charade539 Posted June 27, 2012 ID:564611 Share Posted June 27, 2012 Malwarebytes keeps popping up with this virus, but when I tell it to remove it, it shows up again anyway. Also, I'm not sure if it is directly related to this virus or if another might be causing the problem, but I am continuously getting redirects and popups on my Firefox browser. It usually takes 5-10 tries of clicking a link to get to the site I wanted in the first place. Per your instructions, the information is below:.DDS (Ver_2011-08-26.01) - NTFSAMD64Internet Explorer: 9.0.8112.16421Run by Kyle at 19:18:59 on 2012-06-26Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8191.6115 [GMT -5:00].SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exeC:\Windows\system32\nvvsvc.exeC:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exeC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\WLANExt.exeC:\Windows\system32\conhost.exeC:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exeC:\Windows\system32\taskhost.exeC:\Windows\Explorer.EXEC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeC:\Program Files (x86)\Bonjour\mDNSResponder.exeC:\Windows\System32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\Edimax\Common\RaUI.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Program Files (x86)\Edimax\Common\RaRegistry.exeC:\Program Files (x86)\Edimax\Common\RaRegistry64.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Windows\system32\SearchIndexer.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exeC:\Windows\System32\svchost.exe -k swprvC:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\SysWOW64\svchost.exe" -k LocalServiceDnsC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253uInternet Settings,ProxyOverride = *.local;<local>uURLSearchHooks: IObit Toolbar: {0bda0769-fd72-49f4-9266-e1fb004f4d8f} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dlluURLSearchHooks: H - No FilemWinlogon: Userinit=userinit.exe,BHO: IObit Toolbar: {0bda0769-fd72-49f4-9266-e1fb004f4d8f} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: Updater For Spam Free Search Bar: {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - C:\Program Files (x86)\blekkotb\auxi\blekkoAu.dllBHO: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dllBHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dllBHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No FileBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No FileTB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dllTB: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dllTB: IObit Toolbar: {0bda0769-fd72-49f4-9266-e1fb004f4d8f} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dllTB: {687578B9-7132-4A7A-80E4-30EE31099E03} - No FileuRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStartmRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun: [<NO NAME>]mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"mRun: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostartStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WIRELE~1.LNK - C:\Program Files (x86)\Edimax\Common\RaUI.exemPolicies-explorer: NoActiveDesktop = 1 (0x1)mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableLUA = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)mPolicies-system: PromptOnSecureDesktop = 0 (0x0)IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLLLSP: mswsock.dllTrusted Zone: clonewarsadventures.comTrusted Zone: freerealms.comTrusted Zone: soe.comTrusted Zone: sony.comDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: DhcpNameServer = 192.168.2.1TCP: Interfaces\{4B151ABF-B89E-41C3-AEC3-A607F2CC3AD9} : DhcpNameServer = 192.168.2.1Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLLSEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dllBHO-X64: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dllBHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: Updater For Spam Free Search Bar: {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - C:\Program Files (x86)\blekkotb\auxi\blekkoAu.dllBHO-X64: Updater For Spam Free Search Bar - No FileBHO-X64: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dllBHO-X64: Spam Free Search Bar - No FileBHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dllBHO-X64: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No FileBHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No FileTB-X64: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dllTB-X64: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - C:\Program Files (x86)\blekkotb\blekkoDx.dllTB-X64: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\5.1\iobitToolbarIE.dllTB-X64: {687578B9-7132-4A7A-80E4-30EE31099E03} - No FilemRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun-x64: [(Default)]mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"mRun-x64: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostartSEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll.================= FIREFOX ===================.FF - ProfilePath - C:\Users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\tq9u0624.default\FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - about:homeFF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dllFF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dllFF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dllFF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dllFF - plugin: C:\Users\Kyle\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dllFF - plugin: C:\Users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\tq9u0624.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll.============= SERVICES / DRIVERS ===============.R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]R1 SBRE;SBRE;\??\C:\Windows\system32\drivers\SBREdrv.sys --> C:\Windows\system32\drivers\SBREdrv.sys [?]R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-3-12 913792]R2 IMFservice;IMF Service;C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-6-22 821592]R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2011-9-16 15928]R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\Windows\system32\drivers\LMIRfsDriver.sys --> C:\Windows\system32\drivers\LMIRfsDriver.sys [?]R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-10 654408]R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-5-22 1262400]R2 RalinkRegistryWriter;Ralink Registry Writer;C:\Program Files (x86)\Edimax\Common\RaRegistry.exe [2012-5-8 185632]R2 RalinkRegistryWriter64;Ralink Registry Writer 64;C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [2012-5-8 212256]R2 Sentinel64;Sentinel64;C:\Windows\system32\Drivers\Sentinel64.sys --> C:\Windows\system32\Drivers\Sentinel64.sys [?]R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-5-15 382272]R3 esgiguard;esgiguard;C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-3-2 13088]R3 FileMonitor;FileMonitor;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2012-6-22 21384]R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]R3 RegFilter;RegFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2012-6-22 33184]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-5 160944]S2 SpyHunter 4 Service;SpyHunter 4 Service;C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [2012-6-2 1019328]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-6-2 250056]S3 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2012-3-4 748440]S3 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-9-26 375176]S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-11 113120]S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]S3 SentinelKeysServer;Sentinel Keys Server;C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2009-9-17 369952]S3 SentinelSecurityRuntime;Sentinel Security Runtime;C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [2009-9-17 292128]S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]S3 UrlFilter;UrlFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\UrlFilter.sys [2012-6-22 21872].=============== Created Last 30 ================.2012-06-26 22:50:53 57976 ----a-r- C:\Windows\System32\drivers\SBREDrv.sys2012-06-26 22:50:46 -------- d-----w- C:\Program Files (x86)\STOPzilla!2012-06-26 22:50:45 -------- d-----w- C:\ProgramData\STOPzilla!2012-06-26 22:50:45 -------- d-----w- C:\Program Files (x86)\Common Files\iS32012-06-26 22:42:56 110080 ----a-r- C:\Users\Kyle\AppData\Roaming\Microsoft\Installer\{18F97AF0-4F88-4494-AFE2-5A5702E142CC}\IconF7A21AF7.exe2012-06-26 22:42:56 110080 ----a-r- C:\Users\Kyle\AppData\Roaming\Microsoft\Installer\{18F97AF0-4F88-4494-AFE2-5A5702E142CC}\IconD7F16134.exe2012-06-26 22:42:56 110080 ----a-r- C:\Users\Kyle\AppData\Roaming\Microsoft\Installer\{18F97AF0-4F88-4494-AFE2-5A5702E142CC}\Icon1226A4C5.exe2012-06-26 22:42:56 -------- d-----w- C:\sh4ldr2012-06-26 22:42:56 -------- d-----w- C:\Program Files\Enigma Software Group2012-06-26 22:42:20 -------- d-----w- C:\Windows\18F97AF04F884494AFE25A5702E142CC.TMP2012-06-23 21:25:31 -------- d-----w- C:\Users\Kyle\AppData\Local\Macromedia2012-06-23 21:03:09 9815752 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe2012-06-23 18:27:49 -------- d-----w- C:\Program Files (x86)\MCSkin3D2012-06-21 05:56:21 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%2012-06-19 18:16:25 9013136 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4D8DADC4-F81E-4476-A9F1-A093EF46F036}\mpengine.dll2012-06-18 03:44:46 14604 ----a-w- C:\Windows\SysWow64\drivers\pfc.sys2012-06-18 03:44:43 344064 ----a-r- C:\Windows\SysWow64\msvcr70.dll2012-06-09 00:40:11 -------- d-----w- C:\Users\Kyle\AppData\Roaming\Braid2012-06-09 00:39:59 3851784 ----a-w- C:\Windows\SysWow64\D3DX9_39.dll2012-06-06 19:18:50 770384 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr100.dll2012-06-06 19:18:50 421200 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp100.dll2012-06-06 19:18:50 136672 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll2012-06-06 02:23:24 4227704 ----a-w- C:\Windows\SysWow64\GameMon.des2012-06-06 02:23:10 5174 ----a-w- C:\Windows\SysWow64\nppt9x.vxd2012-06-06 02:23:10 4682 ----a-w- C:\Windows\SysWow64\npptNT2.sys2012-06-06 02:23:00 -------- d-----w- C:\Program Files\Common Files\INCA Shared2012-06-05 08:15:47 -------- d-----w- C:\Program Files (x86)\BandiMPEG12012-06-05 08:15:46 -------- d-----w- C:\gPotato2012-06-03 21:02:48 -------- d-----w- C:\Python272012-06-03 20:56:13 -------- d-----w- C:\Program Files (x86)\OpenRPG2012-06-02 18:10:13 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe2012-05-30 02:07:21 -------- d-----w- C:\Users\Kyle\AppData\Local\CRE2012-05-30 02:07:20 -------- d-----w- C:\Program Files (x86)\Conduit2012-05-30 02:07:19 -------- d-----w- C:\Users\Kyle\AppData\Local\Conduit.==================== Find3M ====================.2012-06-23 21:03:12 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2012-05-26 17:49:43 955848 ----a-w- C:\Windows\System32\npDeployJava1.dll2012-05-26 17:49:43 839112 ----a-w- C:\Windows\System32\deployJava1.dll2012-05-24 15:47:56 24448 ----a-w- C:\Windows\System32\RegistryDefragBootTime.exe2012-05-15 09:29:47 889664 ----a-w- C:\Windows\System32\nvvsvc.exe2012-05-15 09:29:46 63296 ----a-w- C:\Windows\System32\nvshext.dll2012-05-15 09:29:46 118080 ----a-w- C:\Windows\System32\nvmctray.dll2012-05-15 09:29:25 3149632 ----a-w- C:\Windows\System32\nvsvc64.dll2012-05-15 09:28:42 6151488 ----a-w- C:\Windows\System32\nvcpl.dll2012-05-15 07:21:50 423744 ----a-w- C:\Windows\SysWow64\nvStreaming.exe2012-04-25 16:35:32 23376 ----a-r- C:\Windows\SysWow64\SZIO5.dll2012-04-25 16:35:22 546640 ----a-r- C:\Windows\SysWow64\SZComp5.dll2012-04-25 16:35:16 481104 ----a-r- C:\Windows\SysWow64\SZBase5.dll2012-04-19 22:39:44 29008 ----a-r- C:\Windows\SysWow64\IS3XDat5.dll2012-04-19 22:39:44 231248 ----a-r- C:\Windows\SysWow64\IS3Win325.dll2012-04-19 22:39:42 390992 ----a-r- C:\Windows\SysWow64\IS3UI5.dll2012-04-19 22:39:42 100176 ----a-r- C:\Windows\SysWow64\IS3Svc5.dll2012-04-19 22:39:36 104272 ----a-r- C:\Windows\SysWow64\IS3Inet5.dll2012-04-19 22:39:34 67408 ----a-r- C:\Windows\SysWow64\IS3Hks5.dll2012-04-19 22:39:34 132944 ----a-r- C:\Windows\SysWow64\IS3HTUI5.dll2012-04-19 22:39:32 456528 ----a-r- C:\Windows\SysWow64\IS3DBA5.dll2012-04-19 22:39:30 808784 ----a-r- C:\Windows\SysWow64\IS3Base5.dll2012-04-11 04:31:54 2303488 ----a-w- C:\Windows\SysWow64\python27.dll2012-04-04 20:56:40 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys.============= FINISH: 19:19:23.51 ===============.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-08-26.01).Microsoft Windows 7 Home PremiumBoot Device: \Device\HarddiskVolume1Install Date: 6/2/2011 8:25:26 AMSystem Uptime: 6/26/2012 6:51:51 PM (1 hours ago).Motherboard: MSI | | G41M-P33 (MS-7592)Processor: Intel® Core2 Quad CPU Q8400 @ 2.66GHz | CPU 1 | 2670/333mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 1863 GiB total, 1248.091 GiB free.D: is CDROM (CDFS)E: is CDROM ().==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP243: 6/17/2012 2:11:57 PM - Windows UpdateRP244: 6/17/2012 10:44:29 PM - Installed Adobe Premiere ProRP245: 6/18/2012 3:00:12 AM - Windows UpdateRP246: 6/18/2012 11:42:55 PM - Windows UpdateRP247: 6/19/2012 1:13:15 PM - Windows UpdateRP248: 6/19/2012 1:15:24 PM - Windows UpdateRP249: 6/20/2012 11:57:23 AM - Windows UpdateRP250: 6/21/2012 3:00:13 AM - Windows UpdateRP251: 6/22/2012 3:00:11 AM - Windows UpdateRP252: 6/22/2012 5:27:10 AM - Removed Java 6 Update 31RP253: 6/22/2012 5:36:44 AM - Windows UpdateRP254: 6/23/2012 12:34:53 AM - Windows UpdateRP255: 6/23/2012 1:15:26 PM - Windows UpdateRP256: 6/23/2012 11:24:57 PM - Windows UpdateRP257: 6/24/2012 2:44:31 PM - Windows UpdateRP258: 6/25/2012 3:00:16 AM - Windows UpdateRP259: 6/26/2012 2:00:43 AM - Windows UpdateRP260: 6/26/2012 3:05:09 PM - Windows UpdateRP261: 6/26/2012 5:36:49 PM - Restore OperationRP262: 6/26/2012 5:42:23 PM - Installed SpyHunterRP263: 6/26/2012 5:50:10 PM - Installed STOPzilla. Available with Windows Installer version 1.2 and later.RP264: 6/26/2012 6:16:56 PM - StopZILLA! Restore Point.RP265: 6/26/2012 6:56:01 PM - StopZILLA! Restore Point..==== Installed Programs ======================. Update for Microsoft Office 2007 (KB2508958)Adobe AIRAdobe Community HelpAdobe Flash Player 11 ActiveXAdobe Flash Player 11 PluginAdobe Media PlayerAdobe Photoshop CS5Adobe Premiere ProAdobe Premiere Pro CS6 Functional ContentAdobe Reader X (10.1.3)ADRIFT 5.0Advanced SystemCare 5Aeria IgniteAge of MythologyAnti-phishing Domain AdvisorApple Application SupportApple Software UpdateArmed and DangerousArtisteer 3AVG PC Tuneup 2011Azada In Libro Collectors EditionBandisoft MPEG-1 DecoderBlack & White® 2Black & White® 2 Battle of the GodsBlack and WhiteChampions Online: Free For AllCisco EAP-FAST ModuleCisco LEAP ModuleCisco PEAP ModuleCreatures Albian YearsDAEMON Tools LiteDAEMON Tools ToolbarDocking StationDrawn 2 Dark FlightDream of Mirror OnlineDungeon Siege Legends of ArannaEdimax RT2860 Wireless LAN CardEverQuest IIEverQuest II Extendedeyeon Fusion 5.2Fallout: New VegasFreedom Force vs the 3rd ReichFreelancerGemini Lost .Google ChromeGreen MoonhorseExpressIBM ViaVoice Command and Control Runtime 5.3 - UK EnglishIBM ViaVoice Outloud Runtime - UK EnglishIObit Malware FighterIObit Toolbar v5.1Legend of GrimrockLightWave 10.0 64-bitLogMeInMalwarebytes Anti-Malware version 1.61.0.1400MCSkin3D version 1.4Microsoft Game Studios Common Redistributables Pack 1Microsoft Games for Windows - LIVE RedistributableMicrosoft Games for Windows MarketplaceMicrosoft Office 2007 Service Pack 3 (SP3)Microsoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Enterprise 2007Microsoft Office Excel MUI (English) 2007Microsoft Office Groove MUI (English) 2007Microsoft Office Groove Setup Metadata MUI (English) 2007Microsoft Office InfoPath MUI (English) 2007Microsoft Office OneNote MUI (English) 2007Microsoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Word MUI (English) 2007Microsoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219Microsoft WSE 3.0 RuntimeMicrosoft XML ParserMicrosoft XNA Framework Redistributable 4.0Microsoft Zoo TycoonMicrosoft_VC80_ATL_x86Microsoft_VC80_CRT_x86Microsoft_VC80_MFC_x86Microsoft_VC80_MFCLOC_x86Microsoft_VC90_ATL_x86Microsoft_VC90_CRT_x86Microsoft_VC90_MFC_x86Minecraft Beta CrackedMorrowindMozilla Firefox 14.0 (x86 en-US)Mozilla Maintenance ServiceMSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MSXML 4.0 SP2 Parser and SDKMSXML4 ParserNVIDIA 3D Vision Controller DriverNVIDIA PhysXNVIDIA Stereoscopic 3D DriverOblivionOpenRPG (Remove Only)Otherworld - Spring of Shadows CEPDF Settings CS5Pet WorkshopPetz 4 (remove only)PetzA 2.2.5PidginPortalPortal 2Portal 2 Authoring Tools - BetaPython 2.7.3QuickTimeRequiemRockets and Robots ClipartSci-Fi Clipart SeriesSecurity Update for CAPICOM (KB931906)Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)Security Update for Microsoft .NET Framework 4 Extended (KB2487367)Security Update for Microsoft .NET Framework 4 Extended (KB2656351)Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596785) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596792) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596871) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596880) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2597162) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2597969) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2598041) 32-Bit EditionSecurity Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit EditionSecurity Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit EditionSecurity Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit EditionSecurity Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit EditionSecurity Update for Microsoft Office Word 2007 (KB2596917) 32-Bit EditionSentinel Protection Installer 7.6.1Skype™ 5.9Spam Free Search BarSpeedFan (remove only)Spiral KnightsSPORE™SPORE™ Creepy & Cute Parts PackStar Wars®: Knights of the Old Republic StarTopiaSteamSTOPzillaTES Construction SetThe Elder Scrolls V: SkyrimTotal Video Converter 3.71 100812Ubisoft Game LauncherUpdate for 2007 Microsoft Office System (KB967642)Update for Microsoft .NET Framework 4 Client Profile (KB2468871)Update for Microsoft .NET Framework 4 Client Profile (KB2533523)Update for Microsoft .NET Framework 4 Client Profile (KB2600217)Update for Microsoft .NET Framework 4 Extended (KB2468871)Update for Microsoft .NET Framework 4 Extended (KB2533523)Update for Microsoft .NET Framework 4 Extended (KB2600217)Update for Microsoft Office 2007 Help for Common Features (KB963673)Update for Microsoft Office Access 2007 Help (KB963663)Update for Microsoft Office Excel 2007 Help (KB963678)Update for Microsoft Office Infopath 2007 Help (KB963662)Update for Microsoft Office OneNote 2007 Help (KB963670)Update for Microsoft Office Outlook 2007 Help (KB963677)Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687267) 32-Bit EditionUpdate for Microsoft Office Powerpoint 2007 Help (KB963669)Update for Microsoft Office Publisher 2007 Help (KB963667)Update for Microsoft Office Script Editor Help (KB963671)Update for Microsoft Office Word 2007 Help (KB963665)WinampWinamp Detector Plug-inWinArchiverWorld of Warcraft.==== Event Viewer Messages From Past Week ========.6/26/2012 6:54:38 PM, Error: Service Control Manager [7000] - The UrlFilter service failed to start due to the following error: There are no more endpoints available from the endpoint mapper.6/26/2012 6:53:18 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.6/26/2012 6:53:18 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.6/26/2012 6:53:18 PM, Error: Service Control Manager [7000] - The Hardlock service failed to start due to the following error: Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.6/26/2012 6:52:48 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.6/26/2012 6:52:07 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\drivers\pfc.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.6/26/2012 6:13:40 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.6/25/2012 4:52:48 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.6/25/2012 4:45:44 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.6/23/2012 1:12:40 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.6/22/2012 4:38:07 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}6/22/2012 4:38:06 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}6/22/2012 4:38:05 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}6/22/2012 4:37:57 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}6/22/2012 4:37:47 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vpcnfltr vpcvmm vwififlt Wanarpv6 WfpLwf6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.6/22/2012 4:37:46 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.6/19/2012 6:01:23 PM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10..==== End Of File =========================== Link to post Share on other sites More sharing options...
