JKDGuy

SOrry for the delay! had a busy day here it is: HijackThis Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 8:30:53 PM, on 11/18/2012 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16455) Boot mode: Normal Running processes: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Program Files (x86)\AIM\aim.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe E:\Downloads\Music\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: AOL Messaging Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file) O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AOL Messaging Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll O3 - Toolbar: AOL Messaging Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden O4 - Startup: Dropbox.lnk = Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - Global Startup: SmartSVN 6.6 (background).lnk = C:\Program Files (x86)\SmartSVN 6.6\bin\smartsvn.exe O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O15 - Trusted Zone: *.clonewarsadventures.com O15 - Trusted Zone: *.freerealms.com O15 - Trusted Zone: *.soe.com O15 - Trusted Zone: *.sony.com O16 - DPF: {20D5FC56-9F89-4966-94E1-122DDA4FA5E7} - http://start1.gnjoy.com/cab/1004/GSystemInfo.cab O16 - DPF: {8768D5EA-5412-4810-A032-09AD2A726C69} (DownStarter2 Control) - http://bgweb.nowcdn.co.kr/Bin/DownStarter2.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing) O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Protexis Licensing V2 x64 (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: SmartSVN Status Cache (statuscached) - Unknown owner - C:\Program Files (x86)\SmartSVN 6.6\bin\statuscached.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe O23 - Service: Wacom Professional Touch Service (TouchServiceWacom) - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\Wacom_TouchService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 9980 bytes MBAM Malwarebytes Anti-Malware (PRO) 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.19.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Aaron :: BEAST [administrator] Protection: Disabled 11/18/2012 8:32:43 PM mbam-log-2012-11-18 (20-32-43).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 206019 Time elapsed: 1 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ------- As for how it's running, no more blue screens at all, and everything seems to be going smooth

alright, here's the next log report from combofix with CFScript dragged on to it! ComboFix 12-11-16.02 - Aaron 11/18/2012 19:07:26.2.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10098 [GMT -8:00] Running from: c:\users\Aaron\Desktop\ComboFix.exe Command switches used :: c:\users\Aaron\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\svchost.exe . . ((((((((((((((((((((((((( Files Created from 2012-10-19 to 2012-11-19 ))))))))))))))))))))))))))))))) . . 2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\programdata\eSellerate 2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\program files (x86)\Common Files\eSellerate 2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files\NewBlue 2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files (x86)\NewBlue 2012-11-19 03:17 . 2012-11-19 03:17 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-18 22:56 . 2012-11-18 22:56 -------- d-----w- C:\TDSSKiller_Quarantine 2012-11-17 18:42 . 2012-11-17 18:42 -------- d-----w- c:\users\Aaron\AppData\Roaming\Malwarebytes 2012-11-17 18:41 . 2012-11-17 18:41 -------- d-----w- c:\programdata\Malwarebytes 2012-11-17 18:41 . 2012-11-17 18:41 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-11-17 18:41 . 2012-09-30 03:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-11-16 23:25 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4881AD12-ADFF-4E8F-945B-CBBAB95C95DE}\mpengine.dll 2012-11-16 01:43 . 2012-11-16 01:43 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-11-16 01:42 . 2012-11-16 01:42 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-11-16 01:38 . 2012-11-16 01:38 -------- d-----w- c:\programdata\McAfee 2012-11-14 08:26 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-14 08:26 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-14 08:26 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-14 08:26 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-14 08:18 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe 2012-11-14 08:18 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll 2012-11-14 08:18 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll 2012-11-14 08:18 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2012-11-14 08:18 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll 2012-11-14 08:18 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2012-11-14 08:18 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2012-10-26 23:33 . 2012-10-26 23:33 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-23 23:47 . 2012-10-23 23:47 -------- d-----w- c:\programdata\ATI 2012-10-23 23:46 . 2012-10-23 23:46 -------- d-----w- c:\program files (x86)\AMD AVT 2012-10-23 23:46 . 2012-10-23 23:46 -------- d-----w- c:\program files (x86)\AMD APP . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-16 01:42 . 2011-04-27 00:44 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-11-14 08:19 . 2010-05-24 21:32 66395536 ----a-w- c:\windows\system32\MRT.exe 2012-10-19 06:09 . 2012-10-19 06:09 289768 ----a-w- c:\windows\system32\javaws.exe 2012-10-19 06:09 . 2012-10-19 06:09 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll 2012-10-19 06:09 . 2011-05-13 06:48 189416 ----a-w- c:\windows\system32\javaw.exe 2012-10-19 06:09 . 2012-10-19 06:09 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-10-19 06:09 . 2011-05-13 06:48 916456 ----a-w- c:\windows\system32\deployJava1.dll 2012-10-19 06:09 . 2011-05-13 06:48 188904 ----a-w- c:\windows\system32\java.exe 2012-10-10 23:28 . 2012-05-21 23:35 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-10 23:28 . 2011-05-31 22:57 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-28 22:37 . 2012-09-28 22:37 221696 ----a-w- c:\windows\system32\clinfo.exe 2012-09-28 22:36 . 2012-09-28 22:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll 2012-09-28 22:36 . 2012-09-28 22:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll 2012-09-28 22:36 . 2012-09-28 22:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll 2012-09-28 22:36 . 2012-09-28 22:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll 2012-09-28 22:36 . 2012-09-28 22:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll 2012-09-28 22:32 . 2012-09-28 22:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll 2012-09-28 02:23 . 2011-11-10 02:33 5557928 ----a-w- c:\windows\SysWow64\atiumdag.dll 2012-09-28 02:21 . 2012-09-28 02:21 10697216 ----a-w- c:\windows\system32\drivers\atikmdag.sys 2012-09-28 02:05 . 2012-09-28 02:05 70144 ----a-w- c:\windows\system32\coinst_9.002.dll 2012-09-28 02:03 . 2012-09-28 02:03 163840 ----a-w- c:\windows\system32\atiapfxx.exe 2012-09-28 02:02 . 2012-09-28 02:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll 2012-09-28 02:02 . 2012-09-28 02:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll 2012-09-28 02:02 . 2012-09-28 02:02 44544 ----a-w- c:\windows\system32\aticalcl64.dll 2012-09-28 02:02 . 2012-09-28 02:02 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll 2012-09-28 02:02 . 2012-09-28 02:02 16082432 ----a-w- c:\windows\system32\aticaldd64.dll 2012-09-28 01:59 . 2012-09-28 01:59 23825920 ----a-w- c:\windows\system32\atio6axx.dll 2012-09-28 01:57 . 2012-09-28 01:57 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll 2012-09-28 01:43 . 2010-11-26 02:58 935424 ----a-w- c:\windows\SysWow64\aticfx32.dll 2012-09-28 01:41 . 2010-09-29 01:54 1120768 ----a-w- c:\windows\system32\aticfx64.dll 2012-09-28 01:41 . 2012-09-28 01:41 19624960 ----a-w- c:\windows\SysWow64\atioglxx.dll 2012-09-28 01:39 . 2012-09-28 01:39 6536192 ----a-w- c:\windows\SysWow64\atidxx32.dll 2012-09-28 01:39 . 2012-09-28 01:39 442368 ----a-w- c:\windows\system32\atidemgy.dll 2012-09-28 01:39 . 2012-09-28 01:39 538112 ----a-w- c:\windows\system32\atieclxx.exe 2012-09-28 01:38 . 2012-09-28 01:38 239616 ----a-w- c:\windows\system32\atiesrxx.exe 2012-09-28 01:36 . 2012-09-28 01:36 120320 ----a-w- c:\windows\system32\atitmm64.dll 2012-09-28 01:36 . 2012-09-28 01:36 21504 ----a-w- c:\windows\system32\atimuixx.dll 2012-09-28 01:36 . 2012-09-28 01:36 59392 ----a-w- c:\windows\system32\atiedu64.dll 2012-09-28 01:36 . 2012-09-28 01:36 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll 2012-09-28 01:31 . 2012-09-28 01:31 3127296 ----a-w- c:\windows\system32\atiumd6a.dll 2012-09-28 01:25 . 2012-09-28 01:25 6704640 ----a-w- c:\windows\system32\atiumd64.dll 2012-09-28 01:22 . 2010-09-29 01:37 7167488 ----a-w- c:\windows\system32\atidxx64.dll 2012-09-28 01:22 . 2011-11-10 02:29 2691584 ----a-w- c:\windows\SysWow64\atiumdva.dll 2012-09-28 01:13 . 2012-09-28 01:13 595456 ----a-w- c:\windows\system32\atiadlxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 405504 ----a-w- c:\windows\SysWow64\atiadlxy.dll 2012-09-28 01:13 . 2012-09-28 01:13 17920 ----a-w- c:\windows\system32\atig6pxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\system32\atiglpxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 41984 ----a-w- c:\windows\system32\atig6txx.dll 2012-09-28 01:13 . 2012-09-28 01:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll 2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\atimpc64.dll 2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\amdpcom64.dll 2012-09-28 01:12 . 2012-09-28 01:12 460288 ----a-w- c:\windows\system32\drivers\atikmpag.sys 2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll 2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll 2012-09-28 01:11 . 2010-09-29 01:14 129536 ----a-w- c:\windows\system32\atiuxp64.dll 2012-09-28 01:11 . 2012-09-28 01:11 109568 ----a-w- c:\windows\SysWow64\atiuxpag.dll 2012-09-28 01:11 . 2012-09-28 01:11 103424 ----a-w- c:\windows\system32\atiu9p64.dll 2012-09-28 01:10 . 2011-09-08 16:51 82944 ----a-w- c:\windows\SysWow64\atiu9pag.dll 2012-09-28 01:09 . 2012-09-28 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2012-09-14 19:19 . 2012-10-09 21:43 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:28 . 2012-10-09 21:43 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-08-31 18:19 . 2012-10-09 21:43 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys 2012-08-30 18:03 . 2012-10-09 21:43 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-08-30 17:12 . 2012-10-09 21:43 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-08-30 17:12 . 2012-10-09 21:43 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-08-24 18:05 . 2012-10-09 21:43 220160 ----a-w- c:\windows\system32\wintrust.dll 2012-08-24 16:57 . 2012-10-09 21:43 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-08-22 18:12 . 2012-09-12 03:56 950128 ----a-w- c:\windows\system32\drivers\ndis.sys 2012-08-22 18:12 . 2012-09-12 03:56 376688 ----a-w- c:\windows\system32\drivers\netio.sys 2012-08-22 18:12 . 2012-09-12 03:56 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 21:01 . 2012-09-25 23:04 245760 ----a-w- c:\windows\system32\OxpsConverter.exe 2012-08-21 20:01 . 2012-09-17 03:59 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-08-21 20:01 . 2011-01-14 00:23 125872 ----a-w- c:\windows\system32\GEARAspi64.dll 2012-08-21 20:01 . 