Jump to content

BC.Miner virus assistance, please.


Recommended Posts

Malwarebytes keeps popping up with this virus, but when I tell it to remove it, it shows up again anyway. Also, I'm not sure if it is directly related to this virus or if another might be causing the problem, but I am continuously getting redirects and popups on my Firefox browser. It usually takes 5-10 tries of clicking a link to get to the site I wanted in the first place. Per your instructions, the information is below:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Kyle at 19:18:59 on 2012-06-26

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8191.6115 [GMT -5:00]

.

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Edimax\Common\RaUI.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Edimax\Common\RaRegistry.exe

C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\SysWOW64\svchost.exe" -k LocalServiceDns

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253

uInternet Settings,ProxyOverride = *.local;<local>

uURLSearchHooks: IObit Toolbar: {0bda0769-fd72-49f4-9266-e1fb004f4d8f} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dll

uURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: IObit Toolbar: {0bda0769-fd72-49f4-9266-e1fb004f4d8f} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Updater For Spam Free Search Bar: {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - C:\Program Files (x86)\blekkotb\auxi\blekkoAu.dll

BHO: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll

TB: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dll

TB: IObit Toolbar: {0bda0769-fd72-49f4-9266-e1fb004f4d8f} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dll

TB: {687578B9-7132-4A7A-80E4-30EE31099E03} - No File

uRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [<NO NAME>]

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WIRELE~1.LNK - C:\Program Files (x86)\Edimax\Common\RaUI.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

LSP: mswsock.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{4B151ABF-B89E-41C3-AEC3-A607F2CC3AD9} : DhcpNameServer = 192.168.2.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO-X64: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Updater For Spam Free Search Bar: {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - C:\Program Files (x86)\blekkotb\auxi\blekkoAu.dll

BHO-X64: Updater For Spam Free Search Bar - No File

BHO-X64: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dll

BHO-X64: Spam Free Search Bar - No File

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO-X64: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

TB-X64: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll

TB-X64: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dll

TB-X64: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dll

TB-X64: {687578B9-7132-4A7A-80E4-30EE31099E03} - No File

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [(Default)]

mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun-x64: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\tq9u0624.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Users\Kyle\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: C:\Users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\tq9u0624.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll

.

============= SERVICES / DRIVERS ===============

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]

R1 SBRE;SBRE;\??\C:\Windows\system32\drivers\SBREdrv.sys --> C:\Windows\system32\drivers\SBREdrv.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-3-12 913792]

R2 IMFservice;IMF Service;C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-6-22 821592]

R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2011-9-16 15928]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\Windows\system32\drivers\LMIRfsDriver.sys --> C:\Windows\system32\drivers\LMIRfsDriver.sys [?]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-10 654408]

R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-5-22 1262400]

R2 RalinkRegistryWriter;Ralink Registry Writer;C:\Program Files (x86)\Edimax\Common\RaRegistry.exe [2012-5-8 185632]

R2 RalinkRegistryWriter64;Ralink Registry Writer 64;C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [2012-5-8 212256]

R2 Sentinel64;Sentinel64;C:\Windows\system32\Drivers\Sentinel64.sys --> C:\Windows\system32\Drivers\Sentinel64.sys [?]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-5-15 382272]

R3 esgiguard;esgiguard;C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-3-2 13088]

R3 FileMonitor;FileMonitor;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2012-6-22 21384]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]

R3 RegFilter;RegFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2012-6-22 33184]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-5 160944]

S2 SpyHunter 4 Service;SpyHunter 4 Service;C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [2012-6-2 1019328]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-6-2 250056]

S3 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2012-3-4 748440]

S3 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-9-26 375176]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-11 113120]

S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]

S3 SentinelKeysServer;Sentinel Keys Server;C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2009-9-17 369952]

S3 SentinelSecurityRuntime;Sentinel Security Runtime;C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [2009-9-17 292128]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 UrlFilter;UrlFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\UrlFilter.sys [2012-6-22 21872]

.

=============== Created Last 30 ================

.

2012-06-26 22:50:53 57976 ----a-r- C:\Windows\System32\drivers\SBREDrv.sys

2012-06-26 22:50:46 -------- d-----w- C:\Program Files (x86)\STOPzilla!

2012-06-26 22:50:45 -------- d-----w- C:\ProgramData\STOPzilla!

2012-06-26 22:50:45 -------- d-----w- C:\Program Files (x86)\Common Files\iS3

2012-06-26 22:42:56 110080 ----a-r- C:\Users\Kyle\AppData\Roaming\Microsoft\Installer\{18F97AF0-4F88-4494-AFE2-5A5702E142CC}\IconF7A21AF7.exe

2012-06-26 22:42:56 110080 ----a-r- C:\Users\Kyle\AppData\Roaming\Microsoft\Installer\{18F97AF0-4F88-4494-AFE2-5A5702E142CC}\IconD7F16134.exe

2012-06-26 22:42:56 110080 ----a-r- C:\Users\Kyle\AppData\Roaming\Microsoft\Installer\{18F97AF0-4F88-4494-AFE2-5A5702E142CC}\Icon1226A4C5.exe

2012-06-26 22:42:56 -------- d-----w- C:\sh4ldr

2012-06-26 22:42:56 -------- d-----w- C:\Program Files\Enigma Software Group

2012-06-26 22:42:20 -------- d-----w- C:\Windows\18F97AF04F884494AFE25A5702E142CC.TMP

2012-06-23 21:25:31 -------- d-----w- C:\Users\Kyle\AppData\Local\Macromedia

2012-06-23 21:03:09 9815752 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe

2012-06-23 18:27:49 -------- d-----w- C:\Program Files (x86)\MCSkin3D

2012-06-21 05:56:21 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

2012-06-19 18:16:25 9013136 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4D8DADC4-F81E-4476-A9F1-A093EF46F036}\mpengine.dll

2012-06-18 03:44:46 14604 ----a-w- C:\Windows\SysWow64\drivers\pfc.sys

2012-06-18 03:44:43 344064 ----a-r- C:\Windows\SysWow64\msvcr70.dll

2012-06-09 00:40:11 -------- d-----w- C:\Users\Kyle\AppData\Roaming\Braid

2012-06-09 00:39:59 3851784 ----a-w- C:\Windows\SysWow64\D3DX9_39.dll

2012-06-06 19:18:50 770384 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll

2012-06-06 19:18:50 421200 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll

2012-06-06 19:18:50 136672 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll

2012-06-06 02:23:24 4227704 ----a-w- C:\Windows\SysWow64\GameMon.des

2012-06-06 02:23:10 5174 ----a-w- C:\Windows\SysWow64\nppt9x.vxd

2012-06-06 02:23:10 4682 ----a-w- C:\Windows\SysWow64\npptNT2.sys

2012-06-06 02:23:00 -------- d-----w- C:\Program Files\Common Files\INCA Shared

2012-06-05 08:15:47 -------- d-----w- C:\Program Files (x86)\BandiMPEG1

2012-06-05 08:15:46 -------- d-----w- C:\gPotato

2012-06-03 21:02:48 -------- d-----w- C:\Python27

2012-06-03 20:56:13 -------- d-----w- C:\Program Files (x86)\OpenRPG

2012-06-02 18:10:13 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-05-30 02:07:21 -------- d-----w- C:\Users\Kyle\AppData\Local\CRE

2012-05-30 02:07:20 -------- d-----w- C:\Program Files (x86)\Conduit

2012-05-30 02:07:19 -------- d-----w- C:\Users\Kyle\AppData\Local\Conduit

.

==================== Find3M ====================

.

2012-06-23 21:03:12 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-05-26 17:49:43 955848 ----a-w- C:\Windows\System32\npDeployJava1.dll

2012-05-26 17:49:43 839112 ----a-w- C:\Windows\System32\deployJava1.dll

2012-05-24 15:47:56 24448 ----a-w- C:\Windows\System32\RegistryDefragBootTime.exe

2012-05-15 09:29:47 889664 ----a-w- C:\Windows\System32\nvvsvc.exe

2012-05-15 09:29:46 63296 ----a-w- C:\Windows\System32\nvshext.dll

2012-05-15 09:29:46 118080 ----a-w- C:\Windows\System32\nvmctray.dll

2012-05-15 09:29:25 3149632 ----a-w- C:\Windows\System32\nvsvc64.dll

2012-05-15 09:28:42 6151488 ----a-w- C:\Windows\System32\nvcpl.dll

2012-05-15 07:21:50 423744 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

2012-04-25 16:35:32 23376 ----a-r- C:\Windows\SysWow64\SZIO5.dll

2012-04-25 16:35:22 546640 ----a-r- C:\Windows\SysWow64\SZComp5.dll

2012-04-25 16:35:16 481104 ----a-r- C:\Windows\SysWow64\SZBase5.dll

2012-04-19 22:39:44 29008 ----a-r- C:\Windows\SysWow64\IS3XDat5.dll

2012-04-19 22:39:44 231248 ----a-r- C:\Windows\SysWow64\IS3Win325.dll

2012-04-19 22:39:42 390992 ----a-r- C:\Windows\SysWow64\IS3UI5.dll

2012-04-19 22:39:42 100176 ----a-r- C:\Windows\SysWow64\IS3Svc5.dll

2012-04-19 22:39:36 104272 ----a-r- C:\Windows\SysWow64\IS3Inet5.dll

2012-04-19 22:39:34 67408 ----a-r- C:\Windows\SysWow64\IS3Hks5.dll

2012-04-19 22:39:34 132944 ----a-r- C:\Windows\SysWow64\IS3HTUI5.dll

2012-04-19 22:39:32 456528 ----a-r- C:\Windows\SysWow64\IS3DBA5.dll

2012-04-19 22:39:30 808784 ----a-r- C:\Windows\SysWow64\IS3Base5.dll

2012-04-11 04:31:54 2303488 ----a-w- C:\Windows\SysWow64\python27.dll

2012-04-04 20:56:40 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

.

============= FINISH: 19:19:23.51 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 6/2/2011 8:25:26 AM

System Uptime: 6/26/2012 6:51:51 PM (1 hours ago)

.

Motherboard: MSI | | G41M-P33 (MS-7592)

Processor: Intel® Core2 Quad CPU Q8400 @ 2.66GHz | CPU 1 | 2670/333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 1863 GiB total, 1248.091 GiB free.

D: is CDROM (CDFS)

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP243: 6/17/2012 2:11:57 PM - Windows Update

RP244: 6/17/2012 10:44:29 PM - Installed Adobe Premiere Pro

RP245: 6/18/2012 3:00:12 AM - Windows Update

RP246: 6/18/2012 11:42:55 PM - Windows Update

RP247: 6/19/2012 1:13:15 PM - Windows Update

RP248: 6/19/2012 1:15:24 PM - Windows Update

RP249: 6/20/2012 11:57:23 AM - Windows Update

RP250: 6/21/2012 3:00:13 AM - Windows Update

RP251: 6/22/2012 3:00:11 AM - Windows Update

RP252: 6/22/2012 5:27:10 AM - Removed Java 6 Update 31

RP253: 6/22/2012 5:36:44 AM - Windows Update

RP254: 6/23/2012 12:34:53 AM - Windows Update

RP255: 6/23/2012 1:15:26 PM - Windows Update

RP256: 6/23/2012 11:24:57 PM - Windows Update

RP257: 6/24/2012 2:44:31 PM - Windows Update

RP258: 6/25/2012 3:00:16 AM - Windows Update

RP259: 6/26/2012 2:00:43 AM - Windows Update

RP260: 6/26/2012 3:05:09 PM - Windows Update

RP261: 6/26/2012 5:36:49 PM - Restore Operation

RP262: 6/26/2012 5:42:23 PM - Installed SpyHunter

RP263: 6/26/2012 5:50:10 PM - Installed STOPzilla. Available with Windows Installer version 1.2 and later.

RP264: 6/26/2012 6:16:56 PM - StopZILLA! Restore Point.

RP265: 6/26/2012 6:56:01 PM - StopZILLA! Restore Point.

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Adobe AIR

Adobe Community Help

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Player

Adobe Photoshop CS5

Adobe Premiere Pro

Adobe Premiere Pro CS6 Functional Content

Adobe Reader X (10.1.3)

ADRIFT 5.0

Advanced SystemCare 5

Aeria Ignite

Age of Mythology

Anti-phishing Domain Advisor

Apple Application Support

Apple Software Update

Armed and Dangerous

Artisteer 3

AVG PC Tuneup 2011

Azada In Libro Collectors Edition

Bandisoft MPEG-1 Decoder

Black & White® 2

Black & White® 2 Battle of the Gods

Black and White

Champions Online: Free For All

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Creatures Albian Years

DAEMON Tools Lite

DAEMON Tools Toolbar

Docking Station

Drawn 2 Dark Flight

Dream of Mirror Online

Dungeon Siege Legends of Aranna

Edimax RT2860 Wireless LAN Card

EverQuest II

EverQuest II Extended

eyeon Fusion 5.2

Fallout: New Vegas

Freedom Force vs the 3rd Reich

Freelancer

Gemini Lost .

Google Chrome

Green Moon

horseExpress

IBM ViaVoice Command and Control Runtime 5.3 - UK English

IBM ViaVoice Outloud Runtime - UK English

IObit Malware Fighter

IObit Toolbar v5.1

Legend of Grimrock

LightWave 10.0 64-bit

LogMeIn

Malwarebytes Anti-Malware version 1.61.0.1400

MCSkin3D version 1.4

Microsoft Game Studios Common Redistributables Pack 1

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft WSE 3.0 Runtime

Microsoft XML Parser

Microsoft XNA Framework Redistributable 4.0

Microsoft Zoo Tycoon

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Minecraft Beta Cracked

Morrowind

Mozilla Firefox 14.0 (x86 en-US)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

MSXML4 Parser

NVIDIA 3D Vision Controller Driver

NVIDIA PhysX

NVIDIA Stereoscopic 3D Driver

Oblivion

OpenRPG (Remove Only)

Otherworld - Spring of Shadows CE

PDF Settings CS5

Pet Workshop

Petz 4 (remove only)

PetzA 2.2.5

Pidgin

Portal

Portal 2

Portal 2 Authoring Tools - Beta

Python 2.7.3

QuickTime

Requiem

Rockets and Robots Clipart

Sci-Fi Clipart Series

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition

Sentinel Protection Installer 7.6.1

Skype™ 5.9

Spam Free Search Bar

SpeedFan (remove only)

Spiral Knights

SPORE™

SPORE™ Creepy & Cute Parts Pack

Star Wars®: Knights of the Old Republic

StarTopia

Steam

STOPzilla

TES Construction Set

The Elder Scrolls V: Skyrim

Total Video Converter 3.71 100812

Ubisoft Game Launcher

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687267) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Winamp

Winamp Detector Plug-in

WinArchiver

World of Warcraft

.

==== Event Viewer Messages From Past Week ========

.

6/26/2012 6:54:38 PM, Error: Service Control Manager [7000] - The UrlFilter service failed to start due to the following error: There are no more endpoints available from the endpoint mapper.

6/26/2012 6:53:18 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

6/26/2012 6:53:18 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

6/26/2012 6:53:18 PM, Error: Service Control Manager [7000] - The Hardlock service failed to start due to the following error: Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

6/26/2012 6:52:48 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.

6/26/2012 6:52:07 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\drivers\pfc.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

6/26/2012 6:13:40 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.

6/25/2012 4:52:48 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

6/25/2012 4:45:44 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

6/23/2012 1:12:40 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

6/22/2012 4:38:07 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

6/22/2012 4:38:05 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

6/22/2012 4:37:57 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

6/22/2012 4:37:47 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vpcnfltr vpcvmm vwififlt Wanarpv6 WfpLwf

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

6/19/2012 6:01:23 PM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.

.

==== End Of File ===========================

Link to post
Share on other sites

  • Staff

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us


  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

    [*]Please do not attach logs or use code boxes, just copy and paste the text.

    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.

    [*]Please read every post completely before doing anything.

    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

    [*]Please provide feedback about your experience as we go.

    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Security Check

  • Download Security Check by screen317 from
here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

Link to post
Share on other sites

Hello Gringo, nice to meet you. Here's the Security Check report:

Results of screen317's Security Check version 0.99.42

Windows 7 x64 (UAC is disabled!)

Out of date service pack!!

