47:44.0171 5896 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

    22:47:44.0375 5896 IpFilterDriver - ok

    22:47:44.0437 5896 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

    22:47:44.0593 5896 IpInIp - ok

    22:47:44.0625 5896 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

    22:47:44.0812 5896 IpNat - ok

    22:47:44.0953 5896 iPod Service (49918803b661367023bf325cf602afdc) C:\Program Files\iPod\bin\iPodService.exe

    22:47:45.0015 5896 iPod Service - ok

    22:47:45.0046 5896 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

    22:47:45.0234 5896 IPSec - ok

    22:47:45.0281 5896 IrBus (b43b36b382aea10861f7c7a37f9d4ae2) C:\WINDOWS\system32\DRIVERS\IrBus.sys

    22:47:45.0453 5896 IrBus - ok

    22:47:45.0500 5896 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

    22:47:45.0671 5896 IRENUM - ok

    22:47:45.0765 5896 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

    22:47:45.0953 5896 isapnp - ok

    22:47:46.0109 5896 JavaQuickStarterService (a1509ba3a5fdc5366146e92b3d130eb5) C:\Program Files\Java\jre7\bin\jqs.exe

    22:47:46.0125 5896 JavaQuickStarterService - ok

    22:47:46.0171 5896 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

    22:47:46.0343 5896 Kbdclass - ok

    22:47:46.0375 5896 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

    22:47:46.0546 5896 kbdhid - ok

    22:47:46.0625 5896 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

    22:47:46.0796 5896 kmixer - ok

    22:47:46.0859 5896 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

    22:47:46.0953 5896 KSecDD - ok

    22:47:46.0984 5896 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll

    22:47:47.0078 5896 lanmanserver - ok

    22:47:47.0140 5896 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll

    22:47:47.0203 5896 lanmanworkstation - ok

    22:47:47.0218 5896 lbrtfdc - ok

    22:47:47.0281 5896 LexBceS (5e3498f3d0146c0e275272b94369e3d2) C:\WINDOWS\system32\LEXBCES.EXE

    22:47:47.0359 5896 LexBceS - ok

    22:47:47.0421 5896 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll

    22:47:47.0593 5896 LmHosts - ok

    22:47:47.0687 5896 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    22:47:47.0734 5896 MDM - ok

    22:47:47.0781 5896 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll

    22:47:47.0984 5896 Messenger - ok

    22:47:48.0031 5896 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

    22:47:48.0250 5896 mnmdd - ok

    22:47:48.0328 5896 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\System32\mnmsrvc.exe

    22:47:48.0531 5896 mnmsrvc - ok

    22:47:48.0546 5896 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

    22:47:48.0796 5896 Modem - ok

    22:47:48.0843 5896 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys

    22:47:49.0093 5896 MODEMCSA - ok

    22:47:49.0125 5896 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

    22:47:49.0312 5896 Mouclass - ok

    22:47:49.0359 5896 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

    22:47:49.0546 5896 mouhid - ok

    22:47:49.0593 5896 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

    22:47:49.0765 5896 MountMgr - ok

    22:47:49.0796 5896 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\System32\DRIVERS\mraid35x.sys

    22:47:50.0000 5896 mraid35x - ok

    22:47:50.0062 5896 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

    22:47:50.0265 5896 MRxDAV - ok

    22:47:50.0359 5896 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

    22:47:50.0531 5896 MRxSmb - ok

    22:47:50.0703 5896 MSCSPTISRV (f1534aca143ca86cd57672953754fab0) C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

    22:47:50.0734 5896 MSCSPTISRV ( UnsignedFile.Multi.Generic ) - warning

    22:47:50.0734 5896 MSCSPTISRV - detected UnsignedFile.Multi.Generic (1)

    22:47:50.0781 5896 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\System32\msdtc.exe

    22:47:51.0000 5896 MSDTC - ok

    22:47:51.0046 5896 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

    22:47:51.0218 5896 Msfs - ok

    22:47:51.0234 5896 MSIServer - ok

    22:47:51.0265 5896 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

    22:47:51.0453 5896 MSKSSRV - ok

    22:47:51.0484 5896 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

    22:47:51.0671 5896 MSPCLOCK - ok

    22:47:51.0703 5896 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

    22:47:51.0875 5896 MSPQM - ok

    22:47:51.0921 5896 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

    22:47:52.0078 5896 mssmbios - ok

    22:47:52.0125 5896 MSSQL$MICROSOFTBCM - ok

    22:47:52.0203 5896 MSSQLServerADHelper (cb7524c21727404bd3140dca32deb7de) C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe

    22:47:52.0234 5896 MSSQLServerADHelper ( UnsignedFile.Multi.Generic ) - warning

    22:47:52.0234 5896 MSSQLServerADHelper - detected UnsignedFile.Multi.Generic (1)

    22:47:52.0265 5896 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

    22:47:52.0421 5896 MSTEE - ok

    22:47:52.0484 5896 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

    22:47:52.0531 5896 Mup - ok

    22:47:52.0562 5896 MVDCODEC (04dd08f6c43d331c238197e7deaf0d5e) C:\WINDOWS\system32\DRIVERS\atinmdxx.sys

    22:47:52.0609 5896 MVDCODEC - ok

    22:47:52.0718 5896 N360 (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    22:47:52.0750 5896 N360 - ok

    22:47:52.0796 5896 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

    22:47:52.0984 5896 NABTSFEC - ok

    22:47:53.0031 5896 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll

    22:47:53.0218 5896 napagent - ok

    22:47:53.0406 5896 NAVENG (f11033730b38260b6892e837c457fb4b) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20120704.017\NAVENG.SYS

    22:47:53.0421 5896 NAVENG - ok

    22:47:53.0578 5896 NAVEX15 (4e4e7c0259d3bb97de24a636c0e06aba) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20120704.017\NAVEX15.SYS

    22:47:53.0703 5896 NAVEX15 - ok

    22:47:53.0937 5896 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

    22:47:54.0125 5896 NDIS - ok

    22:47:54.0187 5896 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

    22:47:54.0953 5896 NdisIP - ok

    22:47:55.0000 5896 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

    22:47:55.0062 5896 NdisTapi - ok

    22:47:55.0109 5896 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

    22:47:55.0281 5896 Ndisuio - ok

    22:47:55.0328 5896 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

    22:47:55.0484 5896 NdisWan - ok

    22:47:55.0531 5896 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

    22:47:55.0578 5896 NDProxy - ok

    22:47:55.0609 5896 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

    22:47:55.0781 5896 NetBIOS - ok

    22:47:55.0843 5896 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

    22:47:56.0015 5896 NetBT - ok

    22:47:56.0078 5896 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

    22:47:56.0234 5896 NetDDE - ok

    22:47:56.0265 5896 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe

    22:47:56.0421 5896 NetDDEdsdm - ok

    22:47:56.0468 5896 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

    22:47:56.0640 5896 Netlogon - ok

    22:47:56.0718 5896 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll

    22:47:56.0906 5896 Netman - ok

    22:47:57.0062 5896 NetSvc (737351f39fef765234037770abdd72bd) C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    22:47:57.0109 5896 NetSvc ( UnsignedFile.Multi.Generic ) - warning

    22:47:57.0109 5896 NetSvc - detected UnsignedFile.Multi.Generic (1)

    22:47:57.0250 5896 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

    22:47:57.0296 5896 NetTcpPortSharing - ok

    22:47:57.0343 5896 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

    22:47:57.0515 5896 NIC1394 - ok

    22:47:57.0562 5896 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll

    22:47:57.0593 5896 Nla - ok

    22:47:57.0671 5896 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

    22:47:57.0859 5896 Npfs - ok

    22:47:57.0921 5896 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

    22:47:58.0125 5896 Ntfs - ok

    22:47:58.0171 5896 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe

    22:47:58.0312 5896 NtLmSsp - ok

    22:47:58.0406 5896 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll

    22:47:58.0593 5896 NtmsSvc - ok

    22:47:58.0625 5896 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

    22:47:58.0828 5896 Null - ok

    22:47:59.0015 5896 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

    22:47:59.0343 5896 nv - ok

    22:47:59.0453 5896 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

    22:47:59.0656 5896 NwlnkFlt - ok

    22:47:59.0687 5896 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

    22:47:59.0859 5896 NwlnkFwd - ok

    22:47:59.0890 5896 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

    22:48:00.0062 5896 ohci1394 - ok

    22:48:00.0125 5896 omci (53d5f1278d9edb21689bbbcecc09108d) C:\WINDOWS\system32\DRIVERS\omci.sys