2011-01-14 00:23 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN1] @="{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN2] @="{CC8811D2-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D2-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN3] @="{CC8811D3-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D3-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN4] @="{CC8811D4-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D4-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN5] @="{CC8811D5-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D5-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN6] @="{CC8811D6-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D6-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN7] @="{CC8811D7-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D7-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288] "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-12 288088] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] . c:\users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-7-24 26909544] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ SmartSVN 6.6 (background).lnk - c:\program files (x86)\SmartSVN 6.6\bin\smartsvn.exe [2011-4-26 213504] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R2 statuscached;SmartSVN Status Cache;c:\program files (x86)\SmartSVN 6.6\bin\statuscached.exe [2011-04-26 216576] R3 ALSysIO;ALSysIO;c:\users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x] R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408] R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-07 35840] R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-07-23 1432400] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x] R3 npkycryp;npkycryp;f:\games\Gravity\RO\Gravity\RO\npkycryp.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-24 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R3 X6va005;X6va005;c:\users\Aaron\AppData\Local\Temp\005513E.tmp [x] R4 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816] S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [2009-12-25 297512] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-23 283200] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936] S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960] S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe [2010-11-30 336824] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2012-04-18 8518008] S2 TouchServiceWacom;Wacom Professional Touch Service;c:\program files\Tablet\Wacom\Wacom_TouchService.exe [2012-04-18 567672] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896] S3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2012-03-29 13688] S3 MAUSBJAMLAB;Service for M-Audio JamLab;c:\windows\system32\DRIVERS\MAudioJamLab.sys [2009-09-03 187912] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 83080] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 184968] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2012-03-29 65912] S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-03-29 15736] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 14442105 *NewlyCreated* - 77667716 *NewlyCreated* - ASWMBR *NewlyCreated* - WS2IFSL *Deregistered* - 14442105 *Deregistered* - 77667716 *Deregistered* - aswMBR . Contents of the 'Scheduled Tasks' folder . 2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1673349048-1130703633-4174618188-1000Core.job - c:\users\Aaron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-26 23:39] . 2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1673349048-1130703633-4174618188-1000UA.job - c:\users\Aaron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-26 23:39] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-29 10038304] "M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-03 798216] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-01-08 2328944] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com TCP: DhcpNameServer = 192.168.1.1 DPF: {20D5FC56-9F89-4966-94E1-122DDA4FA5E7} - hxxp://start1.gnjoy.com/cab/1004/GSystemInfo.cab DPF: {8768D5EA-5412-4810-A032-09AD2A726C69} - hxxp://bgweb.nowcdn.co.kr/Bin/DownStarter2.cab FF - ProfilePath - c:\users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\u44lvvmm.default-1352605413830\ FF - prefs.js: browser.startup.homepage - google.com FF - ExtSQL: 2012-11-15 17:42; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) SafeBoot-14442105.sys AddRemove-LimitRO Installer Lite 2012-04-20 - f:\games\LimitRO\Uninstal.exe AddRemove-LimitRONova - f:\games\LimitRO\uninst.exe AddRemove-PunkBusterSvc - c:\program files (x86)\GAMERSFIRST\APB RELOADED\Binaries\pbsvc_apb.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005] "ImagePath"="\??\c:\users\Aaron\AppData\Local\Temp\005513E.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{61539ECD-CC67-4437-A03C-9AACCBD14326}"=hex:51,66,7a,6c,4c,1d,38,12,a3,9d,40, 65,55,82,59,01,df,2a,d9,ec,ce,8f,07,32 "{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}"=hex:51,66,7a,6c,4c,1d,38,12,ed,e2,e6, 8b,ec,e5,85,03,cf,88,91,ea,bc,02,ef,f7 "{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8, 89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b "{00C6482D-C502-44C8-8409-FCE54AD9C208}"=hex:51,66,7a,6c,4c,1d,38,12,43,4b,d5, 04,30,8b,a6,01,fb,1f,bf,a5,4f,87,86,1c "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{B0CDA128-B425-4EEF-A174-61A11AC5DBF8}"=hex:51,66,7a,6c,4c,1d,38,12,46,a2,de, b4,17,fa,81,0b,de,62,22,e1,1f,9b,9f,ec "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:3b,52,4f,6f,c7,bf,cd,01 . [HKEY_USERS\S-1-5-21-1673349048-1130703633-4174618188-1000\Software\SecuROM\License information*] "datasecu"=hex:a7,84,5a,e4,88,5d,c0,ba,7e,91,61,c4,2c,c9,36,c1,92,2f,e0,dc,ce, 3e,cb,44,79,61,2b,84,e6,39,68,18,c3,a3,d6,d0,dc,5b,cd,02,f7,85,6a,f5,90,f0,\ "rkeysecu"=hex:94,de,f2,cd,22,e1,1f,e9,2c,ea,cd,c1,41,1c,26,29 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\0a\03\13\12\19\"6" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-11-18 19:19:28 ComboFix-quarantined-files.txt 2012-11-19 03:19 ComboFix2.txt 2012-11-18 21:33 . Pre-Run: 88,941,408,256 bytes free Post-Run: 88,781,336,576 bytes free . - - End Of File - - EA20B7068DB7D3263555A1A3692FD505 As for the status of the computer, haven't had a blue screen since after the instructions I followed in your first few posts

Alrighty! here goes: TDSSKiller 14:40:14.0988 6744 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 14:40:15.0499 6744 ============================================================ 14:40:15.0499 6744 Current date / time: 2012/11/18 14:40:15.0499 14:40:15.0499 6744 SystemInfo: 14:40:15.0499 6744 14:40:15.0499 6744 OS Version: 6.1.7601 ServicePack: 1.0 14:40:15.0499 6744 Product type: Workstation 14:40:15.0499 6744 ComputerName: BEAST 14:40:15.0499 6744 UserName: Aaron 14:40:15.0499 6744 Windows directory: C:\Windows 14:40:15.0499 6744 System windows directory: C:\Windows 14:40:15.0499 6744 Running under WOW64 14:40:15.0499 6744 Processor architecture: Intel x64 14:40:15.0499 6744 Number of processors: 8 14:40:15.0499 6744 Page size: 0x1000 14:40:15.0499 6744 Boot type: Normal boot 14:40:15.0499 6744 ============================================================ 14:40:16.0337 6744 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 14:40:16.0359 6744 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 14:40:16.0377 6744 Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 14:40:16.0380 6744 ============================================================ 14:40:16.0380 6744 \Device\Harddisk0\DR0: 14:40:16.0380 6744 MBR partitions: 14:40:16.0380 6744 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800 14:40:16.0380 6744 \Device\Harddisk1\DR1: 14:40:16.0381 6744 MBR partitions: 14:40:16.0381 6744 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800 14:40:16.0381 6744 \Device\Harddisk2\DR2: 14:40:16.0381 6744 MBR partitions: 14:40:16.0381 6744 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 14:40:16.0381 6744 \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000 14:40:16.0381 6744 ============================================================ 14:40:16.0412 6744 C: <-> \Device\Harddisk2\DR2\Partition2 14:40:16.0441 6744 E: <-> \Device\Harddisk1\DR1\Partition1 14:40:16.0469 6744 F: <-> \Device\Harddisk0\DR0\Partition1 14:40:16.0469 6744 ============================================================ 14:40:16.0469 6744 Initialize success 14:40:16.0469 6744 ============================================================ 14:55:59.0835 6184 ============================================================ 14:55:59.0835 6184 Scan started 14:55:59.0835 6184 Mode: Manual; 14:55:59.0835 6184 ============================================================ 14:56:02.0073 6184 ================ Scan system memory ======================== 14:56:02.0073 6184 System memory - ok 14:56:02.0073 6184 ================ Scan services ============================= 14:56:02.0196 6184 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 14:56:02.0197 6184 1394ohci - ok 14:56:02.0229 6184 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 14:56:02.0230 6184 ACPI - ok 14:56:02.0252 6184 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 14:56:02.0253 6184 AcpiPmi - ok 14:56:02.0297 6184 [ 2F0683FD2DF1D92E891CACA14B45A8C1 ] adfs C:\Windows\system32\drivers\adfs.sys 14:56:02.0297 6184 adfs - ok 14:56:02.0448 6184 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 14:56:02.0448 6184 AdobeARMservice - ok 14:56:02.0494 6184 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys 14:56:02.0496 6184 adp94xx - ok 14:56:02.0514 6184 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys 14:56:02.0516 6184 adpahci - ok 14:56:02.0526 6184 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys 14:56:02.0526 6184 adpu320 - ok 14:56:02.0554 6184 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 14:56:02.0554 6184 AeLookupSvc - ok 14:56:02.0599 6184 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 14:56:02.0601 6184 AFD - ok 14:56:02.0625 6184 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 14:56:02.0626 6184 agp440 - ok 14:56:02.0661 6184 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 14:56:02.0661 6184 ALG - ok 14:56:02.0666 6184 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 14:56:02.0666 6184 aliide - ok 14:56:02.0698 6184 ALSysIO - ok 14:56:02.0750 6184 [ 4C1E3649C89C7D542CD18ECC5210099D ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe 14:56:02.0751 6184 AMD External Events Utility - ok 14:56:02.0760 6184 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 14:56:02.0760 6184 amdide - ok 14:56:02.0793 6184 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys 14:56:02.0793 6184 AmdK8 - ok 14:56:03.0179 6184 [ A3C0A15B39F979E8F3EABA901D72ECD7 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys 14:56:03.0215 6184 amdkmdag - ok 14:56:03.0273 6184 [ 20F3CD38B107C1BD747C0EA37D450165 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys 14:56:03.0275 6184 amdkmdap - ok 14:56:03.0286 6184 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys 14:56:03.0286 6184 AmdPPM - ok 14:56:03.0310 6184 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 14:56:03.0310 6184 amdsata - ok 14:56:03.0333 6184 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys 14:56:03.0333 6184 amdsbs - ok 14:56:03.0346 6184 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 14:56:03.0346 6184 amdxata - ok 14:56:03.0397 6184 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 14:56:03.0397 6184 AppID - ok 14:56:03.0420 6184 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 14:56:03.0421 6184 AppIDSvc - ok 14:56:03.0458 6184 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 14:56:03.0459 6184 Appinfo - ok 14:56:03.0574 6184 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 14:56:03.0575 6184 Apple Mobile Device - ok 14:56:03.0601 6184 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys 14:56:03.0602 6184 arc - ok 14:56:03.0604 6184 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys 14:56:03.0604 6184 arcsas - ok 14:56:03.0715 6184 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 14:56:03.0715 6184 aspnet_state - ok 14:56:03.0741 6184 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 14:56:03.0741 6184 AsyncMac - ok 14:56:03.0756 6184 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 14:56:03.0756 6184 atapi - ok 14:56:03.0803 6184 [ B0790FF0E25B7A2674296052F2162C1A ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys 14:56:03.0803 6184 AtiHDAudioService - ok 14:56:03.0864 6184 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 14:56:03.0866 6184 AudioEndpointBuilder - ok 14:56:03.0873 6184 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 14:56:03.0875 6184 AudioSrv - ok 14:56:03.0917 6184 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 14:56:03.0918 6184 AxInstSV - ok 14:56:03.0954 6184 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys 14:56:03.0956 6184 b06bdrv - ok 14:56:03.0977 6184 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 14:56:03.0978 6184 b57nd60a - ok 14:56:04.0099 6184 [ A2494901E7226B356B8C1005C45F1C5F ] BBSvc C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe 14:56:04.0100 6184 BBSvc - ok 14:56:04.0155 6184 [ 63B1CBBAE4790B5BAC98F01BF9449722 ] BBUpdate C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe 14:56:04.0156 6184 BBUpdate - ok 14:56:04.0205 6184 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 14:56:04.0205 6184 BDESVC - ok 14:56:04.0256 6184 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 14:56:04.0257 6184 Beep - ok 14:56:04.0302 6184 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 14:56:04.0304 6184 BFE - ok 14:56:04.0357 6184 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll 14:56:04.0360 6184 BITS - ok 14:56:04.0384 6184 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 14:56:04.0385 6184 blbdrive - ok 14:56:04.0469 6184 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 14:56:04.0470 6184 Bonjour Service - ok 14:56:04.0512 6184 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 14:56:04.0512 6184 bowser - ok 14:56:04.0520 6184 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys 14:56:04.0520 6184 BrFiltLo - ok 14:56:04.0530 6184 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys 14:56:04.0530 6184 BrFiltUp - ok 14:56:04.0533 6184 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys 14:56:04.0533 6184 BridgeMP - ok 14:56:04.0577 6184 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 14:56:04.0577 6184 Browser - ok 14:56:04.0594 6184 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 14:56:04.0595 6184 Brserid - ok 14:56:04.0605 6184 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 14:56:04.0605 6184 BrSerWdm - ok 14:56:04.0616 6184 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 14:56:04.0617 6184 BrUsbMdm - ok 14:56:04.0630 6184 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 14:56:04.0630 6184 BrUsbSer - ok 14:56:04.0632 6184 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys 14:56:04.0632 6184 BTHMODEM - ok 14:56:04.0654 6184 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 14:56:04.0654 6184 bthserv - ok 14:56:04.0706 6184 [ 9887CA12F407D7FBC7F48F3678F5F0B6 ] BVRPMPR5a64 C:\Windows\system32\drivers\BVRPMPR5a64.SYS 14:56:04.0706 6184 BVRPMPR5a64 - ok 14:56:04.0717 6184 catchme - ok 14:56:04.0748 6184 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 14:56:04.0749 6184 cdfs - ok 14:56:04.0780 6184 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 14:56:04.0780 6184 cdrom - ok 14:56:04.0828 6184 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 14:56:04.0829 6184 CertPropSvc - ok 14:56:04.0848 6184 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys 14:56:04.0849 6184 circlass - ok 14:56:04.0879 6184 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 14:56:04.0880 6184 CLFS - ok 14:56:04.0919 6184 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 14:56:04.0920 6184 clr_optimization_v2.0.50727_32 - ok 14:56:04.0938 6184 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 14:56:04.0938 6184 clr_optimization_v2.0.50727_64 - ok 14:56:05.0022 6184 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 14:56:05.0023 6184 clr_optimization_v4.0.30319_32 - ok 14:56:05.0047 6184 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 14:56:05.0048 6184 clr_optimization_v4.0.30319_64 - ok 14:56:05.0080 6184 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys 14:56:05.0081 6184 CmBatt - ok 14:56:05.0111 6184 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 14:56:05.0111 6184 cmdide - ok 14:56:05.0157 6184 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys 14:56:05.0158 6184 CNG - ok 14:56:05.0183 6184 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys 14:56:05.0183 6184 Compbatt - ok 14:56:05.0235 6184 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys 14:56:05.0235 6184 CompositeBus - ok 14:56:05.0255 6184 COMSysApp - ok 14:56:05.0290 6184 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys 14:56:05.0290 6184 crcdisk - ok 14:56:05.0350 6184 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll 14:56:05.0351 6184 CryptSvc - ok 14:56:05.0457 6184 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE 14:56:05.0460 6184 cvhsvc - ok 14:56:05.0508 6184 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 14:56:05.0511 6184 DcomLaunch - ok 14:56:05.0538 6184 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 14:56:05.0540 6184 defragsvc - ok 14:56:05.0579 6184 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 14:56:05.0579 6184 DfsC - ok 14:56:05.0603 6184 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 14:56:05.0604 6184 Dhcp - ok 14:56:05.0622 6184 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 14:56:05.0622 6184 discache - ok 14:56:05.0638 6184 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys 14:56:05.0638 6184 Disk - ok 14:56:05.0677 6184 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 14:56:05.0678 6184 Dnscache - ok 14:56:05.0726 6184 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 14:56:05.0727 6184 dot3svc - ok 14:56:05.0765 6184 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 14:56:05.0766 6184 DPS - ok 14:56:05.0789 6184 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 14:56:05.0789 6184 drmkaud - ok 14:56:05.0815 6184 [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys 14:56:05.0816 6184 dtsoftbus01 - ok 14:56:05.0850 6184 dump_wmimmc - ok 14:56:05.0918 6184 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 14:56:05.0921 6184 DXGKrnl - ok 14:56:05.0952 6184 EagleX64 - ok 14:56:05.0974 6184 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 14:56:05.0975 6184 EapHost - ok 14:56:06.0035 6184 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys 14:56:06.0046 6184 ebdrv - ok 14:56:06.0068 6184 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 14:56:06.0069 6184 EFS - ok 14:56:06.0158 6184 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 14:56:06.0161 6184 ehRecvr - ok 14:56:06.0184 6184 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 14:56:06.0185 6184 ehSched - ok 14:56:06.0211 6184 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys 14:56:06.0213 6184 elxstor - ok 14:56:06.0221 6184 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 14:56:06.0222 6184 ErrDev - ok 14:56:06.0255 6184 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 14:56:06.0257 6184 EventSystem - ok 14:56:06.0269 6184 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 14:56:06.0270 6184 exfat - ok 14:56:06.0286 6184 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 14:56:06.0287 6184 fastfat - ok 14:56:06.0337 6184 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 14:56:06.0340 6184 Fax - ok 14:56:06.0349 6184 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys 14:56:06.0349 6184 fdc - ok 14:56:06.0371 6184 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 14:56:06.0371 6184 fdPHost - ok 14:56:06.0380 6184 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 14:56:06.0381 6184 FDResPub - ok 14:56:06.0397 6184 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 14:56:06.0397 6184 FileInfo - ok 14:56:06.0412 6184 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 14:56:06.0412 6184 Filetrace - ok 14:56:06.0483 6184 [ 1F63900E2EB00101B9ACA2B7A870704E ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 14:56:06.0485 6184 FLEXnet Licensing Service - ok 14:56:06.0528 6184 [ 64AB6F28047744B9B19C97459C2AB31B ] FLEXnet Licensing Service 64 C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe 14:56:06.0533 6184 FLEXnet Licensing Service 64 - ok 14:56:06.0550 6184 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 14:56:06.0550 6184 flpydisk - ok 14:56:06.0599 6184 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 14:56:06.0600 6184 FltMgr - ok 14:56:06.0645 6184 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll 14:56:06.0650 6184 FontCache - ok 14:56:06.0712 6184 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 14:56:06.0712 6184 FontCache3.0.0.0 - ok 14:56:06.0731 6184 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 14:56:06.0731 6184 FsDepends - ok 14:56:06.0767 6184 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 14:56:06.0767 6184 Fs_Rec - ok 14:56:06.0819 6184 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 14:56:06.0820 6184 fvevol - ok 14:56:06.0833 6184 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys 14:56:06.0833 6184 gagp30kx - ok 14:56:06.0884 6184 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 14:56:06.0884 6184 GEARAspiWDM - ok 14:56:06.0935 6184 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 14:56:06.0938 6184 gpsvc - ok 14:56:06.0951 6184 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 14:56:06.0952 6184 hcw85cir - ok 14:56:06.0985 6184 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 14:56:06.0986 6184 HdAudAddService - ok 14:56:07.0015 6184 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys 14:56:07.0016 6184 HDAudBus - ok 14:56:07.0027 6184 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys 14:56:07.0027 6184 HidBatt - ok 14:56:07.0036 6184 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys 14:56:07.0037 6184 HidBth - ok 14:56:07.0051 6184 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys 14:56:07.0051 6184 HidIr - ok 14:56:07.0086 6184 [ 3CC53BC405F609F61D4A879F3E7EBC4A ] hidkmdf C:\Windows\system32\DRIVERS\hidkmdf.sys 14:56:07.0086 6184 hidkmdf - ok 14:56:07.0134 6184 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll 14:56:07.0134 6184 hidserv - ok 14:56:07.0173 6184 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 14:56:07.0173 6184 HidUsb - ok 14:56:07.0219 6184 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 14:56:07.0220 6184 hkmsvc - ok 14:56:07.0274 6184 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 14:56:07.0275 6184 HomeGroupListener - ok 14:56:07.0347 6184 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 14:56:07.0348 6184 HomeGroupProvider - ok 14:56:07.0372 6184 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 14:56:07.0372 6184 HpSAMD - ok 14:56:07.0446 6184 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 14:56:07.0448 6184 HTTP - ok 14:56:07.0479 6184 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 14:56:07.0479 6184 hwpolicy - ok 14:56:07.0534 6184 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 14:56:07.0535 6184 i8042prt - ok 14:56:07.0575 6184 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 14:56:07.0576 6184 iaStorV - ok 14:56:07.0663 6184 