fyzhix Posted July 13, 2012 ID:570318 Share Posted July 13, 2012 Hello,I was hoping to receive some help removing the above mentioned malware which was recently found on my laptop. I've tried a number of malware removal tools and they have been unsuccessful (Malwarebytes, Prevx) along with a few guides online. I've booted into windows safe mode (and booted from a flashdrive made on a clean computer) and tried to remove the files manually in the command prompt but again, no success.TDS detected some suspicious items but the option to cure was not available. I'll post each of the scan logs as a reply to this message.Thank you Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570319 Share Posted July 13, 2012 Malwarebytes Anti-Malware 1.62.0.1300www.malwarebytes.orgDatabase version: v2012.07.13.09Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421Jon :: FYZHIX [administrator]13/07/2012 2:19:50 PMmbam-log-2012-07-13 (14-19-50).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 211615Time elapsed: 3 minute(s), 41 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 1C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.(end) Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570320 Share Posted July 13, 2012 OTL logfile created on: 7/13/2012 3:16:48 PM - Run 1OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Jon\Downloads64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.0.8112.16421)Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy7.99 Gb Total Physical Memory | 5.91 Gb Available Physical Memory | 73.99% Memory free15.98 Gb Paging File | 13.63 Gb Available in Paging File | 85.32% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.07 Gb Total Space | 115.00 Gb Free Space | 25.49% Space Free | Partition Type: NTFSComputer Name: FYZHIX | User Name: Jon | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - File not found --PRC - [2012/07/13 15:15:59 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Jon\Downloads\OTL.exePRC - [2012/07/05 16:39:23 | 000,529,232 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exePRC - [2012/06/23 21:50:22 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exePRC - [2012/04/04 01:53:56 | 000,815,512 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exePRC - [2012/03/28 21:54:08 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\nlssrv32.exePRC - [2011/12/24 02:05:21 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exePRC - [2010/04/01 05:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exePRC - [2010/02/11 12:56:00 | 000,415,040 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exePRC - [2010/02/11 12:53:00 | 000,660,800 | ---- | M] (SoftThinks) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exePRC - [2009/12/29 17:35:38 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exePRC - [2009/10/15 04:10:28 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exePRC - [2009/06/24 17:21:38 | 000,409,744 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exePRC - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exePRC - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exePRC - [2009/02/24 16:47:06 | 000,143,360 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe========== Modules (No Company Name) ==========MOD - [2012/07/05 16:39:20 | 020,313,384 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dllMOD - [2012/07/05 16:39:12 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dllMOD - [2012/07/05 16:39:12 | 000,895,312 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dllMOD - [2012/07/05 16:39:12 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dllMOD - [2012/07/05 16:39:12 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dllMOD - [2012/06/23 21:50:21 | 002,042,848 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dllMOD - [2012/05/10 03:30:01 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dllMOD - [2012/05/10 03:29:57 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dllMOD - [2012/05/10 03:29:51 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dllMOD - [2011/11/02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dllMOD - [2011/11/02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dllMOD - [2010/11/20 08:19:56 | 000,232,448 | ---- | M] () -- \\?\globalroot\systemroot\syswow64\mswsock.DLLMOD - [2010/11/20 08:19:56 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dllMOD - [2010/02/11 12:56:00 | 000,415,040 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exeMOD - [2010/02/11 12:53:00 | 000,234,816 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dllMOD - [2010/02/11 12:53:00 | 000,128,320 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dllMOD - [2010/02/11 12:53:00 | 000,121,152 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dllMOD - [2010/02/11 12:53:00 | 000,111,936 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dllMOD - [2010/02/11 12:53:00 | 000,079,168 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dllMOD - [2010/02/11 12:53:00 | 000,075,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dllMOD - [2010/02/11 12:52:00 | 001,123,648 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dllMOD - [2009/10/15 04:10:28 | 000,498,160 | ---- | M] () -- C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exeMOD - [2009/02/27 17:38:20 | 000,139,264 | R--- | M] () -- C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll========== Win32 Services (SafeList) ==========SRV:64bit: - File not found [Auto | Stopped] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)SRV:64bit: - [2012/04/10 23:07:31 | 006,746,280 | ---- | M] (Prevx) [Auto | Running] -- C:\Program Files\Prevx\prevx.exe -- (CSIScanner)SRV:64bit: - [2012/04/04 13:51:56 | 000,032,400 | ---- | M] () [Auto | Running] -- C:\Program Files\UCT\HDR Express\HDRExpressService.exe -- (HDRExpressService)SRV:64bit: - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)SRV:64bit: - [2011/11/09 23:11:32 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)SRV:64bit: - [2010/01/20 16:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\stacsv64.exe -- (STacSV)SRV:64bit: - [2009/11/02 13:48:18 | 000,126,352 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)SRV:64bit: - [2009/09/21 16:24:40 | 001,420,560 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel®SRV:64bit: - [2009/09/21 16:03:06 | 000,315,664 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)SRV:64bit: - [2009/09/21 16:00:44 | 000,831,760 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel®SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV:64bit: - [2009/03/02 14:42:00 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters)SRV:64bit: - [2007/02/12 04:43:00 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\SysNative\drivers\o2flash.exe -- (O2FLASH)SRV - [2012/07/11 23:48:54 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2012/07/05 16:39:23 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)SRV - [2012/06/23 21:50:21 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)SRV - [2012/03/28 21:54:08 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc)SRV - [2010/10/08 15:51:29 | 000,658,432 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)SRV - [2010/05/27 13:20:53 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)SRV - [2010/02/11 12:53:00 | 000,660,800 | ---- | M] (SoftThinks) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)SRV - [2010/01/20 16:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe -- (STacSV)SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2009/06/05 20:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe -- (GameConsoleService)SRV - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)SRV - [2009/03/02 14:42:00 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters)========== Driver Services (SafeList) ==========DRV:64bit: - [2012/04/10 23:07:32 | 000,065,736 | ---- | M] (Prevx) [File_System | System | Running] -- C:\Windows\SysNative\drivers\pxrts.sys -- (pxrts)DRV:64bit: - [2012/04/10 23:07:32 | 000,036,384 | ---- | M] (Prevx) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pxscan.sys -- (pxscan)DRV:64bit: - [2012/04/10 23:07:31 | 000,024,024 | ---- | M] (Prevx) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\pxkbf.sys -- (pxkbf)DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)DRV:64bit: - [2012/02/15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:64bit: - [2011/11/09 23:45:30 | 010,567,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)DRV:64bit: - [2011/11/09 23:45:30 | 010,567,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)DRV:64bit: - [2011/11/09 22:12:44 | 000,325,632 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)DRV:64bit: - [2011/06/10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)DRV:64bit: - [2010/11/20 05:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)DRV:64bit: - [2010/10/08 00:41:53 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)DRV:64bit: - [2010/04/08 04:12:02 | 000,124,944 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)DRV:64bit: - [2010/01/20 16:10:00 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)DRV:64bit: - [2009/11/13 02:42:52 | 000,074,272 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\o2mdgx64.sys -- (O2MDGRDR)DRV:64bit: - [2009/11/02 13:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)DRV:64bit: - [2009/10/29 06:02:48 | 000,299,056 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)DRV:64bit: - [2009/09/17 14:33:00 | 000,023,912 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Acceler.sys -- (Acceler)DRV:64bit: - [2009/09/15 12:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel®DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/07/13 20:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)DRV:64bit: - [2009/07/09 04:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)DRV:64bit: - [2009/06/15 14:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2006/11/01 12:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)DRV - [2009/12/29 17:35:40 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/05/27 12:31:11] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl -- ({1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7})DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0E937946-F307-4D87-B8EC-7264358E0E93}IE:64bit: - HKLM\..\SearchScopes\{0E937946-F307-4D87-B8EC-7264358E0E93}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBoxIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\..\SearchScopes,DefaultScope = {F36BF7D4-67A4-4797-965A-DAA94CECC552}IE - HKLM\..\SearchScopes\{F36BF7D4-67A4-4797-965A-DAA94CECC552}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBoxIE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {F36BF7D4-67A4-4797-965A-DAA94CECC552}IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {F36BF7D4-67A4-4797-965A-DAA94CECC552}IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/23IE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ieIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie'>http://www.google.com/ieIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://my.olg.ca/dana-na/auth/url_default/welcome.cgiIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ieIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ieIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\..\SearchScopes,DefaultScope = {06BBA5A7-DF97-455E-897A-DE1D33E6B3F2}IE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\..\SearchScopes\{06BBA5A7-DF97-455E-897A-DE1D33E6B3F2}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8IE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searIE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local========== FireFox ==========FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22FF - user.js - File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Jon\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Jon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Jon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jon\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jon\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2011/08/28 16:46:01 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012/04/17 12:39:40 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/23 21:50:22 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/07/05 18:53:57 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012/06/22 19:09:12 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012/05/17 20:26:17 | 000,000,000 | ---D | M]FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/23 21:50:22 | 000,000,000 | ---D | M]FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/07/05 18:53:57 | 000,000,000 | ---D | M][2010/06/05 01:20:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jon\AppData\Roaming\Mozilla\Extensions[2010/06/05 01:07:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jon\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}[2012/07/05 16:54:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jon\AppData\Roaming\Mozilla\Firefox\Profiles\gk0r17dz.default\extensions[2012/01/09 20:59:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions[2012/04/17 12:39:40 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES (X86)\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN[2012/07/05 16:54:31 | 000,743,290 | ---- | M] () (No name found) -- C:\USERS\JON\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GK0R17DZ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI[2012/05/05 12:26:06 | 000,035,695 | ---- | M] () (No name found) -- C:\USERS\JON\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GK0R17DZ.DEFAULT\EXTENSIONS\FACEBOOK@DISCONNECT.ME.XPI[2012/06/23 21:50:22 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll[2010/06/05 01:26:04 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll[2011/05/04 23:40:47 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml[2011/11/08 20:58:15 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml========== Chrome ==========CHR - homepage: http://g.msn.com/USCON/23CHR - default_search_provider: Google (Enabled)CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}CHR - homepage: http://g.msn.com/USCON/23CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Jon\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dllCHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dllCHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dllCHR - plugin: Java Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dllCHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\nppdf32.dllCHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dllCHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dllCHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLLCHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLLCHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewerCHR - plugin: Native Client (Enabled) = C:\Users\Jon\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dllCHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Jon\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dllCHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dllCHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Jon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dllCHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\Jon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dllCHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dllCHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllCHR - plugin: Google Update (Enabled) = C:\Users\Jon\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dllCHR - plugin: Facebook Plugin (Enabled) = C:\Users\Jon\AppData\Roaming\Facebook\npfbplugin_1_0_3.dllCHR - plugin: Default Plug-in (Enabled) = default_pluginCHR - Extension: YouTube = C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\CHR - Extension: Google Search = C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\CHR - Extension: Dark abstract theme = C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnneafiffajmgfkidbdfpfkehpodbhkd\1.2_0\CHR - Extension: Downloads = C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfchnphgogjhineanplmfkofljiagjfb\1_0\CHR - Extension: Gmail = C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)O4:64bit: - HKLM..\Run: [intelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)O4:64bit: - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)O4:64bit: - HKLM..\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not foundO4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe ()O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)O4 - HKLM..\Run: [startCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)O4 - HKLM..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-21-13878151-3475214259-3496771340-1001..\Run: [AdobeBridge] File not foundO4 - HKU\S-1-5-21-13878151-3475214259-3496771340-1001..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)O4 - HKU\S-1-5-21-13878151-3475214259-3496771340-1001..\Run: [steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)O4:64bit: - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe (Softthinks)O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not foundO4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not foundO4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not foundO4 - Startup: C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not foundO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1O7 - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not foundO8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not foundO10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not foundO1364bit: - gopher Prefix: missingO13 - gopher Prefix: missingO16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)O16 - DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} https://my.olg.ca/,DanaInfo=OLGCTOR03.ent.ad.mre,ST=1+/dwa85W.cab (IBM Lotus iNotes 8.5 Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{592560D1-F2F9-4783-A21A-244096A5A365}: DhcpNameServer = 192.168.0.1O18:64bit: - Protocol\Handler\livecall - No CLSID value foundO18:64bit: - Protocol\Handler\msdaipp - No CLSID value foundO18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value foundO18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value foundO18:64bit: - Protocol\Handler\ms-help - No CLSID value foundO18:64bit: - Protocol\Handler\msnim - No CLSID value foundO18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not foundO20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not foundO21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O35 - HKU\S-1-5-21-13878151-3475214259-3496771340-1001..