Trojan.agent keeps coming back.

DaveFL · June 27, 2012

Hi. I sure would appreciate some help on this one... Mbam succesfully removes trojan.agent only to have it reappear again!

Thanks for any insight into this one....

DaveFL

DDS.txt

Attach.txt

MrCharlie · June 27, 2012

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system (don't run any other options, they're not all bad!!!!!!!)

Post back the report.

MrC

DaveFL · June 27, 2012

Thanks MrC!

Here is the roguekiller report:

RogueKiller V7.6.0 [06/26/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User: Judith [Admin rights]

Mode: Scan -- Date: 06/27/2012 12:47:12

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 7 ¤¤¤

[ROGUE ST] HKLM\[...]\Policies\Explorer\Run : 63726 (C:\PROGRA~3\LOCALS~1\Temp\ydmopeomydw.cmd) -> FOUND

[ROGUE ST] HKLM\[...]\Wow6432Node\Policies\Explorer\Run : 63726 (C:\PROGRA~3\LOCALS~1\Temp\ydmopeomydw.cmd) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[sCRSV] HKCU\[...]\Desktop : SCRNSAVE.EXE (C:\Windows\WLXPGSS.SCR) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

127.0.0.1 www.007guard.com

127.0.0.1 007guard.com

127.0.0.1 008i.com

127.0.0.1 www.008k.com

127.0.0.1 008k.com

127.0.0.1 www.00hq.com

127.0.0.1 00hq.com

127.0.0.1 010402.com

127.0.0.1 www.032439.com

127.0.0.1 032439.com

127.0.0.1 www.0scan.com

127.0.0.1 0scan.com

127.0.0.1 www.1000gratisproben.com

127.0.0.1 1000gratisproben.com

127.0.0.1 www.1001namen.com

127.0.0.1 1001namen.com

127.0.0.1 www.100888290cs.com

127.0.0.1 100888290cs.com

127.0.0.1 www.100sexlinks.com

127.0.0.1 100sexlinks.com

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000BEVT-75ZAT0 ATA Device +++++

--- User ---

[MBR] 3ba969ee2cc047bdb3b710487d5dcce1

[bSP] 679622b6581f2beb419270d0e98cd78d : Windows 7 MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 10000 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 20686848 | Size: 60000 Mo

3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 143566848 | Size: 406838 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

MrCharlie · June 27, 2012

OK, run RogueKiller again and click Scan

When the scan completes > click on the Registry Entries tab

Put a check next to all of these and uncheck the rest:

¤¤¤ Registry Entries: 7*
[ROGUE ST] HKLM\[...]\Policies\Explorer\Run : 63726 (C:\PROGRA~3\LOCALS~1\Temp\ydmopeomydw.cmd) -> FOUND
[ROGUE ST] HKLM\[...]\Wow6432Node\Policies\Explorer\Run : 63726 (C:\PROGRA~3\LOCALS~1\Temp\ydmopeomydw.cmd) -> FOUND

Now click Delete on the right hand column.

--------------------------------------------

Next......

Please make sure system restore is running and create a new restore point before continuing.

XP <===> Vista & W7

XP users > please back up the registry using ERUNT.

-----------------------------------------

Please download and run TDSSKiller to your desktop as outlined below:

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

-------------------------

Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

------------------------

Click the Start Scan button.

-----------------------

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose delete.

----------------------

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

--------------------

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

-------------------

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose delete.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

MrC

DaveFL · June 27, 2012

Thanks! I ran TDSSKiller and I skipped the 4 items that it flagged.

It found nothing like: \device\harddisk0\DR0.

The report:

13:14:55.0772 3320 TDSS rootkit removing tool 2.7.42.0 Jun 25 2012 21:18:44

13:14:57.0628 3320 ============================================================

13:14:57.0628 3320 Current date / time: 2012/06/27 13:14:57.0628

13:14:57.0628 3320 SystemInfo:

13:14:57.0628 3320

13:14:57.0628 3320 OS Version: 6.1.7601 ServicePack: 1.0

13:14:57.0628 3320 Product type: Workstation

13:14:57.0628 3320 ComputerName: JUDITH-PC

13:14:57.0628 3320 UserName: Judith

13:14:57.0628 3320 Windows directory: C:\Windows

13:14:57.0628 3320 System windows directory: C:\Windows

13:14:57.0628 3320 Running under WOW64

13:14:57.0628 3320 Processor architecture: Intel x64

13:14:57.0628 3320 Number of processors: 4

13:14:57.0628 3320 Page size: 0x1000

13:14:57.0628 3320 Boot type: Normal boot

13:14:57.0628 3320 ============================================================

13:14:59.0079 3320 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

13:14:59.0094 3320 ============================================================

13:14:59.0094 3320 \Device\Harddisk0\DR0:

13:14:59.0094 3320 MBR partitions:

13:14:59.0094 3320 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1388000

13:14:59.0094 3320 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x13BA800, BlocksNum 0x7530000

13:14:59.0110 3320 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x88EB000, BlocksNum 0x31A9A800

13:14:59.0110 3320 ============================================================

13:14:59.0126 3320 C: <-> \Device\Harddisk0\DR0\Partition1

13:14:59.0157 3320 D: <-> \Device\Harddisk0\DR0\Partition2

13:14:59.0157 3320 ============================================================

13:14:59.0157 3320 Initialize success

13:14:59.0157 3320 ============================================================

13:15:29.0686 3772 ============================================================

13:15:29.0686 3772 Scan started

13:15:29.0686 3772 Mode: Manual; SigCheck; TDLFS;

13:15:29.0686 3772 ============================================================

13:15:30.0809 3772 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys

13:15:30.0950 3772 1394ohci - ok

13:15:31.0012 3772 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys

13:15:31.0059 3772 ACPI - ok

13:15:31.0090 3772 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys

13:15:31.0184 3772 AcpiPmi - ok

13:15:31.0340 3772 AdobeActiveFileMonitor8.0 (4451cc2275b04043ec2bcc757af97291) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe

13:15:31.0355 3772 AdobeActiveFileMonitor8.0 - ok

13:15:31.0558 3772 AdobeFlashPlayerUpdateSvc (f3cd7b20b27d1772c946df993ff3635c) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

13:15:31.0620 3772 AdobeFlashPlayerUpdateSvc - ok

13:15:31.0698 3772 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

13:15:31.0745 3772 adp94xx - ok

13:15:31.0792 3772 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

13:15:31.0823 3772 adpahci - ok

13:15:31.0839 3772 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

13:15:31.0854 3772 adpu320 - ok

13:15:31.0886 3772 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll

13:15:32.0057 3772 AeLookupSvc - ok

13:15:32.0104 3772 AERTFilters (3ac22a3dfa8a050e35f0e3cd99d0cdf2) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