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 14:56:07.0666 6184 idsvc - ok 14:56:07.0686 6184 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys 14:56:07.0686 6184 iirsp - ok 14:56:07.0732 6184 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 14:56:07.0735 6184 IKEEXT - ok 14:56:07.0780 6184 [ A3BCBD0F710580A07D1B929D787D36CE ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys 14:56:07.0787 6184 IntcAzAudAddService - ok 14:56:07.0810 6184 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 14:56:07.0811 6184 intelide - ok 14:56:07.0830 6184 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 14:56:07.0830 6184 intelppm - ok 14:56:07.0851 6184 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 14:56:07.0852 6184 IPBusEnum - ok 14:56:07.0891 6184 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 14:56:07.0891 6184 IpFilterDriver - ok 14:56:07.0931 6184 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 14:56:07.0933 6184 iphlpsvc - ok 14:56:07.0951 6184 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 14:56:07.0951 6184 IPMIDRV - ok 14:56:07.0964 6184 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 14:56:07.0964 6184 IPNAT - ok 14:56:08.0017 6184 [ 6E50CFA46527B39015B750AAD161C5CC ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 14:56:08.0020 6184 iPod Service - ok 14:56:08.0045 6184 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 14:56:08.0045 6184 IRENUM - ok 14:56:08.0070 6184 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 14:56:08.0070 6184 isapnp - ok 14:56:08.0091 6184 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 14:56:08.0092 6184 iScsiPrt - ok 14:56:08.0155 6184 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 14:56:08.0155 6184 kbdclass - ok 14:56:08.0193 6184 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys 14:56:08.0193 6184 kbdhid - ok 14:56:08.0293 6184 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 14:56:08.0293 6184 KeyIso - ok 14:56:08.0364 6184 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 14:56:08.0365 6184 KSecDD - ok 14:56:08.0382 6184 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 14:56:08.0383 6184 KSecPkg - ok 14:56:08.0430 6184 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 14:56:08.0431 6184 ksthunk - ok 14:56:08.0490 6184 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 14:56:08.0492 6184 KtmRm - ok 14:56:08.0560 6184 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll 14:56:08.0562 6184 LanmanServer - ok 14:56:08.0604 6184 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 14:56:08.0605 6184 LanmanWorkstation - ok 14:56:08.0628 6184 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 14:56:08.0629 6184 lltdio - ok 14:56:08.0637 6184 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 14:56:08.0638 6184 lltdsvc - ok 14:56:08.0651 6184 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 14:56:08.0652 6184 lmhosts - ok 14:56:08.0675 6184 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys 14:56:08.0676 6184 LSI_FC - ok 14:56:08.0679 6184 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys 14:56:08.0679 6184 LSI_SAS - ok 14:56:08.0681 6184 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys 14:56:08.0681 6184 LSI_SAS2 - ok 14:56:08.0689 6184 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys 14:56:08.0690 6184 LSI_SCSI - ok 14:56:08.0708 6184 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 14:56:08.0708 6184 luafv - ok 14:56:08.0758 6184 [ 221FD25930DDF5E8F7427FBEA2736A05 ] MAUSBJAMLAB C:\Windows\system32\DRIVERS\MAudioJamLab.sys 14:56:08.0759 6184 MAUSBJAMLAB - ok 14:56:08.0813 6184 [ A8FE8F2783B2929B56F5370A89356CE9 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys 14:56:08.0813 6184 MBAMProtector - ok 14:56:08.0865 6184 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe 14:56:08.0866 6184 MBAMScheduler - ok 14:56:08.0887 6184 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe 14:56:08.0890 6184 MBAMService - ok 14:56:08.0929 6184 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 14:56:08.0930 6184 Mcx2Svc - ok 14:56:08.0958 6184 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys 14:56:08.0958 6184 megasas - ok 14:56:08.0962 6184 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys 14:56:08.0963 6184 MegaSR - ok 14:56:08.0992 6184 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 14:56:08.0993 6184 MMCSS - ok 14:56:08.0995 6184 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 14:56:08.0995 6184 Modem - ok 14:56:09.0012 6184 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 14:56:09.0012 6184 monitor - ok 14:56:09.0042 6184 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 14:56:09.0043 6184 mouclass - ok 14:56:09.0063 6184 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 14:56:09.0063 6184 mouhid - ok 14:56:09.0102 6184 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 14:56:09.0103 6184 mountmgr - ok 14:56:09.0153 6184 [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 14:56:09.0154 6184 MozillaMaintenance - ok 14:56:09.0182 6184 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 14:56:09.0182 6184 mpio - ok 14:56:09.0223 6184 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 14:56:09.0224 6184 mpsdrv - ok 14:56:09.0282 6184 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 14:56:09.0285 6184 MpsSvc - ok 14:56:09.0330 6184 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 14:56:09.0331 6184 MRxDAV - ok 14:56:09.0363 6184 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 14:56:09.0364 6184 mrxsmb - ok 14:56:09.0419 6184 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 14:56:09.0420 6184 mrxsmb10 - ok 14:56:09.0431 6184 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 14:56:09.0431 6184 mrxsmb20 - ok 14:56:09.0452 6184 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 14:56:09.0452 6184 msahci - ok 14:56:09.0480 6184 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 14:56:09.0481 6184 msdsm - ok 14:56:09.0496 6184 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 14:56:09.0497 6184 MSDTC - ok 14:56:09.0512 6184 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 14:56:09.0512 6184 Msfs - ok 14:56:09.0518 6184 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 14:56:09.0519 6184 mshidkmdf - ok 14:56:09.0530 6184 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 14:56:09.0531 6184 msisadrv - ok 14:56:09.0563 6184 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 14:56:09.0564 6184 MSiSCSI - ok 14:56:09.0566 6184 msiserver - ok 14:56:09.0581 6184 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 14:56:09.0581 6184 MSKSSRV - ok 14:56:09.0594 6184 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 14:56:09.0594 6184 MSPCLOCK - ok 14:56:09.0607 6184 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 14:56:09.0608 6184 MSPQM - ok 14:56:09.0652 6184 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 14:56:09.0653 6184 MsRPC - ok 14:56:09.0674 6184 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys 14:56:09.0674 6184 mssmbios - ok 14:56:09.0681 6184 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 14:56:09.0681 6184 MSTEE - ok 14:56:09.0695 6184 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys 14:56:09.0696 6184 MTConfig - ok 14:56:09.0729 6184 [ 19B006B181E3875FD254F7B67ACF1E7C ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys 14:56:09.0730 6184 MTsensor - ok 14:56:09.0750 6184 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 14:56:09.0750 6184 Mup - ok 14:56:09.0779 6184 [ 8DB5861A8DB19ABAF430FCD001EF5E93 ] mv91xx C:\Windows\system32\DRIVERS\mv91xx.sys 14:56:09.0780 6184 mv91xx - ok 14:56:09.0820 6184 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 14:56:09.0823 6184 napagent - ok 14:56:09.0847 6184 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 14:56:09.0848 6184 NativeWifiP - ok 14:56:09.0899 6184 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 14:56:09.0902 6184 NDIS - ok 14:56:09.0913 6184 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 14:56:09.0913 6184 NdisCap - ok 14:56:09.0936 6184 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 14:56:09.0937 6184 NdisTapi - ok 14:56:09.0977 6184 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 14:56:09.0977 6184 Ndisuio - ok 14:56:10.0018 6184 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 14:56:10.0018 6184 NdisWan - ok 14:56:10.0052 6184 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 14:56:10.0052 6184 NDProxy - ok 14:56:10.0079 6184 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 14:56:10.0079 6184 NetBIOS - ok 14:56:10.0114 6184 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 14:56:10.0115 6184 NetBT - ok 14:56:10.0126 6184 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 14:56:10.0126 6184 Netlogon - ok 14:56:10.0170 6184 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 14:56:10.0172 6184 Netman - ok 14:56:10.0216 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 14:56:10.0217 6184 NetMsmqActivator - ok 14:56:10.0219 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 14:56:10.0219 6184 NetPipeActivator - ok 14:56:10.0234 6184 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 14:56:10.0236 6184 netprofm - ok 14:56:10.0239 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 14:56:10.0239 6184 NetTcpActivator - ok 14:56:10.0241 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 14:56:10.0242 6184 NetTcpPortSharing - ok 14:56:10.0253 6184 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys 14:56:10.0253 6184 nfrd960 - ok 14:56:10.0390 6184 [ 0BCB418C2906852C6F9347A258FD5711 ] NIHardwareService C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe 14:56:10.0408 6184 NIHardwareService - ok 14:56:10.0430 6184 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll 14:56:10.0432 6184 NlaSvc - ok 14:56:10.0440 6184 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 14:56:10.0440 6184 Npfs - ok 14:56:10.0479 6184 npggsvc - ok 14:56:10.0549 6184 [ AAF9B4DF67938753CB21808EA3574242 ] npkcrypt F:\Games\Gravity\RO\Gravity\RO\npkcrypt.sys 14:56:10.0550 6184 npkcrypt - ok 14:56:10.0552 6184 npkycryp - ok 14:56:10.0554 6184 NPPTNT2 - ok 14:56:10.0573 6184 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 14:56:10.0574 6184 nsi - ok 14:56:10.0591 6184 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 14:56:10.0592 6184 nsiproxy - ok 14:56:10.0647 6184 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 14:56:10.0652 6184 Ntfs - ok 14:56:10.0661 6184 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 14:56:10.0662 6184 Null - ok 14:56:10.0688 6184 [ 285ACEC1B13A15BA520AAE06BACB9CFF ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys 14:56:10.0688 6184 nusb3hub - ok 14:56:10.0699 6184 [ F6D625FF7B56BB6EA063F0D3A5BBC996 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys 14:56:10.0700 6184 nusb3xhc - ok 14:56:10.0728 6184 [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys 14:56:10.0729 6184 NVENETFD - ok 14:56:10.0869 6184 [ DD81FBC57AB9134CDDC5CE90880BFD80 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys 14:56:10.0907 6184 nvlddmkm - ok 14:56:10.0939 6184 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 14:56:10.0940 6184 nvraid - ok 14:56:10.0969 6184 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 14:56:10.0970 6184 nvstor - ok 14:56:10.0989 6184 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 14:56:10.0990 6184 nv_agp - ok 14:56:11.0001 6184 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 14:56:11.0001 6184 ohci1394 - ok 14:56:11.0058 6184 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 14:56:11.0059 6184 ose - ok 14:56:11.0214 6184 