Staff gringo_pr Posted June 27, 2012 Staff ID:564670 Share Posted June 27, 2012 Greetings and Welcome to The Forums!!My name is Gringo and I'll be glad to help you with your computer problems.I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of usPlease do not run any tools unless instructed to do so.We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.[*]Please do not attach logs or use code boxes, just copy and paste the text.Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.[*]Please read every post completely before doing anything.Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.[*]Please provide feedback about your experience as we go.A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.Security CheckDownload Security Check by screen317 from here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links.Link 1Link 2Link 31. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Double click on combofix.exe & follow the prompts.When finished, it will produce a report for you.Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stallNote 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer"information and logs"In your next post I need the followingLog from Combofixlet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
charade539 Posted June 27, 2012 Author ID:564685 Share Posted June 27, 2012 Hello Gringo, nice to meet you. Here's the Security Check report: Results of screen317's Security Check version 0.99.42 Windows 7 x64 (UAC is disabled!) Out of date service pack!! Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! WMI entry may not exist for antivirus; attempting automatic update.`````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.61.0.1400 AVG PC Tuneup 2011 Adobe Reader X (10.1.3) Mozilla Firefox (14.0) Google Chrome 19.0.1084.52 Google Chrome 19.0.1084.56 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe IObit IObit Malware Fighter IMFsrv.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log``````````````````````I will run combofix as soon as I post this so I can close the browser. Link to post Share on other sites More sharing options...
charade539 Posted June 27, 2012 Author ID:564687 Share Posted June 27, 2012 This is what happened when I ran Combofix. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted June 27, 2012 Staff ID:564737 Share Posted June 27, 2012 Hellodownload Farbar Recovery Scan Tool x64 and save it to a flash drive.Plug the flashdrive into the infected PC.Enter System Recovery Options. To enter System Recovery Options from the Advanced Boot Options:Restart the computer.As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.Use the arrow keys to select the Repair your computer menu item.Select US as the keyboard language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account an click Next.To enter System Recovery Options by using Windows installation disc:Insert the installation disc.Restart your computer.If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.Click Repair your computer.Select US as the keyboard language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account and click Next.On the System Recovery Options menu you will get the following options:Startup RepairSystem RestoreWindows Complete PC RestoreWindows Memory Diagnostic ToolCommand Prompt[*]Select Command Prompt[*]In the command window type in notepad and press Enter.[*]The notepad opens. Under File menu select Open.[*]Select "Computer" and find your flash drive letter and close the notepad.[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter Note: Replace letter e with the drive letter of your flash drive.[*]The tool will start to run.[*]When the tool opens click Yes to disclaimer.[*]Press Scan button.[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.Gringo Link to post Share on other sites More sharing options...
charade539 Posted June 27, 2012 Author ID:564871 Share Posted June 27, 2012 I downloaded the file, put it on a thumb drive, and followed your instructions, but the option to "Repair your computer" did not appear. I removed all other files from the flash drive and tried again, but it still did not show up. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted June 27, 2012 Staff ID:564874 Share Posted June 27, 2012 Greetingsgo here to see how to make a repair disk - http://windows.microsoft.com/en-us/windows7/Create-a-system-repair-disc Link to post Share on other sites More sharing options...
charade539 Posted June 27, 2012 Author ID:564884 Share Posted June 27, 2012 I attempted to follow your instructions and am now stuck on a boot loop. It continously returns the the 'start windows normally/safe mode/etc' screen. No matter what I choose it just restarts. Link to post Share on other sites More sharing options...
charade539 Posted June 27, 2012 Author ID:564886 Share Posted June 27, 2012 Also, I need to add that there was no option to choose my account, it automatically ran a diagnostic and rebooted, and then this began. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted June 27, 2012 Staff ID:564896 Share Posted June 27, 2012 have you removed the CDgringo Link to post Share on other sites More sharing options...
charade539 Posted June 27, 2012 Author ID:564921 Share Posted June 27, 2012 Yes, we removed the CD. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted June 28, 2012 Staff ID:564942 Share Posted June 28, 2012 have you tried the last known config that worked?gringo Link to post Share on other sites More sharing options...
charade539 Posted June 28, 2012 Author ID:565218 Share Posted June 28, 2012 I did, and I am now able to get back into Windows. Will retry your instructions. Link to post Share on other sites More sharing options...
charade539 Posted June 29, 2012 Author ID:565416 Share Posted June 29, 2012 Here you go.Scan result of Farbar Recovery Scan Tool Version: 25-06-2012Ran by SYSTEM at 29-06-2012 14:17:28Running from F:\Windows 7 Home Premium (X64) OS Language: English(US)The current controlset is ControlSet001========================== Registry (Whitelisted) =============HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462408 2012-04-04] (Malwarebytes Corporation)HKLM-x32\...\Run: [] [x]HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)HKLM-x32\...\Run: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart [4464472 2012-05-09] (IObit)HKU\Kyle\...\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart [288128 2012-05-28] (IObit)Tcpip\Parameters: [DhcpNameServer] 192.168.2.1Startup: C:\Users\All Users\Start Menu\Programs\Startup\Wireless Utility.lnkShortcutTarget: Wireless Utility.lnk -> C:\Program Files (x86)\Edimax\Common\RaUI.exe (Edimax Technology Co.)==================== Services (Whitelisted) ======2 AdvancedSystemCareService5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [913792 2012-05-26] (IObit)3 Application Updater; "C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe" [748440 2012-03-04] (Spigot, Inc.)2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)3 LMIGuardianSvc; "C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe" [375176 2011-09-26] (LogMeIn, Inc.)4 LMIMaint; "C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe" [147336 2011-09-26] (LogMeIn, Inc.)4 LogMeIn; "C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe" [407424 2011-09-16] (LogMeIn, Inc.)2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [654408 2012-04-04] (Malwarebytes Corporation)2 RalinkRegistryWriter; C:\Program Files (x86)\Edimax\Common\RaRegistry.exe [185632 2009-10-06] (Ralink Technology, Corp.)2 RalinkRegistryWriter64; C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [212256 2009-10-06] (Ralink Technology, Corp.)3 SentinelKeysServer; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe" [369952 2009-09-16] (SafeNet, Inc.)3 SentinelProtectionServer; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe" [1246496 2009-09-17] (SafeNet, Inc)3 SentinelSecurityRuntime; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe" [292128 2009-09-16] (SafeNet, Inc.)2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1019328 2012-06-02] (Enigma Software Group USA, LLC.)2 szserver; "C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe" [67408 2012-04-25] (iS3, Inc.)========================== Drivers (Whitelisted) =============1 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [279616 2011-12-27] (DT Soft Ltd)3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()3 FileMonitor; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [21384 2012-01-05] (IObit)0 is3srv; C:\Windows\SysWow64\drivers\is3srv64.sys [74768 2011-09-26] (iS3 Inc.)2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [15928 2011-09-16] (LogMeIn, Inc.)3 lmimirr; C:\Windows\System32\Drivers\lmimirr.sys [11552 2011-09-16] (LogMeIn, Inc.)2 LMIRfsDriver; C:\Windows\System32\Drivers\LMIRfsDriver.sys [72216 2011-09-16] (LogMeIn, Inc.)3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24904 2012-04-04] (Malwarebytes Corporation)3 pfc; C:\Windows\SysWow64\Drivers\pfc.sys [14604 2003-08-11] (Padus, Inc.)3 RegFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [33184 2012-04-28] (IObit.com)1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [57976 2012-01-12] (GFI Software)2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)0 speedfan; C:\Windows\SysWow64\speedfan.sys [29592 2011-03-18] (Almico Software)0 szkg5; C:\Windows\SysWow64\DRIVERS\szkg64.sys [74768 2011-09-26] (iS3 Inc.)3 UrlFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [21872 2012-04-28] (IObit.com)3 dump_wmimmc; \??\C:\gPotato\IrisOnline\GameGuard\dump_wmimmc.sys [x]4 LMIRfsClientNP; [x]3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]3 X6va005; \??\C:\Users\Kyle\AppData\Local\Temp\005510C.tmp [x]========================== NetSvcs (Whitelisted) ======================= One Month Created Files and Folders ==============2012-06-28 10:37 - 2012-06-28 10:37 - 00000240 ____A C:\Windows\System32\Drivers\kgpcpy.cfg2012-06-27 01:24 - 2012-06-27 01:24 - 00020299 ____A C:\Users\Kyle\Desktop\Combofix Error.PNG2012-06-27 01:21 - 2012-06-27 16:22 - 00000000 ___SD C:\32788R22FWJFW2012-06-27 01:21 - 2012-06-27 16:22 - 00000000 ____D C:\Windows\erdnt2012-06-27 01:21 - 2012-06-27 01:21 - 00000000 ____D C:\Qoobox2012-06-27 01:17 - 2012-06-27 01:17 - 04569121 ___RA (Swearware) C:\Users\Kyle\Downloads\ComboFix.exe2012-06-27 01:15 - 2012-06-27 01:15 - 00000184 ____A C:\Windows\SysWOW64\Drivers\kgpfr2.cfg2012-06-27 01:14 - 2012-06-27 01:14 - 00881475 ____A C:\Users\Kyle\Downloads\SecurityCheck.exe2012-06-26 16:34 - 2012-06-27 16:21 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\.minecraft2012-06-26 16:33 - 2012-06-26 16:35 - 00000000 ____D C:\Users\Kyle\Desktop\New folder2012-06-26 16:07 - 2012-06-26 16:07 - 00607260 ____R (Swearware) C:\Users\Kyle\Downloads\dds.com2012-06-26 14:50 - 2012-06-28 22:59 - 00000000 ____D C:\Users\All Users\STOPzilla!2012-06-26 14:50 - 2012-06-27 16:22 - 00000000 ____D C:\Program Files (x86)\STOPzilla!2012-06-26 14:50 - 2012-01-12 06:28 - 00057976 ___RA (GFI Software) C:\Windows\System32\Drivers\SBREDrv.sys2012-06-26 14:48 - 2012-06-26 14:48 - 00509440 ____A (iS3, Inc.) C:\Users\Kyle\Downloads\SZSetupAV.exe2012-06-26 14:42 - 2012-06-27 16:22 - 00000000 ____D C:\Windows\18F97AF04F884494AFE25A5702E142CC.TMP2012-06-26 14:42 - 2012-06-27 16:21 - 00000000 ____D C:\Program Files\Enigma Software Group2012-06-26 14:42 - 2012-06-26 14:43 - 00000000 ____D C:\sh4ldr2012-06-26 14:42 - 2012-06-26 14:42 - 00002256 ____A C:\Users\Kyle\Desktop\SpyHunter.lnk2012-06-26 14:40 - 2012-06-26 14:41 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer(1).exe2012-06-26 14:40 - 2012-06-26 14:40 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer.exe2012-06-25 14:33 - 2012-06-25 14:33 - 00000000 ____D C:\Users\Kyle\Downloads\attachments2012-06-25 14:05 - 2012-06-25 14:06 - 04402056 ____A C:\Users\Kyle\Downloads\attachments.zip2012-06-23 13:53 - 2012-06-23 13:53 - 65994752 ____A C:\Windows\System32\config\SOFTWARE.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 18915328 ____A C:\Windows\System32\config\SYSTEM.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 00167936 ____A C:\Windows\System32\config\DEFAULT.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 00057344 ____A C:\Windows\System32\config\SAM.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 00028672 ____A C:\Windows\System32\config\SECURITY.iobit2012-06-23 13:25 - 2012-06-23 13:25 - 00000000 ____D C:\Users\Kyle\AppData\Local\Macromedia2012-06-23 13:03 - 2012-06-23 13:03 - 09815752 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2012-06-23 10:27 - 2012-06-28 11:15 - 00000000 ____D C:\Program Files (x86)\MCSkin3D2012-06-23 10:27 - 2012-06-23 10:27 - 01965549 ____A (Altered Softworks ) C:\Users\Kyle\Downloads\mcskin3d_1_4_0_235.exe2012-06-23 10:27 - 2012-06-23 10:27 - 00001011 ____A C:\Users\Public\Desktop\MCSkin3D.lnk2012-06-22 17:46 - 2012-06-25 13:39 - 00001070 ____A C:\Windows\PFRO.log2012-06-22 13:23 - 2012-06-22 13:23 - 00001177 ____A C:\Users\Public\Desktop\IObit Malware Fighter.lnk2012-06-22 13:20 - 2012-06-22 13:21 - 19551736 ____A (IObit ) C:\Users\Kyle\Downloads\imf-setup.exe2012-06-22 12:35 - 2012-06-29 11:03 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job2012-06-22 11:50 - 2012-06-28 10:33 - 00000672 ____A C:\Windows\setupact.log2012-06-22 11:50 - 2012-06-22 11:50 - 00000000 ____A C:\Windows\setuperr.log2012-06-22 02:18 - 2012-06-22 02:19 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.exe2012-06-22 02:16 - 2012-06-22 02:16 - 00000618 ____A C:\Users\Kyle\Documents\cc_20120622_051608.reg2012-06-22 00:55 - 2012-06-22 17:42 - 00000361 ____A C:\rkill.log2012-06-22 00:54 - 2012-06-22 00:54 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.com2012-06-22 00:39 - 2012-06-22 00:39 - 00045664 ____A C:\Users\Kyle\Desktop\GMer.log2012-06-22 00:00 - 2012-06-22 00:00 - 00302592 ____A C:\Users\Kyle\Downloads\odp539no.exe2012-06-21 19:23 - 2012-06-27 16:22 - 00000000 ____D C:\Users\Kyle\Downloads\tdsskiller2012-06-21 19:23 - 2012-06-21 19:23 - 02109806 ____A C:\Users\Kyle\Downloads\tdsskiller.zip2012-06-20 22:03 - 2012-06-20 22:03 - 00278561 ____A C:\Users\Kyle\Downloads\Minecraft.exe2012-06-20 22:02 - 2012-06-20 22:02 - 01589718 ____A C:\Users\Kyle\Downloads\Minecraft_Server.exe2012-06-20 21:56 - 2012-06-27 16:21 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%2012-06-20 21:44 - 2012-06-20 21:45 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft_key_code_generator2012-06-20 21:35 - 2012-06-20 21:35 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft Gift Code Generator v1.9.12012-06-20 09:04 - 2012-06-22 02:01 - 00001584 ____A C:\Users\Kyle\Desktop\F-list.lnk2012-06-20 09:02 - 2012-06-27 16:21 - 00000000 ____D C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta2012-06-19 11:54 - 2012-06-19 11:54 - 00951853 ____A C:\Users\Kyle\Downloads\RK_00262_HD25.mp42012-06-19 11:49 - 2012-06-19 11:49 - 00001822 ____A C:\Users\Kyle\Downloads\backfill.mov2012-06-19 11:49 - 2012-06-19 11:49 - 00001817 ____A C:\Users\Kyle\Downloads\welding.mov2012-06-19 11:48 - 2012-06-19 11:48 - 00997888 ____A C:\Users\Kyle\Downloads\sparks.avi2012-06-18 16:29 - 2012-06-27 16:22 - 00000000 ____D C:\Users\Kyle\Downloads\The Secret World of Arrietty 2012 DVDRip XViD-sC0rp2012-06-18 12:25 - 2012-06-18 12:25 - 00001196 ____A C:\Users\Kyle\Desktop\FileZilla.lnk2012-06-17 19:44 - 2003-08-11 07:13 - 00344064 ___RA (Microsoft Corporation) C:\Windows\SysWOW64\msvcr70.dll2012-06-17 19:44 - 2003-08-11 07:07 - 00014604 ____A (Padus, Inc.) C:\Windows\SysWOW64\Drivers\pfc.sys2012-06-17 18:57 - 2012-06-17 18:58 - 00000000 ____D C:\Users\Kyle\Downloads\PremierePro_6_Content_LS72012-06-17 18:45 - 2012-06-17 18:56 - 768928646 ____A C:\Users\Kyle\Downloads\PremierePro_6_Content_LS7.7z2012-06-17 18:29 - 2012-06-17 18:29 - 00000000 ____D C:\Users\Kyle\Downloads\Encore Working2012-06-16 22:25 - 2012-06-17 12:38 - 00000000 ____D C:\Users\Kyle\Desktop\Flea Market2012-06-14 18:21 - 2012-06-14 18:21 - 02446584 ____A (pepsoft.org) C:\Users\Kyle\Documents\worldpainter_64_0.8.9.exe2012-06-13 15:08 - 2012-06-13 15:10 - 09813457 ____A C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta.zip2012-06-13 12:05 - 2012-06-23 12:32 - 00002119 ____A C:\Users\Public\Desktop\Legend of Grimrock.lnk2012-06-13 12:05 - 2012-06-13 12:07 - 00000000 ____D C:\Users\Kyle\Downloads\The Legend of Korra2012-06-13 12:05 - 2012-06-13 12:05 - 00000000 ____D C:\Users\Kyle\Documents\Almost Human2012-06-11 23:31 - 2012-06-11 23:31 - 00036210 ____A C:\Users\Kyle\Documents\Loki_009.htm2012-06-11 08:58 - 2012-06-11 08:58 - 00024032 ____A C:\Users\Kyle\Documents\cc_20120611_115807.reg2012-06-10 23:07 - 2012-06-10 23:07 - 00107753 ____A C:\Users\Kyle\Documents\Loki_008.htm2012-06-10 18:46 - 2012-06-10 18:46 - 00323997 ____A C:\Users\Kyle\Downloads\Remaster Patch.zip2012-06-10 18:46 - 2012-06-10 18:46 - 00000000 ____D C:\Users\Kyle\Downloads\Remaster Patch2012-06-08 22:01 - 2012-06-08 22:01 - 00070272 ____A C:\Users\Kyle\Documents\Loki_007.htm2012-06-08 17:37 - 2012-06-08 17:37 - 