13:15:32.0229 3772 AERTFilters - ok

13:15:32.0244 3772 Afc - ok

13:15:32.0338 3772 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys

13:15:32.0385 3772 AFD - ok

13:15:32.0447 3772 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys

13:15:32.0463 3772 agp440 - ok

13:15:32.0478 3772 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe

13:15:32.0541 3772 ALG - ok

13:15:32.0572 3772 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys

13:15:32.0572 3772 aliide - ok

13:15:32.0619 3772 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys

13:15:32.0634 3772 amdide - ok

13:15:32.0666 3772 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

13:15:32.0744 3772 AmdK8 - ok

13:15:32.0759 3772 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

13:15:32.0806 3772 AmdPPM - ok

13:15:32.0853 3772 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys

13:15:32.0884 3772 amdsata - ok

13:15:32.0931 3772 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

13:15:32.0978 3772 amdsbs - ok

13:15:32.0993 3772 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys

13:15:33.0024 3772 amdxata - ok

13:15:33.0087 3772 ApfiltrService (8b522286c8d6a20133d12225b7759596) C:\Windows\system32\DRIVERS\Apfiltr.sys

13:15:33.0134 3772 ApfiltrService - ok

13:15:33.0180 3772 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys

13:15:33.0336 3772 AppID - ok

13:15:33.0368 3772 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll

13:15:33.0461 3772 AppIDSvc - ok

13:15:33.0508 3772 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll

13:15:33.0602 3772 Appinfo - ok

13:15:33.0695 3772 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

13:15:33.0711 3772 arc - ok

13:15:33.0726 3772 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

13:15:33.0742 3772 arcsas - ok

13:15:33.0758 3772 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

13:15:33.0836 3772 AsyncMac - ok

13:15:33.0851 3772 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys

13:15:33.0867 3772 atapi - ok

13:15:33.0976 3772 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

13:15:34.0054 3772 AudioEndpointBuilder - ok

13:15:34.0054 3772 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll

13:15:34.0101 3772 AudioSrv - ok

13:15:34.0226 3772 AVG Security Toolbar Service (d45b7995761253a92ab071d576114f28) C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe

13:15:34.0257 3772 AVG Security Toolbar Service - ok

13:15:34.0319 3772 Avgfwfd (705417fd6c165ccf926aca943b478d68) C:\Windows\system32\DRIVERS\avgfwd6a.sys

13:15:34.0350 3772 Avgfwfd - ok

13:15:34.0631 3772 avgfws (2f0c5ae2352f22b587edc2829c971262) C:\Program Files (x86)\AVG\AVG10\avgfws.exe

13:15:34.0694 3772 avgfws - ok

13:15:35.0474 3772 AVGIDSAgent (7a0f6a3e0e41425b9ba54616b482668a) C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

13:15:35.0708 3772 AVGIDSAgent - ok

13:15:35.0926 3772 AVGIDSDriver (e6671e90d38c88764412e07c9d9b3d63) C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys

13:15:35.0957 3772 AVGIDSDriver - ok

13:15:36.0051 3772 AVGIDSEH (1553b388e0f0462c25ad8f30c3c29e83) C:\Windows\system32\DRIVERS\AVGIDSEH.Sys

13:15:36.0082 3772 AVGIDSEH - ok

13:15:36.0113 3772 AVGIDSFilter (dca426a66739e75f51a72160dfb945ad) C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys

13:15:36.0129 3772 AVGIDSFilter - ok

13:15:36.0176 3772 Avgldx64 (ff7383388a7d2283dae5831abc2b0720) C:\Windows\system32\DRIVERS\avgldx64.sys

13:15:36.0207 3772 Avgldx64 - ok

13:15:36.0238 3772 Avgmfx64 (997d002827d3e3dcbbb25bf46db161ab) C:\Windows\system32\DRIVERS\avgmfx64.sys

13:15:36.0254 3772 Avgmfx64 - ok

13:15:36.0285 3772 Avgrkx64 (bccfe3374c887075cde2ac8fdb1cb2f8) C:\Windows\system32\DRIVERS\avgrkx64.sys

13:15:36.0300 3772 Avgrkx64 - ok

13:15:36.0363 3772 Avgtdia (0d49adcebe243b79366ea523b647519a) C:\Windows\system32\DRIVERS\avgtdia.sys

13:15:36.0410 3772 Avgtdia - ok

13:15:36.0722 3772 avgwd (fc2bc51120a945f7c70376495e4e7737) C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe

13:15:36.0737 3772 avgwd - ok

13:15:36.0815 3772 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll

13:15:36.0878 3772 AxInstSV - ok

13:15:36.0940 3772 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

13:15:37.0018 3772 b06bdrv - ok

13:15:37.0080 3772 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

13:15:37.0143 3772 b57nd60a - ok

13:15:37.0174 3772 BCM42RLY (e001dd475a7c27ebe5a0db45c11bad71) C:\Windows\system32\drivers\BCM42RLY.sys

13:15:37.0190 3772 BCM42RLY - ok

13:15:37.0439 3772 BCM43XX (37394d3553e220fb732c21e217e1bd8b) C:\Windows\system32\DRIVERS\bcmwl664.sys

13:15:37.0548 3772 BCM43XX - ok

13:15:37.0751 3772 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll

13:15:37.0829 3772 BDESVC - ok

13:15:37.0876 3772 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

13:15:37.0954 3772 Beep - ok

13:15:38.0063 3772 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll

13:15:38.0126 3772 BFE - ok

13:15:38.0297 3772 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll

13:15:38.0422 3772 BITS - ok

13:15:38.0469 3772 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

13:15:38.0500 3772 blbdrive - ok

13:15:38.0547 3772 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys

13:15:38.0594 3772 bowser - ok

13:15:38.0609 3772 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

13:15:38.0687 3772 BrFiltLo - ok

13:15:38.0703 3772 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

13:15:38.0718 3772 BrFiltUp - ok

13:15:38.0750 3772 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll

13:15:38.0859 3772 Browser - ok

13:15:38.0906 3772 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

13:15:38.0968 3772 Brserid - ok

13:15:38.0984 3772 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

13:15:39.0015 3772 BrSerWdm - ok

13:15:39.0030 3772 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

13:15:39.0062 3772 BrUsbMdm - ok

13:15:39.0062 3772 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

13:15:39.0108 3772 BrUsbSer - ok

13:15:39.0124 3772 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

13:15:39.0155 3772 BTHMODEM - ok

13:15:39.0202 3772 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll

13:15:39.0280 3772 bthserv - ok

13:15:39.0311 3772 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

13:15:39.0405 3772 cdfs - ok

13:15:39.0467 3772 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys

13:15:39.0530 3772 cdrom - ok

13:15:39.0576 3772 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

13:15:39.0654 3772 CertPropSvc - ok

13:15:39.0686 3772 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

13:15:39.0717 3772 circlass - ok

13:15:39.0795 3772 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

13:15:39.0857 3772 CLFS - ok

13:15:39.0920 3772 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:15:39.0951 3772 clr_optimization_v2.0.50727_32 - ok