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.61.0.1400

AVG PC Tuneup 2011

Adobe Reader X (10.1.3)

Mozilla Firefox (14.0)

Google Chrome 19.0.1084.52

Google Chrome 19.0.1084.56

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

IObit IObit Malware Fighter IMFsrv.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:

````````````````````End of Log``````````````````````

I will run combofix as soon as I post this so I can close the browser.

Link to post
Share on other sites

  • Staff

Hello

download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:


    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Gringo

Link to post
Share on other sites

Here you go.

Scan result of Farbar Recovery Scan Tool Version: 25-06-2012

Ran by SYSTEM at 29-06-2012 14:17:28

Running from F:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462408 2012-04-04] (Malwarebytes Corporation)

HKLM-x32\...\Run: [] [x]

HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart [4464472 2012-05-09] (IObit)

HKU\Kyle\...\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart [288128 2012-05-28] (IObit)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Startup: C:\Users\All Users\Start Menu\Programs\Startup\Wireless Utility.lnk

ShortcutTarget: Wireless Utility.lnk -> C:\Program Files (x86)\Edimax\Common\RaUI.exe (Edimax Technology Co.)

==================== Services (Whitelisted) ======

2 AdvancedSystemCareService5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [913792 2012-05-26] (IObit)

3 Application Updater; "C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe" [748440 2012-03-04] (Spigot, Inc.)

2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)

3 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe" [375176 2011-09-26] (LogMeIn, Inc.)

4 LMIMaint; "C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe" [147336 2011-09-26] (LogMeIn, Inc.)

4 LogMeIn; "C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe" [407424 2011-09-16] (LogMeIn, Inc.)

2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [654408 2012-04-04] (Malwarebytes Corporation)

2 RalinkRegistryWriter; C:\Program Files (x86)\Edimax\Common\RaRegistry.exe [185632 2009-10-06] (Ralink Technology, Corp.)

2 RalinkRegistryWriter64; C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [212256 2009-10-06] (Ralink Technology, Corp.)

3 SentinelKeysServer; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe" [369952 2009-09-16] (SafeNet, Inc.)

3 SentinelProtectionServer; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe" [1246496 2009-09-17] (SafeNet, Inc)

3 SentinelSecurityRuntime; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe" [292128 2009-09-16] (SafeNet, Inc.)

2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1019328 2012-06-02] (Enigma Software Group USA, LLC.)

2 szserver; "C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe" [67408 2012-04-25] (iS3, Inc.)

========================== Drivers (Whitelisted) =============

1 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [279616 2011-12-27] (DT Soft Ltd)

3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()

3 FileMonitor; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [21384 2012-01-05] (IObit)

0 is3srv; C:\Windows\SysWow64\drivers\is3srv64.sys [74768 2011-09-26] (iS3 Inc.)

2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [15928 2011-09-16] (LogMeIn, Inc.)

3 lmimirr; C:\Windows\System32\Drivers\lmimirr.sys [11552 2011-09-16] (LogMeIn, Inc.)

2 LMIRfsDriver; C:\Windows\System32\Drivers\LMIRfsDriver.sys [72216 2011-09-16] (LogMeIn, Inc.)

3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24904 2012-04-04] (Malwarebytes Corporation)

3 pfc; C:\Windows\SysWow64\Drivers\pfc.sys [14604 2003-08-11] (Padus, Inc.)

3 RegFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [33184 2012-04-28] (IObit.com)

1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [57976 2012-01-12] (GFI Software)

2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)

0 speedfan; C:\Windows\SysWow64\speedfan.sys [29592 2011-03-18] (Almico Software)

0 szkg5; C:\Windows\SysWow64\DRIVERS\szkg64.sys [74768 2011-09-26] (iS3 Inc.)

3 UrlFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [21872 2012-04-28] (IObit.com)

3 dump_wmimmc; \??\C:\gPotato\IrisOnline\GameGuard\dump_wmimmc.sys [x]

4 LMIRfsClientNP; [x]

3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]

3 X6va005; \??\C:\Users\Kyle\AppData\Local\Temp\005510C.tmp [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-06-28 10:37 - 2012-06-28 10:37 - 00000240 ____A C:\Windows\System32\Drivers\kgpcpy.cfg

2012-06-27 01:24 - 2012-06-27 01:24 - 00020299 ____A C:\Users\Kyle\Desktop\Combofix Error.PNG

2012-06-27 01:21 - 2012-06-27 16:22 - 00000000 ___SD C:\32788R22FWJFW

2012-06-27 01:21 - 2012-06-27 16:22 - 00000000 ____D C:\Windows\erdnt

2012-06-27 01:21 - 2012-06-27 01:21 - 00000000 ____D C:\Qoobox

2012-06-27 01:17 - 2012-06-27 01:17 - 04569121 ___RA (Swearware) C:\Users\Kyle\Downloads\ComboFix.exe

2012-06-27 01:15 - 2012-06-27 01:15 - 00000184 ____A C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2012-06-27 01:14 - 2012-06-27 01:14 - 00881475 ____A C:\Users\Kyle\Downloads\SecurityCheck.exe

2012-06-26 16:34 - 2012-06-27 16:21 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\.minecraft

2012-06-26 16:33 - 2012-06-26 16:35 - 00000000 ____D C:\Users\Kyle\Desktop\New folder

2012-06-26 16:07 - 2012-06-26 16:07 - 00607260 ____R (Swearware) C:\Users\Kyle\Downloads\dds.com

2012-06-26 14:50 - 2012-06-28 22:59 - 00000000 ____D C:\Users\All Users\STOPzilla!

2012-06-26 14:50 - 2012-06-27 16:22 - 00000000 ____D C:\Program Files (x86)\STOPzilla!

2012-06-26 14:50 - 2012-01-12 06:28 - 00057976 ___RA (GFI Software) C:\Windows\System32\Drivers\SBREDrv.sys

2012-06-26 14:48 - 2012-06-26 14:48 - 00509440 ____A (iS3, Inc.) C:\Users\Kyle\Downloads\SZSetupAV.exe

2012-06-26 14:42 - 2012-06-27 16:22 - 00000000 ____D C:\Windows\18F97AF04F884494AFE25A5702E142CC.TMP

2012-06-26 14:42 - 2012-06-27 16:21 - 00000000 ____D C:\Program Files\Enigma Software Group

2012-06-26 14:42 - 2012-06-26 14:43 - 00000000 ____D C:\sh4ldr

2012-06-26 14:42 - 2012-06-26 14:42 - 00002256 ____A C:\Users\Kyle\Desktop\SpyHunter.lnk

2012-06-26 14:40 - 2012-06-26 14:41 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer(1).exe

2012-06-26 14:40 - 2012-06-26 14:40 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer.exe

2012-06-25 14:33 - 2012-06-25 14:33 - 00000000 ____D C:\Users\Kyle\Downloads\attachments

2012-06-25 14:05 - 2012-06-25 14:06 - 04402056 ____A C:\Users\Kyle\Downloads\attachments.zip

2012-06-23 13:53 - 2012-06-23 13:53 - 65994752 ____A C:\Windows\System32\config\SOFTWARE.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 18915328 ____A C:\Windows\System32\config\SYSTEM.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 00167936 ____A C:\Windows\System32\config\DEFAULT.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 00057344 ____A C:\Windows\System32\config\SAM.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 00028672 ____A C:\Windows\System32\config\SECURITY.iobit

2012-06-23 13:25 - 2012-06-23 13:25 - 00000000 ____D C:\Users\Kyle\AppData\Local\Macromedia

2012-06-23 13:03 - 2012-06-23 13:03 - 09815752 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2012-06-23 10:27 - 2012-06-28 11:15 - 00000000 ____D C:\Program Files (x86)\MCSkin3D

2012-06-23 10:27 - 2012-06-23 10:27 - 01965549 ____A (Altered Softworks ) C:\Users\Kyle\Downloads\mcskin3d_1_4_0_235.exe

2012-06-23 10:27 - 2012-06-23 10:27 - 00001011 ____A C:\Users\Public\Desktop\MCSkin3D.lnk

2012-06-22 17:46 - 2012-06-25 13:39 - 00001070 ____A C:\Windows\PFRO.log

2012-06-22 13:23 - 2012-06-22 13:23 - 00001177 ____A C:\Users\Public\Desktop\IObit Malware Fighter.lnk

2012-06-22 13:20 - 2012-06-22 13:21 - 19551736 ____A (IObit ) C:\Users\Kyle\Downloads\imf-setup.exe

2012-06-22 12:35 - 2012-06-29 11:03 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-06-22 11:50 - 2012-06-28 10:33 - 00000672 ____A C:\Windows\setupact.log

2012-06-22 11:50 - 2012-06-22 11:50 - 00000000 ____A C:\Windows\setuperr.log

2012-06-22 02:18 - 2012-06-22 02:19 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.exe

2012-06-22 02:16 - 2012-06-22 02:16 - 00000618 ____A C:\Users\Kyle\Documents\cc_20120622_051608.reg

2012-06-22 00:55 - 2012-06-22 17:42 - 00000361 ____A C:\rkill.log

2012-06-22 00:54 - 2012-06-22 00:54 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.com

2012-06-22 00:39 - 2012-06-22 00:39 - 00045664 ____A C:\Users\Kyle\Desktop\GMer.log

2012-06-22 00:00 - 2012-06-22 00:00 - 00302592 ____A C:\Users\Kyle\Downloads\odp539no.exe

2012-06-21 19:23 - 2012-06-27 16:22 - 00000000 ____D C:\Users\Kyle\Downloads\tdsskiller

2012-06-21 19:23 - 2012-06-21 19:23 - 02109806 ____A C:\Users\Kyle\Downloads\tdsskiller.zip

2012-06-20 22:03 - 2012-06-20 22:03 - 00278561 ____A C:\Users\Kyle\Downloads\Minecraft.exe

2012-06-20 22:02 - 2012-06-20 22:02 - 01589718 ____A C:\Users\Kyle\Downloads\Minecraft_Server.exe

2012-06-20 21:56 - 2012-06-27 16:21 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%

2012-06-20 21:44 - 2012-06-20 21:45 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft_key_code_generator

2012-06-20 21:35 - 2012-06-20 21:35 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft Gift Code Generator v1.9.1

2012-06-20 09:04 - 2012-06-22 02:01 - 00001584 ____A C:\Users\Kyle\Desktop\F-list.lnk

2012-06-20 09:02 - 2012-06-27 16:21 - 00000000 ____D C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta

2012-06-19 11:54 - 2012-06-19 11:54 - 00951853 ____A C:\Users\Kyle\Downloads\RK_00262_HD25.mp4

2012-06-19 11:49 - 2012-06-19 11:49 - 00001822 ____A C:\Users\Kyle\Downloads\backfill.mov

2012-06-19 11:49 - 2012-06-19 11:49 - 00001817 ____A C:\Users\Kyle\Downloads\welding.mov

2012-06-19 11:48 - 2012-06-19 11:48 - 00997888 ____A C:\Users\Kyle\Downloads\sparks.avi

2012-06-18 16:29 - 2012-06-27 16:22 - 00000000 ____D C:\Users\Kyle\Downloads\The Secret World of Arrietty 2012 DVDRip XViD-sC0rp

2012-06-18 12:25 - 2012-06-18 12:25 - 00001196 ____A C:\Users\Kyle\Desktop\FileZilla.lnk

2012-06-17 19:44 - 2003-08-11 07:13 - 00344064 ___RA (Microsoft Corporation) C:\Windows\SysWOW64\msvcr70.dll

2012-06-17 19:44 - 2003-08-11 07:07 - 00014604 ____A (Padus, Inc.) C:\Windows\SysWOW64\Drivers\pfc.sys

2012-06-17 18:57 - 2012-06-17 18:58 - 00000000 ____D C:\Users\Kyle\Downloads\PremierePro_6_Content_LS7

2012-06-17 18:45 - 2012-06-17 18:56 - 768928646 ____A C:\Users\Kyle\Downloads\PremierePro_6_Content_LS7.7z

2012-06-17 18:29 - 2012-06-17 18:29 - 00000000 ____D C:\Users\Kyle\Downloads\Encore Working

2012-06-16 22:25 - 2012-06-17 12:38 - 00000000 ____D C:\Users\Kyle\Desktop\Flea Market

2012-06-14 18:21 - 2012-06-14 18:21 - 02446584 ____A (pepsoft.org) C:\Users\Kyle\Documents\worldpainter_64_0.8.9.exe

2012-06-13 15:08 - 2012-06-13 15:10 - 09813457 ____A C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta.zip

2012-06-13 12:05 - 2012-06-23 12:32 - 00002119 ____A C:\Users\Public\Desktop\Legend of Grimrock.lnk

2012-06-13 12:05 - 2012-06-13 12:07 - 00000000 ____D C:\Users\Kyle\Downloads\The Legend of Korra

2012-06-13 12:05 - 2012-06-13 12:05 - 00000000 ____D C:\Users\Kyle\Documents\Almost Human

2012-06-11 23:31 - 2012-06-11 23:31 - 00036210 ____A C:\Users\Kyle\Documents\Loki_009.htm

2012-06-11 08:58 - 2012-06-11 08:58 - 00024032 ____A C:\Users\Kyle\Documents\cc_20120611_115807.reg

2012-06-10 23:07 - 2012-06-10 23:07 - 00107753 ____A C:\Users\Kyle\Documents\Loki_008.htm

2012-06-10 18:46 - 2012-06-10 18:46 - 00323997 ____A C:\Users\Kyle\Downloads\Remaster Patch.zip

2012-06-10 18:46 - 2012-06-10 18:46 - 00000000 ____D C:\Users\Kyle\Downloads\Remaster Patch

2012-06-08 22:01 - 2012-06-08 22:01 - 00070272 ____A C:\Users\Kyle\Documents\Loki_007.htm

2012-06-08 17:37 - 2012-06-08 17:37 - 00000000 ____D C:\Users\Kyle\Downloads\StarForge_V0.1

2012-06-08 17:30 - 2012-06-08 17:36 - 315470531 ____A C:\Users\Kyle\Downloads\StarForge_V0.1.zip

2012-06-08 16:40 - 2012-06-08 16:42 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Braid

2012-06-08 16:39 - 2008-07-12 05:18 - 03851784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll

2012-06-07 21:19 - 2012-06-07 21:58 - 00017140 ____A C:\Users\Kyle\Documents\Loki_006.htm

2012-06-07 20:45 - 2012-06-07 20:51 - 00000028 ____A C:\Windows\encore_launcher.ini

2012-06-07 18:55 - 2012-06-07 18:55 - 00000000 ____D C:\Users\Kyle\Downloads\grendel_cage

2012-06-07 14:14 - 2012-06-07 14:14 - 01114119 ____A C:\Users\Kyle\Downloads\Creatures_Update_2.exe

2012-06-07 14:09 - 2012-06-07 14:09 - 00002395 ____A C:\Users\Kyle\Downloads\tomato_soup.zip

2012-06-07 14:06 - 2012-06-07 14:06 - 00014335 ____A C:\Users\Kyle\Downloads\peartree.zip

2012-06-07 14:04 - 2012-06-07 14:04 - 00023323 ____A C:\Users\Kyle\Downloads\grapevine.zip

2012-06-07 14:04 - 2012-06-07 14:04 - 00013553 ____A C:\Users\Kyle\Downloads\grendel_cage.zip

2012-06-07 14:03 - 2012-06-07 14:03 - 00049380 ____A C:\Users\Kyle\Downloads\de_theme.zip

2012-06-07 12:53 - 2012-06-07 12:53 - 00000000 ____D C:\Users\Kyle\Downloads\c_albian_years_manuals

2012-06-07 12:24 - 2012-06-10 18:57 - 00002340 ____A C:\Users\Public\Desktop\Creatures 2.lnk

2012-06-07 12:24 - 2012-06-10 18:57 - 00002331 ____A C:\Users\Public\Desktop\Creatures 1.lnk

2012-06-07 12:23 - 2012-06-07 12:24 - 00000000 ____D C:\Users\Kyle\Documents\Creatures

2012-06-07 12:16 - 2012-06-07 12:19 - 116171848 ____A (GOG.com ) C:\Users\Kyle\Downloads\setup_creatures_albian_years.exe

2012-06-07 12:16 - 2012-06-07 12:16 - 01207334 ____A C:\Users\Kyle\Downloads\c_albian_years_manuals.zip

2012-06-07 00:33 - 2012-06-07 00:34 - 00025288 ____A C:\Users\Kyle\Documents\LokiThor3some_001.htm

2012-06-06 18:15 - 2012-06-14 12:20 - 00000000 ____D C:\Users\Kyle\Documents\Island Stuff

2012-06-06 11:06 - 2012-06-06 11:06 - 17151152 ____A (Mozilla) C:\Users\Kyle\Downloads\Firefox Setup 13.0b7.exe

2012-06-06 01:41 - 2012-06-06 01:41 - 00094869 ____A C:\Users\Kyle\Documents\Loki_005.htm

2012-06-05 19:47 - 2012-06-05 19:49 - 31733248 ____A C:\Users\Kyle\Downloads\dockingstation_195.exe

2012-06-05 18:23 - 2012-06-05 18:23 - 00000000 ____D C:\Program Files\Common Files\INCA Shared

2012-06-05 18:23 - 2011-11-08 13:00 - 04227704 ____A (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des

2012-06-05 18:23 - 2005-01-03 16:43 - 00004682 ____A (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\npptNT2.sys

2012-06-05 18:23 - 2003-07-20 01:17 - 00005174 ____A C:\Windows\SysWOW64\nppt9x.vxd

2012-06-05 00:52 - 2012-06-05 00:52 - 00077900 ____A C:\Users\Kyle\Documents\Loki_004.htm

2012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\Program Files (x86)\BandiMPEG1

2012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\gPotato

2012-06-04 23:46 - 2012-06-05 00:15 - 1764105178 ____A (Acresso Software Inc. ) C:\Users\Kyle\Downloads\Iris_US_v1.20.31086.exe

2012-06-04 23:45 - 2012-06-04 23:45 - 00773400 ____A C:\Users\Kyle\Downloads\IRIS_US_Downloader.exe

2012-06-03 13:02 - 2012-06-03 13:03 - 00000000 ____D C:\Python27

2012-06-03 13:00 - 2012-06-03 13:02 - 15867904 ____A C:\Users\Kyle\Downloads\python-2.7.3.msi

2012-06-03 12:56 - 2012-06-03 13:03 - 00000000 ____D C:\Program Files (x86)\OpenRPG

2012-06-03 12:55 - 2012-06-03 12:56 - 00829561 ____A C:\Users\Kyle\Downloads\openrpg-1.7.1.exe

2012-06-03 00:38 - 2012-06-03 00:38 - 00105831 ____A C:\Users\Kyle\Documents\Loki_003.htm

2012-06-02 10:36 - 2012-06-03 20:50 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who

2012-06-02 10:28 - 2012-06-02 10:30 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who 2005 Season 1-5

2012-06-02 10:10 - 2012-06-23 13:03 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-05-31 17:56 - 2012-05-31 18:05 - 00000000 ____D C:\Users\Kyle\Documents\Recipes

2012-05-31 10:33 - 2012-05-31 10:34 - 27070144 ____A (IObit ) C:\Users\Kyle\Downloads\asc-setup.exe