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKU\.DEFAULT\...exe [@ = exefile] -- "%1" %*O37 - HKU\S-1-5-18\...exe [@ = exefile] -- "%1" %*O37 - HKU\S-1-5-21-13878151-3475214259-3496771340-1001\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)========== Files/Folders - Created Within 30 Days ==========[2012/07/13 10:59:42 | 000,000,000 | ---D | C] -- C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam[2012/07/12 19:56:34 | 000,000,000 | ---D | C] -- C:\Users\Jon\Desktop\Untitled Export[2012/07/12 19:02:32 | 000,000,000 | ---D | C] -- C:\Users\Jon\Documents\Adobe[2012/07/12 18:51:30 | 000,000,000 | ---D | C] -- C:\Users\Jon\Desktop\Adobe[2012/07/11 01:38:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DeepSkyStacker[2012/07/11 01:38:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DeepSkyStacker[2012/07/07 08:33:41 | 000,000,000 | ---D | C] -- C:\Users\Jon\Documents\Astronomy Tools[2012/07/07 08:33:22 | 000,000,000 | ---D | C] -- C:\Users\Jon\Desktop\New Folder[2012/07/07 07:45:43 | 000,000,000 | ---D | C] -- C:\Users\Jon\AppData\Roaming\Stellarium[2012/07/07 07:45:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellarium[2012/07/07 07:45:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Stellarium[2012/07/05 18:55:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Oracle[2012/07/04 19:32:19 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%[2012/06/20 19:10:38 | 000,000,000 | ---D | C] -- C:\Users\Jon\Documents\Pay stubs[2012/06/19 22:09:05 | 000,000,000 | ---D | C] -- C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RegiStax 5[2012/06/19 22:09:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RegiStax 5_1[2012/06/15 03:07:43 | 000,000,000 | ---D | C] -- C:\Users\Jon\Logitech[2012/06/15 03:07:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Remote Control Software Common[2012/06/15 03:07:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech[2012/06/15 03:06:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech[2012/06/15 03:06:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Remote Control USB Driver[2012/06/14 14:16:21 | 000,000,000 | ---D | C] -- C:\Users\Jon\AppData\Local\Macromedia[3 C:\Users\Jon\Documents\*.tmp files -> C:\Users\Jon\Documents\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2012/07/13 14:58:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-13878151-3475214259-3496771340-1001UA.job[2012/07/13 14:49:03 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2012/07/13 14:49:03 | 000,014,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2012/07/13 14:47:08 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job[2012/07/13 14:44:23 | 000,717,324 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2012/07/13 14:44:23 | 000,621,742 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2012/07/13 14:44:23 | 000,108,792 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2012/07/13 14:37:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2012/07/13 14:37:00 | 2138,447,871 | -HS- | M] () -- C:\hiberfil.sys[2012/07/13 14:35:06 | 000,249,623 | ---- | M] () -- C:\Users\Jon\Desktop\tumblr_m710oxajQl1qhhq9ro1_1280.jpg[2012/07/13 14:17:48 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2012/07/12 19:44:03 | 000,110,673 | ---- | M] () -- C:\Users\Jon\Desktop\milky-way-EDIT.jpg[2012/07/12 19:44:03 | 000,001,456 | ---- | M] () -- C:\Users\Jon\AppData\Local\Adobe Save for Web 12.0 Prefs[2012/07/12 18:58:38 | 000,002,069 | ---- | M] () -- C:\Users\Public\Desktop\Lightroom 4.1 64-bit.lnk[2012/07/12 17:59:21 | 000,002,389 | ---- | M] () -- C:\Users\Jon\Desktop\Google Chrome.lnk[2012/07/12 17:58:01 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-13878151-3475214259-3496771340-1001Core.job[2012/07/12 15:07:47 | 000,035,231 | ---- | M] () -- C:\Users\Jon\Desktop\enhanced-buzz-22028-1341865646-1.jpg[2012/07/12 13:04:57 | 000,128,524 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2862.jpg[2012/07/12 12:50:30 | 000,135,792 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2881.jpg[2012/07/12 12:34:43 | 000,160,140 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2660.jpg[2012/07/12 12:23:57 | 000,146,034 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2671.jpg[2012/07/11 22:58:21 | 000,153,906 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2921.jpg[2012/07/11 22:52:51 | 000,177,000 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2913.jpg[2012/07/11 22:44:52 | 000,214,610 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2884.jpg[2012/07/11 22:37:18 | 000,195,454 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2901.jpg[2012/07/11 22:30:51 | 000,164,047 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2854.jpg[2012/07/11 22:26:01 | 000,217,048 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2870.jpg[2012/07/11 15:35:43 | 000,160,994 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2886.jpg[2012/07/11 11:36:31 | 005,194,928 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2012/07/11 01:38:29 | 000,002,591 | ---- | M] () -- C:\Users\Public\Desktop\DeepSkyStacker.lnk[2012/07/09 07:56:10 | 000,069,170 | ---- | M] () -- C:\Users\Jon\Documents\Deep Sky Stacker.pdf[2012/07/09 07:43:56 | 000,845,758 | ---- | M] () -- C:\Users\Jon\Documents\DSS Le nebulose IC405 e IC 410 in Auriga.pdf[2012/07/09 07:41:24 | 000,997,615 | ---- | M] () -- C:\Users\Jon\Documents\My Quick DeepSkyStacker Tutorial « Flintstone Stargazing.pdf[2012/07/08 22:22:57 | 000,667,857 | ---- | M] () -- C:\Users\Jon\Desktop\hdr-2637-2639.jpg[2012/07/08 22:07:16 | 000,209,128 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2649.jpg[2012/07/08 14:07:11 | 001,192,175 | ---- | M] () -- C:\Users\Jon\Desktop\forest-1.jpg[2012/07/07 07:45:31 | 000,001,929 | ---- | M] () -- C:\Users\Public\Desktop\Stellarium.lnk[2012/07/07 05:22:58 | 000,053,696 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2614.jpg[2012/07/06 17:28:02 | 000,108,071 | ---- | M] () -- C:\Users\Jon\Desktop\_MG_2613.jpg[2012/07/05 21:25:45 | 000,138,588 | ---- | M] () -- C:\Users\Jon\Documents\jen - flihjt.pdf[2012/07/03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys[2012/06/22 22:32:28 | 000,076,234 | ---- | M] () -- C:\Users\Jon\Documents\Astronomy Receipt.pdf[2012/06/22 12:46:30 | 001,311,928 | ---- | M] () -- C:\Users\Jon\Documents\Cindy.jpg[2012/06/19 22:09:05 | 000,001,077 | ---- | M] () -- C:\Users\Jon\Desktop\RegiStax 5.1 .lnk[2012/06/15 03:07:38 | 000,002,359 | ---- | M] () -- C:\Users\Public\Desktop\Logitech Harmony Remote Software 7.lnk[3 C:\Users\Jon\Documents\*.tmp files -> C:\Users\Jon\Documents\*.tmp -> ]========== Files Created - No Company Name ==========[2012/07/13 14:37:20 | 000,232,960 | ---- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000008.@[2012/07/13 14:37:19 | 000,000,804 | ---- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\00000004.@[2012/07/13 14:36:52 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000000.@[2012/07/13 14:36:52 | 000,002,048 | ---- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000004.@[2012/07/13 14:33:14 | 000,249,623 | ---- | C] () -- C:\Users\Jon\Desktop\tumblr_m710oxajQl1qhhq9ro1_1280.jpg[2012/07/12 19:44:02 | 000,110,673 | ---- | C] () -- C:\Users\Jon\Desktop\milky-way-EDIT.jpg[2012/07/12 18:58:38 | 000,002,077 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 4.1 64-bit.lnk[2012/07/12 18:58:38 | 000,002,069 | ---- | C] () -- C:\Users\Public\Desktop\Lightroom 4.1 64-bit.lnk[2012/07/12 15:07:46 | 000,035,231 | ---- | C] () -- C:\Users\Jon\Desktop\enhanced-buzz-22028-1341865646-1.jpg[2012/07/12 13:04:56 | 000,128,524 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2862.jpg[2012/07/12 12:50:29 | 000,135,792 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2881.jpg[2012/07/12 12:34:43 | 000,160,140 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2660.jpg[2012/07/12 12:23:57 | 000,146,034 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2671.jpg[2012/07/11 22:58:20 | 000,153,906 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2921.jpg[2012/07/11 22:52:50 | 000,177,000 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2913.jpg[2012/07/11 22:44:51 | 000,214,610 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2884.jpg[2012/07/11 22:37:17 | 000,195,454 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2901.jpg[2012/07/11 22:30:50 | 000,164,047 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2854.jpg[2012/07/11 22:26:00 | 000,217,048 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2870.jpg[2012/07/11 15:35:42 | 000,160,994 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2886.jpg[2012/07/11 01:38:29 | 000,002,591 | ---- | C] () -- C:\Users\Public\Desktop\DeepSkyStacker.lnk[2012/07/09 07:56:16 | 000,069,170 | ---- | C] () -- C:\Users\Jon\Documents\Deep Sky Stacker.pdf[2012/07/09 07:44:29 | 000,845,758 | ---- | C] () -- C:\Users\Jon\Documents\DSS Le nebulose IC405 e IC 410 in Auriga.pdf[2012/07/09 07:41:30 | 000,997,615 | ---- | C] () -- C:\Users\Jon\Documents\My Quick DeepSkyStacker Tutorial « Flintstone Stargazing.pdf[2012/07/08 22:22:56 | 000,667,857 | ---- | C] () -- C:\Users\Jon\Desktop\hdr-2637-2639.jpg[2012/07/08 22:07:16 | 000,209,128 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2649.jpg[2012/07/08 14:07:10 | 001,192,175 | ---- | C] () -- C:\Users\Jon\Desktop\forest-1.jpg[2012/07/07 07:45:31 | 000,001,929 | ---- | C] () -- C:\Users\Public\Desktop\Stellarium.lnk[2012/07/07 05:22:57 | 000,053,696 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2614.jpg[2012/07/06 17:28:02 | 000,108,071 | ---- | C] () -- C:\Users\Jon\Desktop\_MG_2613.jpg[2012/07/05 21:25:58 | 000,138,588 | ---- | C] () -- C:\Users\Jon\Documents\jen - flihjt.pdf[2012/07/04 19:25:51 | 000,080,896 | ---- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000064.@[2012/07/04 19:25:41 | 000,001,632 | ---- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\000000cb.@[2012/06/22 22:32:39 | 000,076,234 | ---- | C] () -- C:\Users\Jon\Documents\Astronomy Receipt.pdf[2012/06/22 12:46:27 | 001,311,928 | ---- | C] () -- C:\Users\Jon\Documents\Cindy.jpg[2012/06/19 22:09:05 | 000,001,077 | ---- | C] () -- C:\Users\Jon\Desktop\RegiStax 5.1 .lnk[2012/06/15 03:07:38 | 000,002,359 | ---- | C] () -- C:\Users\Public\Desktop\Logitech Harmony Remote Software 7.lnk[2012/05/20 20:25:13 | 000,003,584 | ---- | C] () -- C:\Users\Jon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2012/01/11 09:19:17 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@[2012/01/11 09:19:17 | 000,002,048 | -HS- | C] () -- C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@[2011/11/09 23:39:44 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll[2011/11/09 23:39:32 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll[2011/11/09 22:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat[2011/11/09 22:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat[2011/09/12 19:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat[2011/01/07 17:09:21 | 000,726,950 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2010/11/17 01:18:13 | 000,000,032 | ---- | C] () -- C:\Users\Jon\AppData\Roaming\mintinlu[2010/11/12 16:20:11 | 000,000,333 | ---- | C] () -- C:\Windows\Brpfx04a.ini[2010/11/12 16:20:11 | 000,000,094 | ---- | C] () -- C:\Windows\brpcfx.ini[2010/11/12 16:19:48 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI[2010/11/12 16:19:48 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7840W.DAT[2010/11/12 16:18:27 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\BrMuSNMP.dll[2010/11/12 16:18:27 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini[2010/11/12 16:18:26 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat[2010/11/12 16:18:19 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL[2010/11/12 16:18:12 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI[2010/08/04 19:23:59 | 000,010,752 | ---- | C] () -- C:\Windows\SysWow64\BASSMOD.dll[2010/06/19 20:31:29 | 000,001,456 | ---- | C] () -- C:\Users\Jon\AppData\Local\Adobe Save for Web 12.0 Prefs[2010/06/05 23:11:55 | 000,007,605 | ---- | C] () -- C:\Users\Jon\AppData\Local\Resmon.ResmonCfg========== LOP Check ==========[2011/08/28 17:44:28 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\onOne Software[2011/08/28 17:44:28 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\onOne Software[2012/05/22 13:34:31 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\3D RealityMaps Viewer[2012/05/22 13:51:04 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Alpen 3D Online[2012/06/01 20:26:26 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\calibre[2010/06/07 19:50:40 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Canon[2011/10/12 17:53:27 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1[2011/02/25 23:54:41 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\com.inm.fusion.PixtorioViewer.744790F1545733D757EA034B675902690507C2E8.1[2011/08/10 20:55:28 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Crayon Physics Deluxe[2010/10/08 15:49:58 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\DAEMON Tools Lite[2012/06/01 21:02:13 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\eBookConverter[2010/06/19 20:32:34 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Facebook[2010/08/03 12:53:55 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Foxit Software[2010/08/04 19:21:47 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\GlobalSCAPE[2012/06/01 21:09:41 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\libimobiledevice[2012/06/01 20:14:06 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\log[2010/06/17 23:08:49 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Mask Pro 4.0[2012/07/12 19:35:46 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\onOne Software[2012/03/13 09:10:12 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\PC-FAX TX[2012/02/02 03:43:59 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Pdfsvg[2010/07/06 23:24:10 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\PictureCode[2012/07/07 07:45:45 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Stellarium[2010/06/05 01:07:00 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\Thunderbird[2012/06/01 20:33:23 | 000,000,000 | ---D | M] -- C:\Users\Jon\AppData\Roaming\uTorrent[2012/07/13 14:24:55 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT========== Purity Check ==========< End of report >OTL Extras logfile created on: 7/13/2012 3:16:48 PM - Run 1OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Jon\Downloads64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.0.8112.16421)Locale: 00000409 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy7.99 Gb Total Physical Memory | 5.91 Gb Available Physical Memory | 73.99% Memory free15.98 Gb Paging File | 13.63 Gb Available in Paging File | 85.32% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.07 Gb Total Space | 115.00 Gb Free Space | 25.49% Space Free | Partition Type: NTFSComputer Name: FYZHIX | User Name: Jon | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (SafeList) ==================== File Associations ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>][HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>][HKEY_USERS\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)========== Shell Spawning ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 064bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]========== Firewall Settings ==================== Authorized Applications List ==================== Vista Active Open Ports Exception List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]========== Vista Active Application Exception List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]========== HKEY_LOCAL_MACHINE Uninstall List ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0611B3CC-B5DB-4B93-ACE4-97B8F938E6B7}" = 64 Bit HP CIO Components Installer"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)"{26A24AE4-039D-4CA4-87B4-2F86416018FF}" = Java 6 Update 18 (64-bit)"{2D7ED2A0-9553-412B-939F-D6E0AEB2ABE1}" = ISO Recorder"{35A50BE1-FDD7-4FC7-CCE5-03D2A63D4CF4}" = AMD Catalyst Install Manager"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Intel® Turbo Boost Technology Monitor"{3C32C938-3071-BEF0-1EA5-403A420031A0}" = ccc-utility64"{3F372A41-8007-012F-F5AE-685F588FC897}" = AMD Media Foundation Decoders"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148"{4FFA2088-8317-3B14-93CD-4C699DB37843}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64"{CCAFF072-4DDB-4846-963D-15F02A8E9472}" = Intel® PROSet/Wireless WiFi Software"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319"{F20BB80C-4979-65A2-92A3-AA9A12C664AA}" = ATI AVIVO64 Codecs"{F325B47E-7592-7556-52F6-3D3D3842A028}" = ccc-utility64"{F7ADB493-B913-4D61-9A63-DA736C20C3F2}" = Adobe Photoshop Lightroom 4.1 64-bit"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager"CutePDF Writer Installation" = CutePDF Writer 2.8"Microsoft Security Client" = Microsoft Security Essentials"PCSI" = Prevx"ProInst" = Intel PROSet Wireless"SynTPDeinstKey" = Synaptics Pointing Device Driver"WinRAR archiver" = WinRAR archiver[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center"{05886DF5-4816-0808-67D3-CC7583FF2412}" = CCC Help Spanish"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86"{0B41DC4A-DF1E-949F-5665-31483F2C72F4}" = Catalyst Control Center Graphics Previews Vista"{0D961826-E722-B86D-7BA7-AA70A0B110C5}" = Catalyst Control Center Graphics Previews Common"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime"{0EA3F981-CC0C-E079-726E-CD0F7D23F2AA}" = Catalyst Control Center Localization All"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86"{10CE3DC0-A77E-7661-13F4-25D30BC113B2}" = Catalyst Control Center Graphics Full New"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1"{1204CCB8-9A7D-3375-C8E0-6A4FA16A4036}" = CCC Help Chinese Traditional"{18435829-4E75-4CD1-9796-A62DBBAE2ED7}" = DeepSkyStacker"{1C11FFE1-50D3-B755-A8A7-8363385B4CA3}" = CCC Help Danish"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{21B8371C-9EBA-2CB4-E0A2-9DF0C4A074EC}" = Catalyst Control Center Core Implementation"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{2461E016-9FB4-B233-A74D-91D11A664342}" = CCC Help English"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 29"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java 7 Update 5"{27A21358-02A7-B745-ABBE-25566FE9B397}" = Catalyst Control Center Graphics Full Existing"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform"{32778D4F-E904-E33E-0C48-15E672604D09}" = Catalyst Control Center InstallProxy"{3444DB77-6D7A-9553-2EE1-60D2A4D003D3}" = CCC Help German"{34842CCC-AE14-61AE-C8FB-87FAD755B483}" = CCC Help Russian"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729"{3D65CEB1-0709-43EB-D6CF-DB66D3FAB2D4}" = CCC Help Japanese"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite MFC-7840W"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials"{49F1C7D8-B6D5-448C-C9D5-F6C2E3889B16}" = CCC Help Norwegian"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4CA1E8E2-B2A9-40C1-8EC4-BBCB23BAAA19}_is1" = Crayon Physics Deluxe version 55"{4E33D05D-76CF-5D3C-4D5D-7727530FA161}" = Adobe Content Viewer"{51002784-18FA-8FF9-9A1A-2468E7FCA096}" = Catalyst Control Center Graphics Previews Common"{53104B7F-FE3A-B641-1E46-89870E1A63D8}" = CCC Help Chinese Standard"{59679381-3F22-4A40-A7AD-890242D74DF4}" = Perfect Photo Suite 6.1"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7"{5E2E222D-D776-A325-362C-B95017148AB1}" = CCC Help Dutch"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX"{69533745-1E2D-4C98-8B4A-B7643EF9E1A2}" = Catalyst Control Center - Branding"{6A6CD707-5B29-5069-B571-2778668C952F}" = CCC Help Finnish"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{7210BCFE-ED8D-4261-8537-81B5A4BDFA2A}" = Rosetta Stone V3"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide"{80F19EAA-44C4-47C2-AE87-1C7628E858D6}" = Logitech Harmony Remote Software 7"{816E3C02-DABF-1354-0B98-5E153F7DF79B}" = Skins"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver"{856DC9B3-F770-9F58-E939-EBEB66C880C1}" = CCC Help Portuguese"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-002A-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0116-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)"{91F34319-08DE-457a-99C0-0BCDFAC145B9}" = CuteFTP 