13:15:40.0013 3772 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

13:15:40.0044 3772 clr_optimization_v2.0.50727_64 - ok

13:15:40.0169 3772 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:15:40.0200 3772 clr_optimization_v4.0.30319_32 - ok

13:15:40.0263 3772 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

13:15:40.0294 3772 clr_optimization_v4.0.30319_64 - ok

13:15:40.0325 3772 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

13:15:40.0372 3772 CmBatt - ok

13:15:40.0403 3772 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys

13:15:40.0419 3772 cmdide - ok

13:15:40.0497 3772 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys

13:15:40.0590 3772 CNG - ok

13:15:40.0606 3772 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

13:15:40.0622 3772 Compbatt - ok

13:15:40.0684 3772 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys

13:15:40.0731 3772 CompositeBus - ok

13:15:40.0731 3772 COMSysApp - ok

13:15:40.0762 3772 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

13:15:40.0762 3772 crcdisk - ok

13:15:40.0840 3772 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll

13:15:40.0918 3772 CryptSvc - ok

13:15:40.0965 3772 CtClsFlt (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys

13:15:41.0012 3772 CtClsFlt - ok

13:15:41.0105 3772 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

13:15:41.0168 3772 DcomLaunch - ok

13:15:41.0214 3772 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll

13:15:41.0277 3772 defragsvc - ok

13:15:41.0308 3772 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys

13:15:41.0386 3772 DfsC - ok

13:15:41.0448 3772 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll

13:15:41.0542 3772 Dhcp - ok

13:15:41.0589 3772 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

13:15:41.0636 3772 discache - ok

13:15:41.0667 3772 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

13:15:41.0698 3772 Disk - ok

13:15:41.0729 3772 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll

13:15:41.0823 3772 Dnscache - ok

13:15:41.0901 3772 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe

13:15:41.0979 3772 DockLoginService ( UnsignedFile.Multi.Generic ) - warning

13:15:41.0979 3772 DockLoginService - detected UnsignedFile.Multi.Generic (1)

13:15:42.0026 3772 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll

13:15:42.0119 3772 dot3svc - ok

13:15:42.0150 3772 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll

13:15:42.0228 3772 DPS - ok

13:15:42.0260 3772 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

13:15:42.0291 3772 drmkaud - ok

13:15:42.0478 3772 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys

13:15:42.0556 3772 DXGKrnl - ok

13:15:42.0587 3772 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll

13:15:42.0665 3772 EapHost - ok

13:15:43.0008 3772 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

13:15:43.0196 3772 ebdrv - ok

13:15:43.0367 3772 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe

13:15:43.0398 3772 EFS - ok

13:15:43.0508 3772 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe

13:15:43.0570 3772 ehRecvr - ok

13:15:43.0601 3772 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe

13:15:43.0648 3772 ehSched - ok

13:15:43.0742 3772 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

13:15:43.0773 3772 elxstor - ok

13:15:43.0820 3772 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys

13:15:43.0851 3772 ErrDev - ok

13:15:43.0929 3772 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll

13:15:44.0007 3772 EventSystem - ok

13:15:44.0054 3772 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

13:15:44.0100 3772 exfat - ok

13:15:44.0132 3772 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

13:15:44.0194 3772 fastfat - ok

13:15:44.0303 3772 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe

13:15:44.0350 3772 Fax - ok

13:15:44.0366 3772 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

13:15:44.0397 3772 fdc - ok

13:15:44.0459 3772 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll

13:15:44.0537 3772 fdPHost - ok

13:15:44.0553 3772 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll

13:15:44.0600 3772 FDResPub - ok

13:15:44.0631 3772 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

13:15:44.0662 3772 FileInfo - ok

13:15:44.0678 3772 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

13:15:44.0756 3772 Filetrace - ok

13:15:44.0896 3772 FLEXnet Licensing Service (abedfd48ac042c6aaad32452e77217a1) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

13:15:44.0943 3772 FLEXnet Licensing Service - ok

13:15:45.0021 3772 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

13:15:45.0036 3772 flpydisk - ok

13:15:45.0099 3772 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys

13:15:45.0161 3772 FltMgr - ok

13:15:45.0348 3772 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll

13:15:45.0442 3772 FontCache - ok

13:15:45.0614 3772 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

13:15:45.0629 3772 FontCache3.0.0.0 - ok

13:15:45.0738 3772 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

13:15:45.0754 3772 FsDepends - ok

13:15:45.0785 3772 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys

13:15:45.0816 3772 Fs_Rec - ok

13:15:45.0863 3772 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys

13:15:45.0910 3772 fvevol - ok

13:15:45.0957 3772 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

13:15:45.0972 3772 gagp30kx - ok

13:15:46.0097 3772 GameConsoleService (c1bbce4b30b45410178ee674c818d10c) C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe

13:15:46.0128 3772 GameConsoleService - ok

13:15:46.0144 3772 GoToAssist (d3316f6e3c011435f36e3d6e49b3196c) C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe

13:15:46.0160 3772 GoToAssist - ok

13:15:46.0253 3772 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll

13:15:46.0331 3772 gpsvc - ok

13:15:46.0362 3772 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

13:15:46.0378 3772 hcw85cir - ok

13:15:46.0425 3772 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys

13:15:46.0487 3772 HDAudBus - ok

13:15:46.0534 3772 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys

13:15:46.0565 3772 HECIx64 - ok

13:15:46.0565 3772 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

13:15:46.0596 3772 HidBatt - ok

13:15:46.0612 3772 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

13:15:46.0628 3772 HidBth - ok

13:15:46.0690 3772 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

13:15:46.0721 3772 HidIr - ok

13:15:46.0737 3772 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll

13:15:46.0799 3772 hidserv - ok

13:15:46.0830 3772 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys

13:15:46.0846 3772 HidUsb - ok

13:15:46.0877 3772 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll

13:15:46.0924 3772 hkmsvc - ok

13:15:46.0986 3772 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll

13:15:47.0049 3772 HomeGroupListener - ok

13:15:47.0096 3772 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll

13:15:47.0142 3772 HomeGroupProvider - ok

13:15:47.0189 3772 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys

13:15:47.0220 3772 HpSAMD - ok

13:15:47.0298 3772 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys

13:15:47.0361 3772 HTTP - ok

13:15:47.0392 3772 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys

13:15:47.0392 3772 hwpolicy - ok

13:15:47.0439 3772 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys

13:15:47.0470 3772 i8042prt - ok

13:15:47.0548 3772 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys

13:15:47.0595 3772 iaStorV - ok

13:15:47.0813 3772 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

13:15:47.0876 3772 idsvc - ok

13:15:48.0671 3772 igfx (404548917acaaa314165c2882b045c94) C:\Windows\system32\DRIVERS\igdkmd64.sys