2012-05-31 00:34 - 2012-05-31 00:34 - 00047292 ____A C:\Users\Kyle\Documents\Loki_002.htm

============ 3 Months Modified Files and Folders =============

2012-06-29 14:17 - 2012-06-29 14:17 - 00000000 ____D C:\FRST

2012-06-29 11:10 - 2011-12-20 10:46 - 01872412 ____A C:\Windows\WindowsUpdate.log

2012-06-29 11:10 - 2011-10-02 19:40 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000Core.job

2012-06-29 11:09 - 2011-06-04 13:24 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\.purple

2012-06-29 11:03 - 2012-06-22 12:35 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-06-29 11:03 - 2011-10-02 19:40 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000UA.job

2012-06-28 23:55 - 2011-06-26 16:01 - 00000132 ____A C:\Users\Kyle\AppData\Roaming\Adobe PNG Format CS5 Prefs

2012-06-28 22:59 - 2012-06-26 14:50 - 00000000 ____D C:\Users\All Users\STOPzilla!

2012-06-28 16:02 - 2011-06-04 13:20 - 00000000 ____D C:\Program Files (x86)\Steam

2012-06-28 11:27 - 2011-06-04 13:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2012-06-28 11:15 - 2012-06-23 10:27 - 00000000 ____D C:\Program Files (x86)\MCSkin3D

2012-06-28 10:43 - 2009-07-13 20:45 - 00019312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-06-28 10:43 - 2009-07-13 20:45 - 00019312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-06-28 10:37 - 2012-06-28 10:37 - 00000240 ____A C:\Windows\System32\Drivers\kgpcpy.cfg

2012-06-28 10:33 - 2012-06-22 11:50 - 00000672 ____A C:\Windows\setupact.log

2012-06-28 10:33 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-06-28 10:32 - 2011-06-02 06:22 - 00000000 ____D C:\Users\All Users\NVIDIA

2012-06-27 16:22 - 2012-06-27 01:21 - 00000000 ___SD C:\32788R22FWJFW

2012-06-27 16:22 - 2012-06-27 01:21 - 00000000 ____D C:\Windows\erdnt

2012-06-27 16:22 - 2012-06-26 14:50 - 00000000 ____D C:\Program Files (x86)\STOPzilla!

2012-06-27 16:22 - 2012-06-26 14:42 - 00000000 ____D C:\Windows\18F97AF04F884494AFE25A5702E142CC.TMP

2012-06-27 16:22 - 2012-06-21 19:23 - 00000000 ____D C:\Users\Kyle\Downloads\tdsskiller

2012-06-27 16:22 - 2012-06-18 16:29 - 00000000 ____D C:\Users\Kyle\Downloads\The Secret World of Arrietty 2012 DVDRip XViD-sC0rp

2012-06-27 16:22 - 2012-05-11 11:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2012-06-27 16:22 - 2012-03-12 17:57 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\IObit

2012-06-27 16:22 - 2011-11-15 19:21 - 00000000 ____D C:\Windows\System32\Macromed

2012-06-27 16:22 - 2011-06-02 06:13 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2012-06-27 16:22 - 2011-06-02 05:25 - 00000000 ____D C:\users\Kyle

2012-06-27 16:22 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV

2012-06-27 16:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF

2012-06-27 16:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2012-06-27 16:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\AppCompat

2012-06-27 16:21 - 2012-06-26 16:34 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\.minecraft

2012-06-27 16:21 - 2012-06-26 14:42 - 00000000 ____D C:\Program Files\Enigma Software Group

2012-06-27 16:21 - 2012-06-20 21:56 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%

2012-06-27 16:21 - 2012-06-20 09:02 - 00000000 ____D C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta

2012-06-27 16:21 - 2011-08-26 20:31 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Skype

2012-06-27 16:21 - 2011-06-19 11:45 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Winamp

2012-06-27 16:21 - 2011-06-02 10:20 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Malwarebytes

2012-06-27 16:20 - 2012-03-12 17:57 - 00000000 ____D C:\Program Files (x86)\IObit

2012-06-27 15:34 - 2012-05-29 18:07 - 00000000 ____D C:\Users\Kyle\AppData\Local\Conduit

2012-06-27 01:24 - 2012-06-27 01:24 - 00020299 ____A C:\Users\Kyle\Desktop\Combofix Error.PNG

2012-06-27 01:21 - 2012-06-27 01:21 - 00000000 ____D C:\Qoobox

2012-06-27 01:17 - 2012-06-27 01:17 - 04569121 ___RA (Swearware) C:\Users\Kyle\Downloads\ComboFix.exe

2012-06-27 01:15 - 2012-06-27 01:15 - 00000184 ____A C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2012-06-27 01:14 - 2012-06-27 01:14 - 00881475 ____A C:\Users\Kyle\Downloads\SecurityCheck.exe

2012-06-26 16:35 - 2012-06-26 16:33 - 00000000 ____D C:\Users\Kyle\Desktop\New folder

2012-06-26 16:22 - 2012-05-26 09:48 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin

2012-06-26 16:07 - 2012-06-26 16:07 - 00607260 ____R (Swearware) C:\Users\Kyle\Downloads\dds.com

2012-06-26 14:52 - 2012-03-11 10:57 - 00000000 ____D C:\Users\Kyle\Desktop\Stories

2012-06-26 14:48 - 2012-06-26 14:48 - 00509440 ____A (iS3, Inc.) C:\Users\Kyle\Downloads\SZSetupAV.exe

2012-06-26 14:43 - 2012-06-26 14:42 - 00000000 ____D C:\sh4ldr

2012-06-26 14:42 - 2012-06-26 14:42 - 00002256 ____A C:\Users\Kyle\Desktop\SpyHunter.lnk

2012-06-26 14:41 - 2012-06-26 14:40 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer(1).exe

2012-06-26 14:40 - 2012-06-26 14:40 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer.exe

2012-06-26 13:33 - 2012-05-11 11:56 - 00000000 ____D C:\Users\Kyle\Desktop\TGWTG

2012-06-25 14:33 - 2012-06-25 14:33 - 00000000 ____D C:\Users\Kyle\Downloads\attachments

2012-06-25 14:06 - 2012-06-25 14:05 - 04402056 ____A C:\Users\Kyle\Downloads\attachments.zip

2012-06-25 13:55 - 2009-07-13 21:13 - 00006346 ____A C:\Windows\System32\PerfStringBackup.INI

2012-06-25 13:39 - 2012-06-22 17:46 - 00001070 ____A C:\Windows\PFRO.log

2012-06-23 13:53 - 2012-06-23 13:53 - 65994752 ____A C:\Windows\System32\config\SOFTWARE.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 18915328 ____A C:\Windows\System32\config\SYSTEM.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 00167936 ____A C:\Windows\System32\config\DEFAULT.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 00057344 ____A C:\Windows\System32\config\SAM.iobit

2012-06-23 13:53 - 2012-06-23 13:53 - 00028672 ____A C:\Windows\System32\config\SECURITY.iobit

2012-06-23 13:25 - 2012-06-23 13:25 - 00000000 ____D C:\Users\Kyle\AppData\Local\Macromedia

2012-06-23 13:03 - 2012-06-23 13:03 - 09815752 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2012-06-23 13:03 - 2012-06-02 10:10 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-06-23 13:03 - 2011-06-02 06:13 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-06-23 12:32 - 2012-06-13 12:05 - 00002119 ____A C:\Users\Public\Desktop\Legend of Grimrock.lnk

2012-06-23 10:27 - 2012-06-23 10:27 - 01965549 ____A (Altered Softworks ) C:\Users\Kyle\Downloads\mcskin3d_1_4_0_235.exe

2012-06-23 10:27 - 2012-06-23 10:27 - 00001011 ____A C:\Users\Public\Desktop\MCSkin3D.lnk

2012-06-22 17:42 - 2012-06-22 00:55 - 00000361 ____A C:\rkill.log

2012-06-22 13:23 - 2012-06-22 13:23 - 00001177 ____A C:\Users\Public\Desktop\IObit Malware Fighter.lnk

2012-06-22 13:21 - 2012-06-22 13:20 - 19551736 ____A (IObit ) C:\Users\Kyle\Downloads\imf-setup.exe

2012-06-22 11:50 - 2012-06-22 11:50 - 00000000 ____A C:\Windows\setuperr.log

2012-06-22 02:19 - 2012-06-22 02:18 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.exe

2012-06-22 02:16 - 2012-06-22 02:16 - 00000618 ____A C:\Users\Kyle\Documents\cc_20120622_051608.reg

2012-06-22 02:01 - 2012-06-20 09:04 - 00001584 ____A C:\Users\Kyle\Desktop\F-list.lnk

2012-06-22 00:54 - 2012-06-22 00:54 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.com

2012-06-22 00:39 - 2012-06-22 00:39 - 00045664 ____A C:\Users\Kyle\Desktop\GMer.log

2012-06-22 00:00 - 2012-06-22 00:00 - 00302592 ____A C:\Users\Kyle\Downloads\odp539no.exe

2012-06-21 19:23 - 2012-06-21 19:23 - 02109806 ____A C:\Users\Kyle\Downloads\tdsskiller.zip

2012-06-21 11:33 - 2011-12-09 23:31 - 00000000 ____D C:\Users\Kyle\Documents\Morrowind Mods

2012-06-20 22:26 - 2012-03-03 13:37 - 00000693 ____A C:\Users\Kyle\Desktop\Minecraft.lnk

2012-06-20 22:03 - 2012-06-20 22:03 - 00278561 ____A C:\Users\Kyle\Downloads\Minecraft.exe

2012-06-20 22:02 - 2012-06-20 22:02 - 01589718 ____A C:\Users\Kyle\Downloads\Minecraft_Server.exe

2012-06-20 21:45 - 2012-06-20 21:44 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft_key_code_generator

2012-06-20 21:35 - 2012-06-20 21:35 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft Gift Code Generator v1.9.1

2012-06-19 11:54 - 2012-06-19 11:54 - 00951853 ____A C:\Users\Kyle\Downloads\RK_00262_HD25.mp4

2012-06-19 11:49 - 2012-06-19 11:49 - 00001822 ____A C:\Users\Kyle\Downloads\backfill.mov

2012-06-19 11:49 - 2012-06-19 11:49 - 00001817 ____A C:\Users\Kyle\Downloads\welding.mov

2012-06-19 11:48 - 2012-06-19 11:48 - 00997888 ____A C:\Users\Kyle\Downloads\sparks.avi

2012-06-18 12:25 - 2012-06-18 12:25 - 00001196 ____A C:\Users\Kyle\Desktop\FileZilla.lnk

2012-06-17 19:44 - 2011-08-07 13:44 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2012-06-17 19:44 - 2011-06-02 06:14 - 00000000 ____D C:\Program Files (x86)\Adobe

2012-06-17 18:59 - 2011-06-26 15:07 - 00000000 ____D C:\Program Files\Adobe

2012-06-17 18:59 - 2011-06-26 15:06 - 00000000 ____D C:\Program Files\Common Files\Adobe

2012-06-17 18:58 - 2012-06-17 18:57 - 00000000 ____D C:\Users\Kyle\Downloads\PremierePro_6_Content_LS7

2012-06-17 18:58 - 2011-06-02 06:14 - 00000000 ____D C:\Users\Kyle\AppData\Local\Adobe

2012-06-17 18:56 - 2012-06-17 18:45 - 768928646 ____A C:\Users\Kyle\Downloads\PremierePro_6_Content_LS7.7z

2012-06-17 18:29 - 2012-06-17 18:29 - 00000000 ____D C:\Users\Kyle\Downloads\Encore Working

2012-06-17 12:38 - 2012-06-16 22:25 - 00000000 ____D C:\Users\Kyle\Desktop\Flea Market

2012-06-17 11:58 - 2011-08-26 20:31 - 00000000 ____D C:\Users\All Users\Skype

2012-06-14 19:43 - 2012-05-26 09:50 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\WorldPainter

2012-06-14 18:46 - 2012-05-26 09:50 - 00000000 ____D C:\Program Files\WorldPainter

2012-06-14 18:21 - 2012-06-14 18:21 - 02446584 ____A (pepsoft.org) C:\Users\Kyle\Documents\worldpainter_64_0.8.9.exe

2012-06-14 12:20 - 2012-06-06 18:15 - 00000000 ____D C:\Users\Kyle\Documents\Island Stuff

2012-06-13 15:10 - 2012-06-13 15:08 - 09813457 ____A C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta.zip

2012-06-13 15:01 - 2012-05-11 11:56 - 00001107 ____A C:\Users\Kyle\Desktop\Modeler.lnk

2012-06-13 15:01 - 2012-05-11 11:56 - 00001100 ____A C:\Users\Kyle\Desktop\Layout.lnk

2012-06-13 14:26 - 2011-11-27 11:40 - 00000000 ____D C:\Program Files (x86)\SpeedFan

2012-06-13 12:07 - 2012-06-13 12:05 - 00000000 ____D C:\Users\Kyle\Downloads\The Legend of Korra

2012-06-13 12:05 - 2012-06-13 12:05 - 00000000 ____D C:\Users\Kyle\Documents\Almost Human

2012-06-13 12:04 - 2012-01-30 17:47 - 00000000 ____D C:\Program Files (x86)\GOG.com

2012-06-13 00:09 - 2011-06-02 11:33 - 00000000 ____D C:\Users\All Users\Microsoft Help

2012-06-13 00:04 - 2012-03-12 18:45 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2012-06-11 23:31 - 2012-06-11 23:31 - 00036210 ____A C:\Users\Kyle\Documents\Loki_009.htm

2012-06-11 19:04 - 2011-10-02 19:43 - 00002358 ____A C:\Users\Kyle\Desktop\Google Chrome.lnk

2012-06-11 08:58 - 2012-06-11 08:58 - 00024032 ____A C:\Users\Kyle\Documents\cc_20120611_115807.reg

2012-06-11 08:55 - 2011-07-22 17:14 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\DAEMON Tools Lite

2012-06-10 23:07 - 2012-06-10 23:07 - 00107753 ____A C:\Users\Kyle\Documents\Loki_008.htm

2012-06-10 18:57 - 2012-06-07 12:24 - 00002340 ____A C:\Users\Public\Desktop\Creatures 2.lnk

2012-06-10 18:57 - 2012-06-07 12:24 - 00002331 ____A C:\Users\Public\Desktop\Creatures 1.lnk

2012-06-10 18:46 - 2012-06-10 18:46 - 00323997 ____A C:\Users\Kyle\Downloads\Remaster Patch.zip

2012-06-10 18:46 - 2012-06-10 18:46 - 00000000 ____D C:\Users\Kyle\Downloads\Remaster Patch

2012-06-08 22:01 - 2012-06-08 22:01 - 00070272 ____A C:\Users\Kyle\Documents\Loki_007.htm

2012-06-08 17:37 - 2012-06-08 17:37 - 00000000 ____D C:\Users\Kyle\Downloads\StarForge_V0.1

2012-06-08 17:36 - 2012-06-08 17:30 - 315470531 ____A C:\Users\Kyle\Downloads\StarForge_V0.1.zip

2012-06-08 16:42 - 2012-06-08 16:40 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Braid

2012-06-07 21:58 - 2012-06-07 21:19 - 00017140 ____A C:\Users\Kyle\Documents\Loki_006.htm

2012-06-07 20:51 - 2012-06-07 20:45 - 00000028 ____A C:\Windows\encore_launcher.ini

2012-06-07 18:55 - 2012-06-07 18:55 - 00000000 ____D C:\Users\Kyle\Downloads\grendel_cage

2012-06-07 14:14 - 2012-06-07 14:14 - 01114119 ____A C:\Users\Kyle\Downloads\Creatures_Update_2.exe

2012-06-07 14:09 - 2012-06-07 14:09 - 00002395 ____A C:\Users\Kyle\Downloads\tomato_soup.zip

2012-06-07 14:06 - 2012-06-07 14:06 - 00014335 ____A C:\Users\Kyle\Downloads\peartree.zip

2012-06-07 14:04 - 2012-06-07 14:04 - 00023323 ____A C:\Users\Kyle\Downloads\grapevine.zip

2012-06-07 14:04 - 2012-06-07 14:04 - 00013553 ____A C:\Users\Kyle\Downloads\grendel_cage.zip

2012-06-07 14:03 - 2012-06-07 14:03 - 00049380 ____A C:\Users\Kyle\Downloads\de_theme.zip

2012-06-07 12:53 - 2012-06-07 12:53 - 00000000 ____D C:\Users\Kyle\Downloads\c_albian_years_manuals

2012-06-07 12:24 - 2012-06-07 12:23 - 00000000 ____D C:\Users\Kyle\Documents\Creatures

2012-06-07 12:19 - 2012-06-07 12:16 - 116171848 ____A (GOG.com ) C:\Users\Kyle\Downloads\setup_creatures_albian_years.exe

2012-06-07 12:16 - 2012-06-07 12:16 - 01207334 ____A C:\Users\Kyle\Downloads\c_albian_years_manuals.zip

2012-06-07 00:34 - 2012-06-07 00:33 - 00025288 ____A C:\Users\Kyle\Documents\LokiThor3some_001.htm

2012-06-06 18:32 - 2011-08-30 18:31 - 00000000 ____D C:\Users\Kyle\Desktop\Lizzie's Couch

2012-06-06 11:18 - 2011-06-04 13:18 - 00001053 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk

2012-06-06 11:06 - 2012-06-06 11:06 - 17151152 ____A (Mozilla) C:\Users\Kyle\Downloads\Firefox Setup 13.0b7.exe

2012-06-06 01:41 - 2012-06-06 01:41 - 00094869 ____A C:\Users\Kyle\Documents\Loki_005.htm

2012-06-05 19:54 - 2012-03-13 15:51 - 00000000 ____D C:\Program Files (x86)\Docking Station

2012-06-05 19:49 - 2012-06-05 19:47 - 31733248 ____A C:\Users\Kyle\Downloads\dockingstation_195.exe

2012-06-05 18:23 - 2012-06-05 18:23 - 00000000 ____D C:\Program Files\Common Files\INCA Shared

2012-06-05 01:32 - 2011-07-18 18:54 - 00000000 ____D C:\Program Files\PeerBlock

2012-06-05 00:52 - 2012-06-05 00:52 - 00077900 ____A C:\Users\Kyle\Documents\Loki_004.htm

2012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\Program Files (x86)\BandiMPEG1

2012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\gPotato

2012-06-05 00:15 - 2012-06-04 23:46 - 1764105178 ____A (Acresso Software Inc. ) C:\Users\Kyle\Downloads\Iris_US_v1.20.31086.exe

2012-06-04 23:45 - 2012-06-04 23:45 - 00773400 ____A C:\Users\Kyle\Downloads\IRIS_US_Downloader.exe

2012-06-03 20:50 - 2012-06-02 10:36 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who

2012-06-03 13:03 - 2012-06-03 13:02 - 00000000 ____D C:\Python27

2012-06-03 13:03 - 2012-06-03 12:56 - 00000000 ____D C:\Program Files (x86)\OpenRPG

2012-06-03 13:02 - 2012-06-03 13:00 - 15867904 ____A C:\Users\Kyle\Downloads\python-2.7.3.msi

2012-06-03 12:56 - 2012-06-03 12:55 - 00829561 ____A C:\Users\Kyle\Downloads\openrpg-1.7.1.exe

2012-06-03 00:38 - 2012-06-03 00:38 - 00105831 ____A C:\Users\Kyle\Documents\Loki_003.htm

2012-06-02 10:30 - 2012-06-02 10:28 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who 2005 Season 1-5

2012-06-01 17:22 - 2012-05-22 16:59 - 00000000 ____D C:\Users\Kyle\Downloads\Hentai

2012-05-31 18:05 - 2012-05-31 17:56 - 00000000 ____D C:\Users\Kyle\Documents\Recipes

2012-05-31 13:28 - 2011-06-30 19:02 - 00000000 ____D C:\LiberKey

2012-05-31 10:34 - 2012-05-31 10:33 - 27070144 ____A (IObit ) C:\Users\Kyle\Downloads\asc-setup.exe

2012-05-31 10:34 - 2012-03-12 17:57 - 00001276 ____A C:\Users\Public\Desktop\Uninstaller.lnk

2012-05-31 10:34 - 2012-03-12 17:57 - 00001225 ____A C:\Users\Public\Desktop\Advanced SystemCare 5.lnk

2012-05-31 00:34 - 2012-05-31 00:34 - 00047292 ____A C:\Users\Kyle\Documents\Loki_002.htm