    22:48:00.0140 5896 omci ( UnsignedFile.Multi.Generic ) - warning

    22:48:00.0140 5896 omci - detected UnsignedFile.Multi.Generic (1)

    22:48:00.0281 5896 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

    22:48:00.0312 5896 ose - ok

    22:48:00.0359 5896 ossrv (f0184fe6069be1541a3d18c02a73d161) C:\WINDOWS\system32\drivers\ctoss2k.sys

    22:48:00.0375 5896 ossrv - ok

    22:48:00.0453 5896 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys

    22:48:00.0625 5896 P3 - ok

    22:48:00.0718 5896 PACSPTISVR (17bb6b38de8c2bda692ca1db0cea7325) C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

    22:48:00.0765 5896 PACSPTISVR ( UnsignedFile.Multi.Generic ) - warning

    22:48:00.0765 5896 PACSPTISVR - detected UnsignedFile.Multi.Generic (1)

    22:48:00.0937 5896 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

    22:48:01.0218 5896 Parport - ok

    22:48:01.0234 5896 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

    22:48:01.0421 5896 PartMgr - ok

    22:48:01.0453 5896 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

    22:48:01.0656 5896 ParVdm - ok

    22:48:01.0687 5896 PCDCODEC (1a3e460843151029f98f87274fbb40ca) C:\WINDOWS\system32\DRIVERS\atinpdxx.sys

    22:48:01.0734 5896 PCDCODEC - ok

    22:48:01.0765 5896 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

    22:48:01.0921 5896 PCI - ok

    22:48:01.0953 5896 PCIDump - ok

    22:48:01.0968 5896 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

    22:48:02.0171 5896 PCIIde - ok

    22:48:02.0234 5896 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

    22:48:02.0421 5896 Pcmcia - ok

    22:48:02.0453 5896 PDCOMP - ok

    22:48:02.0500 5896 PDFRAME - ok

    22:48:02.0515 5896 PDRELI - ok

    22:48:02.0531 5896 PDRFRAME - ok

    22:48:02.0625 5896 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\System32\DRIVERS\perc2.sys

    22:48:02.0875 5896 perc2 - ok

    22:48:02.0921 5896 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\System32\DRIVERS\perc2hib.sys

    22:48:03.0171 5896 perc2hib - ok

    22:48:03.0234 5896 PfModNT (c8a2d6ff660ac601b7bb9a9b16a5c25e) C:\WINDOWS\System32\drivers\PfModNT.sys

    22:48:03.0281 5896 PfModNT - ok

    22:48:03.0328 5896 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe

    22:48:03.0359 5896 PlugPlay - ok

    22:48:03.0390 5896 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

    22:48:03.0656 5896 PolicyAgent - ok

    22:48:03.0703 5896 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

    22:48:03.0906 5896 PptpMiniport - ok

    22:48:03.0937 5896 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

    22:48:04.0125 5896 Processor - ok

    22:48:04.0125 5896 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

    22:48:04.0296 5896 ProtectedStorage - ok

    22:48:04.0343 5896 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

    22:48:04.0515 5896 PSched - ok

    22:48:04.0546 5896 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

    22:48:04.0734 5896 Ptilink - ok

    22:48:04.0796 5896 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys

    22:48:04.0828 5896 PxHelp20 - ok

    22:48:04.0859 5896 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\System32\DRIVERS\ql1080.sys

    22:48:05.0046 5896 ql1080 - ok

    22:48:05.0078 5896 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\System32\DRIVERS\ql10wnt.sys

    22:48:05.0281 5896 Ql10wnt - ok

    22:48:05.0312 5896 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\System32\DRIVERS\ql12160.sys

    22:48:05.0468 5896 ql12160 - ok

    22:48:05.0515 5896 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\System32\DRIVERS\ql1240.sys

    22:48:05.0718 5896 ql1240 - ok

    22:48:05.0750 5896 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\System32\DRIVERS\ql1280.sys

    22:48:06.0000 5896 ql1280 - ok

    22:48:06.0031 5896 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

    22:48:06.0218 5896 RasAcd - ok

    22:48:06.0296 5896 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll

    22:48:06.0546 5896 RasAuto - ok

    22:48:06.0562 5896 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

    22:48:06.0734 5896 Rasl2tp - ok

    22:48:06.0781 5896 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll

    22:48:06.0953 5896 RasMan - ok

    22:48:06.0984 5896 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

    22:48:07.0156 5896 RasPppoe - ok

    22:48:07.0187 5896 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

    22:48:07.0359 5896 Raspti - ok

    22:48:07.0406 5896 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

    22:48:07.0578 5896 Rdbss - ok

    22:48:07.0625 5896 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

    22:48:07.0828 5896 RDPCDD - ok

    22:48:07.0890 5896 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

    22:48:08.0109 5896 rdpdr - ok

    22:48:08.0156 5896 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys

    22:48:08.0218 5896 RDPWD - ok

    22:48:08.0265 5896 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe

    22:48:08.0453 5896 RDSessMgr - ok

    22:48:08.0500 5896 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

    22:48:08.0671 5896 redbook - ok

    22:48:08.0734 5896 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll

    22:48:08.0921 5896 RemoteAccess - ok

    22:48:08.0984 5896 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll

    22:48:09.0156 5896 RemoteRegistry - ok

    22:48:09.0218 5896 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\System32\locator.exe

    22:48:10.0015 5896 RpcLocator - ok

    22:48:10.0062 5896 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll

    22:48:10.0093 5896 RpcSs - ok

    22:48:10.0140 5896 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\System32\rsvp.exe

    22:48:10.0359 5896 RSVP - ok

    22:48:10.0406 5896 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe

    22:48:10.0562 5896 SamSs - ok

    22:48:10.0609 5896 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe

    22:48:10.0765 5896 SCardSvr - ok

    22:48:10.0812 5896 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll

    22:48:11.0000 5896 Schedule - ok

    22:48:11.0046 5896 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

    22:48:11.0234 5896 Secdrv - ok

    22:48:11.0265 5896 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll

    22:48:11.0437 5896 seclogon - ok

    22:48:11.0484 5896 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll

    22:48:11.0656 5896 SENS - ok

    22:48:11.0703 5896 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

    22:48:12.0000 5896 serenum - ok

    22:48:12.0046 5896 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

    22:48:12.0234 5896 Serial - ok

    22:48:12.0343 5896 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

    22:48:12.0531 5896 Sfloppy - ok

    22:48:12.0640 5896 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll

    22:48:12.0875 5896 SharedAccess - ok

    22:48:12.0921 5896 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

    22:48:12.0953 5896 ShellHWDetection - ok

    22:48:12.0968 5896 Simbad - ok

    22:48:13.0000 5896 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\System32\DRIVERS\sisagp.sys

    22:48:13.0156 5896 sisagp - ok

    22:48:13.0187 5896 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

    22:48:13.0375 5896 SLIP - ok

    22:48:13.0468 5896 smwdm (39f9595d2f6f7eb93f45a466789a6f49) C:\WINDOWS\system32\drivers\smwdm.sys

    22:48:13.0609 5896 smwdm - ok

    22:48:13.0640 5896 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\System32\DRIVERS\sparrow.sys

    22:48:13.0750 5896 Sparrow - ok

    22:48:13.0796 5896 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

    22:48:13.0953 5896 splitter - ok

    22:48:14.0015 5896 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe

    22:48:14.0093 5896 Spooler - ok

    22:48:14.0171 5896 sprtsvc_dellsupportcenter - ok

    22:48:14.0359 5896 SPTISRV (3980b48dff300a7e4139f5c64da65f5c) C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

    22:48:14.0390 5896 SPTISRV ( UnsignedFile.Multi.Generic ) - warning

    22:48:14.0390 5896 SPTISRV - detected UnsignedFile.Multi.Generic (1)