00000000 ____D C:\Users\Kyle\Downloads\StarForge_V0.12012-06-08 17:30 - 2012-06-08 17:36 - 315470531 ____A C:\Users\Kyle\Downloads\StarForge_V0.1.zip2012-06-08 16:40 - 2012-06-08 16:42 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Braid2012-06-08 16:39 - 2008-07-12 05:18 - 03851784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll2012-06-07 21:19 - 2012-06-07 21:58 - 00017140 ____A C:\Users\Kyle\Documents\Loki_006.htm2012-06-07 20:45 - 2012-06-07 20:51 - 00000028 ____A C:\Windows\encore_launcher.ini2012-06-07 18:55 - 2012-06-07 18:55 - 00000000 ____D C:\Users\Kyle\Downloads\grendel_cage2012-06-07 14:14 - 2012-06-07 14:14 - 01114119 ____A C:\Users\Kyle\Downloads\Creatures_Update_2.exe2012-06-07 14:09 - 2012-06-07 14:09 - 00002395 ____A C:\Users\Kyle\Downloads\tomato_soup.zip2012-06-07 14:06 - 2012-06-07 14:06 - 00014335 ____A C:\Users\Kyle\Downloads\peartree.zip2012-06-07 14:04 - 2012-06-07 14:04 - 00023323 ____A C:\Users\Kyle\Downloads\grapevine.zip2012-06-07 14:04 - 2012-06-07 14:04 - 00013553 ____A C:\Users\Kyle\Downloads\grendel_cage.zip2012-06-07 14:03 - 2012-06-07 14:03 - 00049380 ____A C:\Users\Kyle\Downloads\de_theme.zip2012-06-07 12:53 - 2012-06-07 12:53 - 00000000 ____D C:\Users\Kyle\Downloads\c_albian_years_manuals2012-06-07 12:24 - 2012-06-10 18:57 - 00002340 ____A C:\Users\Public\Desktop\Creatures 2.lnk2012-06-07 12:24 - 2012-06-10 18:57 - 00002331 ____A C:\Users\Public\Desktop\Creatures 1.lnk2012-06-07 12:23 - 2012-06-07 12:24 - 00000000 ____D C:\Users\Kyle\Documents\Creatures2012-06-07 12:16 - 2012-06-07 12:19 - 116171848 ____A (GOG.com ) C:\Users\Kyle\Downloads\setup_creatures_albian_years.exe2012-06-07 12:16 - 2012-06-07 12:16 - 01207334 ____A C:\Users\Kyle\Downloads\c_albian_years_manuals.zip2012-06-07 00:33 - 2012-06-07 00:34 - 00025288 ____A C:\Users\Kyle\Documents\LokiThor3some_001.htm2012-06-06 18:15 - 2012-06-14 12:20 - 00000000 ____D C:\Users\Kyle\Documents\Island Stuff2012-06-06 11:06 - 2012-06-06 11:06 - 17151152 ____A (Mozilla) C:\Users\Kyle\Downloads\Firefox Setup 13.0b7.exe2012-06-06 01:41 - 2012-06-06 01:41 - 00094869 ____A C:\Users\Kyle\Documents\Loki_005.htm2012-06-05 19:47 - 2012-06-05 19:49 - 31733248 ____A C:\Users\Kyle\Downloads\dockingstation_195.exe2012-06-05 18:23 - 2012-06-05 18:23 - 00000000 ____D C:\Program Files\Common Files\INCA Shared2012-06-05 18:23 - 2011-11-08 13:00 - 04227704 ____A (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des2012-06-05 18:23 - 2005-01-03 16:43 - 00004682 ____A (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\npptNT2.sys2012-06-05 18:23 - 2003-07-20 01:17 - 00005174 ____A C:\Windows\SysWOW64\nppt9x.vxd2012-06-05 00:52 - 2012-06-05 00:52 - 00077900 ____A C:\Users\Kyle\Documents\Loki_004.htm2012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\Program Files (x86)\BandiMPEG12012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\gPotato2012-06-04 23:46 - 2012-06-05 00:15 - 1764105178 ____A (Acresso Software Inc. ) C:\Users\Kyle\Downloads\Iris_US_v1.20.31086.exe2012-06-04 23:45 - 2012-06-04 23:45 - 00773400 ____A C:\Users\Kyle\Downloads\IRIS_US_Downloader.exe2012-06-03 13:02 - 2012-06-03 13:03 - 00000000 ____D C:\Python272012-06-03 13:00 - 2012-06-03 13:02 - 15867904 ____A C:\Users\Kyle\Downloads\python-2.7.3.msi2012-06-03 12:56 - 2012-06-03 13:03 - 00000000 ____D C:\Program Files (x86)\OpenRPG2012-06-03 12:55 - 2012-06-03 12:56 - 00829561 ____A C:\Users\Kyle\Downloads\openrpg-1.7.1.exe2012-06-03 00:38 - 2012-06-03 00:38 - 00105831 ____A C:\Users\Kyle\Documents\Loki_003.htm2012-06-02 10:36 - 2012-06-03 20:50 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who2012-06-02 10:28 - 2012-06-02 10:30 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who 2005 Season 1-52012-06-02 10:10 - 2012-06-23 13:03 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2012-05-31 17:56 - 2012-05-31 18:05 - 00000000 ____D C:\Users\Kyle\Documents\Recipes2012-05-31 10:33 - 2012-05-31 10:34 - 27070144 ____A (IObit ) C:\Users\Kyle\Downloads\asc-setup.exe2012-05-31 00:34 - 2012-05-31 00:34 - 00047292 ____A C:\Users\Kyle\Documents\Loki_002.htm============ 3 Months Modified Files and Folders =============2012-06-29 14:17 - 2012-06-29 14:17 - 00000000 ____D C:\FRST2012-06-29 11:10 - 2011-12-20 10:46 - 01872412 ____A C:\Windows\WindowsUpdate.log2012-06-29 11:10 - 2011-10-02 19:40 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000Core.job2012-06-29 11:09 - 2011-06-04 13:24 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\.purple2012-06-29 11:03 - 2012-06-22 12:35 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job2012-06-29 11:03 - 2011-10-02 19:40 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000UA.job2012-06-28 23:55 - 2011-06-26 16:01 - 00000132 ____A C:\Users\Kyle\AppData\Roaming\Adobe PNG Format CS5 Prefs2012-06-28 22:59 - 2012-06-26 14:50 - 00000000 ____D C:\Users\All Users\STOPzilla!2012-06-28 16:02 - 2011-06-04 13:20 - 00000000 ____D C:\Program Files (x86)\Steam2012-06-28 11:27 - 2011-06-04 13:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox2012-06-28 11:15 - 2012-06-23 10:27 - 00000000 ____D C:\Program Files (x86)\MCSkin3D2012-06-28 10:43 - 2009-07-13 20:45 - 00019312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02012-06-28 10:43 - 2009-07-13 20:45 - 00019312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02012-06-28 10:37 - 2012-06-28 10:37 - 00000240 ____A C:\Windows\System32\Drivers\kgpcpy.cfg2012-06-28 10:33 - 2012-06-22 11:50 - 00000672 ____A C:\Windows\setupact.log2012-06-28 10:33 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT2012-06-28 10:32 - 2011-06-02 06:22 - 00000000 ____D C:\Users\All Users\NVIDIA2012-06-27 16:22 - 2012-06-27 01:21 - 00000000 ___SD C:\32788R22FWJFW2012-06-27 16:22 - 2012-06-27 01:21 - 00000000 ____D C:\Windows\erdnt2012-06-27 16:22 - 2012-06-26 14:50 - 00000000 ____D C:\Program Files (x86)\STOPzilla!2012-06-27 16:22 - 2012-06-26 14:42 - 00000000 ____D C:\Windows\18F97AF04F884494AFE25A5702E142CC.TMP2012-06-27 16:22 - 2012-06-21 19:23 - 00000000 ____D C:\Users\Kyle\Downloads\tdsskiller2012-06-27 16:22 - 2012-06-18 16:29 - 00000000 ____D C:\Users\Kyle\Downloads\The Secret World of Arrietty 2012 DVDRip XViD-sC0rp2012-06-27 16:22 - 2012-05-11 11:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service2012-06-27 16:22 - 2012-03-12 17:57 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\IObit2012-06-27 16:22 - 2011-11-15 19:21 - 00000000 ____D C:\Windows\System32\Macromed2012-06-27 16:22 - 2011-06-02 06:13 - 00000000 ____D C:\Windows\SysWOW64\Macromed2012-06-27 16:22 - 2011-06-02 05:25 - 00000000 ____D C:\users\Kyle2012-06-27 16:22 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV2012-06-27 16:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF2012-06-27 16:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration2012-06-27 16:22 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\AppCompat2012-06-27 16:21 - 2012-06-26 16:34 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\.minecraft2012-06-27 16:21 - 2012-06-26 14:42 - 00000000 ____D C:\Program Files\Enigma Software Group2012-06-27 16:21 - 2012-06-20 21:56 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%2012-06-27 16:21 - 2012-06-20 09:02 - 00000000 ____D C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta2012-06-27 16:21 - 2011-08-26 20:31 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Skype2012-06-27 16:21 - 2011-06-19 11:45 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Winamp2012-06-27 16:21 - 2011-06-02 10:20 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Malwarebytes2012-06-27 16:20 - 2012-03-12 17:57 - 00000000 ____D C:\Program Files (x86)\IObit2012-06-27 15:34 - 2012-05-29 18:07 - 00000000 ____D C:\Users\Kyle\AppData\Local\Conduit2012-06-27 01:24 - 2012-06-27 01:24 - 00020299 ____A C:\Users\Kyle\Desktop\Combofix Error.PNG2012-06-27 01:21 - 2012-06-27 01:21 - 00000000 ____D C:\Qoobox2012-06-27 01:17 - 2012-06-27 01:17 - 04569121 ___RA (Swearware) C:\Users\Kyle\Downloads\ComboFix.exe2012-06-27 01:15 - 2012-06-27 01:15 - 00000184 ____A C:\Windows\SysWOW64\Drivers\kgpfr2.cfg2012-06-27 01:14 - 2012-06-27 01:14 - 00881475 ____A C:\Users\Kyle\Downloads\SecurityCheck.exe2012-06-26 16:35 - 2012-06-26 16:33 - 00000000 ____D C:\Users\Kyle\Desktop\New folder2012-06-26 16:22 - 2012-05-26 09:48 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin2012-06-26 16:07 - 2012-06-26 16:07 - 00607260 ____R (Swearware) C:\Users\Kyle\Downloads\dds.com2012-06-26 14:52 - 2012-03-11 10:57 - 00000000 ____D C:\Users\Kyle\Desktop\Stories2012-06-26 14:48 - 2012-06-26 14:48 - 00509440 ____A (iS3, Inc.) C:\Users\Kyle\Downloads\SZSetupAV.exe2012-06-26 14:43 - 2012-06-26 14:42 - 00000000 ____D C:\sh4ldr2012-06-26 14:42 - 2012-06-26 14:42 - 00002256 ____A C:\Users\Kyle\Desktop\SpyHunter.lnk2012-06-26 14:41 - 2012-06-26 14:40 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer(1).exe2012-06-26 14:40 - 2012-06-26 14:40 - 00725440 ____A (Enigma Software Group USA, LLC.) C:\Users\Kyle\Downloads\SpyHunter-Installer.exe2012-06-26 13:33 - 2012-05-11 11:56 - 00000000 ____D C:\Users\Kyle\Desktop\TGWTG2012-06-25 14:33 - 2012-06-25 14:33 - 00000000 ____D C:\Users\Kyle\Downloads\attachments2012-06-25 14:06 - 2012-06-25 14:05 - 04402056 ____A C:\Users\Kyle\Downloads\attachments.zip2012-06-25 13:55 - 2009-07-13 21:13 - 00006346 ____A C:\Windows\System32\PerfStringBackup.INI2012-06-25 13:39 - 2012-06-22 17:46 - 00001070 ____A C:\Windows\PFRO.log2012-06-23 13:53 - 2012-06-23 13:53 - 65994752 ____A C:\Windows\System32\config\SOFTWARE.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 18915328 ____A C:\Windows\System32\config\SYSTEM.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 00167936 ____A C:\Windows\System32\config\DEFAULT.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 00057344 ____A C:\Windows\System32\config\SAM.iobit2012-06-23 13:53 - 2012-06-23 13:53 - 00028672 ____A C:\Windows\System32\config\SECURITY.iobit2012-06-23 13:25 - 2012-06-23 13:25 - 00000000 ____D C:\Users\Kyle\AppData\Local\Macromedia2012-06-23 13:03 - 2012-06-23 13:03 - 09815752 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2012-06-23 13:03 - 2012-06-02 10:10 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2012-06-23 13:03 - 2011-06-02 06:13 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2012-06-23 12:32 - 2012-06-13 12:05 - 00002119 ____A C:\Users\Public\Desktop\Legend of Grimrock.lnk2012-06-23 10:27 - 2012-06-23 10:27 - 01965549 ____A (Altered Softworks ) C:\Users\Kyle\Downloads\mcskin3d_1_4_0_235.exe2012-06-23 10:27 - 2012-06-23 10:27 - 00001011 ____A C:\Users\Public\Desktop\MCSkin3D.lnk2012-06-22 17:42 - 2012-06-22 00:55 - 00000361 ____A C:\rkill.log2012-06-22 13:23 - 2012-06-22 13:23 - 00001177 ____A C:\Users\Public\Desktop\IObit Malware Fighter.lnk2012-06-22 13:21 - 2012-06-22 13:20 - 19551736 ____A (IObit ) C:\Users\Kyle\Downloads\imf-setup.exe2012-06-22 11:50 - 2012-06-22 11:50 - 00000000 ____A C:\Windows\setuperr.log2012-06-22 02:19 - 2012-06-22 02:18 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.exe2012-06-22 02:16 - 2012-06-22 02:16 - 00000618 ____A C:\Users\Kyle\Documents\cc_20120622_051608.reg2012-06-22 02:01 - 2012-06-20 09:04 - 00001584 ____A C:\Users\Kyle\Desktop\F-list.lnk2012-06-22 00:54 - 2012-06-22 00:54 - 01012656 ____A C:\Users\Kyle\Downloads\rkill.com2012-06-22 00:39 - 2012-06-22 00:39 - 00045664 ____A C:\Users\Kyle\Desktop\GMer.log2012-06-22 00:00 - 2012-06-22 00:00 - 00302592 ____A C:\Users\Kyle\Downloads\odp539no.exe2012-06-21 19:23 - 2012-06-21 19:23 - 02109806 ____A C:\Users\Kyle\Downloads\tdsskiller.zip2012-06-21 11:33 - 2011-12-09 23:31 - 00000000 ____D C:\Users\Kyle\Documents\Morrowind Mods2012-06-20 22:26 - 2012-03-03 13:37 - 00000693 ____A C:\Users\Kyle\Desktop\Minecraft.lnk2012-06-20 22:03 - 2012-06-20 22:03 - 00278561 ____A C:\Users\Kyle\Downloads\Minecraft.exe2012-06-20 22:02 - 2012-06-20 22:02 - 01589718 ____A C:\Users\Kyle\Downloads\Minecraft_Server.exe2012-06-20 21:45 - 2012-06-20 21:44 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft_key_code_generator2012-06-20 21:35 - 2012-06-20 21:35 - 00000000 ____D C:\Users\Kyle\Downloads\Minecraft Gift Code Generator v1.9.12012-06-19 11:54 - 2012-06-19 11:54 - 00951853 ____A C:\Users\Kyle\Downloads\RK_00262_HD25.mp42012-06-19 11:49 - 2012-06-19 11:49 - 00001822 ____A C:\Users\Kyle\Downloads\backfill.mov2012-06-19 11:49 - 2012-06-19 11:49 - 00001817 ____A C:\Users\Kyle\Downloads\welding.mov2012-06-19 11:48 - 2012-06-19 11:48 - 00997888 ____A C:\Users\Kyle\Downloads\sparks.avi2012-06-18 12:25 - 2012-06-18 12:25 - 00001196 ____A C:\Users\Kyle\Desktop\FileZilla.lnk2012-06-17 19:44 - 2011-08-07 13:44 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information2012-06-17 19:44 - 2011-06-02 06:14 - 00000000 ____D C:\Program Files (x86)\Adobe2012-06-17 18:59 - 2011-06-26 15:07 - 00000000 ____D C:\Program Files\Adobe2012-06-17 18:59 - 2011-06-26 15:06 - 00000000 ____D C:\Program Files\Common Files\Adobe2012-06-17 18:58 - 2012-06-17 18:57 - 00000000 ____D C:\Users\Kyle\Downloads\PremierePro_6_Content_LS72012-06-17 18:58 - 2011-06-02 06:14 - 00000000 ____D C:\Users\Kyle\AppData\Local\Adobe2012-06-17 18:56 - 2012-06-17 18:45 - 768928646 ____A C:\Users\Kyle\Downloads\PremierePro_6_Content_LS7.7z2012-06-17 18:29 - 2012-06-17 18:29 - 00000000 ____D C:\Users\Kyle\Downloads\Encore Working2012-06-17 12:38 - 2012-06-16 22:25 - 00000000 ____D C:\Users\Kyle\Desktop\Flea Market2012-06-17 11:58 - 2011-08-26 20:31 - 00000000 ____D C:\Users\All Users\Skype2012-06-14 19:43 - 2012-05-26 09:50 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\WorldPainter2012-06-14 18:46 - 2012-05-26 09:50 - 00000000 ____D C:\Program Files\WorldPainter2012-06-14 18:21 - 2012-06-14 18:21 - 02446584 ____A (pepsoft.org) C:\Users\Kyle\Documents\worldpainter_64_0.8.9.exe2012-06-14 12:20 - 2012-06-06 18:15 - 00000000 ____D C:\Users\Kyle\Documents\Island Stuff2012-06-13 15:10 - 2012-06-13 15:08 - 09813457 ____A C:\Users\Kyle\Downloads\F-list Messenger 0-8-3 beta.zip2012-06-13 15:01 - 2012-05-11 11:56 - 00001107 ____A C:\Users\Kyle\Desktop\Modeler.lnk2012-06-13 15:01 - 2012-05-11 11:56 - 00001100 ____A C:\Users\Kyle\Desktop\Layout.lnk2012-06-13 14:26 - 2011-11-27 11:40 - 00000000 ____D C:\Program Files (x86)\SpeedFan2012-06-13 12:07 - 2012-06-13 12:05 - 00000000 ____D C:\Users\Kyle\Downloads\The Legend of Korra2012-06-13 12:05 - 2012-06-13 12:05 - 00000000 ____D C:\Users\Kyle\Documents\Almost Human2012-06-13 12:04 - 2012-01-30 17:47 - 00000000 ____D C:\Program Files (x86)\GOG.com2012-06-13 00:09 - 2011-06-02 11:33 - 00000000 ____D C:\Users\All Users\Microsoft Help2012-06-13 00:04 - 2012-03-12 18:45 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe2012-06-11 23:31 - 2012-06-11 23:31 - 00036210 ____A C:\Users\Kyle\Documents\Loki_009.htm2012-06-11 19:04 - 2011-10-02 19:43 - 00002358 ____A C:\Users\Kyle\Desktop\Google Chrome.lnk2012-06-11 08:58 - 2012-06-11 08:58 - 00024032 ____A C:\Users\Kyle\Documents\cc_20120611_115807.reg2012-06-11 08:55 - 2011-07-22 17:14 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\DAEMON Tools Lite2012-06-10 23:07 - 2012-06-10 23:07 - 00107753 ____A C:\Users\Kyle\Documents\Loki_008.htm2012-06-10 18:57 - 2012-06-07 12:24 - 00002340 ____A C:\Users\Public\Desktop\Creatures 2.lnk2012-06-10 18:57 - 2012-06-07 12:24 - 00002331 ____A C:\Users\Public\Desktop\Creatures 1.lnk2012-06-10 18:46 - 2012-06-10 18:46 - 00323997 ____A C:\Users\Kyle\Downloads\Remaster Patch.zip2012-06-10 18:46 - 2012-06-10 18:46 - 00000000 ____D C:\Users\Kyle\Downloads\Remaster Patch2012-06-08 22:01 - 2012-06-08 22:01 - 00070272 ____A C:\Users\Kyle\Documents\Loki_007.htm2012-06-08 17:37 - 2012-06-08 17:37 - 00000000 ____D C:\Users\Kyle\Downloads\StarForge_V0.12012-06-08 17:36 - 2012-06-08 17:30 - 315470531 ____A C:\Users\Kyle\Downloads\StarForge_V0.1.zip2012-06-08 16:42 - 2012-06-08 16:40 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Braid2012-06-07 21:58 - 2012-06-07 21:19 - 00017140 ____A C:\Users\Kyle\Documents\Loki_006.htm2012-06-07 20:51 - 2012-06-07 20:45 - 00000028 ____A C:\Windows\encore_launcher.ini2012-06-07 18:55 - 2012-06-07 18:55 - 00000000 ____D C:\Users\Kyle\Downloads\grendel_cage2012-06-07 14:14 - 2012-06-07 14:14 - 01114119 ____A C:\Users\Kyle\Downloads\Creatures_Update_2.exe2012-06-07 14:09 - 2012-06-07 14:09 - 00002395 ____A C:\Users\Kyle\Downloads\tomato_soup.zip2012-06-07 14:06 - 2012-06-07 14:06 - 00014335 ____A C:\Users\Kyle\Downloads\peartree.zip2012-06-07 14:04 - 2012-06-07 14:04 - 00023323 ____A C:\Users\Kyle\Downloads\grapevine.zip2012-06-07 14:04 - 2012-06-07 14:04 - 00013553 ____A C:\Users\Kyle\Downloads\grendel_cage.zip2012-06-07 14:03 - 2012-06-07 14:03 - 00049380 ____A C:\Users\Kyle\Downloads\de_theme.zip2012-06-07 12:53 - 2012-06-07 12:53 - 00000000 ____D C:\Users\Kyle\Downloads\c_albian_years_manuals2012-06-07 12:24 - 2012-06-07 12:23 - 00000000 ____D C:\Users\Kyle\Documents\Creatures2012-06-07 12:19 - 2012-06-07 12:16 - 116171848 ____A (GOG.com ) C:\Users\Kyle\Downloads\setup_creatures_albian_years.exe2012-06-07 12:16 - 2012-06-07 12:16 - 01207334 ____A C:\Users\Kyle\Downloads\c_albian_years_manuals.zip2012-06-07 00:34 - 2012-06-07 00:33 - 00025288 ____A C:\Users\Kyle\Documents\LokiThor3some_001.htm2012-06-06 18:32 - 2011-08-30 18:31 - 00000000 ____D C:\Users\Kyle\Desktop\Lizzie's Couch2012-06-06 11:18 - 2011-06-04 13:18 - 00001053 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk2012-06-06 11:06 - 2012-06-06 11:06 - 17151152 ____A (Mozilla) C:\Users\Kyle\Downloads\Firefox Setup 13.0b7.exe2012-06-06 01:41 - 2012-06-06 01:41 - 00094869 ____A C:\Users\Kyle\Documents\Loki_005.htm2012-06-05 19:54 - 2012-03-13 15:51 - 00000000 ____D C:\Program Files (x86)\Docking Station2012-06-05 19:49 - 2012-06-05 19:47 - 31733248 ____A C:\Users\Kyle\Downloads\dockingstation_195.exe2012-06-05 18:23 - 2012-06-05 18:23 - 00000000 ____D C:\Program Files\Common Files\INCA Shared2012-06-05 01:32 - 2011-07-18 18:54 - 00000000 ____D C:\Program Files\PeerBlock2012-06-05 00:52 - 2012-06-05 00:52 - 00077900 ____A C:\Users\Kyle\Documents\Loki_004.htm2012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\Program Files (x86)\BandiMPEG12012-06-05 00:15 - 2012-06-05 00:15 - 00000000 ____D C:\gPotato2012-06-05 00:15 - 2012-06-04 23:46 - 1764105178 ____A (Acresso Software Inc. ) C:\Users\Kyle\Downloads\Iris_US_v1.20.31086.exe2012-06-04 23:45 - 2012-06-04 23:45 - 00773400 ____A C:\Users\Kyle\Downloads\IRIS_US_Downloader.exe2012-06-03 20:50 - 2012-06-02 10:36 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who2012-06-03 13:03 - 2012-06-03 13:02 - 00000000 ____D C:\Python272012-06-03 13:03 - 2012-06-03 12:56 - 00000000 ____D C:\Program Files (x86)\OpenRPG2012-06-03 13:02 - 2012-06-03 13:00 - 15867904 ____A C:\Users\Kyle\Downloads\python-2.7.3.msi2012-06-03 12:56 - 2012-06-03 12:55 - 00829561 ____A C:\Users\Kyle\Downloads\openrpg-1.7.1.exe2012-06-03 00:38 - 2012-06-03 00:38 - 00105831 ____A C:\Users\Kyle\Documents\Loki_003.htm2012-06-02 10:30 - 2012-06-02 10:28 - 00000000 ____D C:\Users\Kyle\Downloads\Doctor Who 2005 Season 1-52012-06-01 17:22 - 2012-05-22 16:59 - 00000000 ____D C:\Users\Kyle\Downloads\Hentai2012-05-31 18:05 - 2012-05-31 17:56 - 00000000 ____D C:\Users\Kyle\Documents\Recipes2012-05-31 13:28 - 2011-06-30 19:02 - 00000000 ____D C:\LiberKey2012-05-31 10:34 - 2012-05-31 10:33 - 27070144 ____A (IObit ) C:\Users\Kyle\Downloads\asc-setup.exe2012-05-31 10:34 - 2012-03-12 17:57 - 00001276 ____A C:\Users\Public\Desktop\Uninstaller.lnk2012-05-31 10:34 - 2012-03-12 17:57 - 00001225 ____A C:\Users\Public\Desktop\Advanced SystemCare 5.lnk2012-05-31 00:34 - 2012-05-31 00:34 - 00047292 ____A C:\Users\Kyle\Documents\Loki_002.htm2012-05-29 18:13 - 2012-05-29 18:10 - 00000000 ____D C:\Users\Kyle\Downloads\Captain America The First Avenger (2011) DVDRip XviD-MAXSPEED2012-05-29 18:07 - 2012-05-29 18:07 - 00000000 ____D C:\Users\Kyle\AppData\Local\CRE2012-05-29 18:07 - 2012-05-29 18:07 - 00000000 ____D C:\Program Files (x86)\Conduit2012-05-28 22:27 - 2012-05-28 22:27 - 00810743 ____A C:\Users\Kyle\Downloads\BTWMod3-64.zip2012-05-28 19:03 - 2012-05-28 19:03 - 00001911 ____A C:\Users\Kyle\Desktop\WorldPainter.lnk2012-05-28 18:57 - 2012-05-28 18:56 - 06766449 ____A (Sytexis Software ) C:\Users\Kyle\Downloads\playclaw3.1969.exe2012-05-28 17:16 - 2012-05-28 17:16 - 00999771 ____A C:\Users\Kyle\Downloads\SinglePlayerCommands-MC1.2.5_V3.2.2.jar2012-05-28 14:50 - 2012-05-28 14:50 - 00000029 ____A C:\Windows\Index.ini2012-05-28 14:45 - 2012-05-28 14:45 - 00189894 ____A C:\Users\Kyle\Documents\cc_20120528_174523.reg2012-05-26 16:58 - 2012-05-26 16:29 - 00000000 ____D C:\Users\Kyle\Downloads\Legend.of.Grimrock-RELOADED2012-05-26 16:58 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\system2012-05-26 16:31 - 2012-05-26 16:27 - 00000000 ____D C:\Users\Kyle\Downloads\Creatures Trilogy2012-05-26 14:54 - 2012-05-26 14:52 - 00000000 ___HD C:\Windows\msdownld.tmp2012-05-26 14:53 - 2012-05-26 14:53 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\Hi-Rez Studios2012-05-26 14:52 - 2012-05-26 14:52 - 00000000 ____D C:\Windows\SysWOW64\directx2012-05-26 14:52 - 2012-05-26 14:52 - 00000000 ____D C:\Windows\B83FC356B7C0441F8A4DD71E088E7974.TMP2012-05-26 14:52 - 2012-05-26 14:52 - 00000000 ____D C:\Users\Kyle\AppData\Local\Aeria Games2012-05-26 14:51 - 2012-05-26 14:51 - 00000000 ____D C:\Users\All Users\Aeria Games2012-05-26 11:34 - 2012-05-26 11:34 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA2012-05-26 10:38 - 2012-05-26 10:38 - 00000000 ____D C:\Users\Kyle\Documents\WorldPainterSaves2012-05-26 10:05 - 2012-05-26 10:04 - 00000000 ____D C:\Users\Kyle\.minecraft2012-05-26 09:51 - 2012-05-26 09:51 - 00001615 ____A C:\Users\Kyle\Desktop\Dream of Mirror Online.lnk2012-05-26 09:49 - 2012-05-26 09:50 - 00955848 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll2012-05-26 09:49 - 2012-05-26 09:50 - 00839112 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll2012-05-26 09:49 - 2012-05-26 09:50 - 00268744 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe2012-05-26 09:49 - 2012-05-26 09:49 - 00189384 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe2012-05-26 09:49 - 2012-05-26 09:49 - 00188872 ____A (Oracle Corporation) C:\Windows\System32\java.exe2012-05-26 09:49 - 2012-05-26 09:49 - 00000000 ____D C:\Program Files\Java2012-05-26 09:48 - 2012-05-26 08:36 - 00000000 ____D C:\AeriaGames2012-05-26 08:28 - 2012-01-28 22:48 - 00000000 ____D C:\Program Files (x86)\horse6.62012-05-26 08:27 - 2011-08-28 21:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft2012-05-26 08:26 - 2011-07-23 12:19 - 00000000 ____D C:\Program Files (x86)\Microsoft Games2012-05-25 13:51 - 2012-05-22 00:01 - 00003211 ____A C:\Users\Kyle\Documents\Lokisms.txt2012-05-24 07:47 - 2012-03-13 04:02 - 00024448 ____A (IObit) C:\Windows\System32\RegistryDefragBootTime.exe2012-05-23 19:36 - 2012-05-23 19:16 - 732221440 ____A C:\Users\Kyle\Downloads\Ralph Bakshi's Wizards.avi2012-05-23 12:29 - 2012-05-23 12:29 - 00000000 ____D C:\Users\Kyle\Downloads\Adobe Premier Pro 2 Keygen & Activation2012-05-22 12:36 - 2011-09-24 15:11 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\NVIDIA2012-05-22 12:20 - 2011-08-08 18:13 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation2012-05-22 12:20 - 2011-06-02 06:21 - 00000000 ____D C:\Program Files\NVIDIA Corporation2012-05-21 17:24 - 2012-05-21 17:24 - 00000258 ____A C:\Users\Kyle\Documents\cc_20120521_202457.reg2012-05-21 14:05 - 2012-05-21 14:05 - 00002467 ____A C:\Users\Kyle\Documents\Spelling Song Lyrics.txt2012-05-21 00:02 - 2012-05-21 00:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight2012-05-21 00:02 - 2012-05-21 00:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight2012-05-19 02:52 - 2012-05-19 02:52 - 00072954 ____A C:\Users\Kyle\Documents\NoisyBoy_002.htm2012-05-18 16:20 - 2011-12-21 22:21 - 00001920 ____A C:\Users\Kyle\Documents\Ad.txt2012-05-18 07:55 - 2012-05-18 07:55 - 00069905 ____A C:\Users\Kyle\Documents\NoisyBoy_001.htm2012-05-17 16:31 - 2012-05-17 16:28 - 00000000 ____D C:\Users\Kyle\Downloads\Thor (2011) DVDRip XviD-MAXSPEED2012-05-17 00:35 - 2012-05-17 00:35 - 00043817 ____A C:\Users\Kyle\Documents\IronMan_001.htm2012-05-15 02:48 - 2012-05-22 12:19 - 25743168 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv64.dll2012-05-15 02:48 - 2012-05-22 12:19 - 25248064 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll2012-05-15 02:48 - 2012-05-22 12:19 - 19607872 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll2012-05-15 02:48 - 2012-05-22 12:19 - 18044224 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dumx.dll2012-05-15 02:48 - 2012-05-22 12:19 - 17551680 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll2012-05-15 02:48 - 2012-05-22 12:19 - 15322432 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll2012-05-15 02:48 - 2012-05-22 12:19 - 14298944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys2012-05-15 02:48 - 2012-05-22 12:19 - 10194752 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2umx.dll2012-05-15 02:48 - 2012-05-22 12:19 - 08139072 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll2012-05-15 02:48 - 2012-05-22 12:19 - 05982528 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll2012-05-15 02:48 - 2012-05-22 12:19 - 02881856 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll2012-05-15 02:48 - 2012-05-22 12:19 - 02681664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll2012-05-15 02:48 - 2012-05-22 12:19 - 02524992 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll2012-05-15 02:48 - 2012-05-22 12:19 - 02445120 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll2012-05-15 02:48 - 2012-05-22 12:19 - 01738048 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco64.dll2012-05-15 02:48 - 2012-05-22 12:19 - 01468224 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco64.dll2012-05-15 02:48 - 2011-06-02 06:21 - 02741568 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi64.dll2012-05-15 02:48 - 2011-06-02 06:21 - 02368832 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll2012-05-15 02:48 - 2011-06-02 06:21 - 00068928 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll2012-05-15 02:48 - 2011-06-02 06:21 - 00061248 ____A (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll2012-05-15 02:48 - 2011-06-02 06:21 - 00014324 ____A C:\Windows\System32\nvinfo.pb2012-05-15 02:48 - 2009-07-13 13:59 - 08105280 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll2012-05-15 01:29 - 2011-06-02 06:22 - 03149632 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc64.dll2012-05-15 01:29 - 2011-06-02 06:22 - 00889664 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe2012-05-15 01:29 - 2011-06-02 06:22 - 00118080 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll2012-05-15 01:29 - 2011-06-02 06:22 - 00063296 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll2012-05-15 01:28 - 2011-06-02 06:22 - 06151488 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll2012-05-14 23:56 - 2012-05-14 23:56 - 00030278 ____A C:\Users\Kyle\Documents\Loki_001.htm2012-05-14 23:21 - 2012-05-14 23:21 - 00423744 ____A C:\Windows\SysWOW64\nvStreaming.exe2012-05-11 11:55 - 2012-05-11 11:55 - 00002231 ____A C:\Users\Kyle\Desktop\Fusion 5.2.lnk2012-05-11 11:54 - 2012-05-11 11:54 - 00000000 ____D C:\Program Files (x86)\eyeon2012-05-11 11:54 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Setup2012-05-11 11:49 - 2012-05-11 11:49 - 00000000 ____D C:\Users\Kyle\Downloads\eyeon fusion 5.22012-05-11 11:46 - 2012-05-11 11:42 - 52374122 ____A C:\Users\Kyle\Downloads\eyeon fusion 5.2.rar2012-05-11 11:34 - 2012-05-11 11:34 - 00000000 ____D C:\Users\All Users\Mozilla2012-05-10 00:26 - 2011-06-02 10:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware2012-05-09 21:51 - 2012-02-15 05:08 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2012-05-09 15:49 - 2011-12-25 09:16 - 00000000 ____D C:\Users\Kyle\AppData\Local\Skyrim2012-05-09 13:45 - 2011-11-27 16:58 - 00000000 ___RD C:\Users\Kyle\Virtual Machines2012-05-09 13:39 - 2012-03-09 17:40 - 00002120 ____A C:\Users\Kyle\Desktop\VisualBoyAdvance - Shortcut.lnk2012-05-09 13:39 - 2011-08-07 14:17 - 00001869 ____A C:\Users\Kyle\Desktop\Star Wars Knights of the Old Republic.lnk2012-05-09 13:39 - 2011-07-18 18:54 - 00001780 ____A C:\Users\Kyle\Desktop\PeerBlock.lnk2012-05-09 13:39 - 2011-06-19 18:17 - 00002058 ____A C:\Users\Public\Desktop\Media Player Classic - Home Cinema x64.lnk2012-05-08 18:23 - 2012-05-08 18:18 - 00000000 ____D C:\Users\All Users\Ralink2012-05-08 17:56 - 2012-05-08 17:56 - 00000000 ____D C:\Program Files (x86)\Edimax2012-05-08 17:56 - 2012-05-08 16:35 - 00000000 ____D C:\Users\All Users\Edimax Driver2012-05-08 17:56 - 2009-07-13 18:34 - 00000512 ____A C:\Windows\win.ini2012-05-08 16:40 - 2012-05-08 16:40 - 00000000 ____D C:\Program Files (x86)\Cisco2012-05-08 16:35 - 2012-05-08 16:35 - 00000000 ____D C:\Users\Kyle\AppData\Roaming\InstallShield2012-05-08 16:35 - 2012-05-08 16:35 - 00000000 ____D C:\Users\All Users\InstallShield2012-04-28 19:27 - 2012-04-13 15:46 - 00000000 ____D C:\Windows\Minidump2012-04-28 19:13 - 2012-04-28 19:13 - 00000000 ____D C:\Program Files (x86)\LucasArts2012-04-25 08:35 - 2012-04-25 08:35 - 00546640 ___RA (iS3, Inc.) C:\Windows\SysWOW64\SZComp5.dll2012-04-25 08:35 - 2012-04-25 08:35 - 00481104 ___RA (iS3, Inc.) C:\Windows\SysWOW64\SZBase5.dll2012-04-25 08:35 - 2012-04-25 08:35 - 00023376 ___RA (iS3, Inc.) C:\Windows\SysWOW64\SZIO5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00808784 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Base5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00456528 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3DBA5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00390992 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3UI5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00231248 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Win325.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00132944 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3HTUI5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00104272 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Inet5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00100176 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Svc5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00067408 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3Hks5.dll2012-04-19 14:39 - 2012-04-19 14:39 - 00029008 ___RA (iS3, Inc.) C:\Windows\SysWOW64\IS3XDat5.dll2012-04-18 14:56 - 2011-08-27 15:55 - 00000000 ____D C:\Users\Kyle\Desktop\Lightwave2012-04-10 20:31 - 2012-04-10 20:31 - 02303488 ____A (Python Software Foundation) C:\Windows\SysWOW64\python27.dll2012-04-05 20:46 - 2012-04-05 20:46 - 00000000 ____D C:\Users\Kyle\AppData\Local\Freelancer2012-04-05 20:46 - 2011-06-04 14:26 - 00000000 ____D C:\Users\Kyle\Documents\My Games2012-04-05 20:42 - 2012-04-05 20:42 - 00002231 ____A C:\Users\Public\Desktop\Freelancer.lnk2012-04-04 12:56 - 2011-06-02 10:20 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys2012-04-04 00:10 - 2012-04-03 16:58 - 00000000 ____D C:\Users\All Users\FarmFrenzy_Rome2012-04-03 16:58 - 2012-04-03 16:58 - 00000000 ____D C:\Users\Public\Documents\AlawarWrapper2012-04-03 16:58 - 2012-04-03 16:58 - 00000000 ____D C:\Users\All Users\AlawarWrapper2012-04-03 16:57 - 2012-04-03 16:57 - 00000000 ____D C:\Windows\Farm Frenzy Ancient RomeZeroAccess:C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\LC:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\UC:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\00000004.@C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\201d3ddeC:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000004.@C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000008.@C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\000000cb.@C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000000.@C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000032.@C:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000064.@ZeroAccess:C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\@C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\LC:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\nC:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U========================= Known DLLs (Whitelisted) ===================================== Bamital & volsnap Check ============C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.C:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legit==================== EXE ASSOCIATION =====================HKLM\...\.exe: exefile => OKHKLM\...\exefile\DefaultIcon: %1 => OKHKLM\...\exefile\open\command: "%1" %* => OK========================= Memory info ======================Percentage of memory in use: 9%Total physical RAM: 8191.24 MBAvailable physical RAM: 7392.3 MBTotal Pagefile: 8189.39 MBAvailable Pagefile: 7371.6 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.9 MB======================= Partitions =========================1 Drive c: () (Fixed) (Total:1862.92 GB) (Free:1242.71 GB) NTFS2 Drive e: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF3 Drive f: () (Removable) (Total:1.9 GB) (Free:1.9 GB) FAT324 Drive g: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS6 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 1863 GB 0 B Disk 1 Online 1952 MB 0 B Partitions of Disk 0:=============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 100 MB 1024 KB Partition 2 Primary 1862 GB 101 MB======================================================================================================Disk: 0Partition 1Type : 07Hidden: NoActive: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 2 Y System Rese NTFS Partition 100 MB Healthy ======================================================================================================Disk: 0Partition 2Type : 07Hidden: NoActive: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 3 C NTFS Partition 1862 GB Healthy ======================================================================================================Partitions of Disk 1:=============== Partition ### Type Size Offset ------------- ---------------- ------- -------* Partition 1 Primary 1952 MB 0 B======================================================================================================Disk: 1There is no partition selected.There is no partition selected.Please select a partition and try again.================================================================================================================================================================Last Boot: 2012-06-28 13:04======================= End Of Log ========================== Link to post Share on other sites More sharing options...
Staff gringo_pr Posted June 30, 2012 Staff ID:565546 Share Posted June 30, 2012 GreetingsOk lets see if we can find a replacement for the infected fileIn Vista or Windows 7: Boot to System Recovery Options and run FRST.Type the following in the edit box after "Search:".services.exeIt then should look like:Search: services.exeClick Search button and post the log (Search.txt) it makes to your reply.Gringo Link to post Share on other sites More sharing options...
charade539 Posted June 30, 2012 Author ID:565800 Share Posted June 30, 2012 Here you go.Farbar Recovery Scan Tool Version: 25-06-2012Ran by SYSTEM at 2012-06-30 17:04:55Running from G:\================== Search: "services.exe" ===================C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCBC:\Windows\System32\services.exe[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06====== End Of Search ====== Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 1, 2012 Staff ID:565830 Share Posted July 1, 2012 HelloOpen notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txtReplace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exeC:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemOn Vista or Windows 7: Now please enter System Recovery Options.Run FRST64 and press the Fix button just once and wait.The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.Gringo Link to post Share on other sites More sharing options...
charade539 Posted July 1, 2012 Author ID:565980 Share Posted July 1, 2012 Here it is.Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 25-06-2012Ran by SYSTEM at 2012-07-01 14:37:53 Run:1Running from G:\==============================================C:\Windows\System32\services.exe moved successfully.C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exeC:\Windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16} moved successfully.C:\Users\Kyle\AppData\Local\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16} moved successfully.==== End of Fixlog ==== Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 1, 2012 Staff ID:566022 Share Posted July 1, 2012 HelloI Would like you to do the following.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.Link 1Link 2Link 31. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Double click on combofix.exe & follow the prompts.When finished, it will produce a report for you. Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stallNote 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer"information and logs"In your next post I need the followingLog from Combofixlet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
charade539 Posted July 3, 2012 Author ID:566668 Share Posted July 3, 2012 ComboFix 12-07-02.01 - Kyle 07/03/2012 16:18:01.1.4 - x64Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8191.6724 [GMT -5:00]Running from: c:\users\Kyle\Downloads\ComboFix.exeSP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\windows\assembly\GAC_32\Desktop.inic:\windows\assembly\GAC_64\Desktop.inic:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\00000004.@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\1afb2d56c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\201d3ddec:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\L\55490ac4c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\nc:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000004.@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\00000008.@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\000000cb.@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000000.@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000032.@c:\windows\Installer\{d270f3b2-8255-d6f6-5ea1-c9a2db5cbd16}\U\80000064.@..((((((((((((((((((((((((( Files Created from 2012-06-03 to 2012-07-03 )))))))))))))))))))))))))))))))..2012-07-03 21:25 . 2012-07-03 21:25 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp2012-07-03 21:25 . 2012-07-03 21:25 -------- d-----w- c:\users\Default\AppData\Local\temp2012-07-02 08:11 . 2012-07-02 08:11 -------- d-----w- c:\programdata\Nexon2012-06-29 22:17 . 2012-06-29 22:18 -------- d-----w- C:\FRST2012-06-27 00:34 . 2012-06-28 00:21 -------- d-----w- c:\users\Kyle\AppData\Roaming\.minecraft2012-06-26 22:50 . 2012-01-12 14:28 57976 ----a-r- c:\windows\system32\drivers\SBREDrv.sys2012-06-26 22:42 . 2012-06-29 19:28 -------- d-----w- C:\sh4ldr2012-06-26 22:42 . 2012-06-28 00:21 -------- d-----w- c:\program files\Enigma Software Group2012-06-26 22:42 . 2012-06-29 19:28 -------- d-----w- c:\windows\18F97AF04F884494AFE25A5702E142CC.TMP2012-06-23 21:25 . 2012-06-23 21:25 -------- d-----w- c:\users\Kyle\AppData\Local\Macromedia2012-06-23 21:03 . 2012-06-23 21:03 9815752 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe2012-06-23 18:27 . 2012-06-28 19:15 -------- d-----w- c:\program files (x86)\MCSkin3D2012-06-21 05:56 . 2012-06-28 00:21 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%2012-06-19 18:16 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4D8DADC4-F81E-4476-A9F1-A093EF46F036}\mpengine.dll2012-06-18 03:44 . 2003-08-11 15:07 14604 ----a-w- c:\windows\SysWow64\drivers\pfc.sys2012-06-18 03:44 . 2003-08-11 15:13 344064 ----a-r- c:\windows\SysWow64\msvcr70.dll2012-06-09 00:40 . 2012-06-09 00:42 -------- d-----w- c:\users\Kyle\AppData\Roaming\Braid2012-06-09 00:39 . 2008-07-12 13:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll2012-06-06 19:18 . 2012-07-01 07:44 136672 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll2012-06-06 19:18 . 2012-06-29 19:25 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll2012-06-06 19:18 . 2012-06-29 19:25 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll2012-06-06 02:23 . 2011-11-08 21:00 4227704 ----a-w- c:\windows\SysWow64\GameMon.des2012-06-06 02:23 . 2005-01-04 00:43 4682 ----a-w- c:\windows\SysWow64\npptNT2.sys2012-06-06 02:23 . 2003-07-20 09:17 5174 ----a-w- c:\windows\SysWow64\nppt9x.vxd2012-06-06 02:23 . 2012-06-06 02:23 -------- d-----w- c:\program files\Common Files\INCA Shared2012-06-05 08:15 . 2012-06-05 08:15 -------- d-----w- c:\program files (x86)\BandiMPEG12012-06-05 08:15 . 2012-06-05 08:15 -------- d-----w- C:\gPotato...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-06-23 21:03 . 2012-06-02 18:10 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2012-06-23 21:03 . 2011-06-02 14:13 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2012-06-22 21:50 . 2012-05-11 19:54 61440 ----a-r- c:\users\Kyle\AppData\Roaming\Microsoft\Installer\{5808DEC3-FD32-42AD-8640-67CF82210D11}\NewShortcut4_5CAB993EDD3D46CC9A9960173F42D18C.exe2012-05-26 17:49 . 2012-05-26 17:50 955848 ----a-w- c:\windows\system32\npDeployJava1.dll2012-05-26 17:49 . 2012-05-26 17:50 839112 ----a-w- c:\windows\system32\deployJava1.dll2012-05-24 15:47 . 2012-03-13 12:02 24448 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe2012-05-15 10:48 . 2012-05-22 20:19 8139072 ----a-w- c:\windows\system32\nvcuda.dll2012-05-15 10:48 . 2012-05-22 20:19 5982528 ----a-w- c:\windows\SysWow64\nvcuda.dll2012-05-15 10:48 . 2012-05-22 20:19 2881856 ----a-w- c:\windows\system32\nvcuvenc.dll2012-05-15 10:48 . 2012-05-22 20:19 2681664 ----a-w- c:\windows\system32\nvcuvid.dll2012-05-15 10:48 . 2012-05-22 20:19 25743168 ----a-w- c:\windows\system32\nvoglv64.dll2012-05-15 10:48 . 2012-05-22 20:19 2524992 ----a-w- c:\windows\SysWow64\nvcuvid.dll2012-05-15 10:48 . 2012-05-22 20:19 25248064 ----a-w- c:\windows\system32\nvcompiler.dll2012-05-15 10:48 . 2012-05-22 20:19 2445120 ----a-w- c:\windows\SysWow64\nvcuvenc.dll2012-05-15 10:48 . 2012-05-22 20:19 19607872 ----a-w- c:\windows\SysWow64\nvoglv32.dll2012-05-15 10:48 . 2012-05-22 20:19 18044224 ----a-w- c:\windows\system32\nvd3dumx.dll2012-05-15 10:48 . 2012-05-22 20:19 17551680 ----a-w- c:\windows\SysWow64\nvcompiler.dll2012-05-15 10:48 . 2012-05-22 20:19 1738048 ----a-w- c:\windows\system32\nvdispco64.dll2012-05-15 10:48 . 2012-05-22 20:19 15322432 ----a-w- c:\windows\SysWow64\nvd3dum.dll2012-05-15 10:48 . 2012-05-22 20:19 1468224 ----a-w- c:\windows\system32\nvgenco64.dll2012-05-15 10:48 . 2012-05-22 20:19 14298944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys2012-05-15 10:48 . 2012-05-22 20:19 10194752 ----a-w- c:\windows\system32\nvwgf2umx.dll2012-05-15 10:48 . 2011-06-02 14:21 68928 ----a-w- c:\windows\system32\OpenCL.dll2012-05-15 10:48 . 2011-06-02 14:21 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll2012-05-15 10:48 . 2011-06-02 14:21 2741568 ----a-w- c:\windows\system32\nvapi64.dll2012-05-15 10:48 . 2011-06-02 14:21 2368832 ----a-w- c:\windows\SysWow64\nvapi.dll2012-05-15 10:48 . 2009-07-13 21:59 8105280 ----a-w- c:\windows\SysWow64\nvwgf2um.dll2012-05-15 09:29 . 2011-06-02 14:22 889664 ----a-w- c:\windows\system32\nvvsvc.exe2012-05-15 09:29 . 2011-06-02 14:22 63296 ----a-w- c:\windows\system32\nvshext.dll2012-05-15 09:29 . 2011-06-02 14:22 118080 ----a-w- c:\windows\system32\nvmctray.dll2012-05-15 09:29 . 2011-06-02 14:22 3149632 ----a-w- c:\windows\system32\nvsvc64.dll2012-05-15 09:28 . 2011-06-02 14:22 6151488 ----a-w- c:\windows\system32\nvcpl.dll2012-05-15 07:21 . 2012-05-15 07:21 423744 ----a-w- c:\windows\SysWow64\nvStreaming.exe2012-04-11 04:31 . 2012-04-11 04:31 2303488 ----a-w- c:\windows\SysWow64\python27.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{20a0be68-8fd9-4539-8712-ce3d1c1fdfc6}]2011-12-22 21:17 262312 ----a-w- c:\program files (x86)\blekkotb\auxi\blekkoAu.dll.[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{26c9e18c-3717-4be1-a225-04e4471f5b6e}]2011-12-22 21:16 86696 ----a-w- c:\program files (x86)\blekkotb\blekkoDx.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]"{26c9e18c-3717-4be1-a225-04e4471f5b6e}"= "c:\program files (x86)\blekkotb\blekkoDx.dll" [2011-12-22 86696].[HKEY_CLASSES_ROOT\clsid\{26c9e18c-3717-4be1-a225-04e4471f5b6e}].[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Wireless Utility.lnk - c:\program files (x86)\Edimax\Common\RaUI.exe [2012-5-8 1638400].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]"aux9"=wdmaud.drv.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ .[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]@="Service".R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400]R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-05 160944]R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]R3 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-03-05 748440]R3 dump_wmimmc;dump_wmimmc;c:\gpotato\IrisOnline\GameGuard\dump_wmimmc.sys [x]R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]R3 FileMonitor;FileMonitor;c:\program files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2012-01-05 21384]R3 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-09-26 375176]R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-01 113120]R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]R3 RegFilter;RegFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [2012-04-28 33184]R3 SentinelKeysServer;Sentinel Keys Server;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2009-09-17 369952]R3 SentinelSecurityRuntime;Sentinel Security Runtime;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [2009-09-17 292128]R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]R3 UrlFilter;UrlFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [2012-04-28 21872]R3 X6va005;X6va005;c:\users\Kyle\AppData\Local\Temp\005510C.tmp [x]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-12-28 279616]S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976]S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]S2 IMFservice;IMF Service;c:\program files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-01-10 821592]S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2011-09-16 15928]S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Edimax\Common\RaRegistry64.exe [2009-10-06 212256]S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [2009-09-17 145448]S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2009-10-06 737792]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]..Contents of the 'Scheduled Tasks' folder.2012-07-03 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-02 21:03].2012-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000Core.job- c:\users\Kyle\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 03:40].2012-07-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045259866-2150992624-2669054454-1000UA.job- c:\users\Kyle\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-03 03:40]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"LoadAppInit_DLLs"=0x0.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3072253uInternet Settings,ProxyOverride = *.local;<local>IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000Trusted Zone: clonewarsadventures.comTrusted Zone: freerealms.comTrusted Zone: soe.comTrusted Zone: sony.comTCP: DhcpNameServer = 192.168.2.1CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\shell32.dllFF - ProfilePath - c:\users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\tq9u0624.default\FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - about:home.- - - - ORPHANS REMOVED - - - -.URLSearchHooks-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file)...[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]"ImagePath"="c:\windows\system32\GameMon.des -service".[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]"ImagePath"="\??\c:\users\Kyle\AppData\Local\Temp\005510C.tmp".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]@Denied: (2) (LocalSystem)"{32099AAC-C132-4136-9E9A-4E364A424E17}"=hex:51,66,7a,6c,4c,1d,38,12,c2,99,1a, 36,00,8f,58,04,e1,8c,0d,76,4f,1c,0a,03"{26C9E18C-3717-4BE1-A225-04E4471F5B6E}"=hex:51,66,7a,6c,4c,1d,38,12,e2,e2,da, 22,25,79,8f,0e,dd,33,47,a4,42,41,1f,7a"{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"=hex:51,66,7a,6c,4c,1d,38,12,07,04,c9, 0f,40,b3,9a,0c,ed,70,a2,bb,05,11,09,9b"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7"{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}"=hex:51,66,7a,6c,4c,1d,38,12,06,bd,b3, 24,eb,c1,57,00,f8,04,8d,7d,19,41,9b,d2"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96, 76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07, 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47, 2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]@Denied: (2) (LocalSystem)"Timestamp"=hex:17,7d,6f,95,5e,06,cd,01.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (LocalSystem)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ac,43,92,d0,f1,01,66,40,b0,14,4b,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ac,43,92,d0,f1,01,66,40,b0,14,4b,\.[HKEY_USERS\S-1-5-21-4045259866-2150992624-2669054454-1000\Software\SecuROM\License information*]"datasecu"=hex:ef,15,8b,66,6a,c4,01,15,05,ad,d2,56,74,f9,9f,4d,ff,a5,ac,2c,52, 64,e8,1d,d0,87,52,aa,e8,26,60,ab,02,33,95,6c,98,77,92,97,8b,17,88,6c,20,66,\"rkeysecu"=hex:32,18,43,1f,a8,21,27,b7,4e,25,7d,cc,0b,3c,91,c9.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:\program files (x86)\Bonjour\mDNSResponder.exec:\program files (x86)\Edimax\Common\RaRegistry.exe.**************************************************************************.Completion time: 2012-07-03 16:32:28 - machine was rebootedComboFix-quarantined-files.txt 2012-07-03 21:32.Pre-Run: 1,338,163,392,512 bytes freePost-Run: 1,337,793,167,360 bytes free.- - End Of File - - 153353FEF6CEE3BF3E69966D6A586F96 Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 4, 2012 Staff ID:566743 Share Posted July 4, 2012 GreetingsI want you to run these next,tdsskiller:Please read carefully and follow these steps.Download TDSSKiller and save it to your Desktop.doubleclick on TDSSKiller.exe to run the application, then on Start Scan.If an infected file is detected, the default action will be Cure, click on Continue.If a suspicious file is detected, the default action will be Skip, click on Continue.It may ask you to reboot the computer to complete the process. Click on Reboot Now.If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.Please download aswMBR to your desktop.Double click the aswMBR.exe icon to run it it will ask to download extra definitions - ALLOW ITClick the Scan button to start the scanOn completion of the scan, click the save log button, save it to your desktop and post it in your next reply.If you have any problems running either one come back and let me knowplease reply with the reports from TDSSKiller and aswMBRGringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 6, 2012 Staff ID:567437 Share Posted July 6, 2012 GreetingsI have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our toolsGringo Link to post Share on other sites More sharing options...