2012-05-29 18:13 - 2012-05-29 18:10 - 00000000 ____D C:\Users\Kyle\Downloads\Captain America The First Avenger (2011) DVDRip XviD-MAXSPEED

2012-05-29 18:07 - 2012-05-29 18:07 - 00000000 ____D C:\Users\Kyle\AppData\Local\CRE

2012-05-29 18:07 - 2012-05-29 18:07 - 00000000 ____D C:\Program Files (x86)\Conduit

2012-05-28 22:27 - 2012-05-28 22:27 - 00810743 ____A C:\Users\Kyle\Downloads\BTWMod3-64.zip

2012-05-28 19:03 - 2012-05-28 19:03 - 00001911 ____A C:\Users\Kyle\Desktop\WorldPainter.lnk

2012-05-28 18:57 - 2012-05-28 18:56 - 06766449 ____A (Sytexis Software ) C:\Users\Kyle\Downloads\playclaw3.1969.exe

2012-05-28 17:16 - 2012-05-28 17:16 - 00999771 ____A C:\Users\Kyle\Downloads\SinglePlayerCommands-MC1.2.5_V3.2.2.jar

2012-05-28 14:50 - 2012-05-28 14:50 - 00000029 ____A C:\Windows\Index.ini

2012-05-28 14:45 - 2012-05-28 14:45 - 00189894 ____A C:\Users\Kyle\Documents\cc_20120528_174523.reg

2012-05-26 16:58 - 2012-05-26 16:29 - 00000000 ____D C:\Users\Kyle\Downloads\Legend.of.Grimrock-RELOADED

2012-05-26 16:58 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\system

2012-05-26 16:31 - 2012-05-26 16:27 - 00000000 ____D C:\Users\Kyle\Downloads\Creatures Trilogy

2012-05-26 14:54 - 2012-05-26 14:52 - 00000000 ___HD C:\Windows\msdownld.tmp

2012-05-26 14:53 - 2012-05-26 14:53 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Hi-Rez Studios

2012-05-26 14:52 - 2012-05-26 14:52 - 00000000 ____D C:\Windows\SysWOW64\directx

2012-05-26 14:52 - 2012-05-26 14:52 - 00000000 ____D C:\Windows\B83FC356B7C0441F8A4DD71E088E7974.TMP

2012-05-26 14:52 - 2012-05-26 14:52 - 00000000 ____D C:\Users\Kyle\AppData\Local\Aeria Games

2012-05-26 14:51 - 2012-05-26 14:51 - 00000000 ____D C:\Users\All Users\Aeria Games

2012-05-26 11:34 - 2012-05-26 11:34 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA

2012-05-26 10:38 - 2012-05-26 10:38 - 00000000 ____D C:\Users\Kyle\Documents\WorldPainterSaves

2012-05-26 10:05 - 2012-05-26 10:04 - 00000000 ____D C:\Users\Kyle\.minecraft

2012-05-26 09:51 - 2012-05-26 09:51 - 00001615 ____A C:\Users\Kyle\Desktop\Dream of Mirror Online.lnk

2012-05-26 09:49 - 2012-05-26 09:50 - 00955848 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll

2012-05-26 09:49 - 2012-05-26 09:50 - 00839112 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll

2012-05-26 09:49 - 2012-05-26 09:50 - 00268744 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe

2012-05-26 09:49 - 2012-05-26 09:49 - 00189384 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe

2012-05-26 09:49 - 2012-05-26 09:49 - 00188872 ____A (Oracle Corporation) C:\Windows\System32\java.exe

2012-05-26 09:49 - 2012-05-26 09:49 - 00000000 ____D C:\Program Files\Java

2012-05-26 09:48 - 2012-05-26 08:36 - 00000000 ____D C:\AeriaGames

2012-05-26 08:28 - 2012-01-28 22:48 - 00000000 ____D C:\Program Files (x86)\horse6.6

2012-05-26 08:27 - 2011-08-28 21:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft

2012-05-26 08:26 - 2011-07-23 12:19 - 00000000 ____D C:\Program Files (x86)\Microsoft Games

2012-05-25 13:51 - 2012-05-22 00:01 - 00003211 ____A C:\Users\Kyle\Documents\Lokisms.txt

2012-05-24 07:47 - 2012-03-13 04:02 - 00024448 ____A (IObit) C:\Windows\System32\RegistryDefragBootTime.exe

2012-05-23 19:36 - 2012-05-23 19:16 - 732221440 ____A C:\Users\Kyle\Downloads\Ralph Bakshi's Wizards.avi

2012-05-23 12:29 - 2012-05-23 12:29 - 00000000 ____D C:\Users\Kyle\Downloads\Adobe Premier Pro 2 Keygen & Activation

2012-05-22 12:36 - 2011-09-24 15:11 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\NVIDIA

2012-05-22 12:20 - 2011-08-08 18:13 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2012-05-22 12:20 - 2011-06-02 06:21 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2012-05-21 17:24 - 2012-05-21 17:24 - 00000258 ____A C:\Users\Kyle\Documents\cc_20120521_202457.reg

2012-05-21 14:05 - 2012-05-21 14:05 - 00002467 ____A C:\Users\Kyle\Documents\Spelling Song Lyrics.txt

2012-05-21 00:02 - 2012-05-21 00:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2012-05-21 00:02 - 2012-05-21 00:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2012-05-19 02:52 - 2012-05-19 02:52 - 00072954 ____A C:\Users\Kyle\Documents\NoisyBoy_002.htm

2012-05-18 16:20 - 2011-12-21 22:21 - 00001920 ____A C:\Users\Kyle\Documents\Ad.txt

2012-05-18 07:55 - 2012-05-18 07:55 - 00069905 ____A C:\Users\Kyle\Documents\NoisyBoy_001.htm

2012-05-17 16:31 - 2012-05-17 16:28 - 00000000 ____D C:\Users\Kyle\Downloads\Thor (2011) DVDRip XviD-MAXSPEED

2012-05-17 00:35 - 2012-05-17 00:35 - 00043817 ____A C:\Users\Kyle\Documents\IronMan_001.htm

2012-05-15 02:48 - 2012-05-22 12:19 - 25743168 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv64.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 25248064 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 19607872 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 18044224 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dumx.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 17551680 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 15322432 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 14298944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys

2012-05-15 02:48 - 2012-05-22 12:19 - 10194752 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2umx.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 08139072 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 05982528 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 02881856 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 02681664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 02524992 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 02445120 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 01738048 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco64.dll

2012-05-15 02:48 - 2012-05-22 12:19 - 01468224 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco64.dll

2012-05-15 02:48 - 2011-06-02 06:21 - 02741568 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi64.dll

2012-05-15 02:48 - 2011-06-02 06:21 - 02368832 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2012-05-15 02:48 - 2011-06-02 06:21 - 00068928 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll

2012-05-15 02:48 - 2011-06-02 06:21 - 00061248 ____A (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2012-05-15 02:48 - 2011-06-02 06:21 - 00014324 ____A C:\Windows\System32\nvinfo.pb

2012-05-15 02:48 - 2009-07-13 13:59 - 08105280 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2012-05-15 01:29 - 2011-06-02 06:22 - 03149632 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc64.dll

2012-05-15 01:29 - 2011-06-02 06:22 - 00889664 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

2012-05-15 01:29 - 2011-06-02 06:22 - 00118080 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll

2012-05-15 01:29 - 2011-06-02 06:22 - 00063296 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll

2012-05-15 01:28 - 2011-06-02 06:22 - 06151488 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll

2012-05-14 23:56 - 2012-05-14 23:56 - 00030278 ____A C:\Users\Kyle\Documents\Loki_001.htm

2012-05-14 23:21 - 2012-05-14 23:21 - 00423744 ____A C:\Windows\SysWOW64\nvStreaming.exe

2012-05-11 11:55 - 2012-05-11 11:55 - 00002231 ____A C:\Users\Kyle\Desktop\Fusion 5.2.lnk

2012-05-11 11:54 - 2012-05-11 11:54 - 00000000 ____D C:\Program Files (x86)\eyeon

2012-05-11 11:54 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Setup

2012-05-11 11:49 - 2012-05-11 11:49 - 00000000 ____D C:\Users\Kyle\Downloads\eyeon fusion 5.2

2012-05-11 11:46 - 2012-05-11 11:42 - 52374122 ____A C:\Users\Kyle\Downloads\eyeon fusion 5.2.rar

2012-05-11 11:34 - 2012-05-11 11:34 - 00000000 ____D C:\Users\All Users\Mozilla

2012-05-10 00:26 - 2011-06-02 10:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-05-09 21:51 - 2012-02-15 05:08 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2012-05-09 15:49 - 2011-12-25 09:16 - 00000000 ____D C:\Users\Kyle\AppData\Local\Skyrim

2012-05-09 13:45 - 2011-11-27 16:58 - 00000000 ___RD C:\Users\Kyle\Virtual Machines

2012-05-09 13:39 - 2012-03-09 17:40 - 00002120 ____A C:\Users\Kyle\Desktop\VisualBoyAdvance - Shortcut.lnk

2012-05-09 13:39 - 2011-08-07 14:17 - 00001869 ____A C:\Users\Kyle\Desktop\Star Wars Knights of the Old Republic.lnk

2012-05-09 13:39 - 2011-07-18 18:54 - 00001780 ____A C:\Users\Kyle\Desktop\PeerBlock.lnk

2012-05-09 13:39 - 2011-06-19 18:17 - 00002058 ____A C:\Users\Public\Desktop\Media Player Classic - Home Cinema x64.lnk

2012-05-08 18:23 - 2012-05-08 18:18 - 00000000 ____D C:\Users\All Users\Ralink

2012-05-08 17:56 - 2012-05-08 17:56 - 00000000 ____D C:\Program Files (x86)\Edimax

2012-05-08 17:56 - 2012-05-08 16:35 - 00000000 ____D C:\Users\All Users\Edimax Driver

2012-05-08 17:56 - 2009-07-13 18:34 - 00000512 ____A C:\Windows\win.ini

2012-05-08 16:40 - 2012-05-08 16:40 - 00000000 ____D C:\Program Files (x86)\Cisco

2012-05-08 16:35 - 2012-05-08 16:35 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\InstallShield

2012-05-08 16:35 - 2012-05-08 16:35 - 00000000 ____D C:\Users\All Users\InstallShield

2012-04-28 19:27 - 2012-04-13 15:46 - 00000000 ____D C:\Windows\Minidump

2012-04-28 19:13 - 2012-04-28 19:13 - 00000000 ____D C:\Program Files (x86)\LucasArts

2012-04-25 08:35 - 2012-04-25 08:35 - 00546640 ___RA (iS3, Inc.) C:\Windows\SysWOW64\SZComp5.dll

2012-04-25 08:35 - 2012-04-25 08:35 - 00481104 ___RA (iS3, Inc.) C:\Windows\SysWOW64\SZBase5.dll

2012-04-25 08:35 - 2012-04-25 08:35 - 00023376 ___RA (iS3, Inc.) C:\Windows\SysWOW64\SZIO5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00808784 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Base5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00456528 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3DBA5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00390992 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3UI5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00231248 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Win325.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00132944 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3HTUI5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00104272 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Inet5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00100176 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Svc5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00067408 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Hks5.dll

2012-04-19 14:39 - 2012-04-19 14:39 - 00029008 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3XDat5.dll

2012-04-18 14:56 - 2011-08-27 15:55 - 00000000 ____D C:\Users\Kyle\Desktop\Lightwave

2012-04-10 20:31 - 2012-04-10 20:31 - 02303488 ____A (Python Software Foundation) C:\Windows\SysWOW64\python27.dll

2012-04-05 20:46 - 2012-04-05 20:46 - 00000000 ____D C:\Users\Kyle\AppData\Local\Freelancer

2012-04-05 20:46 - 2011-06-04 14:26 - 00000000 ____D C:\Users\Kyle\Documents\My Games

2012-04-05 20:42 - 2012-04-05 20:42 - 00002231 ____A C:\Users\Public\Desktop\Freelancer.lnk

2012-04-04 12:56 - 2011-06-02 10:20 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2012-04-04 00:10 - 2012-04-03 16:58 - 00000000 ____D C:\Users\All Users\FarmFrenzy_Rome

2012-04-03 16:58 - 2012-04-03 16:58 - 00000000 ____D C:\Users\Public\Documents\AlawarWrapper

2012-04-03 16:58 - 2012-04-03 16:58 - 00000000 ____D C:\Users\All Users\AlawarWrapper

2012-04-03 16:57 - 2012-04-03 16:57 - 00000000 ____D C:\Windows\Farm Frenzy Ancient Rome

ZeroAccess:

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\00000004.@

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\201d3dde

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000004.@

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000008.@

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\000000cb.@

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000000.@

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000032.@

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000064.@

ZeroAccess:

C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}

C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\@

C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L

C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\n

C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 9%

Total physical RAM: 8191.24 MB

Available physical RAM: 7392.3 MB

Total Pagefile: 8189.39 MB

Available Pagefile: 7371.6 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:1862.92 GB) (Free:1242.71 GB) NTFS

2 Drive e: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF

3 Drive f: () (Removable) (Total:1.9 GB) (Free:1.9 GB) FAT32

4 Drive g: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS

5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

6 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 1863 GB 0 B

Disk 1 Online 1952 MB 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 100 MB 1024 KB

Partition 2 Primary 1862 GB 101 MB

======================================================================================================

Disk: 0

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 Y System Rese NTFS Partition 100 MB Healthy

======================================================================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 C NTFS Partition 1862 GB Healthy

======================================================================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

* Partition 1 Primary 1952 MB 0 B

======================================================================================================

Disk: 1

There is no partition selected.

There is no partition selected.

Please select a partition and try again.

======================================================================================================

==========================================================

Last Boot: 2012-06-28 13:04

======================= End Of Log ==========================

Link to post
Share on other sites

  • Staff

Greetings

Ok lets see if we can find a replacement for the infected file

In Vista or Windows 7: Boot to System Recovery Options and run FRST.

Type the following in the edit box after "Search:".

services.exe

It then should look like:

Search: services.exe

Click Search button and post the log (Search.txt) it makes to your reply.

Gringo

Link to post
Share on other sites

Here you go.

Farbar Recovery Scan Tool Version: 25-06-2012

Ran by SYSTEM at 2012-06-30 17:04:55

Running from G:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe

[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======

Link to post
Share on other sites

  • Staff

Hello

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt


Replace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exe
C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}
C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST64 and press the Fix button just once and wait.

The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Gringo

Link to post
Share on other sites

Here it is.

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 25-06-2012

Ran by SYSTEM at 2012-07-01 14:37:53 Run:1

Running from G:\

==============================================

C:\Windows\System32\services.exe moved successfully.

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16} moved successfully.

C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16} moved successfully.

==== End of Fixlog ====

Link to post
Share on other sites

  • Staff

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

Link to post
Share on other sites

ComboFix 12-07-02.01 - Kyle 07/03/2012 16:18:01.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8191.6724 [GMT -5:00]

Running from: c:\users\Kyle\Downloads\ComboFix.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\assembly\GAC_32\Desktop.ini

c:\windows\assembly\GAC_64\Desktop.ini