    22:48:14.0421 5896 SQLAgent$MICROSOFTBCM - ok

    22:48:14.0484 5896 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

    22:48:14.0656 5896 sr - ok

    22:48:14.0703 5896 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll

    22:48:14.0890 5896 srservice - ok

    22:48:15.0031 5896 SRTSP (83726cf02eced69138948083e06b6eac) C:\WINDOWS\System32\Drivers\N360\0502010.003\SRTSP.SYS

    22:48:15.0093 5896 SRTSP - ok

    22:48:15.0140 5896 SRTSPX (4e7eab2e5615d39cf1f1df9c71e5e225) C:\WINDOWS\system32\drivers\N360\0502010.003\SRTSPX.SYS

    22:48:15.0156 5896 SRTSPX - ok

    22:48:15.0234 5896 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

    22:48:15.0343 5896 Srv - ok

    22:48:15.0390 5896 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys

    22:48:15.0406 5896 sscdbhk5 ( UnsignedFile.Multi.Generic ) - warning

    22:48:15.0406 5896 sscdbhk5 - detected UnsignedFile.Multi.Generic (1)

    22:48:15.0453 5896 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll

    22:48:15.0640 5896 SSDPSRV - ok

    22:48:15.0671 5896 SSPORT - ok

    22:48:15.0687 5896 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys

    22:48:15.0703 5896 ssrtln ( UnsignedFile.Multi.Generic ) - warning

    22:48:15.0703 5896 ssrtln - detected UnsignedFile.Multi.Generic (1)

    22:48:15.0875 5896 SSScsiSV (3dbade5b4aa47c245a69e99d72b8e73b) C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

    22:48:15.0906 5896 SSScsiSV ( UnsignedFile.Multi.Generic ) - warning

    22:48:15.0906 5896 SSScsiSV - detected UnsignedFile.Multi.Generic (1)

    22:48:15.0984 5896 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll

    22:48:16.0218 5896 stisvc - ok

    22:48:16.0265 5896 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

    22:48:16.0437 5896 streamip - ok

    22:48:16.0484 5896 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

    22:48:16.0656 5896 swenum - ok

    22:48:16.0687 5896 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

    22:48:16.0859 5896 swmidi - ok

    22:48:16.0875 5896 SwPrv - ok

    22:48:16.0921 5896 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\System32\DRIVERS\symc810.sys

    22:48:17.0125 5896 symc810 - ok

    22:48:17.0156 5896 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\System32\DRIVERS\symc8xx.sys

    22:48:17.0359 5896 symc8xx - ok

    22:48:17.0437 5896 SymDS (9bbeb8c6258e72d62e7560e6667aad39) C:\WINDOWS\system32\drivers\N360\0502010.003\SYMDS.SYS

    22:48:17.0500 5896 SymDS - ok

    22:48:17.0578 5896 SymEFA (d5c02629c02a820a7e71bca3d44294a3) C:\WINDOWS\system32\drivers\N360\0502010.003\SYMEFA.SYS

    22:48:17.0640 5896 SymEFA - ok

    22:48:17.0703 5896 SymEvent (ab33c3b196197ca467cbdda717860dba) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS

    22:48:17.0750 5896 SymEvent - ok

    22:48:17.0765 5896 SYMFW - ok

    22:48:17.0781 5896 SYMIDS - ok

    22:48:17.0843 5896 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f) C:\WINDOWS\system32\drivers\N360\0502010.003\Ironx86.SYS

    22:48:17.0859 5896 SymIRON - ok

    22:48:17.0875 5896 SYMNDIS - ok

    22:48:17.0921 5896 SYMTDI (336cace58f0359d5cbb1ae6b8a2fb205) C:\WINDOWS\System32\Drivers\N360\0502010.003\SYMTDI.SYS

    22:48:18.0109 5896 SYMTDI - ok

    22:48:18.0156 5896 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\System32\DRIVERS\sym_hi.sys

    22:48:18.0390 5896 sym_hi - ok

    22:48:18.0421 5896 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\System32\DRIVERS\sym_u3.sys

    22:48:18.0625 5896 sym_u3 - ok

    22:48:18.0671 5896 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

    22:48:18.0859 5896 sysaudio - ok

    22:48:18.0906 5896 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe

    22:48:19.0078 5896 SysmonLog - ok

    22:48:19.0156 5896 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll

    22:48:19.0343 5896 TapiSrv - ok

    22:48:19.0406 5896 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

    22:48:19.0437 5896 Tcpip - ok

    22:48:19.0500 5896 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

    22:48:19.0671 5896 TDPIPE - ok

    22:48:19.0703 5896 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

    22:48:19.0890 5896 TDTCP - ok

    22:48:19.0921 5896 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

    22:48:20.0109 5896 TermDD - ok

    22:48:20.0187 5896 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll

    22:48:20.0390 5896 TermService - ok

    22:48:20.0453 5896 tfsnboio (2aceb9567639ff2db9d862104a80227a) C:\WINDOWS\system32\dla\tfsnboio.sys

    22:48:20.0468 5896 tfsnboio ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0468 5896 tfsnboio - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0546 5896 tfsncofs (d9f936eac2a6d55e3de87bedff8137a9) C:\WINDOWS\system32\dla\tfsncofs.sys

    22:48:20.0562 5896 tfsncofs ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0562 5896 tfsncofs - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0609 5896 tfsndrct (0fd9805bc047ada2cff540d4b7fa71fb) C:\WINDOWS\system32\dla\tfsndrct.sys

    22:48:20.0625 5896 tfsndrct ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0625 5896 tfsndrct - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0671 5896 tfsndres (f8b907198e2540a4a340f1e6775f7b71) C:\WINDOWS\system32\dla\tfsndres.sys

    22:48:20.0687 5896 tfsndres ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0687 5896 tfsndres - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0734 5896 tfsnifs (fb11349b31346290d098941f0216cc45) C:\WINDOWS\system32\dla\tfsnifs.sys

    22:48:20.0781 5896 tfsnifs ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0781 5896 tfsnifs - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0828 5896 tfsnopio (1994265f3a90e23a9434bba687f1a069) C:\WINDOWS\system32\dla\tfsnopio.sys

    22:48:20.0843 5896 tfsnopio ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0843 5896 tfsnopio - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0890 5896 tfsnpool (0b3d2bd550aa63bfd25ae8c5afbf7f76) C:\WINDOWS\system32\dla\tfsnpool.sys

    22:48:20.0906 5896 tfsnpool ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0906 5896 tfsnpool - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0937 5896 tfsnudf (716edddba259a2d699332df95301edda) C:\WINDOWS\system32\dla\tfsnudf.sys

    22:48:20.0937 5896 tfsnudf ( UnsignedFile.Multi.Generic ) - warning

    22:48:20.0937 5896 tfsnudf - detected UnsignedFile.Multi.Generic (1)

    22:48:20.0968 5896 tfsnudfa (a8ee7bbdd0b8c01e38221d0dca2e7aaa) C:\WINDOWS\system32\dla\tfsnudfa.sys

    22:48:21.0000 5896 tfsnudfa ( UnsignedFile.Multi.Generic ) - warning

    22:48:21.0000 5896 tfsnudfa - detected UnsignedFile.Multi.Generic (1)

    22:48:21.0046 5896 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll

    22:48:21.0062 5896 Themes - ok

    22:48:21.0109 5896 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\System32\tlntsvr.exe

    22:48:21.0281 5896 TlntSvr - ok

    22:48:21.0328 5896 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\System32\DRIVERS\toside.sys

    22:48:21.0781 5896 TosIde - ok

    22:48:21.0828 5896 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll

    22:48:22.0015 5896 TrkWks - ok

    22:48:22.0078 5896 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

    22:48:22.0250 5896 Udfs - ok

    22:48:22.0281 5896 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\System32\DRIVERS\ultra.sys

    22:48:22.0359 5896 ultra - ok

    22:48:22.0406 5896 UMWdf (ab0a7ca90d9e3d6a193905dc1715ded0) C:\WINDOWS\system32\wdfmgr.exe