charade539 Posted July 6, 2012 Author ID:567659 Share Posted July 6, 2012 Sorry for the delay, things got a little crazy over here. I'll do the next part of your instructions now. Link to post Share on other sites More sharing options...
charade539 Posted July 6, 2012 Author ID:567662 Share Posted July 6, 2012 13:44:02.0609 3432 TDSS rootkit removing tool 2.7.44.0 Jul 2 2012 20:01:0813:44:03.0115 3432 ============================================================13:44:03.0115 3432 Current date / time: 2012/07/06 13:44:03.011513:44:03.0115 3432 SystemInfo:13:44:03.0115 3432 13:44:03.0115 3432 OS Version: 6.1.7600 ServicePack: 0.013:44:03.0115 3432 Product type: Workstation13:44:03.0115 3432 ComputerName: WHEELJACK13:44:03.0115 3432 UserName: Kyle13:44:03.0115 3432 Windows directory: C:\Windows13:44:03.0115 3432 System windows directory: C:\Windows13:44:03.0115 3432 Running under WOW6413:44:03.0115 3432 Processor architecture: Intel x6413:44:03.0115 3432 Number of processors: 413:44:03.0115 3432 Page size: 0x100013:44:03.0115 3432 Boot type: Normal boot13:44:03.0115 3432 ============================================================13:44:04.0325 3432 Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x0000004013:44:04.0331 3432 ============================================================13:44:04.0331 3432 \Device\Harddisk0\DR0:13:44:04.0331 3432 MBR partitions:13:44:04.0331 3432 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3200013:44:04.0331 3432 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xE8DD580013:44:04.0331 3432 ============================================================13:44:04.0350 3432 C: <-> \Device\Harddisk0\DR0\Partition113:44:04.0350 3432 ============================================================13:44:04.0350 3432 Initialize success13:44:04.0350 3432 ============================================================13:44:07.0470 3548 ============================================================13:44:07.0470 3548 Scan started13:44:07.0470 3548 Mode: Manual;13:44:07.0470 3548 ============================================================13:44:08.0359 3548 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys13:44:08.0362 3548 1394ohci - ok13:44:08.0397 3548 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys13:44:08.0400 3548 ACPI - ok13:44:08.0434 3548 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys13:44:08.0435 3548 AcpiPmi - ok13:44:08.0508 3548 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe13:44:08.0509 3548 AdobeARMservice - ok13:44:08.0599 3548 AdobeFlashPlayerUpdateSvc (990dc6edc9f933194d7cd4e65146bc94) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe13:44:08.0602 3548 AdobeFlashPlayerUpdateSvc - ok13:44:08.0627 3548 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys13:44:08.0633 3548 adp94xx - ok13:44:08.0655 3548 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys13:44:08.0659 3548 adpahci - ok13:44:08.0668 3548 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys13:44:08.0670 3548 adpu320 - ok13:44:08.0747 3548 AdvancedSystemCareService5 (96d6cdd0b32846e8cfbe592f4f32e608) C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe13:44:08.0757 3548 AdvancedSystemCareService5 - ok13:44:08.0786 3548 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll13:44:08.0788 3548 AeLookupSvc - ok13:44:08.0809 3548 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys13:44:08.0815 3548 AFD - ok13:44:08.0830 3548 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys13:44:08.0831 3548 agp440 - ok13:44:08.0845 3548 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe13:44:08.0847 3548 ALG - ok13:44:08.0851 3548 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys13:44:08.0851 3548 aliide - ok13:44:08.0856 3548 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys13:44:08.0857 3548 amdide - ok13:44:08.0863 3548 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys13:44:08.0865 3548 AmdK8 - ok13:44:08.0870 3548 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys13:44:08.0871 3548 AmdPPM - ok13:44:08.0879 3548 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys13:44:08.0880 3548 amdsata - ok13:44:08.0891 3548 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys13:44:08.0893 3548 amdsbs - ok13:44:08.0906 3548 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys13:44:08.0907 3548 amdxata - ok13:44:08.0921 3548 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys13:44:08.0922 3548 AppID - ok13:44:08.0931 3548 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll13:44:08.0932 3548 AppIDSvc - ok13:44:08.0960 3548 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll13:44:08.0961 3548 Appinfo - ok13:44:08.0999 3548 Application Updater (54951548980ecd07b80ead3c7921f8a1) C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe13:44:09.0007 3548 Application Updater - ok13:44:09.0055 3548 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys13:44:09.0056 3548 arc - ok13:44:09.0082 3548 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys13:44:09.0084 3548 arcsas - ok13:44:09.0157 3548 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe13:44:09.0158 3548 aspnet_state - ok13:44:09.0182 3548 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys13:44:09.0183 3548 AsyncMac - ok13:44:09.0200 3548 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys13:44:09.0200 3548 atapi - ok13:44:09.0229 3548 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll13:44:09.0236 3548 AudioEndpointBuilder - ok13:44:09.0244 3548 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll13:44:09.0248 3548 AudioSrv - ok13:44:09.0263 3548 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll13:44:09.0265 3548 AxInstSV - ok13:44:09.0283 3548 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys13:44:09.0287 3548 b06bdrv - ok13:44:09.0300 3548 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys13:44:09.0303 3548 b57nd60a - ok13:44:09.0324 3548 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll13:44:09.0325 3548 BDESVC - ok13:44:09.0329 3548 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys13:44:09.0329 3548 Beep - ok13:44:09.0378 3548 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll13:44:09.0386 3548 BFE - ok13:44:09.0428 3548 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\system32\qmgr.dll13:44:09.0476 3548 BITS - ok13:44:09.0505 3548 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys13:44:09.0506 3548 blbdrive - ok13:44:09.0551 3548 Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Program Files (x86)\Bonjour\mDNSResponder.exe13:44:09.0555 3548 Bonjour Service - ok13:44:09.0563 3548 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys13:44:09.0564 3548 bowser - ok13:44:09.0568 3548 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys13:44:09.0569 3548 BrFiltLo - ok13:44:09.0575 3548 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys13:44:09.0576 3548 BrFiltUp - ok13:44:09.0584 3548 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys13:44:09.0586 3548 BridgeMP - ok13:44:09.0602 3548 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll13:44:09.0604 3548 Browser - ok13:44:09.0620 3548 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys13:44:09.0624 3548 Brserid - ok13:44:09.0632 3548 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys13:44:09.0633 3548 BrSerWdm - ok13:44:09.0644 3548 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys13:44:09.0645 3548 BrUsbMdm - ok13:44:09.0649 3548 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys13:44:09.0650 3548 BrUsbSer - ok13:44:09.0655 3548 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys13:44:09.0657 3548 BTHMODEM - ok13:44:09.0666 3548 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll13:44:09.0667 3548 bthserv - ok13:44:09.0689 3548 catchme - ok13:44:09.0697 3548 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys13:44:09.0698 3548 cdfs - ok13:44:09.0723 3548 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys13:44:09.0725 3548 cdrom - ok13:44:09.0734 3548 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll13:44:09.0735 3548 CertPropSvc - ok13:44:09.0751 3548 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys13:44:09.0752 3548 circlass - ok13:44:09.0770 3548 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys13:44:09.0774 3548 CLFS - ok13:44:09.0829 3548 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe13:44:09.0831 3548 clr_optimization_v2.0.50727_32 - ok13:44:09.0873 3548 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe13:44:09.0874 3548 clr_optimization_v2.0.50727_64 - ok13:44:09.0927 3548 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe13:44:09.0929 3548 clr_optimization_v4.0.30319_32 - ok13:44:09.0962 3548 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe13:44:09.0964 3548 clr_optimization_v4.0.30319_64 - ok13:44:09.0968 3548 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys13:44:09.0969 3548 CmBatt - ok13:44:09.0975 3548 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys13:44:09.0976 3548 cmdide - ok13:44:10.0000 3548 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys13:44:10.0005 3548 CNG - ok13:44:10.0016 3548 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys13:44:10.0017 3548 Compbatt - ok13:44:10.0033 3548 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys13:44:10.0034 3548 CompositeBus - ok13:44:10.0052 3548 COMSysApp - ok13:44:10.0058 3548 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys13:44:10.0059 3548 crcdisk - ok13:44:10.0092 3548 CryptSvc (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll13:44:10.0094 3548 CryptSvc - ok13:44:10.0155 3548 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll13:44:10.0162 3548 DcomLaunch - ok13:44:10.0181 3548 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll13:44:10.0185 3548 defragsvc - ok13:44:10.0221 3548 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys13:44:10.0222 3548 DfsC - ok13:44:10.0245 3548 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll13:44:10.0248 3548 Dhcp - ok13:44:10.0263 3548 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys13:44:10.0264 3548 discache - ok13:44:10.0280 3548 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys13:44:10.0281 3548 Disk - ok13:44:10.0313 3548 Dnscache (676108c4e3aa6f6b34633748bd0bebd9) C:\Windows\System32\dnsrslvr.dll13:44:10.0322 3548 Dnscache - ok13:44:10.0372 3548 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll13:44:10.0376 3548 dot3svc - ok13:44:10.0407 3548 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll13:44:10.0408 3548 DPS - ok13:44:10.0443 3548 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys13:44:10.0444 3548 drmkaud - ok13:44:10.0492 3548 dtsoftbus01 (400582b09e0bb557d0ec28a945150eeb) C:\Windows\system32\DRIVERS\dtsoftbus01.sys13:44:10.0495 3548 dtsoftbus01 - ok13:44:10.0552 3548 dump_wmimmc - ok13:44:10.0599 3548 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys13:44:10.0610 3548 DXGKrnl - ok13:44:10.0631 3548 EagleX64 - ok13:44:10.0669 3548 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll13:44:10.0670 3548 EapHost - ok13:44:10.0828 3548 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys13:44:10.0881 3548 ebdrv - ok13:44:10.0960 3548 EFS (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\System32\lsass.exe13:44:10.0961 3548 EFS - ok13:44:11.0004 3548 ehRecvr (47c071994c3f649f23d9cd075ac9304a) C:\Windows\ehome\ehRecvr.exe13:44:11.0012 3548 ehRecvr - ok13:44:11.0023 3548 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe13:44:11.0025 3548 ehSched - ok13:44:11.0099 3548 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys13:44:11.0105 3548 elxstor - ok13:44:11.0113 3548 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys13:44:11.0114 3548 ErrDev - ok13:44:11.0207 3548 esgiguard - ok13:44:11.0245 3548 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll13:44:11.0249 3548 EventSystem - ok13:44:11.0287 3548 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys13:44:11.0289 3548 exfat - ok13:44:11.0307 3548 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys13:44:11.0309 3548 fastfat - ok13:44:11.0341 3548 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe13:44:11.0348 3548 Fax - ok13:44:11.0363 3548 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys13:44:11.0364 3548 fdc - ok13:44:11.0380 3548 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll13:44:11.0381 3548 fdPHost - ok13:44:11.0394 3548 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll13:44:11.0395 3548 FDResPub - ok13:44:11.0405 3548 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys13:44:11.0406 3548 FileInfo - ok13:44:11.0529 3548 FileMonitor (060cc45cecae2feaff9c8c52d8fafaa8) C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys13:44:11.0530 3548 FileMonitor - ok13:44:11.0550 3548 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys13:44:11.0551 3548 Filetrace - ok13:44:11.0559 3548 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys13:44:11.0560 3548 flpydisk - ok13:44:11.0576 3548 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys13:44:11.0580 3548 FltMgr - ok13:44:11.0624 3548 FontCache (bc00505cfda789ed3be95d2ff38c4875) C:\Windows\system32\FntCache.dll13:44:11.0645 3548 FontCache - ok13:44:11.0699 3548 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe13:44:11.0700 3548 FontCache3.0.0.0 - ok13:44:11.0745 3548 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys13:44:11.0746 3548 FsDepends - ok13:44:11.0755 3548 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys13:44:11.0756 3548 Fs_Rec - ok13:44:11.0792 3548 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys13:44:11.0795 3548 fvevol - ok13:44:11.0825 3548 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys13:44:11.0826 3548 gagp30kx - ok13:44:11.0857 3548 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll13:44:11.0865 3548 gpsvc - ok13:44:11.0898 3548 Hardlock (091582da724f54830012e3faaf2f1d1a) C:\Windows\system32\drivers\hardlock.sys13:44:11.0902 3548 Hardlock - ok13:44:11.0926 3548 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys13:44:11.0927 3548 hcw85cir - ok13:44:11.0964 3548 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys13:44:11.0967 3548 HdAudAddService - ok13:44:11.0982 3548 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys13:44:11.0984 3548 HDAudBus - ok13:44:12.0000 3548 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys13:44:12.0002 3548 HidBatt - ok13:44:12.0030 3548 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys13:44:12.0032 3548 HidBth - ok13:44:12.0056 3548 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys13:44:12.0058 3548 HidIr - ok13:44:12.0069 3548 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll13:44:12.0070 3548 hidserv - ok13:44:12.0084 3548 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys13:44:12.0085 3548 HidUsb - ok13:44:12.0102 3548 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll13:44:12.0104 3548 hkmsvc - ok13:44:12.0137 3548 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll13:44:12.0141 3548 HomeGroupListener - ok13:44:12.0183 3548 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll13:44:12.0186 3548 HomeGroupProvider - ok13:44:12.0204 3548 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys13:44:12.0206 3548 HpSAMD - ok13:44:12.0258 3548 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys13:44:12.0266 3548 HTTP - ok13:44:12.0298 3548 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys13:44:12.0299 3548 hwpolicy - ok13:44:12.0318 3548 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys13:44:12.0320 3548 i8042prt - ok13:44:12.0347 3548 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys13:44:12.0352 3548 iaStorV - ok13:44:12.0431 3548 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe13:44:12.0441 3548 idsvc - ok13:44:12.0453 3548 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys13:44:12.0455 3548 iirsp - ok13:44:12.0489 3548 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll13:44:12.0498 3548 IKEEXT - ok13:44:12.0632 3548 IMFservice (8ae99ebe30e8338907361018d9030835) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe13:44:12.0641 3548 IMFservice - ok13:44:12.0723 3548 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys13:44:12.0724 3548 intelide - ok13:44:12.0731 3548 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys13:44:12.0732 3548 intelppm - ok13:44:12.0744 3548 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll13:44:12.0746 3548 IPBusEnum - ok13:44:12.0753 3548 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys13:44:12.0754 3548 IpFilterDriver - ok13:44:12.0795 3548 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll13:44:12.0801 3548 iphlpsvc - ok13:44:12.0819 3548 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys13:44:12.0820 3548 IPMIDRV - ok13:44:12.0826 3548 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys13:44:12.0828 3548 IPNAT - ok13:44:12.0844 3548 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys13:44:12.0845 3548 IRENUM - ok13:44:12.0867 3548 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys13:44:12.0868 3548 isapnp - ok13:44:12.0885 3548 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys13:44:12.0888 3548 iScsiPrt - ok13:44:12.0901 3548 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys13:44:12.0902 3548 kbdclass - ok13:44:12.0914 3548 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys13:44:12.0915 3548 kbdhid - ok13:44:12.0923 3548 KeyIso (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe13:44:12.0924 3548 KeyIso - ok13:44:12.0935 3548 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys13:44:12.0937 3548 KSecDD - ok13:44:12.0948 3548 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys13:44:12.0951 3548 KSecPkg - ok13:44:12.0961 3548 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys13:44:12.0962 3548 ksthunk - ok13:44:12.0991 3548 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll13:44:12.0996 3548 KtmRm - ok13:44:13.0021 3548 LanmanServer (81f1d04d4d0e433099365127375fd501) C:\Windows\System32\srvsvc.dll13:44:13.0025 3548 LanmanServer - ok13:44:13.0034 3548 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll13:44:13.0037 3548 LanmanWorkstation - ok13:44:13.0045 3548 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys13:44:13.0046 3548 lltdio - ok13:44:13.0067 3548 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll13:44:13.0071 3548 lltdsvc - ok13:44:13.0087 3548 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll13:44:13.0087 3548 lmhosts - ok13:44:13.0158 3548 LMIGuardianSvc (e01fded75312652de448e5aa792afa59) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe13:44:13.0163 3548 LMIGuardianSvc - ok13:44:13.0193 3548 LMIInfo (0317335b15ff3bda8e10197e3434cfc0) C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys13:44:13.0194 3548 LMIInfo - ok13:44:13.0211 3548 LMIMaint (be53cf6e8ffef255988209a35f184f9f) C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe13:44:13.0214 3548 LMIMaint - ok13:44:13.0237 3548 lmimirr (413ecdcfad9a82804d3674c8d7eec24e) C:\Windows\system32\DRIVERS\lmimirr.sys13:44:13.0238 3548 lmimirr - ok13:44:13.0241 3548 LMIRfsClientNP - ok13:44:13.0271 3548 LMIRfsDriver (c57d3faa50e6f395759ffb7c709bd944) C:\Windows\system32\drivers\LMIRfsDriver.sys13:44:13.0273 3548 LMIRfsDriver - ok13:44:13.0315 3548 LogMeIn (d3760bc17e1755091b7120cf32dbf56b) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe13:44:13.0320 3548 LogMeIn - ok13:44:13.0334 3548 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys13:44:13.0336 3548 LSI_FC - ok13:44:13.0342 3548 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys13:44:13.0344 3548 LSI_SAS - ok13:44:13.0348 3548 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys13:44:13.0349 3548 LSI_SAS2 - ok13:44:13.0375 3548 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys13:44:13.0377 3548 LSI_SCSI - ok13:44:13.0399 3548 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys13:44:13.0401 3548 luafv - ok13:44:13.0431 3548 MBAMProtector (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys13:44:13.0432 3548 MBAMProtector - ok13:44:13.0482 3548 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe13:44:13.0489 3548 MBAMService - ok13:44:13.0504 3548 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll13:44:13.0506 3548 Mcx2Svc - ok13:44:13.0511 3548 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys13:44:13.0512 3548 megasas - ok13:44:13.0538 3548 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys13:44:13.0541 3548 MegaSR - ok13:44:13.0585 3548 Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe13:44:13.0588 3548 Microsoft Office Groove Audit Service - ok13:44:13.0607 3548 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll13:44:13.0609 3548 MMCSS - ok13:44:13.0622 3548 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys13:44:13.0623 3548 Modem - ok13:44:13.0637 3548 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys13:44:13.0638 3548 monitor - ok13:44:13.0653 3548 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys13:44:13.0655 3548 mouclass - ok13:44:13.0664 3548 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys13:44:13.0666 3548 mouhid - ok13:44:13.0679 3548 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys13:44:13.0681 3548 mountmgr - ok13:44:13.0738 3548 MozillaMaintenance (af9b1aa7cf8e486ff703944e56459ba3) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe13:44:13.0740 3548 MozillaMaintenance - ok13:44:13.0750 3548 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys13:44:13.0752 3548 mpio - ok13:44:13.0768 3548 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys13:44:13.0769 3548 mpsdrv - ok13:44:13.0845 3548 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll13:44:13.0855 3548 MpsSvc - ok13:44:13.0872 3548 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys13:44:13.0874 3548 MRxDAV - ok13:44:13.0883 3548 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys13:44:13.0885 3548 mrxsmb - ok13:44:13.0901 3548 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys13:44:13.0904 3548 mrxsmb10 - ok13:44:13.0915 3548 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys13:44:13.0916 3548 mrxsmb20 - ok13:44:13.0927 3548 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys13:44:13.0929 3548 msahci - ok13:44:13.0939 3548 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys13:44:13.0941 3548 msdsm - ok13:44:13.0956 3548 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe13:44:13.0959 3548 MSDTC - ok13:44:13.0974 3548 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys13:44:13.0975 3548 Msfs - ok13:44:13.0985 3548 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys13:44:13.0986 3548 mshidkmdf - ok13:44:13.0994 3548 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys13:44:13.0995 3548 msisadrv - ok13:44:14.0012 3548 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll13:44:14.0014 3548 MSiSCSI - ok13:44:14.0017 3548 msiserver - ok13:44:14.0028 3548 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys13:44:14.0029 3548 MSKSSRV - ok13:44:14.0042 3548 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys13:44:14.0042 3548 MSPCLOCK - ok13:44:14.0057 3548 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys13:44:14.0058 3548 MSPQM - ok13:44:14.0079 3548 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys13:44:14.0084 3548 MsRPC - ok13:44:14.0098 3548 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys13:44:14.0100 3548 mssmbios - ok13:44:14.0108 3548 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys13:44:14.0109 3548 MSTEE - ok13:44:14.0122 3548 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys13:44:14.0123 3548 MTConfig - ok13:44:14.0140 3548 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys13:44:14.0141 3548 Mup - ok13:44:14.0167 3548 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll13:44:14.0173 3548 napagent - ok13:44:14.0215 3548 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys13:44:14.0219 3548 NativeWifiP - ok13:44:14.0270 3548 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys13:44:14.0280 3548 NDIS - ok13:44:14.0294 3548 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys13:44:14.0295 3548 NdisCap - ok13:44:14.0336 3548 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys13:44:14.0337 3548 NdisTapi - ok13:44:14.0367 3548 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys13:44:14.0367 3548 Ndisuio - ok13:44:14.0401 3548 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys13:44:14.0403 3548 NdisWan - ok13:44:14.0439 3548 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys13:44:14.0441 3548 NDProxy - ok13:44:14.0449 3548 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys13:44:14.0450 3548 NetBIOS - ok13:44:14.0463 3548 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys13:44:14.0466 3548 NetBT - ok13:44:14.0479 3548 Netlogon (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe13:44:14.0481 3548 Netlogon - ok13:44:14.0496 3548 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll13:44:14.0501 3548 Netman - ok13:44:14.0585 3548 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe13:44:14.0588 3548 NetMsmqActivator - ok13:44:14.0591 3548 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe13:44:14.0593 3548 NetPipeActivator - ok13:44:14.0615 3548 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll13:44:14.0621 3548 netprofm - ok13:44:14.0698 3548 netr28x (d9a089e17112f04f452d22254b959d87) C:\Windows\system32\DRIVERS\netr28x.sys13:44:14.0706 3548 netr28x - ok13:44:14.0720 3548 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe13:44:14.0721 3548 NetTcpActivator - ok13:44:14.0724 3548 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe13:44:14.0725 3548 NetTcpPortSharing - ok13:44:14.0750 3548 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys13:44:14.0751 3548 nfrd960 - ok13:44:14.0774 3548 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll13:44:14.0778 3548 NlaSvc - ok13:44:14.0788 3548 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys13:44:14.0789 3548 Npfs - ok13:44:14.0792 3548 npggsvc - ok13:44:14.0798 3548 NPPTNT2 - ok13:44:14.0822 3548 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll13:44:14.0823 3548 nsi - ok13:44:14.0831 3548 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys13:44:14.0832 3548 nsiproxy - ok13:44:14.0880 3548 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys13:44:14.0906 3548 Ntfs - ok13:44:14.0984 3548 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys13:44:14.0985 3548 Null - ok13:44:15.0326 3548 nvlddmkm (ba0b4889c40380a01ecdf84c227a89c9) C:\Windows\system32\DRIVERS\nvlddmkm.sys13:44:15.0529 3548 nvlddmkm - ok13:44:15.0570 3548 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys13:44:15.0572 3548 nvraid - ok13:44:15.0589 3548 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys13:44:15.0591 3548 nvstor - ok13:44:15.0628 3548 nvsvc (06633cf95bea62164c3bfca24bce6b11) C:\Windows\system32\nvvsvc.exe13:44:15.0637 3548 nvsvc - ok13:44:15.0715 3548 nvUpdatusService (53b629ce436b110c5689c2f6439e567b) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe13:44:15.0745 3548 nvUpdatusService - ok13:44:15.0787 3548 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys13:44:15.0789 3548 nv_agp - ok13:44:15.0865 3548 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE13:44:15.0871 3548 odserv - ok13:44:15.0902 3548 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys13:44:15.0903 3548 ohci1394 - ok13:44:15.0929 3548 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE13:44:15.0931 3548 ose - ok13:44:15.0972 3548 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll13:44:15.0977 3548 p2pimsvc - ok13:44:16.0017 3548 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll13:44:16.0023 3548 p2psvc - ok13:44:16.0034 3548 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys13:44:16.0036 3548 Parport - ok13:44:16.0045 3548 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys13:44:16.0047 3548 partmgr - ok13:44:16.0121 3548 pbfilter (7c0582921913d00180ec2b8518ba135c) C:\Program Files\PeerBlock\pbfilter.sys13:44:16.0122 3548 pbfilter - ok13:44:16.0133 3548 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll13:44:16.0136 3548 PcaSvc - ok13:44:16.0152 3548 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys13:44:16.0154 3548 pci - ok13:44:16.0170 3548 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys13:44:16.0171 3548 pciide - ok13:44:16.0196 3548 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys13:44:16.0199 3548 pcmcia - ok13:44:16.0237 3548 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys13:44:16.0238 3548 pcw - ok13:44:16.0285 3548 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys13:44:16.0292 3548 PEAUTH - ok13:44:16.0351 3548 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe13:44:16.0352 3548 PerfHost - ok13:44:16.0420 3548 pfc - ok13:44:16.0464 3548 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll13:44:16.0493 3548 pla - ok13:44:16.0534 3548 PlugPlay (23157d583244400e1d7fbaee2e4b31b7) C:\Windows\system32\umpnpmgr.dll13:44:16.0540 3548 PlugPlay - ok13:44:16.0563 3548 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll13:44:16.0565 3548 PNRPAutoReg - ok13:44:16.0603 3548 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll13:44:16.0606 3548 PNRPsvc - ok13:44:16.0658 3548 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll13:44:16.0664 3548 PolicyAgent - ok13:44:16.0686 3548 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll13:44:16.0690 3548 Power - ok13:44:16.0701 3548 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys13:44:16.0702 3548 PptpMiniport - ok13:44:16.0719 3548 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys13:44:16.0720 3548 Processor - ok13:44:16.0756 3548 ProfSvc (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll13:44:16.0759 3548 ProfSvc - ok13:44:16.0798 3548 ProtectedStorage (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe13:44:16.0800 3548 ProtectedStorage - ok13:44:16.0813 3548 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys13:44:16.0815 3548 Psched - ok13:44:16.0862 3548 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys13:44:16.0890 3548 ql2300 - ok13:44:16.0961 3548 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys13:44:16.0963 3548 ql40xx - ok13:44:16.0990 3548 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll13:44:16.0994 3548 QWAVE - ok13:44:17.0003 3548 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys13:44:17.0004 3548 QWAVEdrv - ok13:44:17.0084 3548 RalinkRegistryWriter (2ee6d9cab03900646d1d3d9077167bd6) C:\Program Files (x86)\Edimax\Common\RaRegistry.exe13:44:17.0086 3548 RalinkRegistryWriter - ok13:44:17.0123 3548 RalinkRegistryWriter64 (46358c32af09a57a171bc422649be53b) C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe13:44:17.0125 3548 RalinkRegistryWriter64 - ok13:44:17.0139 3548 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys13:44:17.0140 3548 RasAcd - ok13:44:17.0155 3548 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys13:44:17.0156 3548 RasAgileVpn - ok13:44:17.0173 3548 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll13:44:17.0175 3548 RasAuto - ok13:44:17.0192 3548 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys13:44:17.0194 3548 Rasl2tp - ok13:44:17.0212 3548 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll13:44:17.0217 3548 RasMan - ok13:44:17.0229 3548 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys13:44:17.0230 3548 RasPppoe - ok13:44:17.0255 3548 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys13:44:17.0257 3548 RasSstp - ok13:44:17.0297 3548 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys13:44:17.0301 3548 rdbss - ok13:44:17.0335 3548 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys13:44:17.0336 3548 rdpbus - ok13:44:17.0347 3548 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys13:44:17.0347 3548 RDPCDD - ok13:44:17.0363 3548 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys13:44:17.0364 3548 RDPENCDD - ok13:44:17.0380 3548 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys13:44:17.0381 3548 RDPREFMP - ok13:44:17.0393 3548 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys13:44:17.0396 3548 RDPWD - ok13:44:17.0413 3548 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys13:44:17.0416 3548 rdyboost - ok13:44:17.0524 3548 RegFilter (c3b79061634fbc3ba3379f557ad952c7) C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys13:44:17.0525 3548 RegFilter - ok13:44:17.0569 3548 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll13:44:17.0571 3548 RemoteAccess - ok13:44:17.0592 3548 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll13:44:17.0595 3548 RemoteRegistry - ok13:44:17.0623 3548 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll13:44:17.0625 3548 RpcEptMapper - ok13:44:17.0629 3548 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe13:44:17.0630 3548 RpcLocator - ok13:44:17.0673 3548 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\System32\rpcss.dll13:44:17.0677 3548 RpcSs - ok13:44:17.0687 3548 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys13:44:17.0688 3548 rspndr - ok13:44:17.0713 3548 RTL8167 (baefee35d27a5440d35092ce10267bec) C:\Windows\system32\DRIVERS\Rt64win7.sys13:44:17.0715 3548 RTL8167 - ok13:44:17.0725 3548 SamSs (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe13:44:17.0726 3548 SamSs - ok13:44:17.0742 3548 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys13:44:17.0744 3548 sbp2port - ok13:44:17.0775 3548 SBRE (9aceb2a2362fc87a3825963e61ba9076) C:\Windows\system32\drivers\SBREdrv.sys13:44:17.0776 3548 SBRE - ok13:44:17.0801 3548 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll13:44:17.0805 3548 SCardSvr - ok13:44:17.0813 3548 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys13:44:17.0814 3548 scfilter - ok13:44:17.0853 3548 Schedule (624d0f5ff99428bb90a5b8a4123e918e) C:\Windows\system32\schedsvc.dll13:44:17.0865 3548 Schedule - ok13:44:17.0893 3548 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll13:44:17.0894 3548 SCPolicySvc - ok13:44:17.0905 3548 