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\00000004.@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\1afb2d56

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\201d3dde

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\55490ac4

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\n

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000004.@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000008.@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\000000cb.@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000000.@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000032.@

c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000064.@

.

.

((((((((((((((((((((((((( Files Created from 2012-06-03 to 2012-07-03 )))))))))))))))))))))))))))))))

.

.

2012-07-03 21:25 . 2012-07-03 21:25 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-07-03 21:25 . 2012-07-03 21:25 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-02 08:11 . 2012-07-02 08:11 -------- d-----w- c:\programdata\Nexon

2012-06-29 22:17 . 2012-06-29 22:18 -------- d-----w- C:\FRST

2012-06-27 00:34 . 2012-06-28 00:21 -------- d-----w- c:\users\Kyle\AppData\Roaming\.minecraft

2012-06-26 22:50 . 2012-01-12 14:28 57976 ----a-r- c:\windows\system32\drivers\SBREDrv.sys

2012-06-26 22:42 . 2012-06-29 19:28 -------- d-----w- C:\sh4ldr

2012-06-26 22:42 . 2012-06-28 00:21 -------- d-----w- c:\program files\Enigma Software Group

2012-06-26 22:42 . 2012-06-29 19:28 -------- d-----w- c:\windows\18F97AF04F884494AFE25A5702E142CC.TMP

2012-06-23 21:25 . 2012-06-23 21:25 -------- d-----w- c:\users\Kyle\AppData\Local\Macromedia

2012-06-23 21:03 . 2012-06-23 21:03 9815752 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-06-23 18:27 . 2012-06-28 19:15 -------- d-----w- c:\program files (x86)\MCSkin3D

2012-06-21 05:56 . 2012-06-28 00:21 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%

2012-06-19 18:16 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4D8DADC4-F81E-4476-A9F1-A093EF46F036}\mpengine.dll

2012-06-18 03:44 . 2003-08-11 15:07 14604 ----a-w- c:\windows\SysWow64\drivers\pfc.sys

2012-06-18 03:44 . 2003-08-11 15:13 344064 ----a-r- c:\windows\SysWow64\msvcr70.dll

2012-06-09 00:40 . 2012-06-09 00:42 -------- d-----w- c:\users\Kyle\AppData\Roaming\Braid

2012-06-09 00:39 . 2008-07-12 13:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll

2012-06-06 19:18 . 2012-07-01 07:44 136672 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll

2012-06-06 19:18 . 2012-06-29 19:25 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll

2012-06-06 19:18 . 2012-06-29 19:25 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll

2012-06-06 02:23 . 2011-11-08 21:00 4227704 ----a-w- c:\windows\SysWow64\GameMon.des

2012-06-06 02:23 . 2005-01-04 00:43 4682 ----a-w- c:\windows\SysWow64\npptNT2.sys

2012-06-06 02:23 . 2003-07-20 09:17 5174 ----a-w- c:\windows\SysWow64\nppt9x.vxd

2012-06-06 02:23 . 2012-06-06 02:23 -------- d-----w- c:\program files\Common Files\INCA Shared

2012-06-05 08:15 . 2012-06-05 08:15 -------- d-----w- c:\program files (x86)\BandiMPEG1

2012-06-05 08:15 . 2012-06-05 08:15 -------- d-----w- C:\gPotato

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-23 21:03 . 2012-06-02 18:10 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-23 21:03 . 2011-06-02 14:13 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-06-22 21:50 . 2012-05-11 19:54 61440 ----a-r- c:\users\Kyle\AppData\Roaming\Microsoft\Installer\{5808DEC3-FD32-42AD-8640-67CF82210D11}\NewShortcut4_5CAB993EDD3D46CC9A9960173F42D18C.exe

2012-05-26 17:49 . 2012-05-26 17:50 955848 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-05-26 17:49 . 2012-05-26 17:50 839112 ----a-w- c:\windows\system32\deployJava1.dll

2012-05-24 15:47 . 2012-03-13 12:02 24448 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2012-05-15 10:48 . 2012-05-22 20:19 8139072 ----a-w- c:\windows\system32\nvcuda.dll

2012-05-15 10:48 . 2012-05-22 20:19 5982528 ----a-w- c:\windows\SysWow64\nvcuda.dll

2012-05-15 10:48 . 2012-05-22 20:19 2881856 ----a-w- c:\windows\system32\nvcuvenc.dll

2012-05-15 10:48 . 2012-05-22 20:19 2681664 ----a-w- c:\windows\system32\nvcuvid.dll

2012-05-15 10:48 . 2012-05-22 20:19 25743168 ----a-w- c:\windows\system32\nvoglv64.dll

2012-05-15 10:48 . 2012-05-22 20:19 2524992 ----a-w- c:\windows\SysWow64\nvcuvid.dll

2012-05-15 10:48 . 2012-05-22 20:19 25248064 ----a-w- c:\windows\system32\nvcompiler.dll

2012-05-15 10:48 . 2012-05-22 20:19 2445120 ----a-w- c:\windows\SysWow64\nvcuvenc.dll

2012-05-15 10:48 . 2012-05-22 20:19 19607872 ----a-w- c:\windows\SysWow64\nvoglv32.dll

2012-05-15 10:48 . 2012-05-22 20:19 18044224 ----a-w- c:\windows\system32\nvd3dumx.dll

2012-05-15 10:48 . 2012-05-22 20:19 17551680 ----a-w- c:\windows\SysWow64\nvcompiler.dll

2012-05-15 10:48 . 2012-05-22 20:19 1738048 ----a-w- c:\windows\system32\nvdispco64.dll

2012-05-15 10:48 . 2012-05-22 20:19 15322432 ----a-w- c:\windows\SysWow64\nvd3dum.dll

2012-05-15 10:48 . 2012-05-22 20:19 1468224 ----a-w- c:\windows\system32\nvgenco64.dll

2012-05-15 10:48 . 2012-05-22 20:19 14298944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2012-05-15 10:48 . 2012-05-22 20:19 10194752 ----a-w- c:\windows\system32\nvwgf2umx.dll

2012-05-15 10:48 . 2011-06-02 14:21 68928 ----a-w- c:\windows\system32\OpenCL.dll

2012-05-15 10:48 . 2011-06-02 14:21 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll

2012-05-15 10:48 . 2011-06-02 14:21 2741568 ----a-w- c:\windows\system32\nvapi64.dll

2012-05-15 10:48 . 2011-06-02 14:21 2368832 ----a-w- c:\windows\SysWow64\nvapi.dll

2012-05-15 10:48 . 2009-07-13 21:59 8105280 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

2012-05-15 09:29 . 2011-06-02 14:22 889664 ----a-w- c:\windows\system32\nvvsvc.exe

2012-05-15 09:29 . 2011-06-02 14:22 63296 ----a-w- c:\windows\system32\nvshext.dll

2012-05-15 09:29 . 2011-06-02 14:22 118080 ----a-w- c:\windows\system32\nvmctray.dll

2012-05-15 09:29 . 2011-06-02 14:22 3149632 ----a-w- c:\windows\system32\nvsvc64.dll

2012-05-15 09:28 . 2011-06-02 14:22 6151488 ----a-w- c:\windows\system32\nvcpl.dll

2012-05-15 07:21 . 2012-05-15 07:21 423744 ----a-w- c:\windows\SysWow64\nvStreaming.exe

2012-04-11 04:31 . 2012-04-11 04:31 2303488 ----a-w- c:\windows\SysWow64\python27.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{20a0be68-8fd9-4539-8712-ce3d1c1fdfc6}]

2011-12-22 21:17 262312 ----a-w- c:\program files (x86)\blekkotb\auxi\blekkoAu.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{26c9e18c-3717-4be1-a225-04e4471f5b6e}]

2011-12-22 21:16 86696 ----a-w- c:\program files (x86)\blekkotb\blekkoDx.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{26c9e18c-3717-4be1-a225-04e4471f5b6e}"= "c:\program files (x86)\blekkotb\blekkoDx.dll" [2011-12-22 86696]

.

[HKEY_CLASSES_ROOT\clsid\{26c9e18c-3717-4be1-a225-04e4471f5b6e}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Wireless Utility.lnk - c:\program files (x86)\Edimax\Common\RaUI.exe [2012-5-8 1638400]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux9"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-05 160944]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]

R3 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-03-05 748440]

R3 dump_wmimmc;dump_wmimmc;c:\gpotato\IrisOnline\GameGuard\dump_wmimmc.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 FileMonitor;FileMonitor;c:\program files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2012-01-05 21384]

R3 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-09-26 375176]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-01 113120]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]

R3 RegFilter;RegFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [2012-04-28 33184]

R3 SentinelKeysServer;Sentinel Keys Server;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2009-09-17 369952]

R3 SentinelSecurityRuntime;Sentinel Security Runtime;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [2009-09-17 292128]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 UrlFilter;UrlFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [2012-04-28 21872]

R3 X6va005;X6va005;c:\users\Kyle\AppData\Local\Temp\005510C.tmp [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-28 279616]

S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]

S2 IMFservice;IMF Service;c:\program files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-01-10 821592]

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2011-09-16 15928]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Edimax\Common\RaRegistry64.exe [2009-10-06 212256]

S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [2009-09-17 145448]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2009-10-06 737792]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]

.

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-03 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-02 21:03]

.

2012-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000Core.job

- c:\users\Kyle\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 03:40]

.

2012-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000UA.job

- c:\users\Kyle\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 03:40]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253

uInternet Settings,ProxyOverride = *.local;<local>

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.2.1

CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\shell32.dll

FF - ProfilePath - c:\users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\tq9u0624.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)

WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]

"ImagePath"="\??\c:\users\Kyle\AppData\Local\Temp\005510C.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{32099AAC-C132-4136-9E9A-4E364A424E17}"=hex:51,66,7a,6c,4c,1d,38,12,c2,99,1a,

36,00,8f,58,04,e1,8c,0d,76,4f,1c,0a,03

"{26C9E18C-3717-4BE1-A225-04E4471F5B6E}"=hex:51,66,7a,6c,4c,1d,38,12,e2,e2,da,

22,25,79,8f,0e,dd,33,47,a4,42,41,1f,7a

"{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"=hex:51,66,7a,6c,4c,1d,38,12,07,04,c9,

0f,40,b3,9a,0c,ed,70,a2,bb,05,11,09,9b

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}"=hex:51,66,7a,6c,4c,1d,38,12,06,bd,b3,

24,eb,c1,57,00,f8,04,8d,7d,19,41,9b,d2

"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,

76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,

2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:17,7d,6f,95,5e,06,cd,01

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ac,43,92,d0,f1,01,66,40,b0,14,4b,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ac,43,92,d0,f1,01,66,40,b0,14,4b,\

.

[HKEY_USERS\S-1-5-21-4045259866-2150992624-2669054454-1000\Software\SecuROM\License information*]

"datasecu"=hex:ef,15,8b,66,6a,c4,01,15,05,ad,d2,56,74,f9,9f,4d,ff,a5,ac,2c,52,

64,e8,1d,d0,87,52,aa,e8,26,60,ab,02,33,95,6c,98,77,92,97,8b,17,88,6c,20,66,\

"rkeysecu"=hex:32,18,43,1f,a8,21,27,b7,4e,25,7d,cc,0b,3c,91,c9

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Bonjour\mDNSResponder.exe

c:\program files (x86)\Edimax\Common\RaRegistry.exe

.

**************************************************************************

.

Completion time: 2012-07-03 16:32:28 - machine was rebooted

ComboFix-quarantined-files.txt 2012-07-03 21:32

.

Pre-Run: 1,338,163,392,512 bytes free

Post-Run: 1,337,793,167,360 bytes free

.

- - End Of File - - 153353FEF6CEE3BF3E69966D6A586F96

Link to post
Share on other sites

  • Staff

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

  • Double click the aswMBR.exe icon to run it
  • it will ask to download extra definitions - ALLOW IT
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

Link to post
Share on other sites

  • Staff

Greetings

I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

Gringo

Link to post
Share on other sites

13:44:02.0609 3432 TDSS rootkit removing tool 2.7.44.0 Jul 2 2012 20:01:08

13:44:03.0115 3432 ============================================================

13:44:03.0115 3432 Current date / time: 2012/07/06 13:44:03.0115

13:44:03.0115 3432 SystemInfo:

13:44:03.0115 3432

13:44:03.0115 3432 OS Version: 6.1.7600 ServicePack: 0.0

13:44:03.0115 3432 Product type: Workstation

13:44:03.0115 3432 ComputerName: WHEELJACK

13:44:03.0115 3432 UserName: Kyle

13:44:03.0115 3432 Windows directory: C:\Windows

13:44:03.0115 3432 System windows directory: C:\Windows

13:44:03.0115 3432 Running under WOW64

13:44:03.0115 3432 Processor architecture: Intel x64

13:44:03.0115 3432 Number of processors: 4

13:44:03.0115 3432 Page size: 0x1000

13:44:03.0115 3432 Boot type: Normal boot

13:44:03.0115 3432 ============================================================

13:44:04.0325 3432 Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

13:44:04.0331 3432 ============================================================

13:44:04.0331 3432 \Device\Harddisk0\DR0:

13:44:04.0331 3432 MBR partitions:

13:44:04.0331 3432 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

13:44:04.0331 3432 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xE8DD5800

13:44:04.0331 3432 ============================================================

13:44:04.0350 3432 C: <-> \Device\Harddisk0\DR0\Partition1

13:44:04.0350 3432 ============================================================

13:44:04.0350 3432 Initialize success

13:44:04.0350 3432 ============================================================

13:44:07.0470 3548 ============================================================

13:44:07.0470 3548 Scan started

13:44:07.0470 3548 Mode: Manual;

13:44:07.0470 3548 ============================================================

13:44:08.0359 3548 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys

13:44:08.0362 3548 1394ohci - ok

13:44:08.0397 3548 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys

13:44:08.0400 3548 ACPI - ok

13:44:08.0434 3548 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys

13:44:08.0435 3548 AcpiPmi - ok

13:44:08.0508 3548 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

13:44:08.0509 3548 AdobeARMservice - ok

13:44:08.0599 3548 AdobeFlashPlayerUpdateSvc (990dc6edc9f933194d7cd4e65146bc94) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

13:44:08.0602 3548 AdobeFlashPlayerUpdateSvc - ok

13:44:08.0627 3548 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

13:44:08.0633 3548 adp94xx - ok

13:44:08.0655 3548 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

13:44:08.0659 3548 adpahci - ok

13:44:08.0668 3548 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

13:44:08.0670 3548 adpu320 - ok

13:44:08.0747 3548 AdvancedSystemCareService5 (96d6cdd0b32846e8cfbe592f4f32e608) C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe

13:44:08.0757 3548 AdvancedSystemCareService5 - ok

13:44:08.0786 3548 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

13:44:08.0788 3548 AeLookupSvc - ok

13:44:08.0809 3548 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys

13:44:08.0815 3548 AFD - ok

13:44:08.0830 3548 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys

13:44:08.0831 3548 agp440 - ok

13:44:08.0845 3548 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

13:44:08.0847 3548 ALG - ok

13:44:08.0851 3548 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys

13:44:08.0851 3548 aliide - ok

13:44:08.0856 3548 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys

13:44:08.0857 3548 amdide - ok

13:44:08.0863 3548 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

13:44:08.0865 3548 AmdK8 - ok

13:44:08.0870 3548 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

13:44:08.0871 3548 AmdPPM - ok

13:44:08.0879 3548 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys

13:44:08.0880 3548 amdsata - ok

13:44:08.0891 3548 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

13:44:08.0893 3548 amdsbs - ok