    22:48:22.0484 5896 UMWdf - ok

    22:48:22.0531 5896 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

    22:48:22.0750 5896 Update - ok

    22:48:22.0828 5896 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll

    22:48:23.0015 5896 upnphost - ok

    22:48:23.0062 5896 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe

    22:48:23.0250 5896 UPS - ok

    22:48:23.0296 5896 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys

    22:48:23.0375 5896 USBAAPL - ok

    22:48:23.0421 5896 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

    22:48:23.0593 5896 usbccgp - ok

    22:48:23.0640 5896 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

    22:48:23.0812 5896 usbehci - ok

    22:48:23.0843 5896 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

    22:48:24.0046 5896 usbhub - ok

    22:48:24.0062 5896 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

    22:48:24.0218 5896 usbprint - ok

    22:48:24.0250 5896 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

    22:48:24.0437 5896 usbscan - ok

    22:48:24.0453 5896 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

    22:48:24.0640 5896 USBSTOR - ok

    22:48:24.0734 5896 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

    22:48:24.0953 5896 usbuhci - ok

    22:48:24.0984 5896 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

    22:48:25.0156 5896 VgaSave - ok

    22:48:25.0218 5896 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\System32\DRIVERS\viaagp.sys

    22:48:25.0406 5896 viaagp - ok

    22:48:25.0437 5896 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys

    22:48:25.0640 5896 ViaIde - ok

    22:48:25.0656 5896 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

    22:48:25.0828 5896 VolSnap - ok

    22:48:25.0890 5896 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe

    22:48:26.0078 5896 VSS - ok

    22:48:26.0125 5896 w32time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll

    22:48:26.0296 5896 w32time - ok

    22:48:26.0343 5896 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

    22:48:26.0515 5896 Wanarp - ok

    22:48:26.0578 5896 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys

    22:48:26.0609 5896 wanatw - ok

    22:48:26.0656 5896 WANMiniportService (909f2dc0da7f57d229a05ee90647b2c3) C:\WINDOWS\wanmpsvc.exe

    22:48:28.0062 5896 WANMiniportService ( UnsignedFile.Multi.Generic ) - warning

    22:48:28.0062 5896 WANMiniportService - detected UnsignedFile.Multi.Generic (1)

    22:48:28.0093 5896 WDICA - ok

    22:48:28.0171 5896 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

    22:48:28.0437 5896 wdmaud - ok

    22:48:28.0500 5896 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll

    22:48:28.0703 5896 WebClient - ok

    22:48:28.0828 5896 WinDefend (f45dd1e1365d857dd08bc23563370d0e) C:\Program Files\Windows Defender\MsMpEng.exe

    22:48:28.0843 5896 WinDefend - ok

    22:48:28.0921 5896 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll

    22:48:29.0109 5896 winmgmt - ok

    22:48:29.0250 5896 WMConnectCDS (cd99c9feae87c1963273f6b150251e33) C:\Program Files\Windows Media Connect 2\wmccds.exe

    22:48:29.0343 5896 WMConnectCDS ( UnsignedFile.Multi.Generic ) - warning

    22:48:29.0343 5896 WMConnectCDS - detected UnsignedFile.Multi.Generic (1)

    22:48:29.0390 5896 WMDM PMSP Service (581176f60885aef8f78c6e38dcc3cdf9) C:\WINDOWS\System32\MsPMSPSv.exe

    22:48:29.0406 5896 WMDM PMSP Service ( UnsignedFile.Multi.Generic ) - warning

    22:48:29.0406 5896 WMDM PMSP Service - detected UnsignedFile.Multi.Generic (1)

    22:48:29.0484 5896 WmdmPmSN (140ef97b64f560fd78643cae2cdad838) C:\WINDOWS\system32\MsPMSNSv.dll

    22:48:29.0578 5896 WmdmPmSN - ok

    22:48:29.0687 5896 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll

    22:48:29.0781 5896 Wmi - ok

    22:48:29.0906 5896 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\System32\wbem\wmiapsrv.exe

    22:48:30.0093 5896 WmiApSrv - ok

    22:48:30.0187 5896 WpdUsb (1385e5aa9c9821790d33a9563b8d2dd0) C:\WINDOWS\system32\Drivers\wpdusb.sys

    22:48:30.0218 5896 WpdUsb - ok

    22:48:30.0281 5896 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

    22:48:30.0500 5896 WS2IFSL - ok

    22:48:30.0562 5896 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll

    22:48:30.0734 5896 wscsvc - ok

    22:48:30.0781 5896 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

    22:48:30.0968 5896 WSTCODEC - ok

    22:48:31.0015 5896 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll

    22:48:31.0187 5896 wuauserv - ok

    22:48:31.0265 5896 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll

    22:48:31.0453 5896 WZCSVC - ok

    22:48:31.0609 5896 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll

    22:48:31.0781 5896 xmlprov - ok

    22:48:31.0828 5896 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0

    22:48:31.0843 5896 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected

    22:48:31.0843 5896 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)

    22:48:31.0875 5896 \Device\Harddisk0\DR0 ( TDSS File System ) - warning

    22:48:31.0875 5896 \Device\Harddisk0\DR0 - detected TDSS File System (1)

    22:48:31.0921 5896 Boot (0x1200) (b9e81464156e28b66ed872da1925d8d6) \Device\Harddisk0\DR0\Partition0

    22:48:31.0921 5896 \Device\Harddisk0\DR0\Partition0 - ok

    22:48:31.0921 5896 ============================================================

    22:48:31.0921 5896 Scan finished

    22:48:31.0921 5896 ============================================================

    22:48:32.0078 3112 Detected object count: 29

    22:48:32.0078 3112 Actual detected object count: 29

    22:48:53.0515 3112 AOL ACS ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0515 3112 AOL ACS ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0515 3112 Creative Service for CDROM Access ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0515 3112 Creative Service for CDROM Access ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0515 3112 drvmcdb ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0515 3112 drvmcdb ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0515 3112 drvnddm ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0515 3112 drvnddm ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0515 3112 DSproct ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0515 3112 DSproct ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0515 3112 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0515 3112 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0531 3112 MSCSPTISRV ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0531 3112 MSCSPTISRV ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0531 3112 MSSQLServerADHelper ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0531 3112 MSSQLServerADHelper ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0531 3112 NetSvc ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0531 3112 NetSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0531 3112 omci ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0531 3112 omci ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0546 3112 PACSPTISVR ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0546 3112 PACSPTISVR ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0546 3112 SPTISRV ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0546 3112 SPTISRV ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0546 3112 sscdbhk5 ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0546 3112 sscdbhk5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0546 3112 ssrtln ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0546 3112 ssrtln ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0562 3112 SSScsiSV ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0562 3112 SSScsiSV ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0562 3112 tfsnboio ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0562 3112 tfsnboio ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0562 3112 tfsncofs ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0562 3112 tfsncofs ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0562 3112 tfsndrct ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0562 3112 tfsndrct ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 tfsndres ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 tfsndres ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 tfsnifs ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 tfsnifs ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 tfsnopio ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 tfsnopio ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 tfsnpool ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 tfsnpool ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 tfsnudf ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 tfsnudf ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 tfsnudfa ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 tfsnudfa ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 WANMiniportService ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 WANMiniportService ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 WMConnectCDS ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 WMConnectCDS ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:53.0578 3112 WMDM PMSP Service ( UnsignedFile.Multi.Generic ) - skipped by user

    22:48:53.0578 3112 WMDM PMSP Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

    22:48:54.0500 3112 \Device\Harddisk0\DR0\# - copied to quarantine

    22:48:54.0500 3112 \Device\Harddisk0\DR0 - copied to quarantine

    22:48:54.0546 3112 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine

    22:48:54.0562 3112 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine

    22:48:54.0578 3112 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine

    22:48:54.0593 3112 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine

    22:48:54.0609 3112 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine

    22:48:54.0609 3112 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine

    22:48:54.0609 3112 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

    22:48:54.0609 3112 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine

    22:48:54.0625 3112 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine

    22:48:54.0625 3112 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine

    22:48:54.0625 3112 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine

    22:48:54.0625 3112 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine

    22:48:54.0640 3112 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot

    22:48:54.0640 3112 \Device\Harddisk0\DR0 - ok

    22:49:01.0359 3112 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure

    22:49:01.0375 3112 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

    22:49:01.0375 3112 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

    22:49:38.0406 4228 Deinitialize success

    ==============

    MalwareBytes Log

    ==============

    Malwarebytes Anti-Malware 1.61.0.1400

    www.malwarebytes.org

    Database version: v2012.07.06.01

    Windows XP Service Pack 3 x86 NTFS

    Internet Explorer 8.0.6001.18702

    Jim :: REYNOLDS [administrator]

    7/5/2012 11:01:08 PM

    mbam-log-2012-07-05 (23-01-08).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 365542

    Time elapsed: 1 hour(s), 17 minute(s), 32 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 1

    C:\Documents and Settings\Jim\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) -> Quarantined and deleted successfully.

    (end)

    Ad network traffic, slow internet connection

    in Resolved Malware Removal Logs

    Posted

    Here are the DDS results...thanks again for your assistance!

    Attach.txt

    ========.

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2011-08-26.01)

    .

    Microsoft Windows XP Professional

    Boot Device: \Device\HarddiskVolume2

    Install Date: 11/15/2003 3:55:47 PM

    System Uptime: 7/3/2012 12:51:03 PM (6 hours ago)

    .

    Motherboard: Dell Computer Corp. | | 0M2035

    Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

    .

    ==== Disk Partitions =========================

    .

    A: is Removable

    C: is FIXED (NTFS) - 112 GiB total, 1.453 GiB free.

    D: is CDROM ()

    E: is CDROM ()

    F: is Removable

    .

    ==== Disabled Device Manager Items =============

    .

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

    Description: Intel® PRO/100 VE Network Connection

    Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_01571028&REV_02\4&1C660DD6&0&40F0

    Manufacturer: Intel

    Name: Intel® PRO/100 VE Network Connection

    PNP Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_01571028&REV_02\4&1C660DD6&0&40F0

    Service: E100B

    .

    ==== System Restore Points ===================

    .

    No restore point in system.

    .

    ==== Installed Programs ======================

    .

    .

    ABBYY FineReader 5.0 Sprint

    Adobe Atmosphere Player for Acrobat and Adobe Reader

    Adobe Flash Player 10 ActiveX

    Adobe Flash Player 10 Plugin

    Adobe Photoshop Elements 2.0

    Adobe Reader 8.3.1

    Adobe Shockwave Player

    America Online (Choose which version to remove)

    AnswerWorks 5.0 English Runtime

    AOL Coach Version 1.0(Build:20030807.3)

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    ATI Control Panel

    ATI Display Driver

    ATIMCEE

    AXIS Media Control Embedded

    Backyard Football

    Banctec Service Agreement

    BCM V.92 56K Modem

    Bonjour

    Business Contact Manager for Outlook 2003

    CANON iMAGE GATEWAY MyCamera Download Plugin

    CANON iMAGE GATEWAY Task for ZoomBrowser EX

    Canon MOV Decoder

    Canon MOV Encoder

    Canon MovieEdit Task for ZoomBrowser EX

    Canon Utilities Digital Photo Professional 3.10

    Canon Utilities EOS Sample Music

    Canon Utilities EOS Utility

    Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX

    Canon Utilities Movie Uploader for YouTube

    Canon Utilities PhotoStitch

    Canon Utilities Picture Style Editor

    Canon Utilities ZoomBrowser EX

    Canon ZoomBrowser EX Memory Card Utility

    Classic PhoneTools

    Compatibility Pack for the 2007 Office system

    Creative MediaSource

    DAO

    Dell AIO Printer A940

    Dell Networking Guide

    Dell Picture Studio - Dell Image Expert

    Dell Solution Center

    Dell Support Center

    DellSupport

    Desktop Doctor

    DS21Patch

    DVDSentry

    EarthLink Setup Files

    ESET Online Scanner v3

    exPressit S.E. 2.1

    Family Tree Maker 2005

    Family Tree Maker 9.0

    Garmin Communicator Plugin

    Garmin POI Loader

    Garmin VoiceStudio v2.10

    GemMaster Mystic

    Glary Utilities 2.37.0.1260

    Google Earth

    Google Toolbar for Internet Explorer

    Google Update Helper

    Google Updater

    GoZone iSync

    Greeting Card Factory Deluxe 2.0

    GTK+ 1.3.0-20030717-1 runtime environment

    Help and Support Customization

    HighMAT Extension to Microsoft Windows XP CD Writing Wizard

    HiJackThis

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

    Hotfix for Windows Internet Explorer 7 (KB947864)

    Hotfix for Windows Media Format SDK (KB902344)

    Hotfix for Windows XP (KB2158563)

    Hotfix for Windows XP (KB2443685)

    Hotfix for Windows XP (KB2570791)

    Hotfix for Windows XP (KB2633952)

    Hotfix for Windows XP (KB952287)

    Hotfix for Windows XP (KB954550-v5)

    Hotfix for Windows XP (KB961118)

    Hotfix for Windows XP (KB970653-v3)

    Hotfix for Windows XP (KB976098-v2)

    Hotfix for Windows XP (KB979306)

    Hotfix for Windows XP (KB981793)

    Intel® PRO Network Connections Drivers

    Intel® PROSet

    iPod for Windows 2006-03-23

    iTunes

    Java Auto Updater

    Java 7

    LAME v3.98.2 for Audacity

    Learn2 Player (Uninstall Only)

    LiveUpdate 1.90 (Symantec Corporation)

    Malwarebytes Anti-Malware version 1.60.1.1000

    Managed DirectX (0901)

    Microsoft .NET Framework 1.0 Hotfix (KB2572066)

    Microsoft .NET Framework 1.0 Hotfix (KB953295)

    Microsoft .NET Framework 1.0 Hotfix (KB979904)

    Microsoft .NET Framework 1.1

    Microsoft .NET Framework 1.1 Security Update (KB2656353)

    Microsoft .NET Framework 1.1 Security Update (KB2656370)

    Microsoft .NET Framework 1.1 Security Update (KB979906)

    Microsoft .NET Framework 2.0 Service Pack 2

    Microsoft .NET Framework 3.0 Service Pack 2

    Microsoft .NET Framework 3.5 SP1

    Microsoft Base Smart Card Cryptographic Service Provider Package

    Microsoft Data Access Components KB870669

    Microsoft Internationalized Domain Names Mitigation APIs

    Microsoft Money 2004

    Microsoft Money 2004 System Pack

    Microsoft National Language Support Downlevel APIs

    Microsoft Office File Validation Add-In

    Microsoft Office Small Business Edition 2003

    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

    Microsoft Windows Journal Viewer

    MobileMe Control Panel

    Modem Helper

    Mozilla Firefox (3.6.25)

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    MSXML 6.0 Parser (KB933579)

    Norton Security Suite

    OpenMG AAC Add-on Module 1.0.00

    OpenMG Limited Patch 4.5-06-05-12-01

    OpenMG Secure Module 4.5.01

    Otto

    Paint Shop Pro 7

    Pdf995

    Picasa 3

    PowerDVD

    Quicken 2011

    QuickTime

    Reader Rabbit's Preschool

    RealPlayer

    RollerCoaster Tycoon 2

    RollerCoaster Tycoon 2: Wacky Worlds

    Samsung CLP-310 Series

    SaveVid Plug-in

    Savings Bond Wizard

    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

    Security Update for Microsoft Windows (KB2564958)

    Security Update for Step By Step Interactive Training (KB898458)

    Security Update for Step By Step Interactive Training (KB923723)

    Security Update for Windows Internet Explorer 7 (KB928090)

    Security Update for Windows Internet Explorer 7 (KB929969)

    Security Update for Windows Internet Explorer 7 (KB931768)

    Security Update for Windows Internet Explorer 7 (KB933566)

    Security Update for Windows Internet Explorer 7 (KB937143)

    Security Update for Windows Internet Explorer 7 (KB938127)

    Security Update for Windows Internet Explorer 7 (KB939653)

    Security Update for Windows Internet Explorer 7 (KB942615)

    Security Update for Windows Internet Explorer 7 (KB944533)

    Security Update for Windows Internet Explorer 7 (KB950759)

    Security Update for Windows Internet Explorer 7 (KB953838)

    Security Update for Windows Internet Explorer 7 (KB956390)

    Security Update for Windows Internet Explorer 7 (KB958215)

    Security Update for Windows Internet Explorer 7 (KB960714)

    Security Update for Windows Internet Explorer 7 (KB961260)

    Security Update for Windows Internet Explorer 7 (KB963027)

    Security Update for Windows Internet Explorer 7 (KB969897)

    Security Update for Windows Internet Explorer 8 (KB2183461)

    Security Update for Windows Internet Explorer 8 (KB2360131)