8 Professional"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86"{975C3A93-2491-3D44-A071-F6CBF153E46D}" = Google Talk Plugin"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9D56904D-6C69-DA2A-F573-9F362C55CB6C}" = CCC Help Swedish"{9F479685-180E-4C05-9400-D59292A1B29C}" = Windows Live Movie Maker"{A33E7B0C-B99C-4EC9-B702-8A328B161AF9}" = Roxio Burn"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync"{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}" = Roxio Burn"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup"{B51C759D-20FD-A4B0-83D1-C4F45E60EC8B}" = CCC Help English"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86"{B862DF65-94C8-6119-1096-2B230D7A6C0E}" = ccc-core-static"{B9CB74A9-8C7C-16C1-D75A-199B4331CEC2}" = CCC Help French"{BDE646E8-86E0-50E1-37BC-0AEBB2185D76}" = Adobe Widget Browser"{C28DD992-5B7B-D195-6841-4EC57DF512BD}" = Adobe Story"{C454E7DD-A09A-6D06-7FF9-59753475FC09}" = Catalyst Pro Control Center"{CE23BD08-F6FD-3337-D8BC-5B55E69263A5}" = Catalyst Control Center InstallProxy"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86"{D489B636-E9AB-C08A-ED7B-EA21B2D3D633}" = CCC Help Korean"{D8D2B468-8342-411A-8760-BCC362C3408F}" = Adobe Creative Suite 5.5 Master Collection"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86"{DA109884-7CDC-5F21-5F0B-742AA74F84E1}" = Catalyst Control Center Localization All"{DDDBB2E2-D331-1DB1-7FC0-AB896FDCA8AE}" = Catalyst Control Center Graphics Light"{E19490CD-5380-4F37-B0A7-624D635605DC}" = Catalyst Control Center - Branding"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F18C2534-CE61-542B-3662-19935DB555BD}" = Pixtorio Viewer"{FB2BED9C-50ED-F5C9-1475-B6C15D21C02A}" = CCC Help Italian"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin"Adobe Shockwave Player" = Adobe Shockwave Player 11.5"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings"Advanced Audio FX Engine" = Advanced Audio FX Engine"AlpenOnlineViewer_is1" = 3D RealityMaps Viewer 1.2.11.0"Bejeweled 2 Deluxe" = Bejeweled 2 Deluxe"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help"com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Story"com.adobe.dmp.contentviewer" = Adobe Content Viewer"com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Widget Browser"com.inm.fusion.PixtorioViewer.744790F1545733D757EA034B675902690507C2E8.1" = Pixtorio Viewer"Dell Webcam Central" = Dell Webcam Central"DPP" = Canon Utilities Digital Photo Professional 3.8"Foxit Reader" = Foxit Reader"Free ISO Creator (by minidvdsoft)_is1" = Free ISO Creator version 2.8"Frozen Synapse_is1" = Frozen Synapse"GoToAssist" = GoToAssist 8.0.0.514"HDR Express" = HDR Express"Machinarium" = Machinarium"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)"Mozilla Thunderbird 13.0.1 (x86 en-US)" = Mozilla Thunderbird 13.0.1 (x86 en-US)"MozillaMaintenanceService" = Mozilla Maintenance Service"nLite_is1" = nLite 1.4.9.1"Office14.SingleImage" = Microsoft Office Home and Student 2010"Picasa 3" = Picasa 3"PST Walker_is1" = PST Walker Evaluation 4.61"QuickGamma_is1" = QuickGamma 3.0.0.1"SendToKindle" = Amazon Send to Kindle"Steam App 400" = Portal"Steam App 620" = Portal 2"Steam App 644" = Portal 2 Publishing Tool"Steam App 72850" = The Elder Scrolls V: Skyrim"Stellarium_is1" = Stellarium 0.11.3"uTorrent" = µTorrent"WildTangent dell Master Uninstall" = WildTangent Games"WinLiveSuite_Wave3" = Windows Live Essentials========== HKEY_USERS Uninstall List ==========[HKEY_USERS\S-1-5-21-13878151-3475214259-3496771340-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"Amazon Kindle" = Amazon Kindle"Facebook Plug-In" = Facebook Plug-In"Google Chrome" = Google Chrome"RegiStax 5.1" = RegiStax 5.1========== Last 20 Event Log Errors ==========[ Application Events ]Error - 7/9/2012 4:04:26 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 998Error - 7/9/2012 4:04:26 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 998Error - 7/9/2012 4:04:27 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a secondError - 7/9/2012 4:04:27 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 1996Error - 7/9/2012 4:04:27 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 1996Error - 7/9/2012 4:04:28 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a secondError - 7/9/2012 4:04:28 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 2995Error - 7/9/2012 4:04:28 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 2995Error - 7/9/2012 4:04:29 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a secondError - 7/9/2012 4:04:29 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 3993Error - 7/9/2012 4:04:29 PM | Computer Name = fyzhix | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 3993[ System Events ]Error - 7/13/2012 2:37:06 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7023Description = The Computer Browser service terminated with the following error: %%1060Error - 7/13/2012 2:37:07 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7003Description = The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.Error - 7/13/2012 2:37:07 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7003Description = The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.Error - 7/13/2012 2:37:07 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7023Description = The Function Discovery Resource Publication service terminated with the following error: %%-2147024891Error - 7/13/2012 2:37:12 PM | Computer Name = fyzhix | Source = VDS Basic Provider | ID = 33554433Description =Error - 7/13/2012 2:38:08 PM | Computer Name = fyzhix | Source = DCOM | ID = 10016Description =Error - 7/13/2012 2:40:17 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7023Description = The Function Discovery Resource Publication service terminated with the following error: %%-2147024891Error - 7/13/2012 2:40:17 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7001Description = The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891Error - 7/13/2012 2:43:12 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7011Description = A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.Error - 7/13/2012 2:45:17 PM | Computer Name = fyzhix | Source = Service Control Manager | ID = 7022Description = The Windows Update service hung on starting.< End of report > Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570321 Share Posted July 13, 2012 15:34:43.0596 4896 TDSS rootkit removing tool 2.7.45.0 Jul 9 2012 12:46:3515:34:43.0953 4896 ============================================================15:34:43.0953 4896 Current date / time: 2012/07/13 15:34:43.095315:34:43.0954 4896 SystemInfo:15:34:43.0954 4896 15:34:43.0954 4896 OS Version: 6.1.7601 ServicePack: 1.015:34:43.0954 4896 Product type: Workstation15:34:43.0954 4896 ComputerName: FYZHIX15:34:43.0954 4896 UserName: Jon15:34:43.0954 4896 Windows directory: C:\Windows15:34:43.0954 4896 System windows directory: C:\Windows15:34:43.0954 4896 Running under WOW6415:34:43.0954 4896 Processor architecture: Intel x6415:34:43.0954 4896 Number of processors: 815:34:43.0954 4896 Page size: 0x100015:34:43.0954 4896 Boot type: Normal boot15:34:43.0954 4896 ============================================================15:34:45.0260 4896 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x0000004015:34:45.0270 4896 ============================================================15:34:45.0270 4896 \Device\Harddisk0\DR0:15:34:45.0271 4896 MBR partitions:15:34:45.0271 4896 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C00015:34:45.0271 4896 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x3862583015:34:45.0271 4896 ============================================================15:34:45.0289 4896 C: <-> \Device\Harddisk0\DR0\Partition115:34:45.0289 4896 ============================================================15:34:45.0289 4896 Initialize success15:34:45.0289 4896 ============================================================15:34:51.0144 2852 ============================================================15:34:51.0144 2852 Scan started15:34:51.0144 2852 Mode: Manual; SigCheck; TDLFS;15:34:51.0144 2852 ============================================================15:34:52.0385 2852 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys15:34:52.0434 2852 1394ohci - ok15:34:52.0489 2852 Acceler (c49c56b35bfc6cda8d1fdcad2885568f) C:\Windows\system32\DRIVERS\Acceler.sys15:34:52.0502 2852 Acceler - ok15:34:52.0542 2852 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys15:34:52.0555 2852 ACPI - ok15:34:52.0565 2852 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys15:34:52.0579 2852 AcpiPmi - ok15:34:52.0751 2852 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe15:34:52.0764 2852 AdobeFlashPlayerUpdateSvc - ok15:34:52.0841 2852 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys15:34:52.0858 2852 adp94xx - ok15:34:52.0909 2852 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys15:34:52.0922 2852 adpahci - ok15:34:52.0941 2852 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys15:34:52.0953 2852 adpu320 - ok15:34:53.0009 2852 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll15:34:53.0044 2852 AeLookupSvc - ok15:34:53.0227 2852 AESTFilters (a6fb9db8f1a86861d955fd6975977ae0) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe15:34:53.0238 2852 AESTFilters - ok15:34:53.0325 2852 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys15:34:53.0343 2852 AFD - ok15:34:53.0404 2852 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys15:34:53.0418 2852 agp440 - ok15:34:53.0434 2852 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe15:34:53.0447 2852 ALG - ok15:34:53.0468 2852 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys15:34:53.0478 2852 aliide - ok15:34:53.0549 2852 AMD External Events Utility (5ec60409bd50953bd4f892b18840039e) C:\Windows\system32\atiesrxx.exe15:34:53.0564 2852 AMD External Events Utility - ok15:34:53.0578 2852 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys15:34:53.0588 2852 amdide - ok15:34:53.0645 2852 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys15:34:53.0660 2852 AmdK8 - ok15:34:54.0252 2852 amdkmdag (322e5c178990f116f00e3d923f4e6b1c) C:\Windows\system32\DRIVERS\atikmdag.sys15:34:54.0347 2852 amdkmdag - ok15:34:54.0554 2852 amdkmdap (961a81a84fdd700e361e8294528a37ba) C:\Windows\system32\DRIVERS\atikmpag.sys15:34:54.0569 2852 amdkmdap - ok15:34:54.0626 2852 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys15:34:54.0640 2852 AmdPPM - ok15:34:54.0691 2852 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys15:34:54.0708 2852 amdsata - ok15:34:54.0750 2852 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys15:34:54.0768 2852 amdsbs - ok15:34:54.0815 2852 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys15:34:54.0829 2852 amdxata - ok15:34:54.0929 2852 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys15:34:54.0964 2852 AppID - ok15:34:55.0017 2852 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll15:34:55.0052 2852 AppIDSvc - ok15:34:55.0097 2852 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll15:34:55.0130 2852 Appinfo - ok15:34:55.0324 2852 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe15:34:55.0338 2852 Apple Mobile Device - ok15:34:55.0405 2852 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll15:34:55.0420 2852 AppMgmt - ok15:34:55.0478 2852 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys15:34:55.0488 2852 arc - ok15:34:55.0509 2852 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys15:34:55.0520 2852 arcsas - ok15:34:55.0555 2852 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys15:34:55.0583 2852 AsyncMac - ok15:34:55.0638 2852 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys15:34:55.0653 2852 atapi - ok15:34:55.0692 2852 AtiHdmiService (637e0753bd6deb8ea5314a5c357ec1a0) C:\Windows\system32\drivers\AtiHdmi.sys15:34:55.0704 2852 AtiHdmiService - ok15:34:56.0291 2852 atikmdag (322e5c178990f116f00e3d923f4e6b1c) C:\Windows\system32\DRIVERS\atikmdag.sys15:34:56.0387 2852 atikmdag - ok15:34:56.0600 2852 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll15:34:56.0633 2852 AudioEndpointBuilder - ok15:34:56.0638 2852 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll15:34:56.0672 2852 AudioSrv - ok15:34:56.0736 2852 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll15:34:56.0752 2852 AxInstSV - ok15:34:56.0845 2852 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys15:34:56.0862 2852 b06bdrv - ok15:34:56.0905 2852 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys15:34:56.0919 2852 b57nd60a - ok15:34:56.0991 2852 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll15:34:57.0005 2852 BDESVC - ok15:34:57.0012 2852 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys15:34:57.0041 2852 Beep - ok15:34:57.0096 2852 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll15:34:57.0130 2852 BITS - ok15:34:57.0173 2852 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys15:34:57.0185 2852 blbdrive - ok15:34:57.0451 2852 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe15:34:57.0463 2852 Bonjour Service - ok15:34:57.0522 2852 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys15:34:57.0535 2852 bowser - ok15:34:57.0591 2852 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys15:34:57.0609 2852 BrFiltLo - ok15:34:57.0617 2852 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys15:34:57.0630 2852 BrFiltUp - ok15:34:57.0690 2852 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll15:34:57.0724 2852 Browser - ok15:34:57.0759 2852 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys15:34:57.0775 2852 Brserid - ok15:34:57.0785 2852 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys15:34:57.0798 2852 BrSerWdm - ok15:34:57.0816 2852 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys15:34:57.0830 2852 BrUsbMdm - ok15:34:57.0844 2852 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys15:34:57.0856 2852 BrUsbSer - ok15:34:57.0876 2852 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys15:34:57.0889 2852 BTHMODEM - ok15:34:57.0944 2852 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll15:34:57.0979 2852 bthserv - ok15:34:58.0011 2852 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys15:34:58.0040 2852 cdfs - ok15:34:58.0103 2852 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys15:34:58.0115 2852 cdrom - ok15:34:58.0173 2852 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll15:34:58.0201 2852 CertPropSvc - ok15:34:58.0255 2852 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys15:34:58.0270 2852 circlass - ok15:34:58.0359 2852 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys15:34:58.0375 2852 CLFS - ok15:34:58.0486 2852 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe15:34:58.0501 2852 clr_optimization_v2.0.50727_32 - ok15:34:58.0603 2852 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe15:34:58.0619 2852 clr_optimization_v2.0.50727_64 - ok15:34:58.0633 2852 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys15:34:58.0645 2852 CmBatt - ok15:34:58.0692 2852 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys15:34:58.0708 2852 cmdide - ok15:34:58.0787 2852 CNG (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys15:34:58.0812 2852 CNG - ok15:34:58.0880 2852 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys15:34:58.0895 2852 Compbatt - ok15:34:58.0952 2852 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys15:34:58.0971 2852 CompositeBus - ok15:34:58.0985 2852 COMSysApp - ok15:34:58.0999 2852 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys15:34:59.0009 2852 crcdisk - ok15:34:59.0075 2852 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll15:34:59.0088 2852 CryptSvc - ok15:34:59.0165 2852 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys15:34:59.0185 2852 CSC - ok15:34:59.0234 2852 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll15:34:59.0251 2852 CscService - ok15:34:59.0676 2852 CSIScanner (5131d2469b6b19dc20b446ebe43ebb79) C:\Program Files\Prevx\prevx.exe15:34:59.0765 2852 CSIScanner - ok15:34:59.0984 2852 CtClsFlt (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys15:34:59.0995 2852 CtClsFlt - ok15:35:00.0076 2852 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll15:35:00.0108 2852 DcomLaunch - ok15:35:00.0170 2852 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll15:35:00.0200 2852 defragsvc - ok15:35:00.0265 2852 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys15:35:00.0295 2852 DfsC - ok15:35:00.0331 2852 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll15:35:00.0362 2852 Dhcp - ok15:35:00.0413 2852 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys15:35:00.0441 2852 discache - ok15:35:00.0513 2852 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys15:35:00.0529 2852 Disk - ok15:35:00.0583 2852 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll15:35:00.0602 2852 Dnscache - ok15:35:00.0689 2852 DockLoginService - ok15:35:00.0753 2852 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll15:35:00.0783 2852 dot3svc - ok15:35:00.0839 2852 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll15:35:00.0874 2852 DPS - ok15:35:00.0906 2852 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys15:35:00.0919 2852 drmkaud - ok15:35:01.0029 2852 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys15:35:01.0051 2852 DXGKrnl - ok15:35:01.0107 2852 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll15:35:01.0143 2852 EapHost - ok15:35:01.0367 2852 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys15:35:01.0405 2852 ebdrv - ok15:35:01.0591 2852 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe15:35:01.0610 2852 EFS - ok15:35:01.0743 2852 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe15:35:01.0766 2852 ehRecvr - ok15:35:01.0823 2852 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe15:35:01.0838 2852 ehSched - ok15:35:01.0976 2852 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys15:35:01.0991 2852 elxstor - ok15:35:02.0045 2852 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys15:35:02.0060 2852 ErrDev - ok15:35:02.0141 2852 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll15:35:02.0175 2852 EventSystem - ok15:35:02.0358 2852 EvtEng (51643ee2712d9212e1e53ca7e8d8eb4a) C:\Program Files\Intel\WiFi\bin\EvtEng.exe15:35:02.0381 2852 EvtEng - ok15:35:02.0602 2852 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys15:35:02.0632 2852 exfat - ok15:35:02.0659 2852 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys15:35:02.0689 2852 fastfat - ok15:35:02.0806 2852 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe15:35:02.0827 2852 Fax - ok15:35:02.0841 2852 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys15:35:02.0853 2852 fdc - ok15:35:02.0899 2852 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll15:35:02.0932 2852 fdPHost - ok15:35:02.0944 2852 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll15:35:02.0974 2852 FDResPub - ok15:35:02.0994 2852 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys15:35:03.0004 2852 FileInfo - ok15:35:03.0011 2852 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys15:35:03.0038 2852 Filetrace - ok15:35:03.0177 2852 FLEXnet Licensing Service (d778107d7c2a19d7e7a884a9f0d79581) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe15:35:03.0187 2852 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning15:35:03.0187 2852 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)15:35:03.0233 2852 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys15:35:03.0247 2852 flpydisk - ok15:35:03.0308 2852 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys15:35:03.0324 2852 FltMgr - ok15:35:03.0424 2852 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll15:35:03.0444 2852 FontCache - ok15:35:03.0628 2852 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe15:35:03.0637 2852 FontCache3.0.0.0 - ok15:35:03.0701 2852 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys15:35:03.0712 2852 FsDepends - ok15:35:03.0761 2852 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys15:35:03.0778 2852 Fs_Rec - ok15:35:03.0854 2852 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys15:35:03.0869 2852 fvevol - ok15:35:03.0931 2852 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys15:35:03.0942 2852 gagp30kx - ok15:35:04.0077 2852 GameConsoleService (c1bbce4b30b45410178ee674c818d10c) C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe15:35:04.0087 2852 GameConsoleService - ok15:35:04.0181 2852 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys15:35:04.0188 2852 GEARAspiWDM - ok15:35:04.0199 2852 GoToAssist (d3316f6e3c011435f36e3d6e49b3196c) C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe15:35:04.0206 2852 GoToAssist - ok15:35:04.0295 2852 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll15:35:04.0333 2852 gpsvc - ok15:35:04.0407 2852 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe15:35:04.0419 2852 gusvc - ok15:35:04.0470 2852 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys15:35:04.0482 2852 hcw85cir - ok15:35:04.0556 2852 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys15:35:04.0572 2852 HDAudBus - ok15:35:04.0731 2852 HDRExpressService (7a481913ac1219d13a8b2d6a66901f72) C:\Program Files\UCT\HDR Express\HDRExpressService.exe15:35:04.0740 2852 HDRExpressService - ok15:35:04.0754 2852 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys15:35:04.0766 2852 HidBatt - ok15:35:04.0778 2852 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys15:35:04.0792 2852 HidBth - ok15:35:04.0809 2852 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys15:35:04.0823 2852 HidIr - ok15:35:04.0873 2852 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll15:35:04.0904 2852 hidserv - ok15:35:04.0929 2852 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys15:35:04.0941 2852 HidUsb - ok15:35:04.0991 2852 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll15:35:05.0022 2852 hkmsvc - ok15:35:05.0082 2852 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll15:35:05.0097 2852 HomeGroupListener - ok15:35:05.0160 2852 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll15:35:05.0173 2852 HomeGroupProvider - ok15:35:05.0242 2852 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys15:35:05.0256 2852 HpSAMD - ok15:35:05.0344 2852 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys15:35:05.0382 2852 HTTP - ok15:35:05.0432 2852 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys15:35:05.0443 2852 hwpolicy - ok15:35:05.0512 2852 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys15:35:05.0527 2852 i8042prt - ok15:35:05.0596 2852 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys15:35:05.0609 2852 iaStorV - ok15:35:05.0805 2852 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe15:35:05.0822 2852 idsvc - ok15:35:05.0872 2852 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys15:35:05.0885 2852 iirsp - ok15:35:05.0999 2852 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll15:35:06.0034 2852 IKEEXT - ok15:35:06.0053 2852 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys15:35:06.0063 2852 intelide - ok15:35:06.0088 2852 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys15:35:06.0099 2852 intelppm - ok15:35:06.0148 2852 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll15:35:06.0177 2852 IPBusEnum - ok15:35:06.0242 2852 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys15:35:06.0275 2852 IpFilterDriver - ok15:35:06.0328 2852 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys15:35:06.0347 2852 IPMIDRV - ok15:35:06.0365 2852 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys15:35:06.0395 2852 IPNAT - ok15:35:06.0546 2852 iPod Service (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe15:35:06.0567 2852 iPod Service - ok15:35:06.0624 2852 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys15:35:06.0640 2852 IRENUM - ok15:35:06.0667 2852 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys15:35:06.0677 2852 isapnp - ok15:35:06.0702 2852 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys15:35:06.0715 2852 iScsiPrt - ok15:35:06.0742 2852 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys15:35:06.0752 2852 kbdclass - ok15:35:06.0774 2852 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys15:35:06.0786 2852 kbdhid - ok15:35:06.0833 2852 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe15:35:06.0846 2852 KeyIso - ok15:35:06.0893 2852 KSecDD (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys15:35:06.0907 2852 KSecDD - ok15:35:06.0971 2852 KSecPkg (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys15:35:06.0982 2852 KSecPkg - ok15:35:06.0989 2852 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys15:35:07.0018 2852 ksthunk - ok15:35:07.0094 2852 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll15:35:07.0126 2852 KtmRm - ok15:35:07.0189 2852 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll15:35:07.0223 2852 LanmanServer - ok15:35:07.0285 2852 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll15:35:07.0317 2852 LanmanWorkstation - ok15:35:07.0350 2852 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys15:35:07.0380 2852 lltdio - ok15:35:07.0408 2852 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll15:35:07.0439 2852 lltdsvc - ok15:35:07.0463 2852 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll15:35:07.0493 2852 lmhosts - ok15:35:07.0555 2852 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys15:35:07.0568 2852 LSI_FC - ok15:35:07.0577 2852 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys15:35:07.0588 2852 LSI_SAS - ok15:35:07.0603 2852 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys15:35:07.0613 2852 LSI_SAS2 - ok15:35:07.0619 2852 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys15:35:07.0632 2852 LSI_SCSI - ok15:35:07.0654 2852 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys15:35:07.0684 2852 luafv - ok15:35:07.0740 2852 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll15:35:07.0758 2852 Mcx2Svc - ok15:35:07.0777 2852 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys15:35:07.0787 2852 megasas - ok15:35:07.0811 2852 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys15:35:07.0823 2852 MegaSR - ok15:35:07.0883 2852 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll15:35:07.0916 2852 MMCSS - ok15:35:07.0920 2852 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys15:35:07.0949 2852 Modem - ok15:35:07.0967 2852 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys15:35:07.0980 2852 monitor - ok15:35:08.0030 2852 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys15:35:08.0044 2852 mouclass - ok15:35:08.0071 2852 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys15:35:08.0083 2852 mouhid - ok15:35:08.0150 2852 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys15:35:08.0165 2852 mountmgr - ok15:35:08.0340 2852 MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe15:35:08.0349 2852 MozillaMaintenance - ok15:35:08.0437 2852 MpFilter (94c66ededcdb6a126880472f9a704d8e) C:\Windows\system32\DRIVERS\MpFilter.sys15:35:08.0453 2852 MpFilter - ok15:35:08.0508 2852 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys15:35:08.0524 2852 mpio - ok15:35:08.0578 2852 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys15:35:08.0614 2852 mpsdrv - ok15:35:08.0668 2852 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys15:35:08.0684 2852 MRxDAV - ok15:35:08.0738 2852 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys15:35:08.0750 2852 mrxsmb - ok15:35:08.0816 2852 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys15:35:08.0831 2852 mrxsmb10 - ok15:35:08.0841 2852 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys15:35:08.0853 2852 mrxsmb20 - ok15:35:08.0905 2852 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys15:35:08.0915 2852 msahci - ok15:35:08.0941 2852 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys15:35:08.0958 2852 msdsm - ok15:35:09.0017 2852 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe15:35:09.0035 2852 MSDTC - ok15:35:09.0052 2852 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys15:35:09.0081 2852 Msfs - ok15:35:09.0103 2852 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys15:35:09.0132 2852 mshidkmdf - ok15:35:09.0140 2852 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys15:35:09.0150 2852 msisadrv - ok15:35:09.0206 2852 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll15:35:09.0238 2852 MSiSCSI - ok15:35:09.0240 2852 msiserver - ok15:35:09.0309 2852 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys15:35:09.0346 2852 MSKSSRV - ok15:35:09.0361 2852 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys15:35:09.0389 2852 MSPCLOCK - ok15:35:09.0403 2852 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys15:35:09.0435 2852 MSPQM - ok15:35:09.0503 2852 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys15:35:09.0520 2852 MsRPC - ok15:35:09.0573 2852 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys15:35:09.0589 2852 mssmbios - ok15:35:09.0596 2852 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys15:35:09.0626 2852 MSTEE - ok15:35:09.0644 2852 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys15:35:09.0662 2852 MTConfig - ok15:35:09.0674 2852 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys15:35:09.0685 2852 Mup - ok15:35:09.0798 2852 MyWiFiDHCPDNS (d285d0539016be299a55ff997b44da33) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe15:35:09.0814 2852 MyWiFiDHCPDNS - ok15:35:09.0897 2852 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll15:35:09.0930 2852 napagent - ok15:35:10.0029 2852 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys15:35:10.0048 2852 NativeWifiP - ok15:35:10.0123 2852 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys15:35:10.0144 2852 NDIS - ok15:35:10.0161 2852 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys15:35:10.0189 2852 NdisCap - ok15:35:10.0212 2852 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys15:35:10.0245 2852 NdisTapi - ok15:35:10.0301 2852 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys15:35:10.0332 2852 Ndisuio - ok15:35:10.0383 2852 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys15:35:10.0416 2852 NdisWan - ok15:35:10.0467 2852 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys15:35:10.0503 2852 NDProxy - ok15:35:10.0572 2852 Net Driver HPZ12 (dc6530a291d4bdf6df399f1f128e7f8f) C:\Windows\system32\HPZinw12.dll15:35:10.0578 2852 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning15:35:10.0578 2852 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)15:35:10.0636 2852 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys15:35:10.0671 2852 NetBIOS - ok15:35:10.0733 2852 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys15:35:10.0765 2852 NetBT - ok15:35:10.0825 2852 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe15:35:10.0843 2852 Netlogon - ok15:35:10.0916 2852 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll15:35:10.0949 2852 Netman - ok15:35:10.0983 2852 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll15:35:11.0015 2852 netprofm - ok15:35:11.0202 2852 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe15:35:11.0212 2852 NetTcpPortSharing - ok15:35:11.0570 2852 NETw5s64 (4d85a450edef10c38882182753a49aae) C:\Windows\system32\DRIVERS\NETw5s64.sys15:35:11.0634 2852 NETw5s64 - ok15:35:11.0891 2852 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys15:35:11.0904 2852 nfrd960 - ok15:35:11.0968 2852 NisDrv (91b4e0273d2f6c24ef845f2b41311289) C:\Windows\system32\DRIVERS\NisDrvWFP.sys15:35:11.0982 2852 NisDrv - ok15:35:12.0140 2852 NisSrv (10a43829a9e606af3eef25a1c1665923) c:\Program Files\Microsoft Security Client\NisSrv.exe15:35:12.0153 2852 NisSrv - ok15:35:12.0243 2852 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll15:35:12.0278 2852 NlaSvc - ok15:35:12.0374 2852 nlsX86cc (b1ef4686961986dffb7fe8f18e6fcb5b) C:\Windows\SysWOW64\nlssrv32.exe15:35:12.0382 2852 nlsX86cc - ok15:35:12.0481 2852 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys15:35:12.0516 2852 Npfs - ok15:35:12.0563 2852 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll15:35:12.0593 2852 nsi - ok15:35:12.0603 2852 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys15:35:12.0632 2852 nsiproxy - ok15:35:12.0769 2852 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys15:35:12.0796 2852 Ntfs - ok15:35:12.0910 2852 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys15:35:12.0939 2852 Null - ok15:35:13.0004 2852 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys15:35:13.0022 2852 nvraid - ok15:35:13.0041 2852 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys15:35:13.0052 2852 nvstor - ok15:35:13.0117 2852 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys15:35:13.0132 2852 nv_agp - ok15:35:13.0205 2852 O2FLASH (d955d5de998db2476bf0892be3a96c26) C:\Windows\system32\DRIVERS\o2flash.exe15:35:13.0219 2852 O2FLASH - ok15:35:13.0239 2852 O2MDGRDR (8c2953537ca19dfaa67d612407e0f33e) C:\Windows\system32\DRIVERS\o2mdgx64.sys15:35:13.0248 2852 O2MDGRDR - ok15:35:13.0269 2852 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys15:35:13.0280 2852 ohci1394 - ok15:35:13.0388 2852 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE15:35:13.0401 2852 ose - ok15:35:13.0766 2852 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE15:35:13.0830 2852 osppsvc - ok15:35:14.0022 2852 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll15:35:14.0036 2852 p2pimsvc - ok15:35:14.0067 2852 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll15:35:14.0081 2852 p2psvc - ok15:35:14.0185 2852 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys15:35:14.0197 2852 Parport - ok15:35:14.0251 2852 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys15:35:14.0268 2852 partmgr - ok15:35:14.0282 2852 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll15:35:14.0298 2852 PcaSvc - ok15:35:14.0360 2852 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys15:35:14.0376 2852 pci - ok15:35:14.0385 2852 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys15:35:14.0395 2852 pciide - ok15:35:14.0422 2852 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys15:35:14.0437 2852 pcmcia - ok15:35:14.0455 2852 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys15:35:14.0464 2852 pcw - ok15:35:14.0507 2852 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys15:35:14.0545 2852 PEAUTH - ok15:35:14.0663 2852 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll15:35:14.0685 2852 PeerDistSvc - ok15:35:14.0857 2852 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe15:35:14.0873 2852 PerfHost - ok15:35:15.0109 2852 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll15:35:15.0147 2852 pla - ok15:35:15.0220 2852 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll15:35:15.0235 2852 PlugPlay - ok15:35:15.0314 2852 Pml Driver HPZ12 (71f62c51dfdfbc04c83c5c64b2b8058e) C:\Windows\system32\HPZipm12.dll15:35:15.0321 2852 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning15:35:15.0321 2852 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)15:35:15.0379 2852 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll15:35:15.0395 2852 PNRPAutoReg - ok15:35:15.0421 2852 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll15:35:15.0440 2852 PNRPsvc - ok15:35:15.0466 2852 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll15:35:15.0496 2852 PolicyAgent - ok15:35:15.0570 2852 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll15:35:15.0601 2852 Power - ok15:35:15.0716 2852 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys15:35:15.0746 2852 PptpMiniport - ok15:35:15.0797 2852 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys15:35:15.0814 2852 Processor - ok15:35:15.0869 2852 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll15:35:15.0906 2852 ProfSvc - ok15:35:15.0958 2852 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe15:35:15.0969 2852 ProtectedStorage - ok15:35:16.0022 2852 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys15:35:16.0056 2852 Psched - ok15:35:16.0108 2852 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys15:35:16.0122 2852 PxHlpa64 - ok15:35:16.0156 2852 pxkbf (ba5f7c107eace67973b4b798832a74c7) C:\Windows\system32\drivers\pxkbf.sys15:35:16.0165 2852 pxkbf - ok15:35:16.0198 2852 pxrts (007e57428802f587d0d6737ae7a9d989) C:\Windows\system32\drivers\pxrts.sys15:35:16.0207 2852 pxrts - ok15:35:16.0266 2852 pxscan (66d4d00c8908888a68b749d91f1e6789) C:\Windows\system32\drivers\pxscan.sys15:35:16.0278 2852 pxscan - ok15:35:16.0418 2852 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys15:35:16.0444 2852 ql2300 - ok15:35:16.0599 2852 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys15:35:16.0610 2852 ql40xx - ok15:35:16.0676 2852 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll15:35:16.0695 2852 QWAVE - ok15:35:16.0711 2852 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys15:35:16.0726 2852 QWAVEdrv - ok15:35:16.0745 2852 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys15:35:16.0774 2852 RasAcd - ok15:35:16.0839 2852 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys15:35:16.0869 2852 RasAgileVpn - ok15:35:16.0892 2852 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll15:35:16.0923 2852 RasAuto - ok15:35:16.0983 2852 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys15:35:17.0016 2852 Rasl2tp - ok15:35:17.0082 2852 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll15:35:17.0116 2852 RasMan - ok15:35:17.0171 2852 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys15:35:17.0201 2852 RasPppoe - ok15:35:17.0217 2852 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys15:35:17.0246 2852 RasSstp - ok15:35:17.0309 2852 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys15:35:17.0345 2852 rdbss - ok15:35:17.0358 2852 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys15:35:17.0371 2852 rdpbus - ok15:35:17.0383 2852 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys15:35:17.0410 2852 RDPCDD - ok15:35:17.0466 2852 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys15:35:17.0481 2852 RDPDR - ok15:35:17.0502 2852 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys15:35:17.0531 2852 RDPENCDD - ok15:35:17.0538 2852 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys15:35:17.0568 2852 RDPREFMP - ok15:35:17.0627 2852 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys15:35:17.0644 2852 RDPWD - ok15:35:17.0718 2852 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys15:35:17.0730 2852 rdyboost - ok15:35:17.0874 2852 RegSrvc (3b71b5b91e7dca93585d5a86c897adc4) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe15:35:17.0893 2852 RegSrvc - ok15:35:17.0958 2852 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll15:35:17.0992 2852 RemoteAccess - ok15:35:18.0053 2852 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll15:35:18.0087 2852 RemoteRegistry - ok15:35:18.0101 2852 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll15:35:18.0132 2852 RpcEptMapper - ok15:35:18.0139 2852 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe15:35:18.0153 