13:15:48.0952 3772 igfx - ok

13:15:49.0139 3772 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

13:15:49.0155 3772 iirsp - ok

13:15:49.0358 3772 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll

13:15:49.0436 3772 IKEEXT - ok

13:15:49.0467 3772 Impcd (4ff8a2082d78255d2eb169f986bcc981) C:\Windows\system32\DRIVERS\Impcd.sys

13:15:49.0498 3772 Impcd - ok

13:15:49.0701 3772 IntcAzAudAddService (2a7cf87be453241fe0baa1c8651e7aa4) C:\Windows\system32\drivers\RTKVHD64.sys

13:15:49.0810 3772 IntcAzAudAddService - ok

13:15:50.0044 3772 IntcDAud (49072edbc5c2f964917d1b585c90ed0a) C:\Windows\system32\DRIVERS\IntcDAud.sys

13:15:50.0122 3772 IntcDAud - ok

13:15:50.0169 3772 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys

13:15:50.0184 3772 intelide - ok

13:15:50.0216 3772 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

13:15:50.0262 3772 intelppm - ok

13:15:50.0294 3772 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll

13:15:50.0387 3772 IPBusEnum - ok

13:15:50.0418 3772 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys

13:15:50.0481 3772 IpFilterDriver - ok

13:15:50.0559 3772 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll

13:15:50.0621 3772 iphlpsvc - ok

13:15:50.0652 3772 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys

13:15:50.0684 3772 IPMIDRV - ok

13:15:50.0715 3772 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

13:15:50.0793 3772 IPNAT - ok

13:15:50.0855 3772 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

13:15:50.0949 3772 IRENUM - ok

13:15:50.0996 3772 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys

13:15:51.0011 3772 isapnp - ok

13:15:51.0058 3772 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys

13:15:51.0105 3772 iScsiPrt - ok

13:15:51.0245 3772 iYogiURLHit.exe (0b7b4a7f60880382789084ba02d142b7) C:\Program Files (x86)\iYogi Support Dock\Services\URLHit\iYogiURLHit.exe

13:15:51.0276 3772 iYogiURLHit.exe ( UnsignedFile.Multi.Generic ) - warning

13:15:51.0276 3772 iYogiURLHit.exe - detected UnsignedFile.Multi.Generic (1)