13:44:08.0906 3548 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys

13:44:08.0907 3548 amdxata - ok

13:44:08.0921 3548 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

13:44:08.0922 3548 AppID - ok

13:44:08.0931 3548 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

13:44:08.0932 3548 AppIDSvc - ok

13:44:08.0960 3548 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll

13:44:08.0961 3548 Appinfo - ok

13:44:08.0999 3548 Application Updater (54951548980ecd07b80ead3c7921f8a1) C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

13:44:09.0007 3548 Application Updater - ok

13:44:09.0055 3548 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

13:44:09.0056 3548 arc - ok

13:44:09.0082 3548 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

13:44:09.0084 3548 arcsas - ok

13:44:09.0157 3548 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

13:44:09.0158 3548 aspnet_state - ok

13:44:09.0182 3548 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

13:44:09.0183 3548 AsyncMac - ok

13:44:09.0200 3548 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys

13:44:09.0200 3548 atapi - ok

13:44:09.0229 3548 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll

13:44:09.0236 3548 AudioEndpointBuilder - ok

13:44:09.0244 3548 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll

13:44:09.0248 3548 AudioSrv - ok

13:44:09.0263 3548 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll

13:44:09.0265 3548 AxInstSV - ok

13:44:09.0283 3548 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

13:44:09.0287 3548 b06bdrv - ok

13:44:09.0300 3548 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

13:44:09.0303 3548 b57nd60a - ok

13:44:09.0324 3548 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

13:44:09.0325 3548 BDESVC - ok

13:44:09.0329 3548 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

13:44:09.0329 3548 Beep - ok

13:44:09.0378 3548 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll

13:44:09.0386 3548 BFE - ok

13:44:09.0428 3548 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\system32\qmgr.dll

13:44:09.0476 3548 BITS - ok

13:44:09.0505 3548 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

13:44:09.0506 3548 blbdrive - ok

13:44:09.0551 3548 Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

13:44:09.0555 3548 Bonjour Service - ok

13:44:09.0563 3548 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys

13:44:09.0564 3548 bowser - ok

13:44:09.0568 3548 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

13:44:09.0569 3548 BrFiltLo - ok

13:44:09.0575 3548 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

13:44:09.0576 3548 BrFiltUp - ok

13:44:09.0584 3548 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys

13:44:09.0586 3548 BridgeMP - ok

13:44:09.0602 3548 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll

13:44:09.0604 3548 Browser - ok

13:44:09.0620 3548 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

13:44:09.0624 3548 Brserid - ok

13:44:09.0632 3548 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

13:44:09.0633 3548 BrSerWdm - ok

13:44:09.0644 3548 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

13:44:09.0645 3548 BrUsbMdm - ok

13:44:09.0649 3548 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

13:44:09.0650 3548 BrUsbSer - ok

13:44:09.0655 3548 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

13:44:09.0657 3548 BTHMODEM - ok

13:44:09.0666 3548 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

13:44:09.0667 3548 bthserv - ok

13:44:09.0689 3548 catchme - ok

13:44:09.0697 3548 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

13:44:09.0698 3548 cdfs - ok

13:44:09.0723 3548 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

13:44:09.0725 3548 cdrom - ok

13:44:09.0734 3548 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll

13:44:09.0735 3548 CertPropSvc - ok

13:44:09.0751 3548 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

13:44:09.0752 3548 circlass - ok

13:44:09.0770 3548 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

13:44:09.0774 3548 CLFS - ok

13:44:09.0829 3548 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:44:09.0831 3548 clr_optimization_v2.0.50727_32 - ok

13:44:09.0873 3548 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

13:44:09.0874 3548 clr_optimization_v2.0.50727_64 - ok

13:44:09.0927 3548 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:44:09.0929 3548 clr_optimization_v4.0.30319_32 - ok

13:44:09.0962 3548 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

13:44:09.0964 3548 clr_optimization_v4.0.30319_64 - ok

13:44:09.0968 3548 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

13:44:09.0969 3548 CmBatt - ok

13:44:09.0975 3548 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys

13:44:09.0976 3548 cmdide - ok

13:44:10.0000 3548 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys

13:44:10.0005 3548 CNG - ok

13:44:10.0016 3548 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

13:44:10.0017 3548 Compbatt - ok

13:44:10.0033 3548 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys

13:44:10.0034 3548 CompositeBus - ok

13:44:10.0052 3548 COMSysApp - ok

13:44:10.0058 3548 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

13:44:10.0059 3548 crcdisk - ok

13:44:10.0092 3548 CryptSvc (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll

13:44:10.0094 3548 CryptSvc - ok

13:44:10.0155 3548 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll

13:44:10.0162 3548 DcomLaunch - ok

13:44:10.0181 3548 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

13:44:10.0185 3548 defragsvc - ok

13:44:10.0221 3548 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys

13:44:10.0222 3548 DfsC - ok

13:44:10.0245 3548 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll

13:44:10.0248 3548 Dhcp - ok

13:44:10.0263 3548 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

13:44:10.0264 3548 discache - ok

13:44:10.0280 3548 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

13:44:10.0281 3548 Disk - ok

13:44:10.0313 3548 Dnscache (676108c4e3aa6f6b34633748bd0bebd9) C:\Windows\System32\dnsrslvr.dll

13:44:10.0322 3548 Dnscache - ok

13:44:10.0372 3548 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll

13:44:10.0376 3548 dot3svc - ok

13:44:10.0407 3548 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll

13:44:10.0408 3548 DPS - ok

13:44:10.0443 3548 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

13:44:10.0444 3548 drmkaud - ok

13:44:10.0492 3548 dtsoftbus01 (400582b09e0bb557d0ec28a945150eeb) C:\Windows\system32\DRIVERS\dtsoftbus01.sys

13:44:10.0495 3548 dtsoftbus01 - ok

13:44:10.0552 3548 dump_wmimmc - ok

13:44:10.0599 3548 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys

13:44:10.0610 3548 DXGKrnl - ok

13:44:10.0631 3548 EagleX64 - ok

13:44:10.0669 3548 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

13:44:10.0670 3548 EapHost - ok

13:44:10.0828 3548 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

13:44:10.0881 3548 ebdrv - ok

13:44:10.0960 3548 EFS (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\System32\lsass.exe

13:44:10.0961 3548 EFS - ok

13:44:11.0004 3548 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe

13:44:11.0012 3548 ehRecvr - ok

13:44:11.0023 3548 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

13:44:11.0025 3548 ehSched - ok

13:44:11.0099 3548 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

13:44:11.0105 3548 elxstor - ok

13:44:11.0113 3548 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys

13:44:11.0114 3548 ErrDev - ok

13:44:11.0207 3548 esgiguard - ok

13:44:11.0245 3548 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

13:44:11.0249 3548 EventSystem - ok

13:44:11.0287 3548 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

13:44:11.0289 3548 exfat - ok

13:44:11.0307 3548 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

13:44:11.0309 3548 fastfat - ok

13:44:11.0341 3548 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe

13:44:11.0348 3548 Fax - ok

13:44:11.0363 3548 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

13:44:11.0364 3548 fdc - ok

13:44:11.0380 3548 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

13:44:11.0381 3548 fdPHost - ok

13:44:11.0394 3548 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

13:44:11.0395 3548 FDResPub - ok

13:44:11.0405 3548 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

13:44:11.0406 3548 FileInfo - ok

13:44:11.0529 3548 FileMonitor (060cc45cecae2feaff9c8c52d8fafaa8) C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys

13:44:11.0530 3548 FileMonitor - ok

13:44:11.0550 3548 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

13:44:11.0551 3548 Filetrace - ok

13:44:11.0559 3548 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

13:44:11.0560 3548 flpydisk - ok

13:44:11.0576 3548 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

13:44:11.0580 3548 FltMgr - ok

13:44:11.0624 3548 FontCache (bc00505cfda789ed3be95d2ff38c4875) C:\Windows\system32\FntCache.dll

13:44:11.0645 3548 FontCache - ok

13:44:11.0699 3548 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

13:44:11.0700 3548 FontCache3.0.0.0 - ok

13:44:11.0745 3548 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

13:44:11.0746 3548 FsDepends - ok

13:44:11.0755 3548 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

13:44:11.0756 3548 Fs_Rec - ok

13:44:11.0792 3548 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys

13:44:11.0795 3548 fvevol - ok

13:44:11.0825 3548 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

13:44:11.0826 3548 gagp30kx - ok

13:44:11.0857 3548 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll

13:44:11.0865 3548 gpsvc - ok

13:44:11.0898 3548 Hardlock (091582da724f54830012e3faaf2f1d1a) C:\Windows\system32\drivers\hardlock.sys

13:44:11.0902 3548 Hardlock - ok

13:44:11.0926 3548 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

13:44:11.0927 3548 hcw85cir - ok

13:44:11.0964 3548 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

13:44:11.0967 3548 HdAudAddService - ok

13:44:11.0982 3548 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys

13:44:11.0984 3548 HDAudBus - ok

13:44:12.0000 3548 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

13:44:12.0002 3548 HidBatt - ok

13:44:12.0030 3548 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

13:44:12.0032 3548 HidBth - ok

13:44:12.0056 3548 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

13:44:12.0058 3548 HidIr - ok

13:44:12.0069 3548 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll

13:44:12.0070 3548 hidserv - ok

13:44:12.0084 3548 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

13:44:12.0085 3548 HidUsb - ok

13:44:12.0102 3548 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll

13:44:12.0104 3548 hkmsvc - ok

13:44:12.0137 3548 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll

13:44:12.0141 3548 HomeGroupListener - ok

13:44:12.0183 3548 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll

13:44:12.0186 3548 HomeGroupProvider - ok

13:44:12.0204 3548 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys

13:44:12.0206 3548 HpSAMD - ok

13:44:12.0258 3548 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

13:44:12.0266 3548 HTTP - ok

13:44:12.0298 3548 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

13:44:12.0299 3548 hwpolicy - ok

13:44:12.0318 3548 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

13:44:12.0320 3548 i8042prt - ok

13:44:12.0347 3548 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys

13:44:12.0352 3548 iaStorV - ok

13:44:12.0431 3548 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

13:44:12.0441 3548 idsvc - ok

13:44:12.0453 3548 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

13:44:12.0455 3548 iirsp - ok

13:44:12.0489 3548 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll

13:44:12.0498 3548 IKEEXT - ok

13:44:12.0632 3548 IMFservice (8ae99ebe30e8338907361018d9030835) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe

13:44:12.0641 3548 IMFservice - ok

13:44:12.0723 3548 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys

13:44:12.0724 3548 intelide - ok

13:44:12.0731 3548 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

13:44:12.0732 3548 intelppm - ok

13:44:12.0744 3548 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

13:44:12.0746 3548 IPBusEnum - ok

13:44:12.0753 3548 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

13:44:12.0754 3548 IpFilterDriver - ok

13:44:12.0795 3548 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll

13:44:12.0801 3548 iphlpsvc - ok

13:44:12.0819 3548 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys

13:44:12.0820 3548 IPMIDRV - ok

13:44:12.0826 3548 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

13:44:12.0828 3548 IPNAT - ok

13:44:12.0844 3548 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

13:44:12.0845 3548 IRENUM - ok

13:44:12.0867 3548 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys

13:44:12.0868 3548 isapnp - ok

13:44:12.0885 3548 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys

13:44:12.0888 3548 iScsiPrt - ok

13:44:12.0901 3548 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

13:44:12.0902 3548 kbdclass - ok

13:44:12.0914 3548 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

13:44:12.0915 3548 kbdhid - ok

13:44:12.0923 3548 KeyIso (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

13:44:12.0924 3548 KeyIso - ok

13:44:12.0935 3548 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys

13:44:12.0937 3548 KSecDD - ok

13:44:12.0948 3548 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys

13:44:12.0951 3548 KSecPkg - ok

13:44:12.0961 3548 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

13:44:12.0962 3548 ksthunk - ok

13:44:12.0991 3548 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

13:44:12.0996 3548 KtmRm - ok

13:44:13.0021 3548 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\System32\srvsvc.dll

13:44:13.0025 3548 LanmanServer - ok

13:44:13.0034 3548 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll

13:44:13.0037 3548 LanmanWorkstation - ok

13:44:13.0045 3548 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

13:44:13.0046 3548 lltdio - ok

13:44:13.0067 3548 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

13:44:13.0071 3548 lltdsvc - ok

13:44:13.0087 3548 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

13:44:13.0087 3548 lmhosts - ok

13:44:13.0158 3548 LMIGuardianSvc (e01fded75312652de448e5aa792afa59) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

13:44:13.0163 3548 LMIGuardianSvc - ok

13:44:13.0193 3548 LMIInfo (0317335b15ff3bda8e10197e3434cfc0) C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys

13:44:13.0194 3548 LMIInfo - ok

13:44:13.0211 3548 LMIMaint (be53cf6e8ffef255988209a35f184f9f) C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe

13:44:13.0214 3548 LMIMaint - ok

13:44:13.0237 3548 lmimirr (413ecdcfad9a82804d3674c8d7eec24e) C:\Windows\system32\DRIVERS\lmimirr.sys

13:44:13.0238 3548 lmimirr - ok

13:44:13.0241 3548 LMIRfsClientNP - ok

13:44:13.0271 3548 LMIRfsDriver (c57d3faa50e6f395759ffb7c709bd944) C:\Windows\system32\drivers\LMIRfsDriver.sys

13:44:13.0273 3548 LMIRfsDriver - ok

13:44:13.0315 3548 LogMeIn (d3760bc17e1755091b7120cf32dbf56b) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

13:44:13.0320 3548 LogMeIn - ok

13:44:13.0334 3548 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

13:44:13.0336 3548 LSI_FC - ok

13:44:13.0342 3548 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

13:44:13.0344 3548 LSI_SAS - ok

13:44:13.0348 3548 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

13:44:13.0349 3548 LSI_SAS2 - ok

13:44:13.0375 3548 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

13:44:13.0377 3548 LSI_SCSI - ok

13:44:13.0399 3548 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