    Security Update for Windows Internet Explorer 8 (KB2416400)

    Security Update for Windows Internet Explorer 8 (KB2482017)

    Security Update for Windows Internet Explorer 8 (KB2497640)

    Security Update for Windows Internet Explorer 8 (KB2510531)

    Security Update for Windows Internet Explorer 8 (KB2530548)

    Security Update for Windows Internet Explorer 8 (KB2544521)

    Security Update for Windows Internet Explorer 8 (KB2559049)

    Security Update for Windows Internet Explorer 8 (KB2618444)

    Security Update for Windows Internet Explorer 8 (KB969897)

    Security Update for Windows Internet Explorer 8 (KB971961)

    Security Update for Windows Internet Explorer 8 (KB972260)

    Security Update for Windows Internet Explorer 8 (KB974455)

    Security Update for Windows Internet Explorer 8 (KB976325)

    Security Update for Windows Internet Explorer 8 (KB978207)

    Security Update for Windows Internet Explorer 8 (KB981332)

    Security Update for Windows Internet Explorer 8 (KB982381)

    Security Update for Windows Media Player (KB2378111)

    Security Update for Windows Media Player (KB911564)

    Security Update for Windows Media Player (KB952069)

    Security Update for Windows Media Player (KB954155)

    Security Update for Windows Media Player (KB968816)

    Security Update for Windows Media Player (KB973540)

    Security Update for Windows Media Player (KB975558)

    Security Update for Windows Media Player (KB978695)

    Security Update for Windows Media Player 10 (KB911565)

    Security Update for Windows Media Player 10 (KB917734)

    Security Update for Windows Media Player 10 (KB936782)

    Security Update for Windows Media Player 6.4 (KB925398)

    Security Update for Windows XP (KB2079403)

    Security Update for Windows XP (KB2115168)

    Security Update for Windows XP (KB2121546)

    Security Update for Windows XP (KB2160329)

    Security Update for Windows XP (KB2229593)

    Security Update for Windows XP (KB2259922)

    Security Update for Windows XP (KB2279986)

    Security Update for Windows XP (KB2286198)

    Security Update for Windows XP (KB2296011)

    Security Update for Windows XP (KB2296199)

    Security Update for Windows XP (KB2347290)

    Security Update for Windows XP (KB2360937)

    Security Update for Windows XP (KB2387149)

    Security Update for Windows XP (KB2393802)

    Security Update for Windows XP (KB2412687)

    Security Update for Windows XP (KB2419632)

    Security Update for Windows XP (KB2423089)

    Security Update for Windows XP (KB2436673)

    Security Update for Windows XP (KB2440591)

    Security Update for Windows XP (KB2443105)

    Security Update for Windows XP (KB2476490)

    Security Update for Windows XP (KB2476687)

    Security Update for Windows XP (KB2478960)

    Security Update for Windows XP (KB2478971)

    Security Update for Windows XP (KB2479628)

    Security Update for Windows XP (KB2479943)

    Security Update for Windows XP (KB2481109)

    Security Update for Windows XP (KB2483185)

    Security Update for Windows XP (KB2485376)

    Security Update for Windows XP (KB2485663)

    Security Update for Windows XP (KB2503658)

    Security Update for Windows XP (KB2503665)

    Security Update for Windows XP (KB2506212)

    Security Update for Windows XP (KB2506223)

    Security Update for Windows XP (KB2507618)

    Security Update for Windows XP (KB2507938)

    Security Update for Windows XP (KB2508272)

    Security Update for Windows XP (KB2508429)

    Security Update for Windows XP (KB2509553)

    Security Update for Windows XP (KB2511455)

    Security Update for Windows XP (KB2524375)

    Security Update for Windows XP (KB2535512)

    Security Update for Windows XP (KB2536276-v2)

    Security Update for Windows XP (KB2536276)

    Security Update for Windows XP (KB2544893-v2)

    Security Update for Windows XP (KB2544893)

    Security Update for Windows XP (KB2555917)

    Security Update for Windows XP (KB2562937)

    Security Update for Windows XP (KB2566454)

    Security Update for Windows XP (KB2567680)

    Security Update for Windows XP (KB2570222)

    Security Update for Windows XP (KB2570947)

    Security Update for Windows XP (KB2584146)

    Security Update for Windows XP (KB2585542)

    Security Update for Windows XP (KB2592799)

    Security Update for Windows XP (KB2598479)

    Security Update for Windows XP (KB2603381)

    Security Update for Windows XP (KB2618451)

    Security Update for Windows XP (KB2619339)

    Security Update for Windows XP (KB2620712)

    Security Update for Windows XP (KB2624667)

    Security Update for Windows XP (KB2631813)

    Security Update for Windows XP (KB2633171)

    Security Update for Windows XP (KB2639417)

    Security Update for Windows XP (KB2646524)

    Security Update for Windows XP (KB923561)

    Security Update for Windows XP (KB923689)

    Security Update for Windows XP (KB938464)

    Security Update for Windows XP (KB941569)

    Security Update for Windows XP (KB946648)

    Security Update for Windows XP (KB950760)

    Security Update for Windows XP (KB950762)

    Security Update for Windows XP (KB950974)

    Security Update for Windows XP (KB951066)

    Security Update for Windows XP (KB951376-v2)

    Security Update for Windows XP (KB951376)

    Security Update for Windows XP (KB951698)

    Security Update for Windows XP (KB951748)

    Security Update for Windows XP (KB952004)

    Security Update for Windows XP (KB952954)

    Security Update for Windows XP (KB953839)

    Security Update for Windows XP (KB954211)

    Security Update for Windows XP (KB954459)

    Security Update for Windows XP (KB954600)

    Security Update for Windows XP (KB955069)

    Security Update for Windows XP (KB956391)

    Security Update for Windows XP (KB956572)

    Security Update for Windows XP (KB956744)

    Security Update for Windows XP (KB956802)

    Security Update for Windows XP (KB956803)

    Security Update for Windows XP (KB956841)

    Security Update for Windows XP (KB956844)

    Security Update for Windows XP (KB957095)

    Security Update for Windows XP (KB957097)

    Security Update for Windows XP (KB958644)

    Security Update for Windows XP (KB958687)

    Security Update for Windows XP (KB958690)

    Security Update for Windows XP (KB958869)

    Security Update for Windows XP (KB959426)

    Security Update for Windows XP (KB960225)

    Security Update for Windows XP (KB960715)

    Security Update for Windows XP (KB960803)

    Security Update for Windows XP (KB960859)

    Security Update for Windows XP (KB961371)

    Security Update for Windows XP (KB961373)

    Security Update for Windows XP (KB961501)

    Security Update for Windows XP (KB968537)

    Security Update for Windows XP (KB969059)

    Security Update for Windows XP (KB969898)

    Security Update for Windows XP (KB969947)

    Security Update for Windows XP (KB970238)

    Security Update for Windows XP (KB970430)

    Security Update for Windows XP (KB971468)

    Security Update for Windows XP (KB971486)

    Security Update for Windows XP (KB971557)

    Security Update for Windows XP (KB971633)

    Security Update for Windows XP (KB971657)

    Security Update for Windows XP (KB972270)

    Security Update for Windows XP (KB973346)

    Security Update for Windows XP (KB973354)

    Security Update for Windows XP (KB973507)

    Security Update for Windows XP (KB973525)

    Security Update for Windows XP (KB973869)

    Security Update for Windows XP (KB973904)

    Security Update for Windows XP (KB974112)

    Security Update for Windows XP (KB974318)

    Security Update for Windows XP (KB974392)

    Security Update for Windows XP (KB974571)

    Security Update for Windows XP (KB975025)

    Security Update for Windows XP (KB975467)

    Security Update for Windows XP (KB975560)

    Security Update for Windows XP (KB975561)

    Security Update for Windows XP (KB975562)

    Security Update for Windows XP (KB975713)

    Security Update for Windows XP (KB977165)

    Security Update for Windows XP (KB977816)

    Security Update for Windows XP (KB977914)

    Security Update for Windows XP (KB978037)

    Security Update for Windows XP (KB978251)

    Security Update for Windows XP (KB978262)

    Security Update for Windows XP (KB978338)

    Security Update for Windows XP (KB978542)

    Security Update for Windows XP (KB978601)

    Security Update for Windows XP (KB978706)

    Security Update for Windows XP (KB979309)

    Security Update for Windows XP (KB979482)

    Security Update for Windows XP (KB979559)

    Security Update for Windows XP (KB979683)

    Security Update for Windows XP (KB979687)

    Security Update for Windows XP (KB980195)

    Security Update for Windows XP (KB980218)

    Security Update for Windows XP (KB980232)

    Security Update for Windows XP (KB980436)

    Security Update for Windows XP (KB981322)

    Security Update for Windows XP (KB981852)

    Security Update for Windows XP (KB981957)

    Security Update for Windows XP (KB981997)

    Security Update for Windows XP (KB982132)

    Security Update for Windows XP (KB982214)

    Security Update for Windows XP (KB982665)

    Security Update for Windows XP (KB982802)

    SmartMusic 2012a

    Sonic MyDVD

    Sonic PrimeTime

    Sonic RecordNow!

    Sonic UDF Reader

    Sonic Update Manager

    SonicStage 4.0

    Sound Blaster Audigy 2

    The GIMP 1.2.5-20030729-1

    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

    Update for Windows Internet Explorer 8 (KB971930)

    Update for Windows Internet Explorer 8 (KB976662)

    Update for Windows Internet Explorer 8 (KB976749)

    Update for Windows Internet Explorer 8 (KB980182)

    Update for Windows XP (KB2141007)

    Update for Windows XP (KB2345886)

    Update for Windows XP (KB2467659)

    Update for Windows XP (KB2541763)

    Update for Windows XP (KB2607712)

    Update for Windows XP (KB2641690)

    Update for Windows XP (KB951072-v2)

    Update for Windows XP (KB951978)

    Update for Windows XP (KB955759)

    Update for Windows XP (KB955839)

    Update for Windows XP (KB967715)

    Update for Windows XP (KB968389)

    Update for Windows XP (KB971029)

    Update for Windows XP (KB971737)

    Update for Windows XP (KB973687)

    Update for Windows XP (KB973815)

    Upromise TurboSaver (remove only)

    Viewpoint Manager (Remove Only)

    VoiceOver Kit

    WD Diagnostics

    WebFldrs XP

    Webshots Desktop

    Windows Defender

    Windows Defender Signatures

    Windows Genuine Advantage Notifications (KB905474)

    Windows Genuine Advantage v1.3.0254.0

    Windows Genuine Advantage Validation Tool (KB892130)

    Windows Imaging Component

    Windows Internet Explorer 7

    Windows Internet Explorer 8

    Windows Media Connect

    Windows Media Format Runtime

    Windows Media Format SDK Hotfix - KB891122

    Windows Media Player 10

    Windows Presentation Foundation

    Windows Savevid Toolbar

    Windows XP Service Pack 3

    XML Paper Specification Shared Components Pack 1.0

    Xvid 1.2.2 final uninstall

    Zoo Tycoon Expanded

    .

    ==== Event Viewer Messages From Past Week ========

    .

    7/3/2012 8:27:07 AM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.

    7/3/2012 8:15:04 AM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: %%2149896199

    7/3/2012 8:14:37 AM, error: Service Control Manager [7000] - The SupportSoft Sprocket Service (dellsupportcenter) service failed to start due to the following error: The system cannot find the file specified.

    7/3/2012 8:14:37 AM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified.

    7/3/2012 8:14:37 AM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified.

    7/3/2012 5:37:01 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the RasMan service.

    7/3/2012 5:36:31 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the w32time service.

    .

    ==== End Of File ===========================

    =======

    DDS.txt

    =======

    .

    DDS (Ver_2011-08-26.01) - NTFSx86

    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.0.0

    Run by Jim at 18:07:29 on 2012-07-03

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.832 [GMT -4:00]

    .

    AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

    FW: Norton Security Suite *Enabled*

    .

    ============== Running Processes ===============

    .

    C:\WINDOWS\System32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe -k DcomLaunch

    svchost.exe

    C:\Program Files\Windows Defender\MsMpEng.exe

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\LEXPPS.EXE

    svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\WINDOWS\System32\CTsvcCDA.exe

    C:\WINDOWS\ehome\ehSched.exe

    C:\Program Files\Java\jre7\bin\jqs.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\BCMSMMSG.exe

    C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    C:\WINDOWS\System32\DSentry.exe

    C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe

    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

    C:\Program Files\Dell AIO Printer A940\dlbabmon.exe

    C:\WINDOWS\System32\svchost.exe -k imgsvc

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\WINDOWS\wanmpsvc.exe

    C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe

    C:\Program Files\QuickTime\QTTask.exe

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\ehome\ehmsas.exe

    C:\Program Files\Support.com\bin\tgcmd.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Mozilla Firefox\firefox.exe

    C:\WINDOWS\system32\taskmgr.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = about:blank

    uSearch Page = hxxp://www.google.com

    uDefault_Page_URL = hxxp://www.dell.com

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language

    uInternet Connection Wizard,ShellNext = iexplore

    uInternet Settings,ProxyOverride = *.local

    uSearchAssistant = hxxp://www.google.com/ie

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

    BHO: Savevid Toolbar: {23cd218f-af09-443f-bbb1-adb89fd5986d} - c:\progra~1\wi0498~1\datamngr\toolbar\savevidX.dll

    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

    BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton security suite\engine\5.2.1.3\coIEPlg.dll

    BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton security suite\engine\5.2.1.3\ips\IPSBHO.DLL

    BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll

    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll

    BHO: DCA BHO: {b49699fc-1665-4414-a1cb-c4a2a4a13eec} - c:\program files\upromise\dca-bho.dll

    BHO: Upromise TurboSaver: {edc0f17f-f4b7-47e4-b73e-887faeb376fa} - c:\program files\upromise\upromisetoolbar.dll

    TB: Upromise TurboSaver: {06e58e5e-f8cb-4049-991e-a41c03bd419e} - c:\program files\upromise\upromisetoolbar.dll

    TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton security suite\engine\5.2.1.3\coIEPlg.dll

    TB: Savevid Toolbar: {23cd218f-af09-443f-bbb1-adb89fd5986d} - c:\progra~1\wi0498~1\datamngr\toolbar\savevidX.dll

    TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll

    TB: !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - No File

    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

    TB: {4E7BD74F-2B8D-469E-95BA-ED6DB186BE32} - No File

    TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

    TB: {00000000-0000-0000-0000-000000000000} - No File

    TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

    EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    c:\docume~1\jim\locals~1\temp\nsm1aa.tmp\temp00

    StartupFolder: c:\docume~1\jim\startm~1\programs\startup\gozone~1.lnk - c:\program files\gozone\GoZone_iSync.exe

    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

    IE: Save video on Savevid.com - c:\program files\savevidplug-in\redirect.htm

    Trusted Zone: kyw1060.com\www

    Trusted Zone: mcafee.com

    Trusted Zone: microsoft.com\*.windowsupdate

    Trusted Zone: phillies.com\www

    Trusted Zone: windowsupdate.com

    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB

    DPF: ppctlcab - hxxp://www.pestscan.com/scanner/ppctlcab.cab

    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB

    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

    DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab

    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab

    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1077755673359

    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1077755629062

    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-170-windows-i586.cab

    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab

    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://samsclubus.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab

    DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-170-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.5/installer.exe

    DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://69.126.199.53:81/activex/AMC.cab

    Notify: WRNotifier - WRLogonNTF.dll

    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - c:\documents and settings\jim\application data\mozilla\firefox\profiles\bl6vfl0c.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource=3&q={searchTerms}

    FF - prefs.js: browser.search.selectedEngine - Search

    FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

    FF - prefs.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\ipsffplgn\components\IPSFFPl.dll

    FF - plugin: c:\program files\canon\mycamera download plugin\NPCIG.dll

    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

    FF - plugin: c:\program files\google\google updater\1.2.567.20382\npCIDetect5.dll

    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

    FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll

    FF - plugin: c:\program files\java\jre7\bin\new_plugin\npdeployJava1.dll

    FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll

    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    FF - Ext: Symantec Intrusion Prevention: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\IPSFFPlgn

    .

    ---- FIREFOX POLICIES ----

    .