13:15:51.0292 3772 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys

13:15:51.0323 3772 kbdclass - ok

13:15:51.0370 3772 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys

13:15:51.0401 3772 kbdhid - ok

13:15:51.0417 3772 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

13:15:51.0448 3772 KeyIso - ok

13:15:51.0479 3772 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys

13:15:51.0526 3772 KSecDD - ok

13:15:51.0557 3772 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys

13:15:51.0588 3772 KSecPkg - ok

13:15:51.0620 3772 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

13:15:51.0698 3772 ksthunk - ok

13:15:51.0760 3772 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll

13:15:51.0854 3772 KtmRm - ok

13:15:51.0900 3772 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll

13:15:51.0978 3772 LanmanServer - ok

13:15:52.0041 3772 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll

13:15:52.0119 3772 LanmanWorkstation - ok

13:15:52.0166 3772 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

13:15:52.0228 3772 lltdio - ok

13:15:52.0275 3772 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll

13:15:52.0353 3772 lltdsvc - ok

13:15:52.0368 3772 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll

13:15:52.0415 3772 lmhosts - ok

13:15:52.0431 3772 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

13:15:52.0478 3772 LSI_FC - ok

13:15:52.0493 3772 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

13:15:52.0524 3772 LSI_SAS - ok

13:15:52.0540 3772 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

13:15:52.0540 3772 LSI_SAS2 - ok

13:15:52.0571 3772 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

13:15:52.0634 3772 LSI_SCSI - ok

13:15:52.0649 3772 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

13:15:52.0712 3772 luafv - ok

13:15:52.0743 3772 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll

13:15:52.0805 3772 Mcx2Svc - ok

13:15:52.0836 3772 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

13:15:52.0852 3772 megasas - ok

13:15:52.0883 3772 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

13:15:52.0899 3772 MegaSR - ok

13:15:52.0930 3772 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

13:15:52.0977 3772 MMCSS - ok

13:15:53.0039 3772 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

13:15:53.0102 3772 Modem - ok

13:15:53.0117 3772 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

13:15:53.0148 3772 monitor - ok

13:15:53.0211 3772 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys

13:15:53.0242 3772 mouclass - ok

13:15:53.0258 3772 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

13:15:53.0304 3772 mouhid - ok

13:15:53.0336 3772 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys

13:15:53.0367 3772 mountmgr - ok

13:15:53.0460 3772 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys

13:15:53.0507 3772 mpio - ok

13:15:53.0538 3772 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

13:15:53.0601 3772 mpsdrv - ok

13:15:53.0788 3772 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll

13:15:53.0850 3772 MpsSvc - ok

13:15:53.0882 3772 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys

13:15:53.0928 3772 MRxDAV - ok

13:15:53.0975 3772 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys

13:15:54.0006 3772 mrxsmb - ok

13:15:54.0069 3772 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys

13:15:54.0100 3772 mrxsmb10 - ok

13:15:54.0147 3772 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

13:15:54.0178 3772 mrxsmb20 - ok

13:15:54.0209 3772 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys

13:15:54.0209 3772 msahci - ok

13:15:54.0240 3772 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys

13:15:54.0272 3772 msdsm - ok

13:15:54.0303 3772 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe

13:15:54.0334 3772 MSDTC - ok

13:15:54.0381 3772 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

13:15:54.0412 3772 Msfs - ok

13:15:54.0443 3772 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

13:15:54.0474 3772 mshidkmdf - ok

13:15:54.0490 3772 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys

13:15:54.0506 3772 msisadrv - ok

13:15:54.0552 3772 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll

13:15:54.0615 3772 MSiSCSI - ok

13:15:54.0615 3772 msiserver - ok

13:15:54.0646 3772 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

13:15:54.0693 3772 MSKSSRV - ok

13:15:54.0708 3772 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

13:15:54.0771 3772 MSPCLOCK - ok

13:15:54.0786 3772 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

13:15:54.0849 3772 MSPQM - ok

13:15:54.0880 3772 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys

13:15:54.0911 3772 MsRPC - ok

13:15:54.0942 3772 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys

13:15:54.0958 3772 mssmbios - ok

13:15:54.0989 3772 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

13:15:55.0036 3772 MSTEE - ok

13:15:55.0052 3772 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

13:15:55.0067 3772 MTConfig - ok

13:15:55.0083 3772 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

13:15:55.0098 3772 Mup - ok

13:15:55.0161 3772 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll

13:15:55.0208 3772 napagent - ok

13:15:55.0270 3772 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

13:15:55.0301 3772 NativeWifiP - ok

13:15:55.0395 3772 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys

13:15:55.0426 3772 NDIS - ok

13:15:55.0457 3772 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

13:15:55.0488 3772 NdisCap - ok

13:15:55.0520 3772 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

13:15:55.0551 3772 NdisTapi - ok

13:15:55.0582 3772 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys

13:15:55.0644 3772 Ndisuio - ok

13:15:55.0660 3772 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys

13:15:55.0754 3772 NdisWan - ok

13:15:55.0785 3772 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys

13:15:55.0832 3772 NDProxy - ok

13:15:55.0847 3772 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

13:15:55.0894 3772 NetBIOS - ok

13:15:55.0956 3772 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys

13:15:56.0050 3772 NetBT - ok

13:15:56.0081 3772 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

13:15:56.0097 3772 Netlogon - ok

13:15:56.0159 3772 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll

13:15:56.0222 3772 Netman - ok

13:15:56.0253 3772 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll

13:15:56.0315 3772 netprofm - ok

13:15:56.0424 3772 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

13:15:56.0440 3772 NetTcpPortSharing - ok

13:15:56.0487 3772 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

13:15:56.0502 3772 nfrd960 - ok

13:15:56.0549 3772 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll

13:15:56.0643 3772 NlaSvc - ok

13:15:56.0658 3772 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

13:15:56.0705 3772 Npfs - ok

13:15:56.0721 3772 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll

13:15:56.0768 3772 nsi - ok

13:15:56.0783 3772 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

13:15:56.0814 3772 nsiproxy - ok

13:15:56.0955 3772 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys

13:15:57.0017 3772 Ntfs - ok

13:15:57.0142 3772 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

13:15:57.0189 3772 Null - ok

13:15:57.0236 3772 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys

13:15:57.0267 3772 nvraid - ok

13:15:57.0314 3772 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys

13:15:57.0345 3772 nvstor - ok

13:15:57.0392 3772 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys

13:15:57.0423 3772 nv_agp - ok

13:15:57.0438 3772 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys

13:15:57.0470 3772 ohci1394 - ok

13:15:57.0516 3772 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

13:15:57.0548 3772 p2pimsvc - ok

13:15:57.0610 3772 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll

13:15:57.0626 3772 p2psvc - ok

13:15:57.0657 3772 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

13:15:57.0672 3772 Parport - ok

13:15:57.0719 3772 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys

13:15:57.0750 3772 partmgr - ok

13:15:57.0766 3772 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll

13:15:57.0797 3772 PcaSvc - ok

13:15:57.0922 3772 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 (7317a0b550f7ac0223b7070897670476) c:\program files\dell support center\pcdsrvc_x64.pkms

13:15:57.0938 3772 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok

13:15:57.0984 3772 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys

13:15:58.0016 3772 pci - ok

13:15:58.0047 3772 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys

13:15:58.0062 3772 pciide - ok

13:15:58.0125 3772 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

13:15:58.0156 3772 pcmcia - ok

13:15:58.0187 3772 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

13:15:58.0203 3772 pcw - ok

13:15:58.0250 3772 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

13:15:58.0312 3772 PEAUTH - ok

13:15:58.0390 3772 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe

13:15:58.0421 3772 PerfHost - ok

13:15:58.0530 3772 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll

13:15:58.0655 3772 pla - ok

13:15:58.0733 3772 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll

13:15:58.0764 3772 PlugPlay - ok

13:15:58.0796 3772 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll

13:15:58.0842 3772 PNRPAutoReg - ok

13:15:58.0889 3772 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll

13:15:58.0889 3772 PNRPsvc - ok

13:15:58.0952 3772 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll

13:15:59.0030 3772 PolicyAgent - ok

13:15:59.0061 3772 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll

13:15:59.0108 3772 Power - ok

13:15:59.0170 3772 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys

13:15:59.0232 3772 PptpMiniport - ok

13:15:59.0264 3772 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

13:15:59.0295 3772 Processor - ok

13:15:59.0326 3772 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll

13:15:59.0373 3772 ProfSvc - ok

13:15:59.0404 3772 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

13:15:59.0420 3772 ProtectedStorage - ok

13:15:59.0482 3772 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys

13:15:59.0529 3772 Psched - ok

13:15:59.0591 3772 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys

13:15:59.0591 3772 PxHlpa64 - ok

13:15:59.0716 3772 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

13:15:59.0763 3772 ql2300 - ok

13:15:59.0903 3772 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

13:15:59.0934 3772 ql40xx - ok

13:15:59.0981 3772 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll

13:16:00.0012 3772 QWAVE - ok

13:16:00.0028 3772 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

13:16:00.0075 3772 QWAVEdrv - ok

13:16:00.0090 3772 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

13:16:00.0137 3772 RasAcd - ok

13:16:00.0184 3772 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

13:16:00.0231 3772 RasAgileVpn - ok

13:16:00.0246 3772 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll

13:16:00.0309 3772 RasAuto - ok

13:16:00.0340 3772 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys

13:16:00.0402 3772 Rasl2tp - ok

13:16:00.0449 3772 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll

13:16:00.0512 3772 RasMan - ok

13:16:00.0527 3772 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

13:16:00.0574 3772 RasPppoe - ok

13:16:00.0605 3772 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

13:16:00.0668 3772 RasSstp - ok

13:16:00.0683 3772 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys

13:16:00.0761 3772 rdbss - ok

13:16:00.0777 3772 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

13:16:00.0839 3772 rdpbus - ok

13:16:00.0870 3772 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

13:16:00.0917 3772 RDPCDD - ok

13:16:00.0933 3772 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

13:16:00.0964 3772 RDPENCDD - ok

13:16:01.0011 3772 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

13:16:01.0042 3772 RDPREFMP - ok

13:16:01.0089 3772 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys

13:16:01.0120 3772 RDPWD - ok

13:16:01.0198 3772 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys

13:16:01.0229 3772 rdyboost - ok

13:16:01.0260 3772 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll

13:16:01.0323 3772 RemoteAccess - ok

13:16:01.0370 3772 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll

13:16:01.0432 3772 RemoteRegistry - ok

13:16:01.0448 3772 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll

13:16:01.0494 3772 RpcEptMapper - ok

13:16:01.0526 3772 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe

13:16:01.0541 3772 RpcLocator - ok

13:16:01.0604 3772 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll

13:16:01.0666 3772 RpcSs - ok

13:16:01.0697 3772 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

13:16:01.0760 3772 rspndr - ok

13:16:01.0806 3772 RSUSBSTOR (502b316947ea887cddd325d4745eb7d0) C:\Windows\system32\Drivers\RtsUStor.sys