2852 RpcLocator - ok15:35:18.0230 2852 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll15:35:18.0268 2852 RpcSs - ok15:35:18.0368 2852 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys15:35:18.0400 2852 rspndr - ok15:35:18.0490 2852 RTL8167 (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys15:35:18.0506 2852 RTL8167 - ok15:35:18.0553 2852 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys15:35:18.0565 2852 s3cap - ok15:35:18.0618 2852 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe15:35:18.0634 2852 SamSs - ok15:35:18.0689 2852 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys15:35:18.0707 2852 sbp2port - ok15:35:18.0734 2852 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll15:35:18.0765 2852 SCardSvr - ok15:35:18.0812 2852 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys15:35:18.0844 2852 scfilter - ok15:35:18.0959 2852 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll15:35:18.0994 2852 Schedule - ok15:35:19.0052 2852 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll15:35:19.0085 2852 SCPolicySvc - ok15:35:19.0104 2852 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys15:35:19.0119 2852 sdbus - ok15:35:19.0174 2852 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll15:35:19.0191 2852 SDRSVC - ok15:35:19.0249 2852 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys15:35:19.0282 2852 secdrv - ok15:35:19.0328 2852 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll15:35:19.0359 2852 seclogon - ok15:35:19.0428 2852 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll15:35:19.0457 2852 SENS - ok15:35:19.0466 2852 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll15:35:19.0478 2852 SensrSvc - ok15:35:19.0494 2852 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys15:35:19.0505 2852 Serenum - ok15:35:19.0550 2852 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys15:35:19.0562 2852 Serial - ok15:35:19.0620 2852 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys15:35:19.0637 2852 sermouse - ok15:35:19.0692 2852 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll15:35:19.0722 2852 SessionEnv - ok15:35:19.0768 2852 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys15:35:19.0786 2852 sffdisk - ok15:35:19.0801 2852 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys15:35:19.0812 2852 sffp_mmc - ok15:35:19.0824 2852 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\DRIVERS\sffp_sd.sys15:35:19.0838 2852 sffp_sd - ok15:35:19.0892 2852 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys15:35:19.0909 2852 sfloppy - ok15:35:20.0034 2852 SftService (beb504962e36d6f368ebfc702a659e09) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE15:35:20.0048 2852 SftService - ok15:35:20.0128 2852 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll15:35:20.0161 2852 ShellHWDetection - ok15:35:20.0189 2852 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys15:35:20.0199 2852 SiSRaid2 - ok15:35:20.0213 2852 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys15:35:20.0223 2852 SiSRaid4 - ok15:35:20.0252 2852 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys15:35:20.0281 2852 Smb - ok15:35:20.0342 2852 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe15:35:20.0360 2852 SNMPTRAP - ok15:35:20.0365 2852 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys15:35:20.0375 2852 spldr - ok15:35:20.0454 2852 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe15:35:20.0490 2852 Spooler - ok15:35:20.0719 2852 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe15:35:20.0775 2852 sppsvc - ok15:35:20.0918 2852 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll15:35:20.0949 2852 sppuinotify - ok15:35:21.0063 2852 sprtsvc_DellSupportCenter (d630b6f2e8379b6f10dc16e82a426552) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe15:35:21.0078 2852 sprtsvc_DellSupportCenter - ok15:35:21.0197 2852 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys15:35:21.0197 2852 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb15:35:21.0199 2852 sptd ( LockedFile.Multi.Generic ) - warning15:35:21.0199 2852 sptd - detected LockedFile.Multi.Generic (1)15:35:21.0270 2852 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys15:35:21.0284 2852 srv - ok15:35:21.0312 2852 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys15:35:21.0326 2852 srv2 - ok15:35:21.0347 2852 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys15:35:21.0360 2852 srvnet - ok15:35:21.0426 2852 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll15:35:21.0457 2852 SSDPSRV - ok15:35:21.0467 2852 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll15:35:21.0499 2852 SstpSvc - ok15:35:21.0689 2852 STacSV (da7702025dfd169b909c4da3126762cc) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe15:35:21.0701 2852 STacSV - ok15:35:21.0782 2852 Steam Client Service - ok15:35:21.0816 2852 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys15:35:21.0830 2852 stexstor - ok15:35:21.0875 2852 STHDA (caf5a9708671b14b9670260735b22c4e) C:\Windows\system32\DRIVERS\stwrt64.sys15:35:21.0888 2852 STHDA - ok15:35:21.0950 2852 StillCam (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys15:35:21.0963 2852 StillCam - ok15:35:22.0058 2852 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll15:35:22.0082 2852 stisvc - ok15:35:22.0141 2852 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys15:35:22.0157 2852 storflt - ok15:35:22.0211 2852 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll15:35:22.0224 2852 StorSvc - ok15:35:22.0239 2852 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys15:35:22.0250 2852 storvsc - ok15:35:22.0267 2852 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys15:35:22.0277 2852 swenum - ok15:35:22.0365 2852 SwitchBoard (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe15:35:22.0377 2852 SwitchBoard ( UnsignedFile.Multi.Generic ) - warning15:35:22.0377 2852 SwitchBoard - detected UnsignedFile.Multi.Generic (1)15:35:22.0455 2852 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll15:35:22.0491 2852 swprv - ok15:35:22.0501 2852 sxuptp - ok15:35:22.0572 2852 SynTP (29ad5ff846e8939c10112f34cb2e334a) C:\Windows\system32\DRIVERS\SynTP.sys15:35:22.0582 2852 SynTP - ok15:35:22.0729 2852 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll15:35:22.0758 2852 SysMain - ok15:35:22.0942 2852 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll15:35:22.0959 2852 TabletInputService - ok15:35:22.0982 2852 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll15:35:23.0013 2852 TapiSrv - ok15:35:23.0028 2852 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll15:35:23.0059 2852 TBS - ok15:35:23.0232 2852 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys15:35:23.0264 2852 Tcpip - ok15:35:23.0397 2852 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys15:35:23.0427 2852 TCPIP6 - ok15:35:23.0511 2852 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys15:35:23.0543 2852 tcpipreg - ok15:35:23.0588 2852 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys15:35:23.0601 2852 TDPIPE - ok15:35:23.0657 2852 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys15:35:23.0673 2852 TDTCP - ok15:35:23.0732 2852 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys15:35:23.0766 2852 tdx - ok15:35:23.0823 2852 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys15:35:23.0839 2852 TermDD - ok15:35:23.0926 2852 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll15:35:23.0960 2852 TermService - ok15:35:24.0012 2852 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll15:35:24.0028 2852 Themes - ok15:35:24.0085 2852 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll15:35:24.0119 2852 THREADORDER - ok15:35:24.0135 2852 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll15:35:24.0166 2852 TrkWks - ok15:35:24.0273 2852 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe15:35:24.0307 2852 TrustedInstaller - ok15:35:24.0365 2852 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys15:35:24.0392 2852 tssecsrv - ok15:35:24.0446 2852 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys15:35:24.0458 2852 TsUsbFlt - ok15:35:24.0531 2852 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys15:35:24.0563 2852 tunnel - ok15:35:24.0591 2852 TurboB (825e7a1f48fb8bcfba27c178aab4e275) C:\Windows\system32\DRIVERS\TurboB.sys15:35:24.0599 2852 TurboB - ok15:35:24.0682 2852 TurboBoost (b206be1174d5964d49a56bb6c4e0524a) C:\Program Files\Intel\TurboBoost\TurboBoost.exe15:35:24.0694 2852 TurboBoost - ok15:35:24.0739 2852 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys15:35:24.0754 2852 uagp35 - ok15:35:24.0823 2852 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys15:35:24.0854 2852 udfs - ok15:35:24.0907 2852 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe15:35:24.0923 2852 UI0Detect - ok15:35:24.0978 2852 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys15:35:24.0994 2852 uliagpkx - ok15:35:25.0012 2852 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys15:35:25.0023 2852 umbus - ok15:35:25.0040 2852 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys15:35:25.0052 2852 UmPass - ok15:35:25.0112 2852 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll15:35:25.0130 2852 UmRdpService - ok15:35:25.0155 2852 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll15:35:25.0187 2852 upnphost - ok15:35:25.0246 2852 USBAAPL64 (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys15:35:25.0262 2852 USBAAPL64 - ok15:35:25.0321 2852 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys15:35:25.0339 2852 usbccgp - ok15:35:25.0361 2852 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys15:35:25.0376 2852 usbcir - ok15:35:25.0395 2852 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys15:35:25.0406 2852 usbehci - ok15:35:25.0433 2852 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys15:35:25.0446 2852 usbhub - ok15:35:25.0465 2852 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys15:35:25.0476 2852 usbohci - ok15:35:25.0538 2852 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys15:35:25.0554 2852 usbprint - ok15:35:25.0606 2852 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys15:35:25.0626 2852 usbscan - ok15:35:25.0642 2852 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS15:35:25.0654 2852 USBSTOR - ok15:35:25.0671 2852 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys15:35:25.0682 2852 usbuhci - ok15:35:25.0764 2852 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys15:35:25.0781 2852 usbvideo - ok15:35:25.0834 2852 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll15:35:25.0868 2852 UxSms - ok15:35:25.0918 2852 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe15:35:25.0930 2852 VaultSvc - ok15:35:25.0993 2852 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys15:35:26.0009 2852 vdrvroot - ok15:35:26.0090 2852 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe15:35:26.0127 2852 vds - ok15:35:26.0186 2852 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys15:35:26.0199 2852 vga - ok15:35:26.0218 2852 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys15:35:26.0247 2852 VgaSave - ok15:35:26.0272 2852 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys15:35:26.0283 2852 vhdmp - ok15:35:26.0300 2852 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys15:35:26.0310 2852 viaide - ok15:35:26.0333 2852 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys15:35:26.0344 2852 vmbus - ok15:35:26.0358 2852 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys15:35:26.0370 2852 VMBusHID - ok15:35:26.0386 2852 vmci - ok15:35:26.0389 2852 VMnetAdapter - ok15:35:26.0410 2852 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys15:35:26.0421 2852 volmgr - ok15:35:26.0483 2852 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys15:35:26.0497 2852 volmgrx - ok15:35:26.0564 2852 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys15:35:26.0577 2852 volsnap - ok15:35:26.0608 2852 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys15:35:26.0627 2852 vsmraid - ok15:35:26.0764 2852 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe15:35:26.0805 2852 VSS - ok15:35:27.0037 2852 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys15:35:27.0053 2852 vwifibus - ok15:35:27.0071 2852 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys15:35:27.0085 2852 vwififlt - ok15:35:27.0100 2852 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys15:35:27.0115 2852 vwifimp - ok15:35:27.0188 2852 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll15:35:27.0220 2852 W32Time - ok15:35:27.0234 2852 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys15:35:27.0246 2852 WacomPen - ok15:35:27.0296 2852 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys15:35:27.0324 2852 WANARP - ok15:35:27.0331 2852 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys15:35:27.0359 2852 Wanarpv6 - ok15:35:27.0451 2852 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe15:35:27.0475 2852 WatAdminSvc - ok15:35:27.0616 2852 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe15:35:27.0640 2852 wbengine - ok15:35:27.0840 2852 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll15:35:27.0857 2852 WbioSrvc - ok15:35:27.0929 2852 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll15:35:27.0949 2852 wcncsvc - ok15:35:27.0965 2852 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll15:35:27.0978 2852 WcsPlugInService - ok15:35:28.0045 2852 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys15:35:28.0057 2852 Wd - ok15:35:28.0107 2852 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys15:35:28.0125 2852 Wdf01000 - ok15:35:28.0143 2852 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll15:35:28.0160 2852 WdiServiceHost - ok15:35:28.0163 2852 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll15:35:28.0179 2852 WdiSystemHost - ok15:35:28.0242 2852 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll15:35:28.0262 2852 WebClient - ok15:35:28.0284 2852 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll15:35:28.0315 2852 Wecsvc - ok15:35:28.0331 2852 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll15:35:28.0361 2852 wercplsupport - ok15:35:28.0380 2852 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll15:35:28.0411 2852 WerSvc - ok15:35:28.0463 2852 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys15:35:28.0502 2852 WfpLwf - ok15:35:28.0544 2852 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys15:35:28.0561 2852 WimFltr - ok15:35:28.0573 2852 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys15:35:28.0583 2852 WIMMount - ok15:35:28.0586 2852 WinHttpAutoProxySvc - ok15:35:28.0704 2852 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll15:35:28.0739 2852 Winmgmt - ok15:35:28.0936 2852 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll15:35:28.0981 2852 WinRM - ok15:35:29.0198 2852 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys15:35:29.0211 2852 WinUsb - ok15:35:29.0316 2852 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll15:35:29.0343 2852 Wlansvc - ok15:35:29.0365 2852 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys15:35:29.0375 2852 WmiAcpi - ok15:35:29.0487 2852 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe15:35:29.0502 2852 wmiApSrv - ok15:35:29.0605 2852 WMPNetworkSvc - ok15:35:29.0619 2852 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll15:35:29.0635 2852 WPCSvc - ok15:35:29.0692 2852 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll15:35:29.0709 2852 WPDBusEnum - ok15:35:29.0757 2852 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys15:35:29.0794 2852 ws2ifsl - ok15:35:29.0827 2852 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys15:35:29.0848 2852 WSDPrintDevice - ok15:35:29.0851 2852 WSearch - ok15:35:30.0037 2852 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll15:35:30.0073 2852 wuauserv - ok15:35:30.0317 2852 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys15:35:30.0345 2852 WudfPf - ok15:35:30.0384 2852 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys15:35:30.0414 2852 WUDFRd - ok15:35:30.0471 2852 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll15:35:30.0503 2852 wudfsvc - ok15:35:30.0567 2852 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll15:35:30.0586 2852 WwanSvc - ok15:35:30.0682 2852 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7} (74983addca2d9618512c088d856d6615) C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl15:35:30.0695 2852 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7} - ok15:35:30.0713 2852 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR015:35:31.0028 2852 \Device\Harddisk0\DR0 - ok15:35:31.0032 2852 Boot (0x1200) (47a2b6601a482770db82e6c7c1fb0314) \Device\Harddisk0\DR0\Partition015:35:31.0034 2852 \Device\Harddisk0\DR0\Partition0 - ok15:35:31.0062 2852 Boot (0x1200) (55d86f776e8bcfec33b424e6fe457015) \Device\Harddisk0\DR0\Partition115:35:31.0063 2852 \Device\Harddisk0\DR0\Partition1 - ok15:35:31.0064 2852 ============================================================15:35:31.0064 2852 Scan finished15:35:31.0064 2852 ============================================================15:35:31.0071 2344 Detected object count: 515:35:31.0071 2344 Actual detected object count: 515:35:41.0377 2344 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user15:35:41.0377 2344 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip15:35:41.0377 2344 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user15:35:41.0378 2344 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip15:35:41.0378 2344 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user15:35:41.0379 2344 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip15:35:41.0380 2344 sptd ( LockedFile.Multi.Generic ) - skipped by user15:35:41.0380 2344 sptd ( LockedFile.Multi.Generic ) - User select action: Skip15:35:41.0381 2344 SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user15:35:41.0381 2344 SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip15:35:46.0709 3540 Deinitialize success Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2012 ID:570332 Share Posted July 13, 2012 Welcome to the forum. Please don't run scans unless instructed to.Please remove any usb or external drives from the computer before you run this scan!Please download and run RogueKiller.For Windows XP, double-click to start.For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.Click Scan to scan the system (don't run any other options, they're not all bad!!!!!!!)Post back the report.MrC Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570335 Share Posted July 13, 2012 Thanks for the quick reply. I apologise for the unsolicited scans / log files.Here's the rogue killer report:RogueKiller V7.6.3 [07/08/2012] by Tigzymail: tigzyRK<at>gmail<dot>comFeedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/Blog: http://tigzyrk.blogspot.comOperating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Normal modeUser: Jon [Admin rights]Mode: Scan -- Date: 07/13/2012 16:44:32¤¤¤ Bad processes: 0 ¤¤¤¤¤¤ Registry Entries: 8 ¤¤¤[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\n.) -> FOUND[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND[HJ] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND[HJ] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND¤¤¤ Particular Files / Folders: ¤¤¤[ZeroAccess][FILE] @ : c:\windows\installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@ --> FOUND[ZeroAccess][FOLDER] U : c:\windows\installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U --> FOUND[ZeroAccess][FOLDER] L : c:\windows\installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L --> FOUND[ZeroAccess][FILE] @ : c:\users\jon\appdata\local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@ --> FOUND[ZeroAccess][FOLDER] U : c:\users\jon\appdata\local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U --> FOUND[ZeroAccess][FOLDER] L : c:\users\jon\appdata\local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L --> FOUND[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND¤¤¤ Driver: [NOT LOADED] ¤¤¤¤¤¤ Infection : ZeroAccess ¤¤¤¤¤¤ HOSTS File: ¤¤¤¤¤¤ MBR Check: ¤¤¤+++++ PhysicalDrive0: Hitachi HTS725050A9A364 ATA Device +++++--- User ---[MBR] c79f2bd0be0c416046337c7b4be5e0f7[bSP] 86e0863e50002712c3a8f7a1fcd1f6b6 : Windows Vista MBR CodePartition table:0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 461899 MoUser = LL1 ... OK!User = LL2 ... OK!Finished : << RKreport[1].txt >>RKreport[1].txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2012 ID:570336 Share Posted July 13, 2012 Your computer is infected with a nasty rootkit. Please read the following information first.You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.BACKDOOR WARNING------------------------------One or more of the identified infections is known to use a backdoor.This allows hackers to remotely control your computer, steal critical system information and download and execute files.I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?http://www.dslreports.com/faq/10451When Should I Format, How Should I Reinstallhttp://www.dslreports.com/faq/10063I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.Please let me know you have read this and agree to it.Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.----------------------------------------For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.Plug the flashdrive into the infected PC.Enter System Recovery Options.To enter System Recovery Options from the Advanced Boot Options:Restart the computer.As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.Use the arrow keys to select the Repair your computer menu item.Select US as the keyboard language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account an click Next.To enter System Recovery Options by using Windows installation disc:Insert the installation disc.Restart your computer.If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.Click Repair your computer.Select US as the keyboard language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account and click Next.On the System Recovery Options menu you will get the following options:Startup RepairSystem RestoreWindows Complete PC RestoreWindows Memory Diagnostic ToolCommand Prompt[*]Select Command Prompt[*]In the command window type in notepad and press Enter.[*]The notepad opens. Under File menu select Open.[*]Select "Computer" and find your flash drive letter and close the notepad.[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press EnterNote: Replace letter e with the drive letter of your flash drive.[*]The tool will start to run.[*]When the tool opens click Yes to disclaimer.[*]Press Scan button.[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply. Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570374 Share Posted July 13, 2012 I read the disclaimer and agree.Here's the log:Scan result of Farbar Recovery Scan Tool Version: 11-07-2012Ran by SYSTEM at 13-07-2012 17:36:31Running from F:\Windows 7 Professional (X64) OS Language: English(US)The current controlset is ControlSet001========================== Registry (Whitelisted) =============HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1882920 2009-10-29] (Synaptics Incorporated)HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-01-20] (IDT, Inc.)HKLM\...\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe [3180624 2009-07-02] (Dell Inc.)HKLM\...\Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1926928 2009-09-21] (Intel® Corporation)HKLM\...\Run: [Logitech Download Assistant] C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [1580368 2010-11-03] (Logitech, Inc.)HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-30] (Adobe Systems Incorporated)HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [343168 2011-11-09] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [140520 2009-12-29] (CyberLink Corp.)HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [409744 2009-06-24] (Creative Technology Ltd)HKLM-x32\...\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-10-15] ()HKLM-x32\...\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [206064 2009-05-21] (SupportSoft, Inc.)HKLM-x32\...\Run: [brMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN [1159168 2009-05-26] (Brother Industries, Ltd.)HKLM-x32\...\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)HKLM-x32\...\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin [1523360 2011-01-12] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)HKLM-x32\...\Run: [] [x]HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2012-04-04] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-04-04] (Adobe Systems Inc.)HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252296 2012-01-17] (Sun Microsystems, Inc.)HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2012-03-27] (Apple Inc.)HKU\Jon\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3872080 2010-04-16] (Microsoft Corporation)HKU\Jon\...\Run: [Google Update] "C:\Users\Jon\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-06-04] (Google Inc.)HKU\Jon\...\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [357696 2010-04-01] (DT Soft Ltd)HKU\Jon\...\Run: [AdobeBridge] [x]HKU\Jon\...\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1242448 2011-12-24] (Valve Corporation)HKLM\...\RunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe" [161736 2010-02-11] ()HKLM-x32\...\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe [165184 2010-02-11] (Softthinks)Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]Tcpip\Parameters: [DhcpNameServer] 192.168.0.1Startup: C:\Users\Default\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)Startup: C:\Users\Default User\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)Startup: C:\Users\Jon\Start Menu\Programs\Startup\Dell Dock.lnkShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)==================== Services (Whitelisted) ======2 CSIScanner; "C:\Program Files\Prevx\prevx.exe" /service [6746280 2012-04-10] (Prevx)2 HDRExpressService; C:\Program Files\UCT\HDR Express\HDRExpressService.exe [32400 2012-04-04] ()3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [315664 2009-09-21] ()3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [291696 2012-03-26] (Microsoft Corporation)2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [66560 2012-03-28] (Nalpeiron Ltd.)2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe [244736 2010-01-20] (IDT, Inc.)2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [x]========================== Drivers (Whitelisted) =============3 pxkbf; C:\Windows\System32\Drivers\pxkbf.sys [24024 2012-04-10] (Prevx)1 pxrts; C:\Windows\System32\Drivers\pxrts.sys [65736 2012-04-10] (Prevx)0 pxscan; C:\Windows\System32\Drivers\pxscan.sys [36384 2012-04-10] (Prevx)0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-10-07] (Duplex Secure Ltd.)2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] ()2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}; \??\C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [146928 2009-12-29] (CyberLink Corp.)3 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [x]0 vmci; C:\Windows\System32\DRIVERS\vmci.sys [x]3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [x]========================== NetSvcs (Whitelisted) ======================= One Month Created Files and Folders ==============2012-07-13 15:44 - 2012-07-13 15:44 - 00002604 ____A C:\Users\Jon\Desktop\RKreport[1].txt2012-07-13 15:44 - 2012-07-13 15:44 - 00000000 ____D C:\Users\Jon\Desktop\RK_Quarantine2012-07-13 15:44 - 2012-07-13 15:44 - 00000000 ____D C:\Users\Jon\.jenny2012-07-13 15:43 - 2012-07-13 15:43 - 01558528 ____A C:\Users\Jon\Downloads\RogueKiller.exe2012-07-13 14:30 - 2012-07-13 14:30 - 00055028 ____A C:\Users\Jon\Desktop\Extras.Txt2012-07-13 14:26 - 2012-07-13 14:26 - 00119472 ____A C:\Users\Jon\Desktop\OTL.Txt2012-07-13 14:26 - 2012-07-13 14:26 - 00055028 ____A C:\Users\Jon\Downloads\Extras.Txt2012-07-13 14:25 - 2012-07-13 14:25 - 00119472 ____A C:\Users\Jon\Downloads\OTL.Txt2012-07-13 14:15 - 2012-07-13 14:15 - 00596480 ____A (OldTimer Tools) C:\Users\Jon\Downloads\OTL.exe2012-07-13 14:13 - 2012-07-13 14:13 - 02135640 ____A (Kaspersky Lab ZAO) C:\Users\Jon\Downloads\tdsskiller.exe2012-07-12 18:56 - 2012-07-12 18:56 - 00000000 ____D C:\Users\Jon\Desktop\Untitled Export2012-07-12 18:02 - 2012-07-12 18:02 - 00000000 ____D C:\Users\Jon\My Documents\Adobe2012-07-12 18:02 - 2012-07-12 18:02 - 00000000 ____D C:\Users\Jon\Documents\Adobe2012-07-12 18:00 - 2012-07-13 11:42 - 00002928 ____A C:\Users\Jon\My Documents\PerfectEffectsConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00002928 ____A C:\Users\Jon\Documents\PerfectEffectsConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00002348 ____A C:\Users\Jon\My Documents\PerfectPortraitConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00002348 ____A C:\Users\Jon\Documents\PerfectPortraitConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00002332 ____A C:\Users\Jon\My Documents\PerfectLayersConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00002332 ____A C:\Users\Jon\Documents\PerfectLayersConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001120 ____A C:\Users\Jon\My Documents\PhotoFrameConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001120 ____A C:\Users\Jon\Documents\PhotoFrameConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001112 ____A C:\Users\Jon\My Documents\GenuineFractalsConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001112 ____A C:\Users\Jon\Documents\GenuineFractalsConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001108 ____A C:\Users\Jon\My Documents\PhotoTuneConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001108 ____A C:\Users\Jon\Documents\PhotoTuneConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001088 ____A C:\Users\Jon\My Documents\PhotoToolsConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001088 ____A C:\Users\Jon\My Documents\FocalPointConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001088 ____A C:\Users\Jon\Documents\PhotoToolsConduit.log2012-07-12 18:00 - 2012-07-13 11:42 - 00001088 ____A C:\Users\Jon\Documents\FocalPointConduit.log2012-07-12 17:58 - 2012-07-12 17:58 - 00002069 ____A C:\Users\Public\Desktop\Lightroom 4.1 64-bit.lnk2012-07-12 17:58 - 2012-07-12 17:58 - 00002069 ____A C:\Users\All Users\Desktop\Lightroom 4.1 64-bit.lnk2012-07-12 17:51 - 2012-07-12 17:51 - 00000000 ____D C:\Users\Jon\Desktop\Adobe2012-07-12 17:44 - 2012-07-12 17:51 - 765299656 ____A (Adobe Systems Incorporated) C:\Users\Jon\Downloads\Lightroom_4_LS11.exe2012-07-12 14:30 - 2012-07-12 14:30 - 00112797 ____A C:\Users\Jon\Downloads\GradientXTerminatorWin.zip2012-07-12 14:30 - 2012-07-12 14:30 - 00000000 ____D C:\Users\Jon\Downloads\GradientXTerminatorWin2012-07-11 01:55 - 2012-06-11 22:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys2012-07-11 01:50 - 2012-06-02 07:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll2012-07-11 01:50 - 2012-06-02 07:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll2012-07-11 01:50 - 2012-06-02 07:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll2012-07-11 01:50 - 2012-06-02 07:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll2012-07-11 01:50 - 2012-06-02 07:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll2012-07-11 01:50 - 2012-06-02 07:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl2012-07-11 01:50 - 2012-06-02 07:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll2012-07-11 01:50 - 2012-06-02 07:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll2012-07-11 01:50 - 2012-06-02 07:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe2012-07-11 01:50 - 2012-06-02 07:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll2012-07-11 01:50 - 2012-06-02 06:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll2012-07-11 01:50 - 2012-06-02 06:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb2012-07-11 01:50 - 2012-06-02 06:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll2012-07-11 01:50 - 2012-06-02 06:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll2012-07-11 01:50 - 2012-06-02 04:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2012-07-11 01:50 - 2012-06-02 03:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2012-07-11 01:50 - 2012-06-02 03:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2012-07-11 01:50 - 2012-06-02 03:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2012-07-11 01:50 - 2012-06-02 03:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2012-07-11 01:50 - 2012-06-02 03:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2012-07-11 01:50 - 2012-06-02 03:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2012-07-11 01:50 - 2012-06-02 03:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2012-07-11 01:50 - 2012-06-02 03:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2012-07-11 01:50 - 2012-06-02 03:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2012-07-11 01:50 - 2012-06-02 03:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2012-07-11 01:50 - 2012-06-02 03:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2012-07-11 01:50 - 2012-06-02 03:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2012-07-11 01:50 - 2012-06-02 03:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2012-07-11 00:38 - 2012-07-11 00:38 - 00002591 ____A C:\Users\Public\Desktop\DeepSkyStacker.lnk2012-07-11 00:38 - 2012-07-11 00:38 - 00002591 ____A C:\Users\All Users\Desktop\DeepSkyStacker.lnk2012-07-11 00:38 - 2012-07-11 00:38 - 00000000 ____D C:\Program Files (x86)\DeepSkyStacker2012-07-11 00:37 - 2012-07-11 00:37 - 00000000 ____D C:\Users\Jon\Downloads\DeepSkyStacker2012-07-10 18:47 - 2012-06-09 00:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll2012-07-10 18:47 - 2012-06-08 23:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2012-07-10 18:47 - 2012-06-06 01:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll2012-07-10 18:47 - 2012-06-06 01:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll2012-07-10 18:47 - 2012-06-06 00:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2012-07-10 18:47 - 2012-06-06 00:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2012-07-10 18:47 - 2012-06-02 00:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys2012-07-10 18:47 - 2012-06-02 00:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys2012-07-10 18:47 - 2012-06-02 00:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys2012-07-10 18:47 - 2012-06-02 00:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll2012-07-10 18:47 - 2012-06-02 00:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll2012-07-10 18:47 - 2012-06-01 23:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2012-07-10 18:47 - 2012-06-01 23:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2012-07-10 18:47 - 2012-06-01 23:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2012-07-10 18:47 - 2012-06-01 23:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2012-07-10 18:47 - 2010-06-25 22:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll2012-07-10 18:47 - 2010-06-25 22:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll2012-07-10 18:46 - 2012-04-24 00:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll2012-07-10 18:46 - 2012-04-24 00:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll2012-07-10 18:46 - 2012-04-24 00:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll2012-07-10 18:46 - 2012-04-23 23:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2012-07-10 18:46 - 2012-04-23 23:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll2012-07-10 18:46 - 2012-04-23 23:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll2012-07-10 18:44 - 2012-06-06 01:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll2012-07-10 18:44 - 2012-06-06 00:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll2012-07-09 07:13 - 2012-07-09 07:14 - 05120402 ____A C:\Users\Jon\Downloads\FL_30_Win.exe2012-07-07 07:33 - 2012-07-07 07:33 - 00000000 ____D C:\Users\Jon\My Documents\Astronomy Tools2012-07-07 07:33 - 2012-07-07 07:33 - 00000000 ____D C:\Users\Jon\Documents\Astronomy Tools2012-07-07 07:33 - 2012-07-07 07:33 - 00000000 ____D C:\Users\Jon\Desktop\New Folder2012-07-07 06:45 - 2012-07-07 06:45 - 00001929 ____A C:\Users\Public\Desktop\Stellarium.lnk2012-07-07 06:45 - 2012-07-07 06:45 - 00001929 ____A C:\Users\All Users\Desktop\Stellarium.lnk2012-07-07 06:45 - 2012-07-07 06:45 - 00000000 ____D C:\Users\Jon\Application Data\Stellarium2012-07-07 06:45 - 2012-07-07 06:45 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Stellarium2012-07-07 06:45 - 2012-07-07 06:45 - 00000000 ____D C:\Program Files (x86)\Stellarium2012-07-07 06:42 - 2012-07-07 06:45 - 59408090 ____A ( ) C:\Users\Jon\Downloads\stellarium-0.11.3-win32.exe2012-07-05 17:55 - 2012-07-05 17:55 - 00000000 ____D C:\Program Files (x86)\Oracle2012-07-05 17:53 - 2012-05-04 18:29 - 00227720 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe2012-07-05 17:52 - 2012-05-15 18:06 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe2012-07-05 17:52 - 2012-05-15 18:06 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe2012-07-05 17:49 - 2012-07-05 17:52 - 00002954 ____A C:\Windows\SysWOW64\jupdate-1.7.0_05-b05.log2012-07-04 18:32 - 2012-07-04 18:32 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%2012-06-25 21:19 - 2012-06-25 21:19 - 00008883 ____A C:\Users\Jon\My Documents\blood pressure.xlsx2012-06-25 21:19 - 2012-06-25 21:19 - 00008883 ____A C:\Users\Jon\Documents\blood pressure.xlsx2012-06-25 05:31 - 2012-06-02 17:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll2012-06-25 05:31 - 2012-06-02 17:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll2012-06-25 05:31 - 2012-06-02 17:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe2012-06-25 05:31 - 2012-06-02 17:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll2012-06-25 05:31 - 2012-06-02 17:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll2012-06-25 05:31 - 2012-06-02 17:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll2012-06-25 05:31 - 2012-06-02 17:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll2012-06-25 05:30 - 2012-06-02 14:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll2012-06-25 05:30 - 2012-06-02 14:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe2012-06-23 17:55 - 2012-06-23 18:17 - 1086629167 ____A C:\Users\Jon\Downloads\2012-06-Marketplace-Bundle.zip2012-06-22 21:33 - 2012-06-22 21:33 - 00024136 ____A C:\Users\Jon\My Documents\ReadMe-Astronomy.txt2012-06-22 21:33 - 2012-06-22 21:33 - 00024136 ____A C:\Users\Jon\Documents\ReadMe-Astronomy.txt2012-06-22 21:32 - 2012-06-22 21:32 - 00047636 ____A C:\Users\Jon\Downloads\Astronomy_Tools_v1_6.zip2012-06-20 18:10 - 2012-07-04 16:19 - 00000000 ____D C:\Users\Jon\My Documents\Pay stubs2012-06-20 18:10 - 2012-07-04 16:19 - 00000000 ____D C:\Users\Jon\Documents\Pay stubs2012-06-19 21:16 - 2012-06-19 21:17 - 10754751 ____A C:\Users\Jon\Downloads\DeepSkyStacker.zip2012-06-19 