13:44:13.0401 3548 luafv - ok

13:44:13.0431 3548 MBAMProtector (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys

13:44:13.0432 3548 MBAMProtector - ok

13:44:13.0482 3548 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

13:44:13.0489 3548 MBAMService - ok

13:44:13.0504 3548 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll

13:44:13.0506 3548 Mcx2Svc - ok

13:44:13.0511 3548 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

13:44:13.0512 3548 megasas - ok

13:44:13.0538 3548 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

13:44:13.0541 3548 MegaSR - ok

13:44:13.0585 3548 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

13:44:13.0588 3548 Microsoft Office Groove Audit Service - ok

13:44:13.0607 3548 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

13:44:13.0609 3548 MMCSS - ok

13:44:13.0622 3548 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

13:44:13.0623 3548 Modem - ok

13:44:13.0637 3548 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

13:44:13.0638 3548 monitor - ok

13:44:13.0653 3548 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

13:44:13.0655 3548 mouclass - ok

13:44:13.0664 3548 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

13:44:13.0666 3548 mouhid - ok

13:44:13.0679 3548 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

13:44:13.0681 3548 mountmgr - ok

13:44:13.0738 3548 MozillaMaintenance (af9b1aa7cf8e486ff703944e56459ba3) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

13:44:13.0740 3548 MozillaMaintenance - ok

13:44:13.0750 3548 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys

13:44:13.0752 3548 mpio - ok

13:44:13.0768 3548 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

13:44:13.0769 3548 mpsdrv - ok

13:44:13.0845 3548 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll

13:44:13.0855 3548 MpsSvc - ok

13:44:13.0872 3548 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

13:44:13.0874 3548 MRxDAV - ok

13:44:13.0883 3548 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys

13:44:13.0885 3548 mrxsmb - ok

13:44:13.0901 3548 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys

13:44:13.0904 3548 mrxsmb10 - ok

13:44:13.0915 3548 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys

13:44:13.0916 3548 mrxsmb20 - ok

13:44:13.0927 3548 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys

13:44:13.0929 3548 msahci - ok

13:44:13.0939 3548 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys

13:44:13.0941 3548 msdsm - ok

13:44:13.0956 3548 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

13:44:13.0959 3548 MSDTC - ok

13:44:13.0974 3548 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

13:44:13.0975 3548 Msfs - ok

13:44:13.0985 3548 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

13:44:13.0986 3548 mshidkmdf - ok

13:44:13.0994 3548 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys

13:44:13.0995 3548 msisadrv - ok

13:44:14.0012 3548 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

13:44:14.0014 3548 MSiSCSI - ok

13:44:14.0017 3548 msiserver - ok

13:44:14.0028 3548 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

13:44:14.0029 3548 MSKSSRV - ok

13:44:14.0042 3548 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

13:44:14.0042 3548 MSPCLOCK - ok

13:44:14.0057 3548 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

13:44:14.0058 3548 MSPQM - ok

13:44:14.0079 3548 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

13:44:14.0084 3548 MsRPC - ok

13:44:14.0098 3548 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

13:44:14.0100 3548 mssmbios - ok

13:44:14.0108 3548 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

13:44:14.0109 3548 MSTEE - ok

13:44:14.0122 3548 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

13:44:14.0123 3548 MTConfig - ok

13:44:14.0140 3548 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

13:44:14.0141 3548 Mup - ok

13:44:14.0167 3548 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll

13:44:14.0173 3548 napagent - ok

13:44:14.0215 3548 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

13:44:14.0219 3548 NativeWifiP - ok

13:44:14.0270 3548 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

13:44:14.0280 3548 NDIS - ok

13:44:14.0294 3548 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

13:44:14.0295 3548 NdisCap - ok

13:44:14.0336 3548 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

13:44:14.0337 3548 NdisTapi - ok

13:44:14.0367 3548 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

13:44:14.0367 3548 Ndisuio - ok

13:44:14.0401 3548 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

13:44:14.0403 3548 NdisWan - ok

13:44:14.0439 3548 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

13:44:14.0441 3548 NDProxy - ok

13:44:14.0449 3548 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

13:44:14.0450 3548 NetBIOS - ok

13:44:14.0463 3548 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

13:44:14.0466 3548 NetBT - ok

13:44:14.0479 3548 Netlogon (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

13:44:14.0481 3548 Netlogon - ok

13:44:14.0496 3548 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

13:44:14.0501 3548 Netman - ok

13:44:14.0585 3548 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:44:14.0588 3548 NetMsmqActivator - ok

13:44:14.0591 3548 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:44:14.0593 3548 NetPipeActivator - ok

13:44:14.0615 3548 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

13:44:14.0621 3548 netprofm - ok

13:44:14.0698 3548 netr28x (d9a089e17112f04f452d22254b959d87) C:\Windows\system32\DRIVERS\netr28x.sys

13:44:14.0706 3548 netr28x - ok

13:44:14.0720 3548 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:44:14.0721 3548 NetTcpActivator - ok

13:44:14.0724 3548 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

13:44:14.0725 3548 NetTcpPortSharing - ok

13:44:14.0750 3548 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

13:44:14.0751 3548 nfrd960 - ok

13:44:14.0774 3548 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll

13:44:14.0778 3548 NlaSvc - ok

13:44:14.0788 3548 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

13:44:14.0789 3548 Npfs - ok

13:44:14.0792 3548 npggsvc - ok

13:44:14.0798 3548 NPPTNT2 - ok

13:44:14.0822 3548 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

13:44:14.0823 3548 nsi - ok

13:44:14.0831 3548 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

13:44:14.0832 3548 nsiproxy - ok

13:44:14.0880 3548 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys

13:44:14.0906 3548 Ntfs - ok

13:44:14.0984 3548 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

13:44:14.0985 3548 Null - ok

13:44:15.0326 3548 nvlddmkm (ba0b4889c40380a01ecdf84c227a89c9) C:\Windows\system32\DRIVERS\nvlddmkm.sys

13:44:15.0529 3548 nvlddmkm - ok

13:44:15.0570 3548 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys

13:44:15.0572 3548 nvraid - ok

13:44:15.0589 3548 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys

13:44:15.0591 3548 nvstor - ok

13:44:15.0628 3548 nvsvc (06633cf95bea62164c3bfca24bce6b11) C:\Windows\system32\nvvsvc.exe

13:44:15.0637 3548 nvsvc - ok

13:44:15.0715 3548 nvUpdatusService (53b629ce436b110c5689c2f6439e567b) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

13:44:15.0745 3548 nvUpdatusService - ok

13:44:15.0787 3548 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys

13:44:15.0789 3548 nv_agp - ok

13:44:15.0865 3548 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

13:44:15.0871 3548 odserv - ok

13:44:15.0902 3548 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys

13:44:15.0903 3548 ohci1394 - ok

13:44:15.0929 3548 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

13:44:15.0931 3548 ose - ok

13:44:15.0972 3548 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

13:44:15.0977 3548 p2pimsvc - ok

13:44:16.0017 3548 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

13:44:16.0023 3548 p2psvc - ok

13:44:16.0034 3548 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

13:44:16.0036 3548 Parport - ok

13:44:16.0045 3548 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

13:44:16.0047 3548 partmgr - ok

13:44:16.0121 3548 pbfilter (7c0582921913d00180ec2b8518ba135c) C:\Program Files\PeerBlock\pbfilter.sys

13:44:16.0122 3548 pbfilter - ok

13:44:16.0133 3548 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

13:44:16.0136 3548 PcaSvc - ok

13:44:16.0152 3548 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys

13:44:16.0154 3548 pci - ok

13:44:16.0170 3548 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys

13:44:16.0171 3548 pciide - ok

13:44:16.0196 3548 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

13:44:16.0199 3548 pcmcia - ok

13:44:16.0237 3548 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

13:44:16.0238 3548 pcw - ok

13:44:16.0285 3548 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

13:44:16.0292 3548 PEAUTH - ok

13:44:16.0351 3548 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

13:44:16.0352 3548 PerfHost - ok

13:44:16.0420 3548 pfc - ok

13:44:16.0464 3548 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll

13:44:16.0493 3548 pla - ok

13:44:16.0534 3548 PlugPlay (23157d583244400e1d7fbaee2e4b31b7) C:\Windows\system32\umpnpmgr.dll

13:44:16.0540 3548 PlugPlay - ok

13:44:16.0563 3548 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

13:44:16.0565 3548 PNRPAutoReg - ok

13:44:16.0603 3548 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

13:44:16.0606 3548 PNRPsvc - ok

13:44:16.0658 3548 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll

13:44:16.0664 3548 PolicyAgent - ok

13:44:16.0686 3548 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

13:44:16.0690 3548 Power - ok

13:44:16.0701 3548 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

13:44:16.0702 3548 PptpMiniport - ok

13:44:16.0719 3548 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

13:44:16.0720 3548 Processor - ok

13:44:16.0756 3548 ProfSvc (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll

13:44:16.0759 3548 ProfSvc - ok

13:44:16.0798 3548 ProtectedStorage (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

13:44:16.0800 3548 ProtectedStorage - ok

13:44:16.0813 3548 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

13:44:16.0815 3548 Psched - ok

13:44:16.0862 3548 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

13:44:16.0890 3548 ql2300 - ok

13:44:16.0961 3548 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

13:44:16.0963 3548 ql40xx - ok

13:44:16.0990 3548 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

13:44:16.0994 3548 QWAVE - ok

13:44:17.0003 3548 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

13:44:17.0004 3548 QWAVEdrv - ok

13:44:17.0084 3548 RalinkRegistryWriter (2ee6d9cab03900646d1d3d9077167bd6) C:\Program Files (x86)\Edimax\Common\RaRegistry.exe

13:44:17.0086 3548 RalinkRegistryWriter - ok

13:44:17.0123 3548 RalinkRegistryWriter64 (46358c32af09a57a171bc422649be53b) C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe

13:44:17.0125 3548 RalinkRegistryWriter64 - ok

13:44:17.0139 3548 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

13:44:17.0140 3548 RasAcd - ok

13:44:17.0155 3548 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

13:44:17.0156 3548 RasAgileVpn - ok

13:44:17.0173 3548 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

13:44:17.0175 3548 RasAuto - ok

13:44:17.0192 3548 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

13:44:17.0194 3548 Rasl2tp - ok

13:44:17.0212 3548 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll

13:44:17.0217 3548 RasMan - ok

13:44:17.0229 3548 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

13:44:17.0230 3548 RasPppoe - ok

13:44:17.0255 3548 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

13:44:17.0257 3548 RasSstp - ok

13:44:17.0297 3548 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

13:44:17.0301 3548 rdbss - ok

13:44:17.0335 3548 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

13:44:17.0336 3548 rdpbus - ok

13:44:17.0347 3548 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

13:44:17.0347 3548 RDPCDD - ok

13:44:17.0363 3548 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

13:44:17.0364 3548 RDPENCDD - ok

13:44:17.0380 3548 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

13:44:17.0381 3548 RDPREFMP - ok

13:44:17.0393 3548 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys

13:44:17.0396 3548 RDPWD - ok

13:44:17.0413 3548 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys

13:44:17.0416 3548 rdyboost - ok

13:44:17.0524 3548 RegFilter (c3b79061634fbc3ba3379f557ad952c7) C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys

13:44:17.0525 3548 RegFilter - ok

13:44:17.0569 3548 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

13:44:17.0571 3548 RemoteAccess - ok

13:44:17.0592 3548 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

13:44:17.0595 3548 RemoteRegistry - ok

13:44:17.0623 3548 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

13:44:17.0625 3548 RpcEptMapper - ok

13:44:17.0629 3548 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

13:44:17.0630 3548 RpcLocator - ok

13:44:17.0673 3548 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\System32\rpcss.dll

13:44:17.0677 3548 RpcSs - ok

13:44:17.0687 3548 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

13:44:17.0688 3548 rspndr - ok

13:44:17.0713 3548 RTL8167 (baefee35d27a5440d35092ce10267bec) C:\Windows\system32\DRIVERS\Rt64win7.sys

13:44:17.0715 3548 RTL8167 - ok

13:44:17.0725 3548 SamSs (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

13:44:17.0726 3548 SamSs - ok

13:44:17.0742 3548 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys

13:44:17.0744 3548 sbp2port - ok

13:44:17.0775 3548 SBRE (9aceb2a2362fc87a3825963e61ba9076) C:\Windows\system32\drivers\SBREdrv.sys

13:44:17.0776 3548 SBRE - ok

13:44:17.0801 3548 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

13:44:17.0805 3548 SCardSvr - ok

13:44:17.0813 3548 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

13:44:17.0814 3548 scfilter - ok

13:44:17.0853 3548 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll

13:44:17.0865 3548 Schedule - ok

13:44:17.0893 3548 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll

13:44:17.0894 3548 SCPolicySvc - ok

13:44:17.0905 3548 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll

13:44:17.0908 3548 SDRSVC - ok

13:44:17.0930 3548 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

13:44:17.0931 3548 secdrv - ok

13:44:17.0942 3548 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll

13:44:17.0943 3548 seclogon - ok

13:44:17.0955 3548 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll

13:44:17.0957 3548 SENS - ok

13:44:17.0962 3548 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

13:44:17.0964 3548 SensrSvc - ok

13:44:17.0994 3548 Sentinel64 (255476b54c82a89416efdf09fd62f107) C:\Windows\System32\Drivers\Sentinel64.sys

13:44:17.0996 3548 Sentinel64 - ok

13:44:18.0039 3548 SentinelKeysServer (1ba2c677c6146a8b3adea7b69d2eed56) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe

13:44:18.0043 3548 SentinelKeysServer - ok

13:44:18.0092 3548 SentinelProtectionServer (d1a2ba8bf092ddf18f3d3db1d5ac7803) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

13:44:18.0112 3548 SentinelProtectionServer - ok

13:44:18.0128 3548 SentinelSecurityRuntime (e80b91aec007711b1eec9c83487754e2) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe

13:44:18.0131 3548 SentinelSecurityRuntime - ok

13:44:18.0194 3548 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

13:44:18.0195 3548 Serenum - ok

13:44:18.0206 3548 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

13:44:18.0208 3548 Serial - ok

13:44:18.0222 3548 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