13:16:01.0838 3772 RSUSBSTOR - ok

13:16:01.0884 3772 RTL8167 (4fe1cef69d36e913738234303986fbb3) C:\Windows\system32\DRIVERS\Rt64win7.sys

13:16:01.0947 3772 RTL8167 - ok

13:16:01.0978 3772 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

13:16:01.0994 3772 SamSs - ok

13:16:02.0025 3772 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys

13:16:02.0072 3772 sbp2port - ok

13:16:02.0243 3772 SBSDWSCService (794d4b48dfb6e999537c7c3947863463) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

13:16:02.0290 3772 SBSDWSCService - ok

13:16:02.0337 3772 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll

13:16:02.0399 3772 SCardSvr - ok

13:16:02.0477 3772 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys

13:16:02.0540 3772 scfilter - ok

13:16:02.0664 3772 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll

13:16:02.0758 3772 Schedule - ok

13:16:02.0789 3772 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll

13:16:02.0836 3772 SCPolicySvc - ok

13:16:02.0883 3772 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll

13:16:02.0930 3772 SDRSVC - ok

13:16:03.0039 3772 SeaPort (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

13:16:03.0070 3772 SeaPort - ok

13:16:03.0117 3772 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

13:16:03.0148 3772 secdrv - ok

13:16:03.0179 3772 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll

13:16:03.0242 3772 seclogon - ok

13:16:03.0257 3772 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll

13:16:03.0304 3772 SENS - ok

13:16:03.0320 3772 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll

13:16:03.0351 3772 SensrSvc - ok

13:16:03.0366 3772 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

13:16:03.0398 3772 Serenum - ok

13:16:03.0444 3772 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

13:16:03.0491 3772 Serial - ok

13:16:03.0538 3772 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

13:16:03.0554 3772 sermouse - ok

13:16:03.0600 3772 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll

13:16:03.0663 3772 SessionEnv - ok

13:16:03.0694 3772 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys

13:16:03.0725 3772 sffdisk - ok

13:16:03.0741 3772 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys

13:16:03.0756 3772 sffp_mmc - ok

13:16:03.0772 3772 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys

13:16:03.0788 3772 sffp_sd - ok

13:16:03.0819 3772 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

13:16:03.0834 3772 sfloppy - ok

13:16:03.0881 3772 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll

13:16:03.0959 3772 SharedAccess - ok

13:16:04.0022 3772 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll

13:16:04.0084 3772 ShellHWDetection - ok

13:16:04.0100 3772 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

13:16:04.0115 3772 SiSRaid2 - ok

13:16:04.0131 3772 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

13:16:04.0146 3772 SiSRaid4 - ok

13:16:04.0178 3772 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

13:16:04.0224 3772 Smb - ok

13:16:04.0256 3772 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe

13:16:04.0287 3772 SNMPTRAP - ok

13:16:04.0302 3772 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

13:16:04.0318 3772 spldr - ok

13:16:04.0380 3772 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe

13:16:04.0443 3772 Spooler - ok

13:16:04.0786 3772 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe

13:16:04.0895 3772 sppsvc - ok

13:16:05.0036 3772 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll

13:16:05.0098 3772 sppuinotify - ok

13:16:05.0176 3772 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys

13:16:05.0238 3772 srv - ok

13:16:05.0301 3772 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys

13:16:05.0348 3772 srv2 - ok

13:16:05.0363 3772 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys

13:16:05.0394 3772 srvnet - ok

13:16:05.0441 3772 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll

13:16:05.0519 3772 SSDPSRV - ok

13:16:05.0535 3772 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll

13:16:05.0613 3772 SstpSvc - ok

13:16:05.0628 3772 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

13:16:05.0644 3772 stexstor - ok

13:16:05.0706 3772 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll

13:16:05.0769 3772 stisvc - ok

13:16:05.0925 3772 SupportDockClientService.exe (3d9deca9db329aa22db331d060b5a1c3) C:\Program Files (x86)\iYogi Support Dock\Services\CommAgent\SupportDockClientService.exe

13:16:05.0925 3772 SupportDockClientService.exe ( UnsignedFile.Multi.Generic ) - warning

13:16:05.0925 3772 SupportDockClientService.exe - detected UnsignedFile.Multi.Generic (1)

13:16:05.0987 3772 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys

13:16:06.0003 3772 swenum - ok

13:16:06.0346 3772 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll

13:16:06.0424 3772 swprv - ok

13:16:06.0861 3772 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll

13:16:06.0954 3772 SysMain - ok

13:16:07.0126 3772 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll

13:16:07.0173 3772 TabletInputService - ok

13:16:07.0235 3772 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll

13:16:07.0298 3772 TapiSrv - ok

13:16:07.0329 3772 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll

13:16:07.0360 3772 TBS - ok

13:16:07.0563 3772 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys

13:16:07.0610 3772 Tcpip - ok

13:16:07.0890 3772 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys

13:16:07.0937 3772 TCPIP6 - ok

13:16:08.0046 3772 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys

13:16:08.0124 3772 tcpipreg - ok

13:16:08.0156 3772 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

13:16:08.0202 3772 TDPIPE - ok

13:16:08.0234 3772 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys

13:16:08.0280 3772 TDTCP - ok

13:16:08.0312 3772 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys

13:16:08.0374 3772 tdx - ok

13:16:08.0624 3772 TeamViewer5 (2a64c802f4c8aa00ac8472c771688e00) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