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll13:44:17.0908 3548 SDRSVC - ok13:44:17.0930 3548 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys13:44:17.0931 3548 secdrv - ok13:44:17.0942 3548 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll13:44:17.0943 3548 seclogon - ok13:44:17.0955 3548 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll13:44:17.0957 3548 SENS - ok13:44:17.0962 3548 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll13:44:17.0964 3548 SensrSvc - ok13:44:17.0994 3548 Sentinel64 (255476b54c82a89416efdf09fd62f107) C:\Windows\System32\Drivers\Sentinel64.sys13:44:17.0996 3548 Sentinel64 - ok13:44:18.0039 3548 SentinelKeysServer (1ba2c677c6146a8b3adea7b69d2eed56) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe13:44:18.0043 3548 SentinelKeysServer - ok13:44:18.0092 3548 SentinelProtectionServer (d1a2ba8bf092ddf18f3d3db1d5ac7803) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe13:44:18.0112 3548 SentinelProtectionServer - ok13:44:18.0128 3548 SentinelSecurityRuntime (e80b91aec007711b1eec9c83487754e2) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe13:44:18.0131 3548 SentinelSecurityRuntime - ok13:44:18.0194 3548 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys13:44:18.0195 3548 Serenum - ok13:44:18.0206 3548 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys13:44:18.0208 3548 Serial - ok13:44:18.0222 3548 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys13:44:18.0222 3548 sermouse - ok13:44:18.0303 3548 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll13:44:18.0312 3548 SessionEnv - ok13:44:18.0322 3548 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys13:44:18.0323 3548 sffdisk - ok13:44:18.0338 3548 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys13:44:18.0339 3548 sffp_mmc - ok13:44:18.0355 3548 sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys13:44:18.0356 3548 sffp_sd - ok13:44:18.0373 3548 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys13:44:18.0374 3548 sfloppy - ok13:44:18.0433 3548 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll13:44:18.0438 3548 SharedAccess - ok13:44:18.0460 3548 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll13:44:18.0464 3548 ShellHWDetection - ok13:44:18.0479 3548 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys13:44:18.0480 3548 SiSRaid2 - ok13:44:18.0494 3548 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys13:44:18.0496 3548 SiSRaid4 - ok13:44:18.0552 3548 SkypeUpdate (c70aebd3608ed9fcea2a1bae83567ffc) C:\Program Files (x86)\Skype\Updater\Updater.exe13:44:18.0555 3548 SkypeUpdate - ok13:44:18.0562 3548 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys13:44:18.0563 3548 Smb - ok13:44:18.0572 3548 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe13:44:18.0574 3548 SNMPTRAP - ok13:44:18.0633 3548 speedfan (12583af6cbe0050651eaf2723b3ad7b3) C:\Windows\syswow64\speedfan.sys13:44:18.0635 3548 speedfan - ok13:44:18.0645 3548 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys13:44:18.0646 3548 spldr - ok13:44:18.0665 3548 Spooler (f8e1fa03cb70d54a9892ac88b91d1e7b) C:\Windows\System32\spoolsv.exe13:44:18.0672 3548 Spooler - ok13:44:18.0778 3548 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe13:44:18.0866 3548 sppsvc - ok13:44:18.0959 3548 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll13:44:18.0961 3548 sppuinotify - ok13:44:18.0987 3548 srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys13:44:18.0992 3548 srv - ok13:44:19.0011 3548 srv2 (4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys13:44:19.0015 3548 srv2 - ok13:44:19.0034 3548 srvnet (5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys13:44:19.0036 3548 srvnet - ok13:44:19.0072 3548 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll13:44:19.0075 3548 SSDPSRV - ok13:44:19.0158 3548 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll13:44:19.0160 3548 SstpSvc - ok13:44:19.0206 3548 Steam Client Service - ok13:44:19.0276 3548 Stereo Service (c354621b6b94e10ae7f5cdbe745feb86) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe13:44:19.0280 3548 Stereo Service - ok13:44:19.0296 3548 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys13:44:19.0297 3548 stexstor - ok13:44:19.0327 3548 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll13:44:19.0334 3548 stisvc - ok13:44:19.0348 3548 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys13:44:19.0349 3548 swenum - ok13:44:19.0398 3548 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe13:44:19.0403 3548 SwitchBoard - ok13:44:19.0435 3548 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll13:44:19.0441 3548 swprv - ok13:44:19.0496 3548 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll13:44:19.0531 3548 SysMain - ok13:44:19.0595 3548 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll13:44:19.0598 3548 TabletInputService - ok13:44:19.0616 3548 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll13:44:19.0621 3548 TapiSrv - ok13:44:19.0629 3548 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll13:44:19.0631 3548 TBS - ok13:44:19.0695 3548 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys13:44:19.0731 3548 Tcpip - ok13:44:19.0807 3548 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys13:44:19.0817 3548 TCPIP6 - ok13:44:19.0854 3548 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys13:44:19.0856 3548 tcpipreg - ok13:44:19.0872 3548 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys13:44:19.0873 3548 TDPIPE - ok13:44:19.0877 3548 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys13:44:19.0878 3548 TDTCP - ok13:44:19.0888 3548 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys13:44:19.0890 3548 tdx - ok13:44:19.0899 3548 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys13:44:19.0900 3548 TermDD - ok13:44:19.0944 3548 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll13:44:19.0952 3548 TermService - ok13:44:19.0978 3548 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll13:44:19.0980 3548 Themes - ok13:44:20.0006 3548 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll13:44:20.0008 3548 THREADORDER - ok13:44:20.0018 3548 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll13:44:20.0021 3548 TrkWks - ok13:44:20.0052 3548 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe13:44:20.0054 3548 TrustedInstaller - ok13:44:20.0073 3548 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys13:44:20.0074 3548 tssecsrv - ok13:44:20.0088 3548 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys13:44:20.0090 3548 tunnel - ok13:44:20.0096 3548 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys13:44:20.0097 3548 uagp35 - ok13:44:20.0111 3548 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys13:44:20.0115 3548 udfs - ok13:44:20.0136 3548 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe13:44:20.0138 3548 UI0Detect - ok13:44:20.0151 3548 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys13:44:20.0152 3548 uliagpkx - ok13:44:20.0163 3548 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys13:44:20.0164 3548 umbus - ok13:44:20.0179 3548 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys13:44:20.0180 3548 UmPass - ok13:44:20.0205 3548 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll13:44:20.0211 3548 upnphost - ok13:44:20.0369 3548 UrlFilter (401984715693b87fdf4f600fbbebd366) C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys13:44:20.0369 3548 UrlFilter - ok13:44:20.0418 3548 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys13:44:20.0419 3548 usbaudio - ok13:44:20.0433 3548 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys13:44:20.0435 3548 usbccgp - ok13:44:20.0471 3548 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys13:44:20.0481 3548 usbcir - ok13:44:20.0522 3548 usbehci (df9f9afc9aaabd8ed47975d44e38169a) C:\Windows\system32\DRIVERS\usbehci.sys13:44:20.0523 3548 usbehci - ok13:44:20.0545 3548 usbhub (372a91bc3c6603080a793880b0873785) C:\Windows\system32\DRIVERS\usbhub.sys13:44:20.0549 3548 usbhub - ok13:44:20.0564 3548 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys13:44:20.0565 3548 usbohci - ok13:44:20.0579 3548 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys13:44:20.0580 3548 usbprint - ok13:44:20.0590 3548 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS13:44:20.0592 3548 USBSTOR - ok13:44:20.0607 3548 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys13:44:20.0608 3548 usbuhci - ok13:44:20.0620 3548 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll13:44:20.0622 3548 UxSms - ok13:44:20.0644 3548 VaultSvc (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe13:44:20.0645 3548 VaultSvc - ok13:44:20.0655 3548 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys13:44:20.0656 3548 vdrvroot - ok13:44:20.0679 3548 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe13:44:20.0686 3548 vds - ok13:44:20.0701 3548 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys13:44:20.0702 3548 vga - ok13:44:20.0716 3548 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys13:44:20.0717 3548 VgaSave - ok13:44:20.0733 3548 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys13:44:20.0735 3548 vhdmp - ok13:44:20.0739 3548 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys13:44:20.0740 3548 viaide - ok13:44:20.0757 3548 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys13:44:20.0758 3548 volmgr - ok13:44:20.0778 3548 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys13:44:20.0783 3548 volmgrx - ok13:44:20.0817 3548 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys13:44:20.0820 3548 volsnap - ok13:44:20.0859 3548 vpcbus (abd9b4a7e2d0ae51a3b8df1af3152d61) C:\Windows\system32\DRIVERS\vpchbus.sys13:44:20.0861 3548 vpcbus - ok13:44:20.0894 3548 vpcnfltr (8acda395841538ce9713a67fe8b2a3eb) C:\Windows\system32\DRIVERS\vpcnfltr.sys13:44:20.0896 3548 vpcnfltr - ok13:44:20.0914 3548 vpcusb (31924e31bc315773e6d149b157db46d5) C:\Windows\system32\DRIVERS\vpcusb.sys13:44:20.0916 3548 vpcusb - ok13:44:20.0937 3548 vpcvmm (c5b651e52540e6f46da66574c74b4898) C:\Windows\system32\drivers\vpcvmm.sys13:44:20.0942 3548 vpcvmm - ok13:44:20.0953 3548 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys13:44:20.0955 3548 vsmraid - ok13:44:21.0008 3548 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe13:44:21.0035 3548 VSS - ok13:44:21.0104 3548 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys13:44:21.0105 3548 vwifibus - ok13:44:21.0112 3548 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys13:44:21.0113 3548 vwififlt - ok13:44:21.0138 3548 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll13:44:21.0143 3548 W32Time - ok13:44:21.0154 3548 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys13:44:21.0155 3548 WacomPen - ok13:44:21.0170 3548 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys13:44:21.0172 3548 WANARP - ok13:44:21.0176 3548 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys13:44:21.0177 3548 Wanarpv6 - ok13:44:21.0234 3548 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe13:44:21.0268 3548 wbengine - ok13:44:21.0323 3548 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll13:44:21.0327 3548 WbioSrvc - ok13:44:21.0374 3548 wcncsvc (8321c2ca3b62b61b293cda3451984468) C:\Windows\System32\wcncsvc.dll13:44:21.0379 3548 wcncsvc - ok13:44:21.0395 3548 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll13:44:21.0398 3548 WcsPlugInService - ok13:44:21.0405 3548 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys13:44:21.0406 3548 Wd - ok13:44:21.0433 3548 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys13:44:21.0440 3548 Wdf01000 - ok13:44:21.0448 3548 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll13:44:21.0451 3548 WdiServiceHost - ok13:44:21.0454 3548 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll13:44:21.0456 3548 WdiSystemHost - ok13:44:21.0477 3548 WebClient (8a438cbb8c032a0c798b0c642ffbe572) C:\Windows\System32\webclnt.dll13:44:21.0480 3548 WebClient - ok13:44:21.0495 3548 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll13:44:21.0499 3548 Wecsvc - ok13:44:21.0512 3548 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll13:44:21.0515 3548 wercplsupport - ok13:44:21.0531 3548 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll13:44:21.0533 3548 WerSvc - ok13:44:21.0545 3548 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys13:44:21.0546 3548 WfpLwf - ok13:44:21.0562 3548 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys13:44:21.0563 3548 WIMMount - ok13:44:21.0609 3548 WinDefend - ok13:44:21.0619 3548 WinHttpAutoProxySvc - ok13:44:21.0663 3548 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll13:44:21.0666 3548 Winmgmt - ok13:44:21.0738 3548 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll13:44:21.0773 3548 WinRM - ok13:44:21.0832 3548 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys13:44:21.0833 3548 WinUsb - ok13:44:21.0867 3548 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll13:44:21.0877 3548 Wlansvc - ok13:44:22.0014 3548 wlidsvc (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE13:44:22.0057 3548 wlidsvc - ok13:44:22.0087 3548 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys13:44:22.0088 3548 WmiAcpi - ok13:44:22.0115 3548 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe13:44:22.0118 3548 wmiApSrv - ok13:44:22.0134 3548 WMPNetworkSvc - ok13:44:22.0150 3548 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll13:44:22.0153 3548 WPCSvc - ok13:44:22.0179 3548 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll13:44:22.0181 3548 WPDBusEnum - ok13:44:22.0221 3548 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys13:44:22.0222 3548 ws2ifsl - ok13:44:22.0298 3548 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll13:44:22.0301 3548 wscsvc - ok13:44:22.0304 3548 WSearch - ok13:44:22.0388 3548 wuauserv (fb3796754fe00f0bdc87a36f164a5f4d) C:\Windows\system32\wuaueng.dll13:44:22.0429 3548 wuauserv - ok13:44:22.0474 3548 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys13:44:22.0476 3548 WudfPf - ok13:44:22.0496 3548 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys13:44:22.0498 3548 WUDFRd - ok13:44:22.0506 3548 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll13:44:22.0508 3548 wudfsvc - ok13:44:22.0522 3548 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll13:44:22.0540 3548 WwanSvc - ok13:44:22.0570 3548 X6va005 - ok13:44:22.0639 3548 xnacc (4a5ce13408945e525503b5f73d29b9c5) C:\Windows\system32\DRIVERS\xnacc.sys13:44:22.0646 3548 xnacc - ok13:44:22.0665 3548 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR013:44:22.0942 3548 \Device\Harddisk0\DR0 - ok13:44:22.0945 3548 Boot (0x1200) (0abed56843fdfb3cc0f99d71652a84d4) \Device\Harddisk0\DR0\Partition013:44:22.0946 3548 \Device\Harddisk0\DR0\Partition0 - ok13:44:22.0950 3548 Boot (0x1200) (fd76dc7f68ee49013e4e965302494e22) \Device\Harddisk0\DR0\Partition113:44:22.0951 3548 \Device\Harddisk0\DR0\Partition1 - ok13:44:22.0952 3548 ============================================================13:44:22.0952 3548 Scan finished13:44:22.0952 3548 ============================================================13:44:22.0961 4892 Detected object count: 013:44:22.0961 4892 Actual detected object count: 0Running aswMBR now. Link to post Share on other sites More sharing options...
charade539 Posted July 6, 2012 Author ID:567688 Share Posted July 6, 2012 aswMBR version 0.9.9.1665 Copyright© 2011 AVAST SoftwareRun date: 2012-07-06 13:47:00-----------------------------13:47:00.607 OS Version: Windows x64 6.1.760013:47:00.607 Number of processors: 4 586 0x170A13:47:00.608 ComputerName: WHEELJACK UserName: Kyle13:47:03.643 Initialize success13:50:16.057 AVAST engine defs: 1207060113:50:50.615 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-213:50:50.618 Disk 0 Vendor: ST32000542AS CC34 Size: 1907729MB BusType: 313:50:50.635 Disk 0 MBR read successfully13:50:50.639 Disk 0 MBR scan13:50:50.644 Disk 0 Windows 7 default MBR code13:50:50.653 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 204813:50:50.669 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 1907627 MB offset 20684813:50:50.687 Disk 0 scanning C:\Windows\system32\drivers13:50:59.240 Service scanning13:51:14.427 Modules scanning13:51:14.435 Disk 0 trace - called modules:13:51:14.457 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys13:51:14.461 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007db8060]13:51:14.467 3 CLASSPNP.SYS[fffff88000dd043f] -> nt!IofCallDriver -> [0xfffffa80077db520]13:51:14.473 5 ACPI.sys[fffff88000f26781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa80077d7680]13:51:17.346 AVAST engine scan C:\Windows13:51:24.157 AVAST engine scan C:\Windows\system3213:54:35.543 AVAST engine scan C:\Windows\system32\drivers13:54:49.266 AVAST engine scan C:\Users\Kyle14:30:52.306 AVAST engine scan C:\ProgramData14:37:04.244 Scan finished successfully14:47:00.155 Disk 0 MBR has been saved successfully to "C:\Users\Kyle\Desktop\MBR.dat"14:47:00.161 The log file has been saved successfully to "C:\Users\Kyle\Desktop\aswMBR.txt" Link to post Share on other sites More sharing options...
Recommended Posts