13:44:18.0222 3548 sermouse - ok

13:44:18.0303 3548 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll

13:44:18.0312 3548 SessionEnv - ok

13:44:18.0322 3548 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys

13:44:18.0323 3548 sffdisk - ok

13:44:18.0338 3548 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys

13:44:18.0339 3548 sffp_mmc - ok

13:44:18.0355 3548 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys

13:44:18.0356 3548 sffp_sd - ok

13:44:18.0373 3548 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

13:44:18.0374 3548 sfloppy - ok

13:44:18.0433 3548 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

13:44:18.0438 3548 SharedAccess - ok

13:44:18.0460 3548 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll

13:44:18.0464 3548 ShellHWDetection - ok

13:44:18.0479 3548 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

13:44:18.0480 3548 SiSRaid2 - ok

13:44:18.0494 3548 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

13:44:18.0496 3548 SiSRaid4 - ok

13:44:18.0552 3548 SkypeUpdate (c70aebd3608ed9fcea2a1bae83567ffc) C:\Program Files (x86)\Skype\Updater\Updater.exe

13:44:18.0555 3548 SkypeUpdate - ok

13:44:18.0562 3548 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

13:44:18.0563 3548 Smb - ok

13:44:18.0572 3548 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

13:44:18.0574 3548 SNMPTRAP - ok

13:44:18.0633 3548 speedfan (12583af6cbe0050651eaf2723b3ad7b3) C:\Windows\syswow64\speedfan.sys

13:44:18.0635 3548 speedfan - ok

13:44:18.0645 3548 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

13:44:18.0646 3548 spldr - ok

13:44:18.0665 3548 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe

13:44:18.0672 3548 Spooler - ok

13:44:18.0778 3548 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe

13:44:18.0866 3548 sppsvc - ok

13:44:18.0959 3548 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

13:44:18.0961 3548 sppuinotify - ok

13:44:18.0987 3548 srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys

13:44:18.0992 3548 srv - ok

13:44:19.0011 3548 srv2 (4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys

13:44:19.0015 3548 srv2 - ok

13:44:19.0034 3548 srvnet (5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys

13:44:19.0036 3548 srvnet - ok

13:44:19.0072 3548 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

13:44:19.0075 3548 SSDPSRV - ok

13:44:19.0158 3548 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

13:44:19.0160 3548 SstpSvc - ok

13:44:19.0206 3548 Steam Client Service - ok

13:44:19.0276 3548 Stereo Service (c354621b6b94e10ae7f5cdbe745feb86) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

13:44:19.0280 3548 Stereo Service - ok

13:44:19.0296 3548 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

13:44:19.0297 3548 stexstor - ok

13:44:19.0327 3548 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll

13:44:19.0334 3548 stisvc - ok

13:44:19.0348 3548 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

13:44:19.0349 3548 swenum - ok

13:44:19.0398 3548 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

13:44:19.0403 3548 SwitchBoard - ok

13:44:19.0435 3548 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

13:44:19.0441 3548 swprv - ok

13:44:19.0496 3548 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll

13:44:19.0531 3548 SysMain - ok

13:44:19.0595 3548 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll

13:44:19.0598 3548 TabletInputService - ok

13:44:19.0616 3548 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll

13:44:19.0621 3548 TapiSrv - ok

13:44:19.0629 3548 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

13:44:19.0631 3548 TBS - ok

13:44:19.0695 3548 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys

13:44:19.0731 3548 Tcpip - ok

13:44:19.0807 3548 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys

13:44:19.0817 3548 TCPIP6 - ok

13:44:19.0854 3548 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

13:44:19.0856 3548 tcpipreg - ok

13:44:19.0872 3548 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

13:44:19.0873 3548 TDPIPE - ok

13:44:19.0877 3548 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

13:44:19.0878 3548 TDTCP - ok

13:44:19.0888 3548 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

13:44:19.0890 3548 tdx - ok

13:44:19.0899 3548 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys

13:44:19.0900 3548 TermDD - ok

13:44:19.0944 3548 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll

13:44:19.0952 3548 TermService - ok

13:44:19.0978 3548 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

13:44:19.0980 3548 Themes - ok

13:44:20.0006 3548 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

13:44:20.0008 3548 THREADORDER - ok

13:44:20.0018 3548 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

13:44:20.0021 3548 TrkWks - ok

13:44:20.0052 3548 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe

13:44:20.0054 3548 TrustedInstaller - ok

13:44:20.0073 3548 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

13:44:20.0074 3548 tssecsrv - ok

13:44:20.0088 3548 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

13:44:20.0090 3548 tunnel - ok

13:44:20.0096 3548 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

13:44:20.0097 3548 uagp35 - ok

13:44:20.0111 3548 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys

13:44:20.0115 3548 udfs - ok

13:44:20.0136 3548 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

13:44:20.0138 3548 UI0Detect - ok

13:44:20.0151 3548 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys

13:44:20.0152 3548 uliagpkx - ok

13:44:20.0163 3548 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

13:44:20.0164 3548 umbus - ok

13:44:20.0179 3548 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

13:44:20.0180 3548 UmPass - ok

13:44:20.0205 3548 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

13:44:20.0211 3548 upnphost - ok

13:44:20.0369 3548 UrlFilter (401984715693b87fdf4f600fbbebd366) C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys

13:44:20.0369 3548 UrlFilter - ok

13:44:20.0418 3548 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys

13:44:20.0419 3548 usbaudio - ok

13:44:20.0433 3548 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys

13:44:20.0435 3548 usbccgp - ok

13:44:20.0471 3548 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys

13:44:20.0481 3548 usbcir - ok

13:44:20.0522 3548 usbehci (df9f9afc9aaabd8ed47975d44e38169a) C:\Windows\system32\DRIVERS\usbehci.sys

13:44:20.0523 3548 usbehci - ok

13:44:20.0545 3548 usbhub (372a91bc3c6603080a793880b0873785) C:\Windows\system32\DRIVERS\usbhub.sys

13:44:20.0549 3548 usbhub - ok

13:44:20.0564 3548 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys

13:44:20.0565 3548 usbohci - ok

13:44:20.0579 3548 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

13:44:20.0580 3548 usbprint - ok

13:44:20.0590 3548 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS

13:44:20.0592 3548 USBSTOR - ok

13:44:20.0607 3548 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys

13:44:20.0608 3548 usbuhci - ok

13:44:20.0620 3548 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

13:44:20.0622 3548 UxSms - ok

13:44:20.0644 3548 VaultSvc (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe

13:44:20.0645 3548 VaultSvc - ok

13:44:20.0655 3548 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys

13:44:20.0656 3548 vdrvroot - ok

13:44:20.0679 3548 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe

13:44:20.0686 3548 vds - ok

13:44:20.0701 3548 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

13:44:20.0702 3548 vga - ok

13:44:20.0716 3548 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

13:44:20.0717 3548 VgaSave - ok

13:44:20.0733 3548 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys

13:44:20.0735 3548 vhdmp - ok

13:44:20.0739 3548 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys

13:44:20.0740 3548 viaide - ok

13:44:20.0757 3548 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys

13:44:20.0758 3548 volmgr - ok

13:44:20.0778 3548 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

13:44:20.0783 3548 volmgrx - ok

13:44:20.0817 3548 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys

13:44:20.0820 3548 volsnap - ok

13:44:20.0859 3548 vpcbus (abd9b4a7e2d0ae51a3b8df1af3152d61) C:\Windows\system32\DRIVERS\vpchbus.sys

13:44:20.0861 3548 vpcbus - ok

13:44:20.0894 3548 vpcnfltr (8acda395841538ce9713a67fe8b2a3eb) C:\Windows\system32\DRIVERS\vpcnfltr.sys

13:44:20.0896 3548 vpcnfltr - ok

13:44:20.0914 3548 vpcusb (31924e31bc315773e6d149b157db46d5) C:\Windows\system32\DRIVERS\vpcusb.sys

13:44:20.0916 3548 vpcusb - ok

13:44:20.0937 3548 vpcvmm (c5b651e52540e6f46da66574c74b4898) C:\Windows\system32\drivers\vpcvmm.sys

13:44:20.0942 3548 vpcvmm - ok

13:44:20.0953 3548 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

13:44:20.0955 3548 vsmraid - ok

13:44:21.0008 3548 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe

13:44:21.0035 3548 VSS - ok

13:44:21.0104 3548 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

13:44:21.0105 3548 vwifibus - ok

13:44:21.0112 3548 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

13:44:21.0113 3548 vwififlt - ok

13:44:21.0138 3548 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

13:44:21.0143 3548 W32Time - ok

13:44:21.0154 3548 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

13:44:21.0155 3548 WacomPen - ok

13:44:21.0170 3548 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

13:44:21.0172 3548 WANARP - ok

13:44:21.0176 3548 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

13:44:21.0177 3548 Wanarpv6 - ok

13:44:21.0234 3548 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe

13:44:21.0268 3548 wbengine - ok

13:44:21.0323 3548 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

13:44:21.0327 3548 WbioSrvc - ok

13:44:21.0374 3548 wcncsvc (8321c2ca3b62b61b293cda3451984468) C:\Windows\System32\wcncsvc.dll

13:44:21.0379 3548 wcncsvc - ok

13:44:21.0395 3548 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

13:44:21.0398 3548 WcsPlugInService - ok

13:44:21.0405 3548 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

13:44:21.0406 3548 Wd - ok

13:44:21.0433 3548 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

13:44:21.0440 3548 Wdf01000 - ok

13:44:21.0448 3548 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

13:44:21.0451 3548 WdiServiceHost - ok

13:44:21.0454 3548 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

13:44:21.0456 3548 WdiSystemHost - ok

13:44:21.0477 3548 WebClient (8a438cbb8c032a0c798b0c642ffbe572) C:\Windows\System32\webclnt.dll

13:44:21.0480 3548 WebClient - ok

13:44:21.0495 3548 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

13:44:21.0499 3548 Wecsvc - ok

13:44:21.0512 3548 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

13:44:21.0515 3548 wercplsupport - ok

13:44:21.0531 3548 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

13:44:21.0533 3548 WerSvc - ok

13:44:21.0545 3548 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

13:44:21.0546 3548 WfpLwf - ok

13:44:21.0562 3548 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

13:44:21.0563 3548 WIMMount - ok

13:44:21.0609 3548 WinDefend - ok

13:44:21.0619 3548 WinHttpAutoProxySvc - ok

13:44:21.0663 3548 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

13:44:21.0666 3548 Winmgmt - ok

13:44:21.0738 3548 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll

13:44:21.0773 3548 WinRM - ok

13:44:21.0832 3548 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys

13:44:21.0833 3548 WinUsb - ok

13:44:21.0867 3548 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

13:44:21.0877 3548 Wlansvc - ok

13:44:22.0014 3548 wlidsvc (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

13:44:22.0057 3548 wlidsvc - ok

13:44:22.0087 3548 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

13:44:22.0088 3548 WmiAcpi - ok

13:44:22.0115 3548 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

13:44:22.0118 3548 wmiApSrv - ok

13:44:22.0134 3548 WMPNetworkSvc - ok

13:44:22.0150 3548 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

13:44:22.0153 3548 WPCSvc - ok

13:44:22.0179 3548 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll

13:44:22.0181 3548 WPDBusEnum - ok

13:44:22.0221 3548 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

13:44:22.0222 3548 ws2ifsl - ok

13:44:22.0298 3548 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll

13:44:22.0301 3548 wscsvc - ok

13:44:22.0304 3548 WSearch - ok

13:44:22.0388 3548 wuauserv (fb3796754fe00f0bdc87a36f164a5f4d) C:\Windows\system32\wuaueng.dll

13:44:22.0429 3548 wuauserv - ok

13:44:22.0474 3548 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys

13:44:22.0476 3548 WudfPf - ok

13:44:22.0496 3548 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys

13:44:22.0498 3548 WUDFRd - ok

13:44:22.0506 3548 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll

13:44:22.0508 3548 wudfsvc - ok

13:44:22.0522 3548 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

13:44:22.0540 3548 WwanSvc - ok

13:44:22.0570 3548 X6va005 - ok

13:44:22.0639 3548 xnacc (4a5ce13408945e525503b5f73d29b9c5) C:\Windows\system32\DRIVERS\xnacc.sys

13:44:22.0646 3548 xnacc - ok

13:44:22.0665 3548 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

13:44:22.0942 3548 \Device\Harddisk0\DR0 - ok

13:44:22.0945 3548 Boot (0x1200) (0abed56843fdfb3cc0f99d71652a84d4) \Device\Harddisk0\DR0\Partition0

13:44:22.0946 3548 \Device\Harddisk0\DR0\Partition0 - ok

13:44:22.0950 3548 Boot (0x1200) (fd76dc7f68ee49013e4e965302494e22) \Device\Harddisk0\DR0\Partition1

13:44:22.0951 3548 \Device\Harddisk0\DR0\Partition1 - ok

13:44:22.0952 3548 ============================================================

13:44:22.0952 3548 Scan finished

13:44:22.0952 3548 ============================================================

13:44:22.0961 4892 Detected object count: 0

13:44:22.0961 4892 Actual detected object count: 0

Running aswMBR now.

Link to post
Share on other sites

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software

Run date: 2012-07-06 13:47:00

-----------------------------

13:47:00.607 OS Version: Windows x64 6.1.7600

13:47:00.607 Number of processors: 4 586 0x170A

13:47:00.608 ComputerName: WHEELJACK UserName: Kyle

13:47:03.643 Initialize success

13:50:16.057 AVAST engine defs: 12070601

13:50:50.615 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2

13:50:50.618 Disk 0 Vendor: ST32000542AS CC34 Size: 1907729MB BusType: 3

13:50:50.635 Disk 0 MBR read successfully

13:50:50.639 Disk 0 MBR scan

13:50:50.644 Disk 0 Windows 7 default MBR code

13:50:50.653 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

13:50:50.669 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 1907627 MB offset 206848

13:50:50.687 Disk 0 scanning C:\Windows\system32\drivers

13:50:59.240 Service scanning

13:51:14.427 Modules scanning

13:51:14.435 Disk 0 trace - called modules:

13:51:14.457 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys

13:51:14.461 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007db8060]

13:51:14.467 3 CLASSPNP.SYS[fffff88000dd043f] -> nt!IofCallDriver -> [0xfffffa80077db520]

13:51:14.473 5 ACPI.sys[fffff88000f26781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa80077d7680]

13:51:17.346 AVAST engine scan C:\Windows

13:51:24.157 AVAST engine scan C:\Windows\system32

13:54:35.543 AVAST engine scan C:\Windows\system32\drivers

13:54:49.266 AVAST engine scan C:\Users\Kyle

14:30:52.306 AVAST engine scan C:\ProgramData

14:37:04.244 Scan finished successfully

14:47:00.155 Disk 0 MBR has been saved successfully to "C:\Users\Kyle\Desktop\MBR.dat"

14:47:00.161 The log file has been saved successfully to "C:\Users\Kyle\Desktop\aswMBR.txt"

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.