13:16:08.0702 3772 TeamViewer5 - ok

13:16:08.0842 3772 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys

13:16:08.0858 3772 TermDD - ok

13:16:08.0951 3772 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll

13:16:09.0029 3772 TermService - ok

13:16:09.0045 3772 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll

13:16:09.0076 3772 Themes - ok

13:16:09.0092 3772 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll

13:16:09.0123 3772 THREADORDER - ok

13:16:09.0154 3772 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll

13:16:09.0232 3772 TrkWks - ok

13:16:09.0294 3772 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe

13:16:09.0372 3772 TrustedInstaller - ok

13:16:09.0388 3772 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys

13:16:09.0450 3772 tssecsrv - ok

13:16:09.0497 3772 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys

13:16:09.0528 3772 TsUsbFlt - ok

13:16:09.0560 3772 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys

13:16:09.0653 3772 tunnel - ok

13:16:09.0669 3772 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

13:16:09.0684 3772 uagp35 - ok

13:16:09.0731 3772 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys

13:16:09.0809 3772 udfs - ok

13:16:09.0840 3772 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe

13:16:09.0872 3772 UI0Detect - ok

13:16:09.0918 3772 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys

13:16:09.0950 3772 uliagpkx - ok

13:16:10.0012 3772 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys

13:16:10.0059 3772 umbus - ok

13:16:10.0121 3772 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

13:16:10.0152 3772 UmPass - ok

13:16:10.0199 3772 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll

13:16:10.0262 3772 upnphost - ok

13:16:10.0293 3772 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys

13:16:10.0324 3772 usbccgp - ok

13:16:10.0371 3772 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys

13:16:10.0433 3772 usbcir - ok

13:16:10.0464 3772 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys

13:16:10.0496 3772 usbehci - ok

13:16:10.0558 3772 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys

13:16:10.0605 3772 usbhub - ok

13:16:10.0636 3772 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys

13:16:10.0667 3772 usbohci - ok

13:16:10.0714 3772 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

13:16:10.0745 3772 usbprint - ok

13:16:10.0761 3772 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys

13:16:10.0792 3772 usbscan - ok

13:16:10.0823 3772 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS

13:16:10.0854 3772 USBSTOR - ok

13:16:10.0886 3772 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys

13:16:10.0917 3772 usbuhci - ok

13:16:10.0979 3772 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys

13:16:11.0010 3772 usbvideo - ok

13:16:11.0057 3772 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll

13:16:11.0120 3772 UxSms - ok

13:16:11.0135 3772 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe

13:16:11.0151 3772 VaultSvc - ok

13:16:11.0229 3772 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys

13:16:11.0260 3772 vdrvroot - ok

13:16:11.0322 3772 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe

13:16:11.0385 3772 vds - ok

13:16:11.0416 3772 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

13:16:11.0447 3772 vga - ok

13:16:11.0447 3772 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

13:16:11.0494 3772 VgaSave - ok

13:16:11.0541 3772 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys

13:16:11.0572 3772 vhdmp - ok

13:16:11.0619 3772 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys

13:16:11.0634 3772 viaide - ok

13:16:11.0666 3772 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys

13:16:11.0697 3772 volmgr - ok

13:16:11.0790 3772 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys

13:16:11.0837 3772 volmgrx - ok

13:16:11.0884 3772 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys

13:16:11.0931 3772 volsnap - ok

13:16:11.0978 3772 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

13:16:12.0009 3772 vsmraid - ok

13:16:12.0180 3772 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe

13:16:12.0274 3772 VSS - ok

13:16:12.0508 3772 vToolbarUpdater11.1.0 (5fa45791413acce628d5361458f32dde) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe

13:16:12.0555 3772 vToolbarUpdater11.1.0 - ok

13:16:12.0711 3772 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys

13:16:12.0758 3772 vwifibus - ok

13:16:12.0773 3772 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys

13:16:12.0804 3772 vwififlt - ok

13:16:12.0851 3772 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll

13:16:12.0914 3772 W32Time - ok

13:16:12.0929 3772 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

13:16:12.0945 3772 WacomPen - ok

13:16:12.0992 3772 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

13:16:13.0054 3772 WANARP - ok

13:16:13.0070 3772 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys

13:16:13.0116 3772 Wanarpv6 - ok

13:16:13.0257 3772 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe

13:16:13.0350 3772 WatAdminSvc - ok

13:16:13.0491 3772 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe

13:16:13.0538 3772 wbengine - ok

13:16:13.0678 3772 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll

13:16:13.0725 3772 WbioSrvc - ok

13:16:13.0772 3772 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll

13:16:13.0834 3772 wcncsvc - ok

13:16:13.0850 3772 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll

13:16:13.0865 3772 WcsPlugInService - ok

13:16:13.0896 3772 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

13:16:13.0912 3772 Wd - ok

13:16:13.0974 3772 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

13:16:14.0037 3772 Wdf01000 - ok

13:16:14.0068 3772 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

13:16:14.0115 3772 WdiServiceHost - ok

13:16:14.0115 3772 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll

13:16:14.0146 3772 WdiSystemHost - ok

13:16:14.0177 3772 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll

13:16:14.0255 3772 WebClient - ok

13:16:14.0286 3772 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll

13:16:14.0364 3772 Wecsvc - ok

13:16:14.0396 3772 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll

13:16:14.0442 3772 wercplsupport - ok

13:16:14.0474 3772 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll

13:16:14.0505 3772 WerSvc - ok

13:16:14.0567 3772 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

13:16:14.0630 3772 WfpLwf - ok

13:16:14.0645 3772 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

13:16:14.0661 3772 WIMMount - ok

13:16:14.0692 3772 WinDefend - ok

13:16:14.0692 3772 WinHttpAutoProxySvc - ok

13:16:14.0754 3772 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll

13:16:14.0817 3772 Winmgmt - ok

13:16:15.0020 3772 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll

13:16:15.0113 3772 WinRM - ok

13:16:15.0332 3772 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll

13:16:15.0410 3772 Wlansvc - ok

13:16:15.0659 3772 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

13:16:15.0722 3772 wlidsvc - ok

13:16:15.0784 3772 wltrysvc (13b0a570e1ae451c92da550085d72cf3) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE

13:16:15.0800 3772 wltrysvc ( UnsignedFile.Multi.Generic ) - warning

13:16:15.0800 3772 wltrysvc - detected UnsignedFile.Multi.Generic (1)

13:16:15.0940 3772 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys

13:16:15.0971 3772 WmiAcpi - ok

13:16:16.0034 3772 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe

13:16:16.0080 3772 wmiApSrv - ok

13:16:16.0112 3772 WMPNetworkSvc - ok

13:16:16.0143 3772 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll

13:16:16.0158 3772 WPCSvc - ok

13:16:16.0205 3772 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll

13:16:16.0252 3772 WPDBusEnum - ok

13:16:16.0299 3772 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

13:16:16.0346 3772 ws2ifsl - ok

13:16:16.0377 3772 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll

13:16:16.0408 3772 wscsvc - ok

13:16:16.0408 3772 WSearch - ok

13:16:16.0626 3772 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll

13:16:16.0704 3772 wuauserv - ok

13:16:16.0860 3772 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys

13:16:16.0923 3772 WudfPf - ok

13:16:16.0970 3772 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys

13:16:17.0032 3772 WUDFRd - ok

13:16:17.0048 3772 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll

13:16:17.0094 3772 wudfsvc - ok

13:16:17.0126 3772 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll

13:16:17.0172 3772 WwanSvc - ok

13:16:17.0204 3772 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

13:16:17.0672 3772 \Device\Harddisk0\DR0 - ok

13:16:17.0672 3772 Boot (0x1200) (ce5930b5af712151cfbbdaa1e8996462) \Device\Harddisk0\DR0\Partition0

13:16:17.0672 3772 \Device\Harddisk0\DR0\Partition0 - ok

13:16:17.0687 3772 Boot (0x1200) (5fbeec304255b89f9f44bfbc42ea0a09) \Device\Harddisk0\DR0\Partition1

13:16:17.0703 3772 \Device\Harddisk0\DR0\Partition1 - ok

13:16:17.0718 3772 Boot (0x1200) (5ea90ad8fd976695ced9d65df11e398f) \Device\Harddisk0\DR0\Partition2

13:16:17.0718 3772 \Device\Harddisk0\DR0\Partition2 - ok

13:16:17.0718 3772 ============================================================

13:16:17.0718 3772 Scan finished

13:16:17.0718 3772 ============================================================

13:16:17.0734 0208 Detected object count: 4

13:16:17.0734 0208 Actual detected object count: 4

13:18:46.0200 0208 DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user

13:18:46.0200 0208 DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:18:46.0200 0208 iYogiURLHit.exe ( UnsignedFile.Multi.Generic ) - skipped by user

13:18:46.0200 0208 iYogiURLHit.exe ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:18:46.0200 0208 SupportDockClientService.exe ( UnsignedFile.Multi.Generic ) - skipped by user

13:18:46.0200 0208 SupportDockClientService.exe ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:18:46.0200 0208 wltrysvc ( UnsignedFile.Multi.Generic ) - skipped by user

13:18:46.0200 0208 wltrysvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

13:19:16.0682 1704 Deinitialize success

MrCharlie · June 27, 2012

That scan was clean.....please do this......

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

DaveFL · June 27, 2012

Thanks again Mr C!

Combofix ran as advertised. The Report:

ComboFix 12-06-27.01 - Judith 06/27/2012 14:31:56.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3893.2321 [GMT -4:00]

Running from: c:\users\Judith\Desktop\ComboFix.exe

AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-05-27 to 2012-06-27 )))))))))))))))))))))))))))))))

.

2012-06-27 18:39 . 2012-06-27 18:39 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-26 20:06 . 2012-06-27 16:06 -------- d-----w- c:\program files (x86)\MALWAREBYTES ANTI-MALWARE

2012-06-22 14:59 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-22 14:59 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll

2012-06-22 14:59 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-06-22 14:59 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-22 14:59 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll

2012-06-22 14:59 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-06-22 14:59 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-06-22 14:58 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-22 14:58 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-06-21 23:18 . 2012-06-21 23:18 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-06-21 23:18 . 2012-06-21 23:18 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-06-12 19:01 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-04 19:56 . 2010-01-25 22:39 24904 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-03-30 11:35 . 2012-05-13 15:29 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-06-11 22:37 2068536 ----a-w- c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-11 2068536]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]

"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-07-07 1779952]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]

"AVG_TRAY"="c:\program files (x86)\AVG\AVG10\avgtray.exe" [2012-01-18 2339168]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-06-11 1104440]

"ROC_roc_dec12"="c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-19 928096]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

.

c:\users\Judith\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-21 257224]

R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264]

R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2010-11-18 25072]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-07-17 220672]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-05 1255736]

S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 26704]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2011-03-16 37456]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]

S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [2010-07-12 57696]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2011-01-07 304720]

S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-03-01 41552]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2011-04-05 377936]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 169312]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-10-09 92160]

S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG10\avgfws.exe [2011-03-09 2708024]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-01-31 7391072]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]

S2 iYogiURLHit.exe;iYogi Hit Agent;c:\program files (x86)\iYogi Support Dock\Services\URLHit\iYogiURLHit.exe [2010-12-03 17408]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 SupportDockClientService.exe;iYogi Communication Agent;c:\program files (x86)\iYogi Support Dock\Services\CommAgent\SupportDockClientService.exe [2010-12-07 55296]

S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-10-19 2011944]

S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-06-11 935480]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-05-27 118864]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 29264]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-12 151040]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-09-26 233984]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-21 413800]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2012-06-27 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-21 23:19]

.

2012-06-05 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

- c:\program files\Dell Support Center\uaclauncher.exe [2010-11-18 15:13]

.

2012-06-26 c:\windows\Tasks\SystemToolsDailyTest.job

- c:\program files\Dell Support Center\pcdrcui.exe [2010-11-18 15:13]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-09-16 357376]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-09 8158240]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-23 166424]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-23 390168]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-23 408600]

"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2009-10-01 3189016]

"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]

"EPSON Stylus CX6000 Series"="c:\windows\system32\spool\DRIVERS\x64\3\E_FATIBIA.EXE" [2006-02-13 131072]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://m.www.yahoo.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

Toolbar-Locked - (no file)

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

SafeBoot-mcmscsvc

SafeBoot-MCODS

Toolbar-Locked - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]

"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,

91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,

38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4

"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,

57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b

"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,

6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:43,54,e4,3b,2d,26,cd,01

.

[HKEY_USERS\S-1-5-21-1495080282-3682843450-985909605-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-1495080282-3682843450-985909605-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\OpenOffice.org 3\program\soffice.exe

c:\program files (x86)\OpenOffice.org 3\program\soffice.bin

c:\program files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

c:\program files (x86)\Common Files\Java\Java Update\jucheck.exe

.

**************************************************************************

.

Completion time: 2012-06-27 14:55:20 - machine was rebooted

ComboFix-quarantined-files.txt 2012-06-27 18:55

.

Pre-Run: 16,540,893,184 bytes free

Post-Run: 16,460,296,192 bytes free

.

- - End Of File - - 79D2C357C7427A992E14F87C7E1F2791

MrCharlie · June 27, 2012

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

DaveFL · June 27, 2012

Thanks Mr Charlie!

MBAM scan was Clean!

I rebooted afterwords, opened IE, scanned again, and it was clean!

Am I Fixed?

the MBAM log:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.06.27.09

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Judith :: JUDITH-PC [administrator]

6/27/2012 3:36:47 PM

mbam-log-2012-06-27 (15-36-47).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 209807

Time elapsed: 3 minute(s), 18 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

MrCharlie · June 27, 2012

Great

A little clean up to do....

Please Uninstall ComboFix:

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

---------------------------------

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

DaveFL · June 27, 2012

Thanks again, Mr Charlie!

Maurice Naggar · June 28, 2012

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Trojan.agent keeps coming back.

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information