21:09 - 2012-06-19 21:09 - 00001077 ____A C:\Users\Jon\Desktop\RegiStax 5.1 .lnk2012-06-19 21:09 - 2012-06-19 21:09 - 00000000 ____D C:\Program Files (x86)\RegiStax 5_12012-06-19 21:08 - 2012-06-19 21:08 - 01847685 ____A () C:\Users\Jon\Downloads\setupregistax5_1.exe2012-06-19 12:38 - 2012-06-19 12:40 - 16561880 ____A (UCT) C:\Users\Jon\Downloads\HDRExpressSetup_x64.exe2012-06-15 02:07 - 2012-06-15 02:08 - 00000000 ____D C:\Users\Jon\Logitech2012-06-15 02:07 - 2012-06-15 02:07 - 00002359 ____A C:\Users\Public\Desktop\Logitech Harmony Remote Software 7.lnk2012-06-15 02:07 - 2012-06-15 02:07 - 00002359 ____A C:\Users\All Users\Desktop\Logitech Harmony Remote Software 7.lnk2012-06-15 02:06 - 2012-06-15 02:06 - 00000000 ____D C:\Program Files (x86)\Logitech2012-06-15 02:02 - 2012-06-15 02:05 - 48357912 ____A (Logitech Inc.) C:\Users\Jon\Downloads\LogitechHarmonyRemote7.7.0-WIN-x86.exe2012-06-14 13:16 - 2012-06-14 13:16 - 00000000 ____D C:\Users\Jon\Local Settings\Macromedia2012-06-14 13:16 - 2012-06-14 13:16 - 00000000 ____D C:\Users\Jon\Local Settings\Application Data\Macromedia2012-06-14 13:16 - 2012-06-14 13:16 - 00000000 ____D C:\Users\Jon\AppData\Local\Macromedia2012-06-13 15:52 - 2012-04-26 00:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll2012-06-13 15:52 - 2012-04-26 00:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll2012-06-13 15:52 - 2012-04-26 00:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe2012-06-13 15:51 - 2012-05-04 06:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe2012-06-13 15:51 - 2012-05-04 05:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2012-06-13 15:51 - 2012-05-04 05:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2012-06-13 15:51 - 2012-04-27 22:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys============ 3 Months Modified Files ========================2012-07-13 16:31 - 2009-07-14 00:10 - 01925595 ____A C:\Windows\WindowsUpdate.log2012-07-13 16:28 - 2009-07-14 00:13 - 00717324 ____A C:\Windows\System32\PerfStringBackup.INI2012-07-13 16:25 - 2009-07-13 23:51 - 00056974 ____A C:\Windows\setupact.log2012-07-13 15:58 - 2010-06-04 23:50 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-13878151-3475214259-3496771340-1001UA.job2012-07-13 15:47 - 2012-04-09 15:55 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job2012-07-13 15:44 - 2012-07-13 15:44 - 00002604 ____A C:\Users\Jon\Desktop\RKreport[1].txt2012-07-13 15:43 - 2012-07-13 15:43 - 01558528 ____A C:\Users\Jon\Downloads\RogueKiller.exe2012-07-13 15:32 - 2011-08-21 15:58 - 01684992 __ASH C:\Users\Jon\My Documents\Thumbs.db2012-07-13 15:32 - 2011-08-21 15:58 - 01684992 __ASH C:\Users\Jon\Documents\Thumbs.db2012-07-13 15:28 - 2010-06-19 19:31 - 00001456 ____A C:\Users\Jon\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs2012-07-13 15:28 - 2010-06-19 19:31 - 00001456 ____A C:\Users\Jon\Local Settings\Adobe Save for Web 12.0 Prefs2012-07-13 15:28 - 2010-06-19 19:31 - 00001456 ____A C:\Users\Jon\AppData\Local\Adobe Save for Web 12.0 Prefs2012-07-13 14:30 - 2012-07-13 14:30 - 00055028 ____A C:\Users\Jon\Desktop\Extras.Txt2012-07-13 14:26 - 2012-07-13 14:26 - 00119472 ____A C:\Users\Jon\Desktop\OTL.Txt2012-07-13 14:26 - 2012-07-13 14:26 - 00055028 ____A C:\Users\Jon\Downloads\Extras.Txt2012-07-13 14:25 - 2012-07-13 14:25 - 00119472 ____A C:\Users\Jon\Downloads\OTL.Txt2012-07-13 14:15 - 2012-07-13 14:15 - 00596480 ____A (OldTimer Tools) C:\Users\Jon\Downloads\OTL.exe2012-07-13 14:13 - 2012-07-13 14:13 - 02135640 ____A (Kaspersky Lab ZAO) C:\Users\Jon\Downloads\tdsskiller.exe2012-07-13 13:49 - 2009-07-13 23:45 - 00014256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02012-07-13 13:49 - 2009-07-13 23:45 - 00014256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02012-07-13 13:37 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT2012-07-13 13:36 - 2010-05-27 14:05 - 00537496 ____A C:\Windows\PFRO.log2012-07-13 13:24 - 2009-07-14 00:08 - 00032628 ____A C:\Windows\Tasks\SCHEDLGU.TXT2012-07-13 13:17 - 2012-04-10 18:44 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2012-07-13 13:17 - 2012-04-10 18:44 - 00001111 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk2012-07-13 11:42 - 2012-07-12 18:00 - 00002928 ____A C:\Users\Jon\My Documents\PerfectEffectsConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00002928 ____A C:\Users\Jon\Documents\PerfectEffectsConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00002348 ____A C:\Users\Jon\My Documents\PerfectPortraitConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00002348 ____A C:\Users\Jon\Documents\PerfectPortraitConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00002332 ____A C:\Users\Jon\My Documents\PerfectLayersConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00002332 ____A C:\Users\Jon\Documents\PerfectLayersConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001120 ____A C:\Users\Jon\My Documents\PhotoFrameConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001120 ____A C:\Users\Jon\Documents\PhotoFrameConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001112 ____A C:\Users\Jon\My Documents\GenuineFractalsConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001112 ____A C:\Users\Jon\Documents\GenuineFractalsConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001108 ____A C:\Users\Jon\My Documents\PhotoTuneConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001108 ____A C:\Users\Jon\Documents\PhotoTuneConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001088 ____A C:\Users\Jon\My Documents\PhotoToolsConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001088 ____A C:\Users\Jon\My Documents\FocalPointConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001088 ____A C:\Users\Jon\Documents\PhotoToolsConduit.log2012-07-13 11:42 - 2012-07-12 18:00 - 00001088 ____A C:\Users\Jon\Documents\FocalPointConduit.log2012-07-12 17:58 - 2012-07-12 17:58 - 00002069 ____A C:\Users\Public\Desktop\Lightroom 4.1 64-bit.lnk2012-07-12 17:58 - 2012-07-12 17:58 - 00002069 ____A C:\Users\All Users\Desktop\Lightroom 4.1 64-bit.lnk2012-07-12 17:51 - 2012-07-12 17:44 - 765299656 ____A (Adobe Systems Incorporated) C:\Users\Jon\Downloads\Lightroom_4_LS11.exe2012-07-12 16:59 - 2010-06-04 23:51 - 00002389 ____A C:\Users\Jon\Desktop\Google Chrome.lnk2012-07-12 16:58 - 2010-06-04 23:50 - 00000848 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-13878151-3475214259-3496771340-1001Core.job2012-07-12 14:30 - 2012-07-12 14:30 - 00112797 ____A C:\Users\Jon\Downloads\GradientXTerminatorWin.zip2012-07-11 22:48 - 2012-04-09 15:55 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2012-07-11 22:48 - 2011-05-22 18:01 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2012-07-11 10:36 - 2009-07-13 23:45 - 05194928 ____A C:\Windows\System32\FNTCACHE.DAT2012-07-11 01:52 - 2010-06-04 23:31 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe2012-07-11 00:38 - 2012-07-11 00:38 - 00002591 ____A C:\Users\Public\Desktop\DeepSkyStacker.lnk2012-07-11 00:38 - 2012-07-11 00:38 - 00002591 ____A C:\Users\All Users\Desktop\DeepSkyStacker.lnk2012-07-09 07:14 - 2012-07-09 07:13 - 05120402 ____A C:\Users\Jon\Downloads\FL_30_Win.exe2012-07-07 06:45 - 2012-07-07 06:45 - 00001929 ____A C:\Users\Public\Desktop\Stellarium.lnk2012-07-07 06:45 - 2012-07-07 06:45 - 00001929 ____A C:\Users\All Users\Desktop\Stellarium.lnk2012-07-07 06:45 - 2012-07-07 06:42 - 59408090 ____A ( ) C:\Users\Jon\Downloads\stellarium-0.11.3-win32.exe2012-07-05 17:52 - 2012-07-05 17:49 - 00002954 ____A C:\Windows\SysWOW64\jupdate-1.7.0_05-b05.log2012-07-03 12:46 - 2010-09-08 22:21 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys2012-06-25 21:19 - 2012-06-25 21:19 - 00008883 ____A C:\Users\Jon\My Documents\blood pressure.xlsx2012-06-25 21:19 - 2012-06-25 21:19 - 00008883 ____A C:\Users\Jon\Documents\blood pressure.xlsx2012-06-23 18:17 - 2012-06-23 17:55 - 1086629167 ____A C:\Users\Jon\Downloads\2012-06-Marketplace-Bundle.zip2012-06-22 21:33 - 2012-06-22 21:33 - 00024136 ____A C:\Users\Jon\My Documents\ReadMe-Astronomy.txt2012-06-22 21:33 - 2012-06-22 21:33 - 00024136 ____A C:\Users\Jon\Documents\ReadMe-Astronomy.txt2012-06-22 21:32 - 2012-06-22 21:32 - 00047636 ____A C:\Users\Jon\Downloads\Astronomy_Tools_v1_6.zip2012-06-19 21:17 - 2012-06-19 21:16 - 10754751 ____A C:\Users\Jon\Downloads\DeepSkyStacker.zip2012-06-19 21:09 - 2012-06-19 21:09 - 00001077 ____A C:\Users\Jon\Desktop\RegiStax 5.1 .lnk2012-06-19 21:08 - 2012-06-19 21:08 - 01847685 ____A () C:\Users\Jon\Downloads\setupregistax5_1.exe2012-06-19 12:40 - 2012-06-19 12:38 - 16561880 ____A (UCT) C:\Users\Jon\Downloads\HDRExpressSetup_x64.exe2012-06-15 02:07 - 2012-06-15 02:07 - 00002359 ____A C:\Users\Public\Desktop\Logitech Harmony Remote Software 7.lnk2012-06-15 02:07 - 2012-06-15 02:07 - 00002359 ____A C:\Users\All Users\Desktop\Logitech Harmony Remote Software 7.lnk2012-06-15 02:06 - 2010-05-27 12:16 - 00020626 ____A C:\Windows\DPINST.LOG2012-06-15 02:05 - 2012-06-15 02:02 - 48357912 ____A (Logitech Inc.) C:\Users\Jon\Downloads\LogitechHarmonyRemote7.7.0-WIN-x86.exe2012-06-15 02:03 - 2010-07-23 21:59 - 00038912 ____A C:\Users\Jon\My Documents\workout.xls2012-06-15 02:03 - 2010-07-23 21:59 - 00038912 ____A C:\Users\Jon\Documents\workout.xls2012-06-12 16:30 - 2010-11-12 15:19 - 00000426 ____A C:\Windows\BRWMARK.INI2012-06-11 22:08 - 2012-07-11 01:55 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys2012-06-09 00:43 - 2012-07-10 18:47 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll2012-06-08 23:41 - 2012-07-10 18:47 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2012-06-06 01:06 - 2012-07-10 18:47 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll2012-06-06 01:06 - 2012-07-10 18:47 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll2012-06-06 01:02 - 2012-07-10 18:44 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll2012-06-06 00:05 - 2012-07-10 18:47 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2012-06-06 00:05 - 2012-07-10 18:47 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2012-06-06 00:03 - 2012-07-10 18:44 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll2012-06-02 17:19 - 2012-06-25 05:31 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll2012-06-02 17:19 - 2012-06-25 05:31 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll2012-06-02 17:19 - 2012-06-25 05:31 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe2012-06-02 17:19 - 2012-06-25 05:31 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll2012-06-02 17:19 - 2012-06-25 05:31 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll2012-06-02 17:15 - 2012-06-25 05:31 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll2012-06-02 17:15 - 2012-06-25 05:31 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll2012-06-02 14:19 - 2012-06-25 05:30 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll2012-06-02 14:15 - 2012-06-25 05:30 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe2012-06-02 07:49 - 2012-07-11 01:50 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll2012-06-02 07:17 - 2012-07-11 01:50 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll2012-06-02 07:12 - 2012-07-11 01:50 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll2012-06-02 07:05 - 2012-07-11 01:50 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll2012-06-02 07:05 - 2012-07-11 01:50 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll2012-06-02 07:04 - 2012-07-11 01:50 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl2012-06-02 07:04 - 2012-07-11 01:50 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll2012-06-02 07:03 - 2012-07-11 01:50 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll2012-06-02 07:01 - 2012-07-11 01:50 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe2012-06-02 07:00 - 2012-07-11 01:50 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll2012-06-02 06:59 - 2012-07-11 01:50 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll2012-06-02 06:57 - 2012-07-11 01:50 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb2012-06-02 06:57 - 2012-07-11 01:50 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll2012-06-02 06:54 - 2012-07-11 01:50 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll2012-06-02 04:07 - 2012-07-11 01:50 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2012-06-02 03:43 - 2012-07-11 01:50 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2012-06-02 03:33 - 2012-07-11 01:50 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2012-06-02 03:26 - 2012-07-11 01:50 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2012-06-02 03:25 - 2012-07-11 01:50 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2012-06-02 03:25 - 2012-07-11 01:50 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2012-06-02 03:23 - 2012-07-11 01:50 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2012-06-02 03:21 - 2012-07-11 01:50 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2012-06-02 03:20 - 2012-07-11 01:50 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2012-06-02 03:19 - 2012-07-11 01:50 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2012-06-02 03:19 - 2012-07-11 01:50 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2012-06-02 03:17 - 2012-07-11 01:50 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2012-06-02 03:16 - 2012-07-11 01:50 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2012-06-02 03:14 - 2012-07-11 01:50 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2012-06-02 00:50 - 2012-07-10 18:47 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys2012-06-02 00:48 - 2012-07-10 18:47 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys2012-06-02 00:48 - 2012-07-10 18:47 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys2012-06-02 00:45 - 2012-07-10 18:47 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll2012-06-02 00:44 - 2012-07-10 18:47 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll2012-06-01 23:40 - 2012-07-10 18:47 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2012-06-01 23:40 - 2012-07-10 18:47 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2012-06-01 23:39 - 2012-07-10 18:47 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2012-06-01 23:34 - 2012-07-10 18:47 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2012-06-01 20:08 - 2012-06-01 19:32 - 00001959 ____A C:\Users\Jon\Application Data\Requiem.log2012-06-01 20:08 - 2012-06-01 19:32 - 00001959 ____A C:\Users\Jon\AppData\Roaming\Requiem.log2012-06-01 20:05 - 2012-06-01 20:05 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk2012-06-01 20:05 - 2012-06-01 20:05 - 00001785 ____A C:\Users\All Users\Desktop\iTunes.lnk2012-06-01 20:01 - 2012-06-01 20:00 - 76761968 ____A (Apple Inc.) C:\Users\Jon\Downloads\iTunes64Setup(2).exe2012-06-01 20:00 - 2012-06-01 19:59 - 07405262 ____A C:\Users\Jon\Downloads\pdfdrm.zip2012-06-01 19:57 - 2012-06-01 19:57 - 00101680 ____A (Amazon.com, Inc.) C:\Windows\System32\stkMonitor.dll2012-06-01 19:50 - 2012-06-01 19:48 - 71279472 ____A (Apple Inc.) C:\Users\Jon\Downloads\iTunes64Setup(1).exe2012-06-01 19:32 - 2012-06-01 19:32 - 11394763 ____A C:\Users\Jon\Downloads\iSmoothBlog-requiem-3.3.5-win.zip2012-06-01 19:21 - 2012-06-01 19:20 - 47520208 ____A C:\Users\Jon\Downloads\calibre-0.8.54.msi2012-06-01 19:01 - 2012-06-01 18:59 - 34817706 ____A ( ) C:\Users\Jon\Downloads\iphonetransfer.exe2012-05-24 21:58 - 2012-05-22 21:01 - 00000026 ____A C:\Users\Jon\My Documents\auradata.txt2012-05-24 21:58 - 2012-05-22 21:01 - 00000026 ____A C:\Users\Jon\Documents\auradata.txt2012-05-22 12:30 - 2012-05-22 12:29 - 15109264 ____A (3D RealityMaps GmbH. ) C:\Users\Jon\Downloads\Setup_MountEverestOnlineViewer.exe2012-05-20 19:25 - 2012-05-20 19:25 - 00003584 ____A C:\Users\Jon\Local Settings\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2012-05-20 19:25 - 2012-05-20 19:25 - 00003584 ____A C:\Users\Jon\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2012-05-20 19:25 - 2012-05-20 19:25 - 00003584 ____A C:\Users\Jon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2012-05-17 19:26 - 2012-05-17 19:26 - 00001847 ____A C:\Users\Public\Desktop\QuickTime Player.lnk2012-05-17 19:26 - 2012-05-17 19:26 - 00001847 ____A C:\Users\All Users\Desktop\QuickTime Player.lnk2012-05-17 11:38 - 2012-05-03 15:05 - 00011973 ____A C:\Users\Jon\My Documents\Rob - Working Hour Ledger.xlsx2012-05-17 11:38 - 2012-05-03 15:05 - 00011973 ____A C:\Users\Jon\Documents\Rob - Working Hour Ledger.xlsx2012-05-16 12:30 - 2012-05-16 12:30 - 03406018 ____A C:\Users\Jon\Downloads\545966_10151715433235704_559880703_24167381_704922201_n.psd2012-05-16 12:29 - 2012-05-16 12:29 - 00892360 ____A (Oracle Corporation) C:\Users\Jon\Downloads\jxpiinstall.exe2012-05-15 18:06 - 2012-07-05 17:52 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe2012-05-15 18:06 - 2012-07-05 17:52 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe2012-05-04 18:29 - 2012-07-05 17:53 - 00227720 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe2012-05-04 18:29 - 2012-05-16 12:31 - 00772504 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll2012-05-04 18:29 - 2010-06-05 09:42 - 00687504 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll2012-05-04 06:06 - 2012-06-13 15:51 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe2012-05-04 05:03 - 2012-06-13 15:51 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2012-05-04 05:03 - 2012-06-13 15:51 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2012-05-01 17:52 - 2012-05-01 17:52 - 01284232 ____A (Coupons.com Incorporated) C:\Users\Jon\Downloads\couponprinter.exe2012-05-01 02:01 - 2011-01-07 16:10 - 00001945 ____A C:\Windows\epplauncher.mif2012-05-01 02:01 - 2011-01-07 16:09 - 00726950 ____A C:\Windows\SysWOW64\PerfStringBackup.INI2012-04-27 22:55 - 2012-06-13 15:51 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys2012-04-26 00:41 - 2012-06-13 15:52 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll2012-04-26 00:41 - 2012-06-13 15:52 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll2012-04-26 00:34 - 2012-06-13 15:52 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe2012-04-24 00:37 - 2012-07-10 18:46 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll2012-04-24 00:37 - 2012-07-10 18:46 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll2012-04-24 00:37 - 2012-07-10 18:46 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll2012-04-23 23:36 - 2012-07-10 18:46 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2012-04-23 23:36 - 2012-07-10 18:46 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll2012-04-23 23:36 - 2012-07-10 18:46 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll2012-04-19 21:24 - 2012-04-19 21:24 - 00001045 ____A C:\Users\Jon\Desktop\Machinarium.lnk2012-04-19 20:44 - 2012-04-19 20:18 - 579317344 ____A C:\Users\Jon\Downloads\Botanicula_1804.exe2012-04-19 20:33 - 2012-04-19 20:10 - 363218549 ____A C:\Users\Jon\Downloads\Machinarium_full_en.exe2012-04-19 20:28 - 2012-04-19 20:11 - 1631325414 ____A C:\Users\Jon\Downloads\Kooky.zip2012-04-19 20:19 - 2012-04-19 20:18 - 20709564 ____A C:\Users\Jon\Downloads\Install_Samorost2.exe2012-04-19 20:03 - 2012-04-19 20:03 - 07967867 ____A (Adobe Systems, Inc.) C:\Users\Jon\Downloads\windosill-windows-1.0.8-1334813813.exe2012-04-18 19:56 - 2012-04-18 19:56 - 00094208 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx2012-04-18 19:56 - 2012-04-18 19:56 - 00069632 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts2012-04-17 11:39 - 2011-08-28 16:01 - 00002028 ____A C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk2012-04-17 11:39 - 2011-08-28 16:01 - 00002028 ____A C:\Users\All Users\Desktop\Adobe Acrobat X Pro.lnkZeroAccess:C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\LC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\UC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\00000004.