    FF - user.js: browser.search.selectedEngine - Search

    FF - user.js: keyword.URL - hxxp://www.gobrs.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ikBIyUNE&q=

    FF - user.js: extensions.incredibar_i.newTab - false

    FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyoApz4U8&loc=IB_TB&i=26&search=

    FF - user.js: extensions.incredibar_i.id - 606540c60000000000000007e9484568

    FF - user.js: extensions.incredibar_i.hardId - 606540c60000000000000007e9484568

    FF - user.js: extensions.incredibar_i.instlDay - 15341

    FF - user.js: extensions.incredibar_i.vrsn - 1.5.3.27

    FF - user.js: extensions.incredibar_i.vrsni - 1.5.3.27

    FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.3.2711:23:06

    FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

    FF - user.js: extensions.incredibar_i.prdct - incredibar

    FF - user.js: extensions.incredibar_i.aflt - orgnl

    FF - user.js: extensions.incredibar_i.smplGrp - none

    FF - user.js: extensions.incredibar_i.tlbrId - base

    FF - user.js: extensions.incredibar_i.instlRef -

    FF - user.js: extensions.incredibar_i.dfltLng -

    FF - user.js: extensions.incredibar_i.excTlbr - false

    FF - user.js: extensions.incredibar_i.ms_url_id -

    FF - user.js: extensions.incredibar_i.upn2 - 6OyoApz4U8

    FF - user.js: extensions.incredibar_i.upn2n - 92260656017641888

    FF - user.js: extensions.incredibar_i.productid - 26

    FF - user.js: extensions.incredibar_i.installerproductid - 26

    FF - user.js: extensions.incredibar_i.did - 10589

    FF - user.js: extensions.incredibar_i.ppd -

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0502010.003\symds.sys [2012-4-23 340088]

    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0502010.003\symefa.sys [2012-4-23 744568]

    R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\bashdefs\20120619.001\BHDrvx86.sys [2012-6-18 821920]

    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0502010.003\ironx86.sys [2012-4-23 136312]

    R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\5.2.1.3\ccsvchst.exe [2012-4-23 130008]

    R2 WinDefend;Windows Defender Service;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-6-2 106656]

    R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\ipsdefs\20120702.001\IDSXpx86.sys [2004-2-25 369632]

    R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20120703.002\NAVENG.SYS [2012-7-3 87928]

    R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\virusdefs\20120703.002\NAVEX15.SYS [2012-7-3 1589752]

    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-8-6 133104]

    S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys --> c:\windows\system32\drivers\SSPORT.sys [?]

    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-8-6 133104]

    .

    =============== Created Last 30 ================

    .

    2012-07-03 13:17:00 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{d32a0764-1d7a-473a-873c-86cec3bc65a4}\offreg.dll

    2012-07-03 02:31:59 6762896 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{d32a0764-1d7a-473a-873c-86cec3bc65a4}\mpengine.dll

    .

    ==================== Find3M ====================

    .

    2012-06-04 22:35:26 222448 ----a-w- c:\windows\system32\muweb.dll

    2012-06-02 20:19:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui

    2012-06-02 20:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl

    2012-06-02 20:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

    2012-06-02 20:19:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui

    2012-06-02 20:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui

    .

    =================== ROOTKIT ====================

    .

    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

    Windows 5.1.2600 Disk: ST3120026AS rev.8.05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17

    .

    device: opened successfully

    user: MBR read successfully

    .

    Disk trace:

    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8ABDF4B1]<<

    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8abe693c]; MOV EAX, [0x8abe6ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

    1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x8AEBDAB8]

    3 CLASSPNP[0xF7637FD7] -> nt!IofCallDriver[0x804E13B9] -> [0x8AC78C38]

    \Driver\atapi[0x8AE2DF38] -> IRP_MJ_CREATE -> 0x8ABDF4B1

    error: Read A device attached to the system is not functioning.

    kernel: MBR read successfully

    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

    detected disk devices:

    detected hooks:

    \Driver\atapi DriverStartIo -> 0x8ABDF2E2

    user & kernel MBR OK

    Warning: possible TDL3 rootkit infection !

    .

    ============= FINISH: 18:31:32.84 ===============

    Ad network traffic, slow internet connection

    in Resolved Malware Removal Logs

    Posted

    Hello:

    Recently experiencing higher CPU usage and increased internet traffic not generated by my browsing sessions. Router logs indicate access to random ad and other spam sites. I've done a MWBytes scan and a HijackThis scan. Logs below. Appreciate any advice. Thank you!

    MalwareBytes Log

    ==============

    Malwarebytes Anti-Malware 1.60.1.1000

    www.malwarebytes.org

    Database version: v2012.07.02.06

    Windows XP Service Pack 3 x86 NTFS

    Internet Explorer 8.0.6001.18702

    Jim :: REYNOLDS [administrator]

    2/25/2004 6:43:11 PM

    mbam-log-2004-02-25 (18-43-11).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 362001

    Time elapsed: 37 minute(s), 55 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 1

    C:\Documents and Settings\Jim\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) -> No action taken.

    (end)

    ============

    Hijack This Log

    ============

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 7:24:36 PM, on 2/25/2004

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\System32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Windows Defender\MsMpEng.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\WINDOWS\System32\CTsvcCDA.exe

    C:\WINDOWS\ehome\ehSched.exe

    C:\Program Files\Java\jre7\bin\jqs.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\wanmpsvc.exe

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\BCMSMMSG.exe

    C:\WINDOWS\ehome\ehmsas.exe

    C:\WINDOWS\System32\DSentry.exe

    C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe

    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe

    C:\Program Files\QuickTime\QTTask.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files\GoZone\GoZone_iSync.exe

    C:\Program Files\Dell AIO Printer A940\dlbabmon.exe

    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Mozilla Firefox\firefox.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

    C:\Program Files\Mozilla Firefox\plugin-container.exe

    C:\Program Files\Support.com\bin\tgcmd.exe

    C:\WINDOWS\system32\msiexec.exe

    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox...tb_id&%language

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: Savevid Toolbar - {23cd218f-af09-443f-bbb1-adb89fd5986d} - C:\PROGRA~1\WI0498~1\Datamngr\ToolBar\savevidX.dll (file missing)

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\5.2.1.3\coIEPlg.dll

    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\5.2.1.3\IPS\IPSBHO.DLL

    O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\Datamngr\ToolBar\searchqudtx.dll (file missing)

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll

    O2 - BHO: DCA - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Upromise\dca-bho.dll

    O2 - BHO: ToolHelper - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files\Upromise\upromisetoolbar.dll

    O3 - Toolbar: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll

    O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\5.2.1.3\coIEPlg.dll

    O3 - Toolbar: Savevid Toolbar - {23cd218f-af09-443f-bbb1-adb89fd5986d} - C:\PROGRA~1\WI0498~1\Datamngr\ToolBar\savevidX.dll (file missing)

    O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\Datamngr\ToolBar\searchqudtx.dll (file missing)

    O3 - Toolbar: (no name) - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - (no file)

    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

    O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL

    O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

    O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"

    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

    O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf

    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

    O4 - HKLM\..\Run: [samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

    O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    O4 - HKCU\..\RunOnce: [shockwave Updater] C:\WINDOWS\SYSTEM32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100429 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 2.8; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

    O4 - Startup: GoZone iSync.lnk = C:\Program Files\GoZone\GoZone_iSync.exe

    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

    O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\SavevidPlug-in\redirect.htm

    O9 - Extra button: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll

    O9 - Extra 'Tools' menuitem: Upromise TurboSaver - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files\Upromise\upromisetoolbar.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O15 - Trusted Zone: www.kyw1060.com

    O15 - Trusted Zone: http://*.mcafee.com

    O15 - Trusted Zone: www.phillies.com

    O15 - Trusted Zone: http://*.windowsupdate.com

    O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.co...inAxControl.CAB

    O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab

    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell...iler/SysPro.CAB

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204

    O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} (Scanner.SysScanner) - http://i.dell.com/im...r/SysProExe.cab

    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...84/mcinsctl.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1263953748824

    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset...lineScanner.cab

    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,21/mcgdmgr.cab

    O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://samsclubus.pn...veX_Control.cab

    O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai...5/installer.exe

    O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://69.126.199.53...activex/AMC.cab

    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

    O23 - Service: Norton Security Suite (N360) - Symantec Corporation - C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (file missing)

    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    --

    End of file - 13341 bytes

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.