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 14:56:11.0230 6184 osppsvc - ok 14:56:11.0252 6184 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 14:56:11.0253 6184 p2pimsvc - ok 14:56:11.0284 6184 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 14:56:11.0286 6184 p2psvc - ok 14:56:11.0315 6184 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys 14:56:11.0316 6184 Parport - ok 14:56:11.0350 6184 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 14:56:11.0351 6184 partmgr - ok 14:56:11.0369 6184 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 14:56:11.0370 6184 PcaSvc - ok 14:56:11.0394 6184 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 14:56:11.0394 6184 pci - ok 14:56:11.0400 6184 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 14:56:11.0400 6184 pciide - ok 14:56:11.0413 6184 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys 14:56:11.0414 6184 pcmcia - ok 14:56:11.0427 6184 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 14:56:11.0427 6184 pcw - ok 14:56:11.0444 6184 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 14:56:11.0446 6184 PEAUTH - ok 14:56:11.0505 6184 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 14:56:11.0506 6184 PerfHost - ok 14:56:11.0566 6184 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 14:56:11.0571 6184 pla - ok 14:56:11.0610 6184 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 14:56:11.0612 6184 PlugPlay - ok 14:56:11.0626 6184 PnkBstrA - ok 14:56:11.0645 6184 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 14:56:11.0645 6184 PNRPAutoReg - ok 14:56:11.0660 6184 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 14:56:11.0662 6184 PNRPsvc - ok 14:56:11.0709 6184 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 14:56:11.0711 6184 PolicyAgent - ok 14:56:11.0719 6184 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 14:56:11.0721 6184 Power - ok 14:56:11.0772 6184 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 14:56:11.0773 6184 PptpMiniport - ok 14:56:11.0800 6184 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys 14:56:11.0800 6184 Processor - ok 14:56:11.0847 6184 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 14:56:11.0849 6184 ProfSvc - ok 14:56:11.0859 6184 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 14:56:11.0860 6184 ProtectedStorage - ok 14:56:11.0906 6184 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 14:56:11.0907 6184 Psched - ok 14:56:11.0981 6184 [ 788CB65D49D1162C5EE6814AFE5B0A70 ] PSI_SVC_2_x64 c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe 14:56:11.0982 6184 PSI_SVC_2_x64 - ok 14:56:12.0019 6184 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys 14:56:12.0025 6184 ql2300 - ok 14:56:12.0038 6184 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys 14:56:12.0039 6184 ql40xx - ok 14:56:12.0063 6184 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 14:56:12.0064 6184 QWAVE - ok 14:56:12.0071 6184 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 14:56:12.0072 6184 QWAVEdrv - ok 14:56:12.0093 6184 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 14:56:12.0093 6184 RasAcd - ok 14:56:12.0119 6184 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 14:56:12.0120 6184 RasAgileVpn - ok 14:56:12.0134 6184 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 14:56:12.0135 6184 RasAuto - ok 14:56:12.0176 6184 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 14:56:12.0177 6184 Rasl2tp - ok 14:56:12.0202 6184 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 14:56:12.0204 6184 RasMan - ok 14:56:12.0222 6184 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 14:56:12.0222 6184 RasPppoe - ok 14:56:12.0281 6184 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 14:56:12.0282 6184 RasSstp - ok 14:56:12.0305 6184 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 14:56:12.0306 6184 rdbss - ok 14:56:12.0319 6184 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys 14:56:12.0319 6184 rdpbus - ok 14:56:12.0332 6184 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 14:56:12.0332 6184 RDPCDD - ok 14:56:12.0343 6184 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 14:56:12.0343 6184 RDPENCDD - ok 14:56:12.0346 6184 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 14:56:12.0347 6184 RDPREFMP - ok 14:56:12.0377 6184 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 14:56:12.0378 6184 RDPWD - ok 14:56:12.0420 6184 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 14:56:12.0420 6184 rdyboost - ok 14:56:12.0469 6184 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 14:56:12.0470 6184 RemoteAccess - ok 14:56:12.0486 6184 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 14:56:12.0487 6184 RemoteRegistry - ok 14:56:12.0506 6184 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 14:56:12.0507 6184 RpcEptMapper - ok 14:56:12.0521 6184 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 14:56:12.0522 6184 RpcLocator - ok 14:56:12.0557 6184 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll 14:56:12.0560 6184 RpcSs - ok 14:56:12.0580 6184 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 14:56:12.0581 6184 rspndr - ok 14:56:12.0617 6184 [ BAEFEE35D27A5440D35092CE10267BEC ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys 14:56:12.0618 6184 RTL8167 - ok 14:56:12.0634 6184 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 14:56:12.0635 6184 SamSs - ok 14:56:12.0654 6184 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 14:56:12.0654 6184 sbp2port - ok 14:56:12.0683 6184 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 14:56:12.0684 6184 SCardSvr - ok 14:56:12.0729 6184 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 14:56:12.0730 6184 scfilter - ok 14:56:12.0777 6184 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 14:56:12.0781 6184 Schedule - ok 14:56:12.0819 6184 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 14:56:12.0820 6184 SCPolicySvc - ok 14:56:12.0858 6184 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 14:56:12.0859 6184 SDRSVC - ok 14:56:12.0879 6184 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 14:56:12.0879 6184 secdrv - ok 14:56:12.0889 6184 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 14:56:12.0890 6184 seclogon - ok 14:56:12.0909 6184 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll 14:56:12.0910 6184 SENS - ok 14:56:12.0933 6184 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 14:56:12.0934 6184 SensrSvc - ok 14:56:12.0964 6184 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 14:56:12.0964 6184 Serenum - ok 14:56:12.0978 6184 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys 14:56:12.0979 6184 Serial - ok 14:56:13.0006 6184 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys 14:56:13.0006 6184 sermouse - ok 14:56:13.0049 6184 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 14:56:13.0050 6184 SessionEnv - ok 14:56:13.0076 6184 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 14:56:13.0076 6184 sffdisk - ok 14:56:13.0085 6184 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 14:56:13.0085 6184 sffp_mmc - ok 14:56:13.0096 6184 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 14:56:13.0096 6184 sffp_sd - ok 14:56:13.0112 6184 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys 14:56:13.0112 6184 sfloppy - ok 14:56:13.0180 6184 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys 14:56:13.0182 6184 Sftfs - ok 14:56:13.0285 6184 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe 14:56:13.0287 6184 sftlist - ok 14:56:13.0332 6184 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys 14:56:13.0333 6184 Sftplay - ok 14:56:13.0355 6184 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys 14:56:13.0356 6184 Sftredir - ok 14:56:13.0401 6184 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys 14:56:13.0402 6184 Sftvol - ok 14:56:13.0417 6184 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe 14:56:13.0418 6184 sftvsa - ok 14:56:13.0463 6184 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 14:56:13.0465 6184 SharedAccess - ok 14:56:13.0516 6184 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 14:56:13.0518 6184 ShellHWDetection - ok 14:56:13.0539 6184 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys 14:56:13.0539 6184 SiSRaid2 - ok 14:56:13.0669 6184 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys 14:56:13.0669 6184 SiSRaid4 - ok 14:56:13.0824 6184 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe 14:56:13.0825 6184 SkypeUpdate - ok 14:56:13.0872 6184 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 14:56:13.0872 6184 Smb - ok 14:56:13.0910 6184 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 14:56:13.0911 6184 SNMPTRAP - ok 14:56:13.0940 6184 [ 12583AF6CBE0050651EAF2723B3AD7B3 ] speedfan C:\Windows\syswow64\speedfan.sys 14:56:13.0941 6184 speedfan - ok 14:56:13.0956 6184 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 14:56:13.0957 6184 spldr - ok 14:56:14.0005 6184 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 14:56:14.0008 6184 Spooler - ok 14:56:14.0079 6184 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 14:56:14.0091 6184 sppsvc - ok 14:56:14.0108 6184 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 14:56:14.0110 6184 sppuinotify - ok 14:56:14.0136 6184 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 14:56:14.0137 6184 srv - ok 14:56:14.0153 6184 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 14:56:14.0154 6184 srv2 - ok 14:56:14.0167 6184 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 14:56:14.0168 6184 srvnet - ok 14:56:14.0191 6184 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 14:56:14.0192 6184 SSDPSRV - ok 14:56:14.0214 6184 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 14:56:14.0215 6184 SstpSvc - ok 14:56:14.0305 6184 [ 969FBE32D34E257A4285BD40E89D72D2 ] statuscached C:\Program Files (x86)\SmartSVN 6.6\bin\statuscached.exe 14:56:14.0306 6184 statuscached - ok 14:56:14.0343 6184 Steam Client Service - ok 14:56:14.0364 6184 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys 14:56:14.0364 6184 stexstor - ok 14:56:14.0411 6184 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 14:56:14.0414 6184 stisvc - ok 14:56:14.0430 6184 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys 14:56:14.0431 6184 swenum - ok 14:56:14.0533 6184 [ F577910A133A592234EBAAD3F3AFA258 ] SwitchBoard C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 14:56:14.0535 6184 SwitchBoard - ok 14:56:14.0555 6184 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 14:56:14.0558 6184 swprv - ok 14:56:14.0608 6184 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 14:56:14.0614 6184 SysMain - ok 14:56:14.0657 6184 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 14:56:14.0658 6184 TabletInputService - ok 14:56:14.0806 6184 [ 17A341D41F30FEA2EFF7223148899FEC ] TabletServiceWacom C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe 14:56:14.0834 6184 TabletServiceWacom - ok 14:56:14.0869 6184 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 14:56:14.0871 6184 TapiSrv - ok 14:56:14.0893 6184 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 14:56:14.0894 6184 TBS - ok 14:56:14.0976 6184 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys 14:56:14.0982 6184 Tcpip - ok 14:56:14.0998 6184 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 14:56:15.0004 6184 TCPIP6 - ok 14:56:15.0023 6184 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 14:56:15.0024 6184 tcpipreg - ok 14:56:15.0059 6184 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 14:56:15.0059 6184 TDPIPE - ok 14:56:15.0096 6184 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 14:56:15.0096 6184 TDTCP - ok 14:56:15.0130 6184 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 14:56:15.0130 6184 tdx - ok 14:56:15.0154 6184 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys 14:56:15.0155 6184 TermDD - ok 14:56:15.0175 6184 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 14:56:15.0178 6184 TermService - ok 14:56:15.0210 6184 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 14:56:15.0211 6184 Themes - ok 14:56:15.0233 6184 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 14:56:15.0234 6184 THREADORDER - ok 14:56:15.0299 6184 [ A15A789141C74AAD7971FBCB4847A593 ] TouchServiceWacom C:\Program Files\Tablet\Wacom\Wacom_TouchService.exe 14:56:15.0301 6184 TouchServiceWacom - ok 14:56:15.0321 6184 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 14:56:15.0322 6184 TrkWks - ok 14:56:15.0381 6184 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 14:56:15.0382 6184 TrustedInstaller - ok 14:56:15.0427 6184 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 14:56:15.0428 6184 tssecsrv - ok 14:56:15.0477 6184 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 14:56:15.0477 6184 TsUsbFlt - ok 14:56:15.0550 6184 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 14:56:15.0550 6184 tunnel - ok 14:56:15.0576 6184 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys 14:56:15.0576 6184 uagp35 - ok 14:56:15.0635 6184 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 14:56:15.0637 6184 udfs - ok 14:56:15.0659 6184 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 14:56:15.0661 6184 UI0Detect - ok 14:56:15.0675 6184 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 14:56:15.0675 6184 uliagpkx - ok 14:56:15.0716 6184 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys 14:56:15.0716 6184 umbus - ok 14:56:15.0731 6184 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys 14:56:15.0732 6184 UmPass - ok 14:56:15.0751 6184 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 14:56:15.0753 6184 upnphost - ok 14:56:15.0801 6184 [ AF1B9474D67897D0C2CFF58E0ACEACCC ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys 14:56:15.0802 6184 USBAAPL64 - ok 14:56:15.0851 6184 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys 14:56:15.0851 6184 usbaudio - ok 14:56:15.0865 6184 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 14:56:15.0866 6184 usbccgp - ok 14:56:15.0908 6184 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 14:56:15.0908 6184 usbcir - ok 14:56:15.0934 6184 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 14:56:15.0934 6184 usbehci - ok 14:56:15.0978 6184 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 14:56:15.0979 6184 usbhub - ok 14:56:16.0008 6184 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys 14:56:16.0008 6184 usbohci - ok 14:56:16.0033 6184 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 14:56:16.0033 6184 usbprint - ok 14:56:16.0052 6184 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 14:56:16.0053 6184 USBSTOR - ok 14:56:16.0075 6184 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys 14:56:16.0076 6184 usbuhci - ok 14:56:16.0095 6184 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 14:56:16.0096 6184 UxSms - ok 14:56:16.0108 6184 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 14:56:16.0109 6184 VaultSvc - ok 14:56:16.0149 6184 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 14:56:16.0150 6184 vdrvroot - ok 14:56:16.0232 6184 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 14:56:16.0234 6184 vds - ok 14:56:16.0246 6184 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 14:56:16.0246 6184 vga - ok 14:56:16.0277 6184 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 14:56:16.0277 6184 VgaSave - ok 14:56:16.0306 6184 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 14:56:16.0307 6184 vhdmp - ok 14:56:16.0323 6184 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 14:56:16.0324 6184 viaide - ok 14:56:16.0335 6184 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 14:56:16.0335 6184 volmgr - ok 14:56:16.0369 6184 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 14:56:16.0371 6184 volmgrx - ok 14:56:16.0385 6184 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 14:56:16.0386 6184 volsnap - ok 14:56:16.0399 6184 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys 14:56:16.0399 6184 vsmraid - ok 14:56:16.0460 6184 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 14:56:16.0466 6184 VSS - ok 14:56:16.0485 6184 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys 14:56:16.0485 6184 vwifibus - ok 14:56:16.0514 6184 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 14:56:16.0516 6184 W32Time - ok 14:56:16.0554 6184 [ 7CB1898A29188FB8DB102406EF0D8D9E ] WacHidRouter C:\Windows\system32\DRIVERS\wachidrouter.sys 14:56:16.0555 6184 WacHidRouter - ok 14:56:16.0556 6184 WacomPen - ok 14:56:16.0590 6184 [ B59EC4DD1026F059CD95C1627562F3F3 ] wacomrouterfilter C:\Windows\system32\DRIVERS\wacomrouterfilter.sys 14:56:16.0590 6184 wacomrouterfilter - ok 14:56:16.0634 6184 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 14:56:16.0635 6184 WANARP - ok 14:56:16.0637 6184 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 14:56:16.0637 6184 Wanarpv6 - ok 14:56:16.0675 6184 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 14:56:16.0680 6184 WatAdminSvc - ok 14:56:16.0724 6184 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 14:56:16.0730 6184 wbengine - ok 14:56:16.0759 6184 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 14:56:16.0761 6184 WbioSrvc - ok 14:56:16.0800 6184 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 14:56:16.0802 6184 wcncsvc - ok 14:56:16.0814 6184 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 14:56:16.0815 6184 WcsPlugInService - ok 14:56:16.0843 6184 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys 14:56:16.0843 6184 Wd - ok 14:56:16.0893 6184 [ A3D04EBF5227886029B4532F20D026F7 ] WDC_SAM C:\Windows\system32\DRIVERS\wdcsam64.sys 14:56:16.0893 6184 WDC_SAM - ok 14:56:16.0939 6184 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 14:56:16.0941 6184 Wdf01000 - ok 14:56:16.0949 6184 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 14:56:16.0950 6184 WdiServiceHost - ok 14:56:16.0952 6184 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 14:56:16.0953 6184 WdiSystemHost - ok 14:56:16.0999 6184 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 14:56:17.0001 6184 WebClient - ok 14:56:17.0023 6184 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 14:56:17.0024 6184 Wecsvc - ok 14:56:17.0032 6184 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 14:56:17.0033 6184 wercplsupport - ok 14:56:17.0049 6184 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 14:56:17.0050 6184 WerSvc - ok 14:56:17.0076 6184 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 14:56:17.0076 6184 WfpLwf - ok 14:56:17.0087 6184 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 14:56:17.0087 6184 WIMMount - ok 14:56:17.0093 6184 WinDefend - ok 14:56:17.0096 6184 WinHttpAutoProxySvc - ok 14:56:17.0133 6184 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 14:56:17.0134 6184 Winmgmt - ok 14:56:17.0219 6184 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 14:56:17.0226 6184 WinRM - ok 14:56:17.0284 6184 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys 14:56:17.0284 6184 WinUsb - ok 14:56:17.0320 6184 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 14:56:17.0324 6184 Wlansvc - ok 14:56:17.0429 6184 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 14:56:17.0437 6184 wlidsvc - ok 14:56:17.0472 6184 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 14:56:17.0472 6184 WmiAcpi - ok 14:56:17.0502 6184 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 14:56:17.0503 6184 wmiApSrv - ok 14:56:17.0560 6184 WMPNetworkSvc - ok 14:56:17.0590 6184 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 14:56:17.0591 6184 WPCSvc - ok 14:56:17.0647 6184 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 14:56:17.0649 6184 WPDBusEnum - ok 14:56:17.0683 6184 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 14:56:17.0683 6184 ws2ifsl - ok 14:56:17.0703 6184 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll 14:56:17.0704 6184 wscsvc - ok 14:56:17.0706 6184 WSearch - ok 14:56:17.0780 6184 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 14:56:17.0789 6184 wuauserv - ok 14:56:17.0823 6184 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 14:56:17.0824 6184 WudfPf - ok 14:56:17.0874 6184 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 14:56:17.0875 6184 WUDFRd - ok 14:56:17.0910 6184 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 14:56:17.0912 6184 wudfsvc - ok 14:56:17.0964 6184 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll 14:56:17.0966 6184 WwanSvc - ok 14:56:18.0062 6184 X6va005 - ok 14:56:18.0152 6184 [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe 14:56:18.0154 6184 YahooAUService - ok 14:56:18.0161 6184 ================ Scan global =============================== 14:56:18.0176 6184 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 14:56:18.0210 6184 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll 14:56:18.0215 6184 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll 14:56:18.0235 6184 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 14:56:18.0247 6184 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 14:56:18.0248 6184 [Global] - ok 14:56:18.0249 6184 ================ Scan MBR ================================== 14:56:18.0250 6184 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 14:56:18.0253 6184 \Device\Harddisk0\DR0 - ok 14:56:18.0254 6184 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1 14:56:18.0256 6184 \Device\Harddisk1\DR1 - ok 14:56:18.0262 6184 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2 14:56:18.0263 6184 Suspicious mbr (Forged): \Device\Harddisk2\DR2 14:56:18.0328 6184 \Device\Harddisk2\DR2 ( Rootkit.Boot.Pihar.c ) - infected 14:56:18.0328 6184 \Device\Harddisk2\DR2 - detected Rootkit.Boot.Pihar.c (0) 14:56:18.0328 6184 ================ Scan VBR ================================== 14:56:18.0330 6184 [ A80D245D8195F033687356E2DF8192FD ] \Device\Harddisk0\DR0\Partition1 14:56:18.0331 6184 \Device\Harddisk0\DR0\Partition1 - ok 14:56:18.0333 6184 [ 6BC2F79692F5FC05AD218EB4F7043E75 ] \Device\Harddisk1\DR1\Partition1 14:56:18.0334 6184 \Device\Harddisk1\DR1\Partition1 - ok 14:56:18.0335 6184 [ 26C0867F5037620F16DDA73962CC25F5 ] \Device\Harddisk2\DR2\Partition1 14:56:18.0336 6184 \Device\Harddisk2\DR2\Partition1 - ok 14:56:18.0342 6184 [ FD89F2BBB09886EA3AED76C2DC78189A ] \Device\Harddisk2\DR2\Partition2 14:56:18.0343 6184 \Device\Harddisk2\DR2\Partition2 - ok 14:56:18.0343 6184 ============================================================ 14:56:18.0343 6184 Scan finished 14:56:18.0343 6184 ============================================================ 14:56:18.0348 3200 Detected object count: 1 14:56:18.0348 3200 Actual detected object count: 1 14:56:36.0271 3200 \Device\Harddisk2\DR2\# - copied to quarantine 14:56:36.0272 3200 \Device\Harddisk2\DR2 - copied to quarantine 14:56:36.0314 3200 \Device\Harddisk2\DR2\TDLFS\cmd.dll - copied to quarantine 14:56:36.0315 3200 \Device\Harddisk2\DR2\TDLFS\cmd64.dll - copied to quarantine 14:56:36.0330 3200 \Device\Harddisk2\DR2\TDLFS\drv32 - copied to quarantine 14:56:36.0338 3200 \Device\Harddisk2\DR2\TDLFS\drv64 - copied to quarantine 14:56:36.0338 3200 \Device\Harddisk2\DR2\TDLFS\servers.dat - copied to quarantine 14:56:36.0339 3200 \Device\Harddisk2\DR2\TDLFS\config.ini - copied to quarantine 14:56:36.0340 3200 \Device\Harddisk2\DR2\TDLFS\ldr16 - copied to quarantine 14:56:36.0341 3200 \Device\Harddisk2\DR2\TDLFS\ldr32 - copied to quarantine 14:56:36.0343 3200 \Device\Harddisk2\DR2\TDLFS\ldr64 - copied to quarantine 14:56:36.0344 3200 \Device\Harddisk2\DR2\TDLFS\s - copied to quarantine 14:56:36.0344 3200 \Device\Harddisk2\DR2\TDLFS\ldrm - copied to quarantine 14:56:36.0345 3200 \Device\Harddisk2\DR2\TDLFS\u - copied to quarantine 14:56:36.0396 3200 \Device\Harddisk2\DR2 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot 14:56:36.0494 3200 \Device\Harddisk2\DR2 - ok 14:56:36.0497 3200 \Device\Harddisk2\DR2 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 14:56:44.0787 6520 Deinitialize success asw aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-11-18 15:03:05 ----------------------------- 15:03:05.222 OS Version: Windows x64 6.1.7601 Service Pack 1 15:03:05.222 Number of processors: 8 586 0x1A05 15:03:05.222 ComputerName: BEAST UserName: Aaron 15:03:06.356 Initialize success 15:05:10.131 AVAST engine defs: 12111801 15:07:52.481 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 15:07:52.482 Disk 0 Vendor: ST1000DL002-9TT153 CC32 Size: 953869MB BusType: 3 15:07:52.484 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-3 15:07:52.485 Disk 1 Vendor: ST1000DL002-9TT153 CC32 Size: 953869MB BusType: 3 15:07:52.487 Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP4T0L0-5 15:07:52.489 Disk 2 Vendor: Hitachi_HDS721050CLA362 JP2OA3MA Size: 476940MB BusType: 3 15:07:52.499 Disk 2 MBR read successfully 15:07:52.501 Disk 2 MBR scan 15:07:52.504 Disk 2 Windows 7 default MBR code 15:07:52.506 Disk 2 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 15:07:52.520 Disk 2 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848 15:07:52.536 Disk 2 scanning C:\Windows\system32\drivers 15:08:01.355 Service scanning 15:08:23.940 Modules scanning 15:08:23.947 Disk 2 trace - called modules: 15:08:23.964 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 15:08:23.967 1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa800af0f060] 15:08:23.970 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa800abbc520] 15:08:23.974 5 ACPI.sys[fffff8800100b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-5[0xfffffa800abab680] 15:08:25.248 AVAST engine scan C:\Windows 15:08:28.014 AVAST engine scan C:\Windows\system32 15:11:07.023 AVAST engine scan C:\Windows\system32\drivers 15:11:17.365 AVAST engine scan C:\Users\Aaron 15:12:10.740 Disk 2 MBR has been saved successfully to "C:\Users\Aaron\Desktop\MBR.dat" 15:12:10.745 The log file has been saved successfully to "C:\Users\Aaron\Desktop\aswMBR.txt"

Also, sorry I couldn't find how to edit my post, but I want to point out, I just scanned with MBAM real quick, and it found no malicious items! I like the sound of that~

Alright! Ran combofix, and here's the log: ComboFix 12-11-16.02 - Aaron 11/18/2012 13:13:30.1.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10223 [GMT -8:00] Running from: c:\users\Aaron\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\353D82383A.sys c:\programdata\418977550 c:\programdata\909388599 c:\users\Aaron\AppData\Local\assembly\tmp c:\windows\security\Database\tmp.edb c:\windows\svchost.exe c:\windows\SysWow64\DEBUG.log c:\windows\SysWow64\URTTemp c:\windows\SysWow64\URTTemp\regtlib.exe c:\windows\UA000104.DLL E:\install.exe . . ((((((((((((((((((((((((( Files Created from 2012-10-18 to 2012-11-18 ))))))))))))))))))))))))))))))) . . 2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\programdata\eSellerate 2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\program files (x86)\Common Files\eSellerate 2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files\NewBlue 2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files (x86)\NewBlue 2012-11-18 21:28 . 2012-11-18 21:28 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-18 20:11 . 2012-11-18 21:17 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4881AD12-ADFF-4E8F-945B-CBBAB95C95DE}\offreg.dll 2012-11-17 18:42 . 2012-11-17 18:42 -------- d-----w- c:\users\Aaron\AppData\Roaming\Malwarebytes 2012-11-17 18:41 . 2012-11-17 18:41 -------- d-----w- c:\programdata\Malwarebytes 2012-11-17 18:41 . 2012-11-17 18:41 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-11-17 18:41 . 2012-09-30 03:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-11-16 23:25 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4881AD12-ADFF-4E8F-945B-CBBAB95C95DE}\mpengine.dll 2012-11-16 01:43 . 2012-11-16 01:43 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-11-16 01:42 . 2012-11-16 01:42 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-11-16 01:38 . 2012-11-16 01:38 -------- d-----w- c:\programdata\McAfee 2012-11-14 08:26 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-14 08:26 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-14 08:26 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-14 08:26 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-14 08:18 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe 2012-11-14 08:18 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll 2012-11-14 08:18 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll 2012-11-14 08:18 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2012-11-14 08:18 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll 2012-11-14 08:18 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2012-11-14 08:18 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2012-10-26 23:33 . 2012-10-26 23:33 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-23 23:47 . 2012-10-23 23:47 -------- d-----w- c:\programdata\ATI 2012-10-23 23:46 . 2012-10-23 23:46 -------- d-----w- c:\program files (x86)\AMD AVT 2012-10-23 23:46 . 2012-10-23 23:46 -------- d-----w- c:\program files (x86)\AMD APP . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-16 01:42 . 2011-04-27 00:44 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-11-14 08:19 . 2010-05-24 21:32 66395536 ----a-w- c:\windows\system32\MRT.exe 2012-10-19 06:09 . 2012-10-19 06:09 289768 ----a-w- c:\windows\system32\javaws.exe 2012-10-19 06:09 . 2012-10-19 06:09 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll 2012-10-19 06:09 . 2011-05-13 06:48 189416 ----a-w- c:\windows\system32\javaw.exe 2012-10-19 06:09 . 2012-10-19 06:09 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-10-19 06:09 . 2011-05-13 06:48 916456 ----a-w- c:\windows\system32\deployJava1.dll 2012-10-19 06:09 . 2011-05-13 06:48 188904 ----a-w- c:\windows\system32\java.exe 2012-10-10 23:28 . 2012-05-21 23:35 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-10 23:28 . 2011-05-31 22:57 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-28 22:37 . 2012-09-28 22:37 221696 ----a-w- c:\windows\system32\clinfo.exe 2012-09-28 22:36 . 2012-09-28 22:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll 2012-09-28 22:36 . 2012-09-28 22:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll 2012-09-28 22:36 . 2012-09-28 22:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll 2012-09-28 22:36 . 2012-09-28 22:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll 2012-09-28 22:36 . 2012-09-28 22:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll 2012-09-28 22:32 . 2012-09-28 22:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll 2012-09-28 02:23 . 2011-11-10 02:33 5557928 ----a-w- c:\windows\SysWow64\atiumdag.dll 2012-09-28 02:21 . 2012-09-28 02:21 10697216 ----a-w- c:\windows\system32\drivers\atikmdag.sys 2012-09-28 02:05 . 2012-09-28 02:05 70144 ----a-w- c:\windows\system32\coinst_9.002.dll 2012-09-28 02:03 . 2012-09-28 02:03 163840 ----a-w- c:\windows\system32\atiapfxx.exe 2012-09-28 02:02 . 2012-09-28 02:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll 2012-09-28 02:02 . 2012-09-28 02:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll 2012-09-28 02:02 . 2012-09-28 02:02 44544 ----a-w- c:\windows\system32\aticalcl64.dll 2012-09-28 02:02 . 2012-09-28 02:02 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll 2012-09-28 02:02 . 2012-09-28 02:02 16082432 ----a-w- c:\windows\system32\aticaldd64.dll 2012-09-28 01:59 . 2012-09-28 01:59 23825920 ----a-w- c:\windows\system32\atio6axx.dll 2012-09-28 01:57 . 2012-09-28 01:57 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll 2012-09-28 01:43 . 2010-11-26 02:58 935424 ----a-w- c:\windows\SysWow64\aticfx32.dll 2012-09-28 01:41 . 2010-09-29 01:54 1120768 ----a-w- c:\windows\system32\aticfx64.dll 2012-09-28 01:41 . 2012-09-28 01:41 19624960 ----a-w- c:\windows\SysWow64\atioglxx.dll 2012-09-28 01:39 . 2012-09-28 01:39 6536192 ----a-w- c:\windows\SysWow64\atidxx32.dll 2012-09-28 01:39 . 2012-09-28 01:39 442368 ----a-w- c:\windows\system32\atidemgy.dll 2012-09-28 01:39 . 2012-09-28 01:39 538112 ----a-w- c:\windows\system32\atieclxx.exe 2012-09-28 01:38 . 2012-09-28 01:38 239616 ----a-w- c:\windows\system32\atiesrxx.exe 2012-09-28 01:36 . 2012-09-28 01:36 120320 ----a-w- c:\windows\system32\atitmm64.dll 2012-09-28 01:36 . 2012-09-28 01:36 21504 ----a-w- c:\windows\system32\atimuixx.dll 2012-09-28 01:36 . 2012-09-28 01:36 59392 ----a-w- c:\windows\system32\atiedu64.dll 2012-09-28 01:36 . 2012-09-28 01:36 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll 2012-09-28 01:31 . 2012-09-28 01:31 3127296 ----a-w- c:\windows\system32\atiumd6a.dll 2012-09-28 01:25 . 2012-09-28 01:25 6704640 ----a-w- c:\windows\system32\atiumd64.dll 2012-09-28 01:22 . 2010-09-29 01:37 7167488 ----a-w- c:\windows\system32\atidxx64.dll 2012-09-28 01:22 . 2011-11-10 02:29 2691584 ----a-w- c:\windows\SysWow64\atiumdva.dll 2012-09-28 01:13 . 2012-09-28 01:13 595456 ----a-w- c:\windows\system32\atiadlxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 405504 ----a-w- c:\windows\SysWow64\atiadlxy.dll 2012-09-28 01:13 . 2012-09-28 01:13 17920 ----a-w- c:\windows\system32\atig6pxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\system32\atiglpxx.dll 2012-09-28 01:13 . 2012-09-28 01:13 41984 ----a-w- c:\windows\system32\atig6txx.dll 2012-09-28 01:13 . 2012-09-28 01:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll 2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\atimpc64.dll 2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\amdpcom64.dll 2012-09-28 01:12 . 2012-09-28 01:12 460288 ----a-w- c:\windows\system32\drivers\atikmpag.sys 2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll 2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll 2012-09-28 01:11 . 2010-09-29 01:14 129536 ----a-w- c:\windows\system32\atiuxp64.dll 2012-09-28 01:11 . 2012-09-28 01:11 109568 ----a-w- c:\windows\SysWow64\atiuxpag.dll 2012-09-28 01:11 . 2012-09-28 01:11 103424 ----a-w- c:\windows\system32\atiu9p64.dll 2012-09-28 01:10 . 2011-09-08 16:51 82944 ----a-w- c:\windows\SysWow64\atiu9pag.dll 2012-09-28 01:09 . 2012-09-28 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2012-09-14 19:19 . 2012-10-09 21:43 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:28 . 2012-10-09 21:43 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-08-31 18:19 . 2012-10-09 21:43 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys 2012-08-30 18:03 . 2012-10-09 21:43 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-08-30 17:12 . 2012-10-09 21:43 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-08-30 17:12 . 2012-10-09 21:43 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-08-24 18:05 . 2012-10-09 21:43 220160 ----a-w- c:\windows\system32\wintrust.dll 2012-08-24 16:57 . 2012-10-09 21:43 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-08-22 18:12 . 2012-09-12 03:56 950128 ----a-w- c:\windows\system32\drivers\ndis.sys 2012-08-22 18:12 . 2012-09-12 03:56 376688 ----a-w- c:\windows\system32\drivers\netio.sys 2012-08-22 18:12 . 2012-09-12 03:56 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 21:01 . 2012-09-25 23:04 245760 ----a-w- c:\windows\system32\OxpsConverter.exe 2012-08-21 20:01 . 2012-09-17 03:59 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-08-21 20:01 . 2011-01-14 00:23 125872 ----a-w- c:\windows\system32\GEARAspi64.dll 2012-08-21 20:01 . 2011-01-14 00:23 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN1] @="{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN2] @="{CC8811D2-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D2-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN3] @="{CC8811D3-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D3-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN4] @="{CC8811D4-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D4-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN5] @="{CC8811D5-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D5-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN6] @="{CC8811D6-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D6-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN7] @="{CC8811D7-1B32-4f3d-A9BF-D21C8F3C0366}" [HKEY_CLASSES_ROOT\CLSID\{CC8811D7-1B32-4f3d-A9BF-D21C8F3C0366}] 2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288] "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-12 288088] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] . c:\users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-7-24 26909544] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ SmartSVN 6.6 (background).lnk - c:\program files (x86)\SmartSVN 6.6\bin\smartsvn.exe [2011-4-26 213504] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R2 statuscached;SmartSVN Status Cache;c:\program files (x86)\SmartSVN 6.6\bin\statuscached.exe [2011-04-26 216576] R3 ALSysIO;ALSysIO;c:\users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x] R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408] R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-07 35840] R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-07-23 1432400] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x] R3 npkycryp;npkycryp;f:\games\Gravity\RO\Gravity\RO\npkycryp.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-24 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R3 X6va005;X6va005;c:\users\Aaron\AppData\Local\Temp\005513E.tmp [x] R4 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816] S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [2009-12-25 297512] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-23 283200] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432] S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960] S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe [2010-11-30 336824] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2012-04-18 8518008] S2 TouchServiceWacom;Wacom Professional Touch Service;c:\program files\Tablet\Wacom\Wacom_TouchService.exe [2012-04-18 567672] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896] S3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2012-03-29 13688] S3 MAUSBJAMLAB;Service for M-Audio JamLab;c:\windows\system32\DRIVERS\MAudioJamLab.sys [2009-09-03 187912] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 83080] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 184968] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2012-03-29 65912] S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-03-29 15736] . . Contents of the 'Scheduled Tasks' folder . 2012-11-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1673349048-1130703633-4174618188-1000Core.job - c:\users\Aaron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-26 23:39] . 2012-11-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1673349048-1130703633-4174618188-1000UA.job - c:\users\Aaron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-26 23:39] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-29 10038304] "M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-03 798216] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-01-08 2328944] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com TCP: DhcpNameServer = 192.168.1.1 DPF: {20D5FC56-9F89-4966-94E1-122DDA4FA5E7} - hxxp://start1.gnjoy.com/cab/1004/GSystemInfo.cab DPF: {8768D5EA-5412-4810-A032-09AD2A726C69} - hxxp://bgweb.nowcdn.co.kr/Bin/DownStarter2.cab FF - ProfilePath - c:\users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\u44lvvmm.default-1352605413830\ FF - prefs.js: browser.startup.homepage - google.com FF - ExtSQL: 2012-11-15 17:42; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-AdobeBridge - (no file) Wow6432Node-HKCU-Run-PlayNC Launcher - (no file) Toolbar-Locked - (no file) AddRemove-LimitRO Installer Lite 2012-04-20 - f:\games\LimitRO\Uninstal.exe AddRemove-LimitRONova - f:\games\LimitRO\uninst.exe AddRemove-PunkBusterSvc - c:\program files (x86)\GAMERSFIRST\APB RELOADED\Binaries\pbsvc_apb.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005] "ImagePath"="\??\c:\users\Aaron\AppData\Local\Temp\005513E.tmp" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{61539ECD-CC67-4437-A03C-9AACCBD14326}"=hex:51,66,7a,6c,4c,1d,38,12,a3,9d,40, 65,55,82,59,01,df,2a,d9,ec,ce,8f,07,32 "{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}"=hex:51,66,7a,6c,4c,1d,38,12,ed,e2,e6, 8b,ec,e5,85,03,cf,88,91,ea,bc,02,ef,f7 "{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8, 89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b "{00C6482D-C502-44C8-8409-FCE54AD9C208}"=hex:51,66,7a,6c,4c,1d,38,12,43,4b,d5, 04,30,8b,a6,01,fb,1f,bf,a5,4f,87,86,1c "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{B0CDA128-B425-4EEF-A174-61A11AC5DBF8}"=hex:51,66,7a,6c,4c,1d,38,12,46,a2,de, b4,17,fa,81,0b,de,62,22,e1,1f,9b,9f,ec "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:3b,52,4f,6f,c7,bf,cd,01 . [HKEY_USERS\S-1-5-21-1673349048-1130703633-4174618188-1000\Software\SecuROM\License information*] "datasecu"=hex:a7,84,5a,e4,88,5d,c0,ba,7e,91,61,c4,2c,c9,36,c1,92,2f,e0,dc,ce, 3e,cb,44,79,61,2b,84,e6,39,68,18,c3,a3,d6,d0,dc,5b,cd,02,f7,85,6a,f5,90,f0,\ "rkeysecu"=hex:94,de,f2,cd,22,e1,1f,e9,2c,ea,cd,c1,41,1c,26,29 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\0a\03\13\12\19\"6" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-11-18 13:33:11 ComboFix-quarantined-files.txt 2012-11-18 21:33 . Pre-Run: 87,366,266,880 bytes free Post-Run: 88,686,940,160 bytes free . - - End Of File - - C8333A9F3E8D9A78EFD7DEFDF0551125 As for how the computer is running, it seems to be running fine, as it was before. The only issue I had was the blue-screens upon start-up, and sometimes at random times. But on that note, it hasn't blue-screened. I would have to restart to see if it does.

Alrighty! I got a couple of awesome blue-screens during this process, but I finally managed to get what I needed >_< Without further delay: SECURITY CHECK LOG Results of screen317's Security Check version 0.99.54 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Windows Firewall Disabled! WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.65.1.1000 Java 6 Update 37 Java SE Development Kit 6 Update 25 Java version out of Date! Adobe Flash Player 11.4.402.287 Adobe Reader X (10.1.4) Mozilla Firefox (16.0.2) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbam.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 1% ````````````````````End of Log`````````````````````` AdwCleaner # AdwCleaner v2.008 - Logfile created 11/18/2012 at 12:24:10 # Updated 17/11/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Aaron - BEAST # Boot Mode : Normal # Running from : C:\Users\Aaron\Desktop\Malware removal\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility ***** [Registry] ***** Key Deleted : HKCU\Software\Headlight Key Deleted : HKCU\Software\IGearSettings Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678} Key Deleted : HKLM\SOFTWARE\Classes\AppID\BHO.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1 Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90} ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v16.0.2 (en-US) Profile name : default-1352605413830 [Profil par défaut] File : C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\u44lvvmm.default-1352605413830\prefs.js [OK] File is clean. ************************* AdwCleaner[s2].txt - [3596 octets] - [18/11/2012 12:24:10] ########## EOF - C:\AdwCleaner[s2].txt - [3656 octets] ########## RogueKiller (its report #2 since I had to redo it because of a bluescreen) RogueKiller V8.3.0 [Nov 17 2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website: http://tigzy.geekstogo.com/roguekiller.php Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Aaron [Admin rights] Mode : Remove -- Date : 11/18/2012 12:42:08 ¤¤¤ Bad processes : 1 ¤¤¤ [sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc] ¤¤¤ Registry Entries : 9 ¤¤¤ [RUN][sUSP PATH] HKCU\[...]\Run : TpScrex (C:\ProgramData\TpScrex\TpScrex.exe /somering) -> DELETED [TASK][sUSP PATH] {60BC2E72-0167-42CA-A79C-A5D52A1634B6} : C:\Users\Aaron\Desktop\ROCAM\rocam.exe -> DELETED [TASK][sUSP PATH] {983C91DD-E38C-4375-A47F-31943562B670} : C:\Users\Aaron\Desktop\Desktop\Useful\ROCAM\rocam.exe -> DELETED [TASK][sUSP PATH] {A7DF1426-B39F-471C-BE7C-93DFBFBB8B66} : C:\Users\Aaron\Desktop\Desktop\Useful\ROCAM\rocam.exe -> DELETED [TASK][sUSP PATH] {DD037168-09C5-4293-A7E3-62F1D45B5A71} : C:\Users\Aaron\Desktop\Desktop\Useful\ROCAM\rocam.exe -> DELETED [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2) [HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1) [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0) [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0) ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts 127.0.0.1 activate.adobe.com ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: ST1000DL002-9TT153 ATA Device +++++ --- User --- [MBR] 5adc99c6fa868368a85bcaff6017c2f9 [bSP] 0be8317992eb36f7aa95344ba181b1b7 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: ST1000DL002-9TT153 ATA Device +++++ --- User --- [MBR] 1a48c9aee4041acf19ad17f132230566 [bSP] fbee5bd38d39a78a8066634f43a0a639 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive2: Hitachi HDS721050CLA362 ATA Device +++++ --- User --- [MBR] ae5095bb70dced8847fbb40244778634 [bSP] 8abbab951ddaa4ba673c453ebc16d29a : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo User = LL1 ... OK! User != LL2 ... KO! --- LL2 --- [MBR] 2a4212a58af793b17b8f7fc6cddea8b4 [bSP] 8abbab951ddaa4ba673c453ebc16d29a : Windows 7/8 MBR Code Partition table: 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo Finished : << RKreport[2]_D_11182012_02d1242.txt >> RKreport[1]_S_11182012_02d1241.txt ; RKreport[2]_D_11182012_02d1242.txt And there it is! Thanks for your time Mr. Gringo!

Greetings folks, I come to you with yet another case of the svchost trojan..! *applause* One day I turned on my computer, and it Blue Screened on me, and unfortunately for me, it started blue screening almost every time I restarted. After starting in safe mode, it randomly started working again on normal reboots, with it blue screening after I restart/start up when I get home from work. (picture of what hte Blue Screen says) http://img651.images...72/img0816q.jpg I have purchased the awesome MBAM program, and am now taking the steps to try and rid myself of this ailment. upon scanning, I found that svchost was the problem, and I would personally rather not reinstall my OS, so I'll take my chances with you guys' expert service in removing it as best as possible. I have attatched the necessary files from DDS (at least I think I did >_< ) So if anyone has the time, 'twould be much appreciated if we could knock this out! attach.txt dds.txt