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\1afb2d56C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\201d3ddeC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000004.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000008.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\000000cb.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000000.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000064.@ZeroAccess:C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\LC:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\UZeroAccess:C:\Windows\assembly\GAC_32\Desktop.iniZeroAccess:C:\Windows\assembly\GAC_64\Desktop.ini========================= Known DLLs (Whitelisted) ===================================== Bamital & volsnap Check ============C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.C:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legit==================== EXE ASSOCIATION =====================HKLM\...\.exe: exefile => OKHKLM\...\exefile\DefaultIcon: %1 => OKHKLM\...\exefile\open\command: "%1" %* => OK========================= Memory info ======================Percentage of memory in use: 9%Total physical RAM: 8180.51 MBAvailable physical RAM: 7371.46 MBTotal Pagefile: 8178.66 MBAvailable Pagefile: 7366.35 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.9 MB======================= Partitions =========================1 Drive c: (OS) (Fixed) (Total:451.07 GB) (Free:114.92 GB) NTFS3 Drive e: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:7.92 GB) NTFS ==>[system with boot components (obtained from reading drive)]4 Drive f: () (Removable) (Total:0.47 GB) (Free:0.47 GB) FAT5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 465 GB 0 B Disk 1 Online 478 MB 0 B Partitions of Disk 0:=============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 OEM 39 MB 31 KB Partition 2 Primary 14 GB 40 MB Partition 3 Primary 451 GB 14 GB==================================================================================Disk: 0Partition 1Type : DEHidden: YesActive: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 4 FAT Partition 39 MB Healthy Hidden ==================================================================================Disk: 0Partition 2Type : 07Hidden: NoActive: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 1 E RECOVERY NTFS Partition 14 GB Healthy ==================================================================================Disk: 0Partition 3Type : 07Hidden: NoActive: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 2 C OS NTFS Partition 451 GB Healthy ==================================================================================Partitions of Disk 1:=============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 477 MB 32 KB==================================================================================Disk: 1Partition 1Type : 06Hidden: NoActive: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 3 F FAT Removable 477 MB Healthy ============================================================================================================================================Last Boot: 2012-07-07 23:54======================= End Of Log ========================== Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2012 ID:570384 Share Posted July 13, 2012 services.exe is infected and has to be replaced:C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.In Vista or Windows 7: Boot to System Recovery Options and run FRST.Type the following in the edit box after "Search:".services.exeIt then should look like:Search: services.exeClick Search button and post the log (Search.txt) it makes to your reply.MrC Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570395 Share Posted July 13, 2012 Here's search.txt:Farbar Recovery Scan Tool Version: 11-07-2012Ran by SYSTEM at 2012-07-13 18:15:08Running from F:\================== Search: "services.exe" ===================C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCBC:\Windows\System32\services.exe[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06====== End Of Search ====== Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2012 ID:570399 Share Posted July 13, 2012 OK, here you go......Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txtC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\LC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\UC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\00000004.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\1afb2d56C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\201d3ddeC:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000004.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000008.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\000000cb.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000000.@C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000064.@C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\LC:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\UC:\Windows\assembly\GAC_32\Desktop.iniC:\Windows\assembly\GAC_64\Desktop.iniReplace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exeNOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemOn Vista or Windows 7: Now please enter System Recovery Options.Run FRST64 and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.MrC Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570411 Share Posted July 13, 2012 Here is fixlog.txt :Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 11-07-2012Ran by SYSTEM at 2012-07-13 18:51:37 Run:1Running from F:\==============================================C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb} moved successfully.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@ not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\00000004.@ not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\1afb2d56 not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L\201d3dde not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000004.@ not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\00000008.@ not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\000000cb.@ not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000000.@ not found.C:\Windows\Installer\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U\80000064.@ not found.C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb} moved successfully.C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\@ not found.C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\L not found.C:\Users\Jon\AppData\Local\{e606ccdd-5c40-8e0d-5bae-d4e785712afb}\U not found.C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.C:\Windows\System32\services.exe moved successfully.C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe==== End of Fixlog ====Thanks for all of your help so far! Greatly appreciated. Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2012 ID:570414 Share Posted July 13, 2012 Great......That worked perfectly!!Next...........Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingc...to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
fyzhix Posted July 13, 2012 Author ID:570424 Share Posted July 13, 2012 Here's ComboFix.txt:ComboFix 12-07-13.03 - Jon 13/07/2012 19:10:47.1.8 - x64Microsoft Windows 7 Professional 6.1.7601.1.1252.2.1033.18.8181.6213 [GMT -4:00]Running from: c:\users\Jon\Desktop\ComboFix.exeAV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\Jon\Documents\~WRL0003.tmpc:\users\Jon\Documents\~WRL0233.tmpc:\users\Jon\Documents\~WRL3545.tmp.Infected copy of c:\windows\SysWow64\kernel32.dll was found and disinfectedRestored copy from - c:\windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.21772_none_fc7f5397ba9be6d3\kernel32.dll..((((((((((((((((((((((((( Files Created from 2012-06-13 to 2012-07-13 )))))))))))))))))))))))))))))))..2012-07-13 23:21 . 2012-07-13 23:21 -------- d-----w- c:\users\Default\AppData\Local\temp2012-07-13 22:36 . 2012-07-13 22:36 -------- d-----w- C:\FRST2012-07-13 20:44 . 2012-07-13 20:44 -------- d-----w- c:\users\Jon\.jenny2012-07-11 06:55 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys2012-07-11 05:38 . 2012-07-11 05:38 -------- d-----w- c:\program files (x86)\DeepSkyStacker2012-07-10 23:46 . 2012-04-24 05:37 1462272 ----a-w- c:\windows\system32\crypt32.dll2012-07-10 23:46 . 2012-04-24 05:37 184320 ----a-w- c:\windows\system32\cryptsvc.dll2012-07-10 23:46 . 2012-04-24 05:37 140288 ----a-w- c:\windows\system32\cryptnet.dll2012-07-10 23:46 . 2012-04-24 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll2012-07-10 23:46 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll2012-07-10 23:46 . 2012-04-24 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll2012-07-07 11:45 . 2012-07-07 11:45 -------- d-----w- c:\users\Jon\AppData\Roaming\Stellarium2012-07-07 11:45 . 2012-07-07 11:45 -------- d-----w- c:\program files (x86)\Stellarium2012-07-05 22:55 . 2012-07-05 22:55 -------- d-----w- c:\program files (x86)\Oracle2012-07-04 23:32 . 2012-07-04 23:32 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%2012-07-04 04:29 . 2012-02-10 14:21 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F6416C25-A024-45AA-9B44-12E1C603B8EE}\gapaengine.dll2012-07-04 04:29 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6A6CAAFD-F45B-4F7B-BC03-6F77D703EAB3}\mpengine.dll2012-07-03 04:22 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2012-06-25 10:31 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll2012-06-25 10:31 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe2012-06-25 10:31 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll2012-06-25 10:31 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll2012-06-25 10:31 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll2012-06-25 10:31 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll2012-06-25 10:31 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll2012-06-25 10:30 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll2012-06-25 10:30 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe2012-06-20 02:09 . 2012-06-20 02:09 -------- d-----w- c:\program files (x86)\RegiStax 5_12012-06-15 07:07 . 2012-06-15 07:08 -------- d-----w- c:\users\Jon\Logitech2012-06-15 07:07 . 2012-06-15 07:07 -------- d-----w- c:\program files (x86)\Common Files\Remote Control Software Common2012-06-15 07:06 . 2012-06-15 07:06 -------- d-----w- c:\program files (x86)\Logitech2012-06-15 07:06 . 2012-06-15 07:06 -------- d-----w- c:\program files (x86)\Common Files\Remote Control USB Driver2012-06-15 07:05 . 2006-02-07 19:44 65024 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe2012-06-15 07:05 . 2006-02-07 19:45 757760 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll2012-06-15 07:05 . 2006-02-07 19:40 204800 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll2012-06-15 07:05 . 2006-02-07 19:40 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll2012-06-15 07:05 . 2006-02-07 19:40 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll2012-06-15 07:05 . 2005-11-14 03:19 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe2012-06-15 07:05 . 2012-06-15 07:05 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll2012-06-15 07:05 . 2012-06-15 07:05 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll2012-06-14 18:16 . 2012-06-14 18:16 -------- d-----w- c:\users\Jon\AppData\Local\Macromedia...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-07-12 03:48 . 2012-04-09 20:55 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2012-07-12 03:48 . 2011-05-22 23:01 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2012-07-03 17:46 . 2010-09-09 03:21 24904 ----a-w- c:\windows\system32\drivers\mbam.sys2012-06-02 00:57 . 2012-06-02 00:57 101680 ----a-w- c:\windows\system32\stkMonitor.dll2012-05-04 23:29 . 2012-05-16 17:31 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll2012-05-04 23:29 . 2010-06-05 14:42 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll2012-05-04 11:06 . 2012-06-13 20:51 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe2012-05-04 10:03 . 2012-06-13 20:51 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe2012-05-04 10:03 . 2012-06-13 20:51 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe2012-04-28 03:55 . 2012-06-13 20:51 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys2012-04-26 05:41 . 2012-06-13 20:52 77312 ----a-w- c:\windows\system32\rdpwsx.dll2012-04-26 05:41 . 2012-06-13 20:52 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll2012-04-26 05:34 . 2012-06-13 20:52 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe2012-04-19 00:56 . 2012-04-19 00:56 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx2012-04-19 00:56 . 2012-04-19 00:56 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-12-24 1242448].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-10 343168]"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-04-04 36760]"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-04-04 815512]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2010-02-11 165184].c:\users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [N/A].c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [N/A].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]"aux"=wdmaud.drv.R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [x]R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 250056]R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-24 113120]R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2009-09-21 315664]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]R3 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-05 1255736]S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2012-04-11 36384]S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-08 834544]S1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2012-04-11 65736]S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2010/05/27 12:31];c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl [2009-12-29 21:35 146928]S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe [2009-03-02 89600]S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-11-10 204288]S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2012-04-11 6746280]S2 HDRExpressService;HDRExpressService;c:\program files\UCT\HDR Express\HDRExpressService.exe [2012-04-04 32400]S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe [2012-03-29 66560]S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-02-11 660800]S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784]S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Acceler.sys [2009-09-17 23912]S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-11-10 10567680]S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-11-10 325632]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]S3 O2MDGRDR;O2MDGRDR;c:\windows\system32\DRIVERS\o2mdgx64.sys [2009-11-13 74272]S3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2012-04-11 24024]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]..Contents of the 'Scheduled Tasks' folder.2012-07-13 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 03:48].2012-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-13878151-3475214259-3496771340-1001Core.job- c:\users\Jon\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-05 04:50].2012-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-13878151-3475214259-3496771340-1001UA.job- c:\users\Jon\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-05 04:50]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-01-20 487424]"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2009-07-02 3180624]"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-09-21 1926928]"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-04 1580368]"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"LoadAppInit_DLLs"=0x1.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = https://my.olg.ca/dana-na/auth/url_default/welcome.cgiuDefault_Search_URL = hxxp://www.google.com/iemLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105TCP: DhcpNameServer = 192.168.0.1DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} - hxxps://my.olg.ca/,DanaInfo=OLGCTOR03.ent.ad.mre,ST=1+/dwa85W.cabFF - ProfilePath - c:\users\Jon\AppData\Roaming\Mozilla\Firefox\Profiles\gk0r17dz.default\.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)Wow6432Node-HKCU-Run-AdobeBridge - (no file)SafeBoot-mcmscsvcSafeBoot-MCODSSafeBoot-MsMpSvcToolbar-Locked - (no file)HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exeAddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exeAddRemove-{C73A3942-84C8-4597-9F9B-EE227DCBA758} - c:\programdata\{D19C2D22-6043-47E7-B400-83A351841204}\delldock.exe...[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (LocalSystem)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dd,31,4e,36,ea,f6,14,41,aa,dd,9f,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dd,31,4e,36,ea,f6,14,41,aa,dd,9f,\.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]@Denied: (A) (Everyone)"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]@Denied: (A) (Everyone).[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]"Key"="ActionsPane3""Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\windows\system32\DRIVERS\o2flash.exec:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exec:\program files (x86)\Dell Support Center\bin\sprtsvc.exe.**************************************************************************.Completion time: 2012-07-13 19:28:56 - machine was rebootedComboFix-quarantined-files.txt 2012-07-13 23:28.Pre-Run: 123,919,413,248 bytes freePost-Run: 124,083,171,328 bytes free.- - End Of File - - 62A16DCE39662319E71BB647906A67B1 Link to post Share on other sites More sharing options...
MrCharlie Posted July 13, 2012 ID:570431 Share Posted July 13, 2012 Looks Good....Please Update and run a Quick Scan with MBAM, post the report.Make sure that everything is checked, and click Remove Selected.Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
fyzhix Posted July 14, 2012 Author ID:570444 Share Posted July 14, 2012 Here's the report:Malwarebytes Anti-Malware 1.62.0.1300www.malwarebytes.orgDatabase version: v2012.07.13.11Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421Jon :: FYZHIX [administrator]13/07/2012 8:07:48 PMmbam-log-2012-07-13 (20-07-48).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 212973Time elapsed: 5 minute(s), 4 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)The system appears to be running great now - PrevX didn't pick anything up on boot either. Link to post Share on other sites More sharing options...
MrCharlie Posted July 14, 2012 ID:570451 Share Posted July 14, 2012 Great A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point---------------------------------Please download OTL from one of the links below: (you may already have OTL on the system)http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.comSave it to your desktop.Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)Any other programs or logs you can manually delete.IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 14, 2012 ID:570601 Share Posted July 14, 2012 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts