winrscmde, rootkits, other nasty stuff

dandelionhead · November 11, 2012

Hello.

I'm trying to help fix a Win 7 computer belonging to an acquaintance. What was initially thought to be a hardware failure turned out to be a fake scanner. Desktop and task manager are inaccessible and the Start Menu looks like it's been partially hidden/messed with. I don't know how web browsing behaves; Google Chrome has been wrecked -- attempting to run or reinstall it results in a BSoD. Internet Explorer (which I had to find manually) seems to work but I only used it for a moment and it's obnoxious about letting me download programs. I don't know if that's normal for IE--I haven't used it in a while. Managed to install Firefox, and it seems normal, but again I only used it for a moment.

Ran Malwarebytes in an attempt to get rid of the scanner and anything lingering, but the problem turned out bigger than expected. There's toolbars and other garbage everywhere, and while Malwarebytes got rid of some of the problem (including, it seems, the fake scanner), winrscmde/svchost.exe continues to persist. Some toolbars uninstalled normally through Control Panel but others didn't and I'm afraid to complicate matters by touching them without further instruction. RogueKiller (scan only) found something called Rans.Gendarm, and possibly ZeroAccess, too. MSE (which ended up partially disabled) reported Alureon and Tracur.AV. It's hard telling what else is there.

I'm sorry for burdening y'all with a mess like this; usually I can Google Fu my way through this stuff, but with a potential rootkit involved I think I'm in over my head. I understand that this computer may be compromised enough that nothing but a full system wipe might save it, but I'm hoping that maybe I can get it to a level of stability that will allow me to back up whatever data I can. Any help would be appreciated.

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft Windows 7 Enterprise

Boot Device: \Device\HarddiskVolume1

Install Date: 12/30/2011 6:36:26 PM

System Uptime: 11/11/2012 8:43:23 AM (0 hours ago)

.

Motherboard: LENOVO | | 6475B14

Processor: Intel® Core™2 Duo CPU T9400 @ 2.53GHz | None | 2534/266mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 149 GiB total, 99.136 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description: PCI Memory Controller

Device ID: PCI\VEN_8086&DEV_444E&SUBSYS_44438086&REV_11\4&324544AA&0&00E2

Manufacturer:

Name: PCI Memory Controller

PNP Device ID: PCI\VEN_8086&DEV_444E&SUBSYS_44438086&REV_11\4&324544AA&0&00E2

Service:

.

==== System Restore Points ===================

.

RP89: 10/21/2012 3:31:00 PM - Scheduled Checkpoint

RP90: 10/30/2012 3:16:47 PM - Scheduled Checkpoint

RP91: 11/3/2012 10:44:15 AM - Installed Java™ 6 Update 37

RP92: 11/3/2012 10:46:30 AM - Installed Java Runtime Environment

RP93: 11/5/2012 2:23:26 PM - Restore Operation

RP94: 11/5/2012 2:40:16 PM - 4th

RP95: 11/5/2012 2:43:42 PM - Restore Operation

RP96: 11/11/2012 6:01:20 AM - Removed AVG 2012

RP97: 11/11/2012 6:05:36 AM - Removed AVG 2012

.

==== Installed Programs ======================

.

7-Zip 9.20

Adobe Reader X (10.1.4)

Ask Toolbar

Ask Toolbar Updater

ASPCA Reminder by We-Care.com v4.1.19.1

ATI Catalyst Install Manager

AuthenTec TrueSuite

CCleaner

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Conexant 20561 SmartAudio HD

DVD Shrink 3.2

FriendsChecker

fTalk

Game Master 2.1 Toolbar

GamesBar (W)

Gimp 2.6.11

Google Toolbar for Internet Explorer

Google Update Helper

Iminent

InfraRecorder

InstallIQ Updater

Integrated Camera

Intel PROSet Wireless

Intel® Graphics Media Accelerator Driver

Intel® Management Engine Interface

Intel® Network Connections Drivers

Intel® PROSet/Wireless WiFi Software

Intel® Active Management Technology

Java Auto Updater

Java™ 6 Update 37

Malwarebytes Anti-Malware version 1.65.1.1000

MeFeedia

Microsoft .NET Framework 4 Client Profile

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Security Client

Microsoft Security Essentials

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox 16.0.2 (x86 en-US)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

PC Optimizer Pro

PinPhotoZoom

Privacy SafeGuard version 1.1

RICOH R5U8xx Media Driver ver.3.64.02

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

ThinkPad Modem Adapter

ThinkPad Power Management Driver

ThinkPad Power Manager

ThinkPad UltraNav Driver

ThinkPad UltraNav Utility

ThinkPad Wireless LAN Adapter Software

ThinkVantage Access Connections

ThinkVantage Communications Utility

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Visual Studio 2008 x64 Redistributables

Windows Searchqu Toolbar

Yahoo! BrowserPlus 2.9.8

Yahoo! Messenger

Yawcam 0.3.7

Yontoo 1.10.02

.

==== Event Viewer Messages From Past Week ========

.

11/9/2012 1:08:02 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891

11/8/2012 2:50:38 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002dda6ea, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110812-52743-01.

11/5/2012 2:30:42 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7034] - The Application Information service terminated unexpectedly. It has done this 1 time(s).

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The User Profile Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The System Event Notification Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Secondary Logon service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

11/5/2012 2:28:42 PM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/5/2012 2:27:46 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002ab77ef, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110512-51932-01.

11/5/2012 10:12:57 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffffffff8a002f5, 0x0000000000000001, 0xfffffa800e5d4c10, 0x0000000000000002). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110512-36426-01.

11/5/2012 10:07:03 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000096, 0xfffff80002ab94aa, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110512-65520-01.

11/5/2012 10:02:25 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

11/4/2012 4:57:24 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002d846ea, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110412-32791-01.

11/4/2012 4:51:14 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002dc56ea, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 110412-32105-01.

11/4/2012 4:48:00 PM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s).

11/11/2012 8:44:04 AM, Error: Service Control Manager [7000] - The rimsptsk service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

11/11/2012 8:44:04 AM, Error: Service Control Manager [7000] - The rimmptsk service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

11/11/2012 8:44:04 AM, Error: Service Control Manager [7000] - The Ricoh xD-Picture Card Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

11/11/2012 8:44:00 AM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891

11/11/2012 6:23:38 AM, Error: Service Control Manager [7003] - The Microsoft Network Inspection System service depends the following service: BFE. This service might not be installed.

11/11/2012 6:23:38 AM, Error: Service Control Manager [7001] - The Microsoft Network Inspection service depends on the Microsoft Network Inspection System service which failed to start because of the following error: The dependency service does not exist or has been marked for deletion.

11/11/2012 6:23:38 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: Ed-PC\Ed Error Code: 0x8007042c Error description: The dependency service or group failed to start.

11/11/2012 6:23:38 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: Ed-PC\Ed Current Engine Version: Previous Engine Version: Error code: 0x8007042c Error description: The dependency service or group failed to start.

11/11/2012 6:23:22 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.139.1832.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft....5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: Ed-PC\Ed Current Engine Version: Previous Engine Version: 1.1.8904.0 Error code: 0x8050a003 Error description: This package does not contain up-to-date definition files for this program. For more information, see Help and Support.

11/11/2012 6:23:22 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.139.1832.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft....5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: Ed-PC\Ed Current Engine Version: Previous Engine Version: 1.1.8904.0 Error code: 0x8050a003 Error description: This package does not contain up-to-date definition files for this program. For more information, see Help and Support.

11/11/2012 6:23:05 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.139.1832.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft....5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.8904.0 Error code: 0x8007042c Error description: The dependency service or group failed to start.

11/11/2012 6:23:00 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x8007042c Error description: The dependency service or group failed to start.

11/11/2012 6:23:00 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x8007042c Error description: The dependency service or group failed to start.

11/11/2012 6:11:13 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070424 Error description: The specified service does not exist as an installed service.

11/11/2012 6:10:27 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070424 Error description: The specified service does not exist as an installed service.

11/11/2012 1:37:19 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

11/11/2012 1:31:15 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service YahooAUService with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

11/11/2012 1:12:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

11/11/2012 1:12:44 AM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21

11/11/2012 1:12:39 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

11/11/2012 1:12:28 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx64 Avgmfx64 discache spldr TPPWRIF Wanarpv6

11/10/2012 8:21:38 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800021d86ea, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 111012-52478-01.

11/10/2012 7:41:43 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001e6f7ef, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 111012-28173-01.

11/10/2012 4:52:16 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

11/10/2012 4:48:14 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001ebc7ef, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 111012-50715-01.

11/10/2012 4:19:18 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

11/10/2012 4:05:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

11/10/2012 4:05:34 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

11/10/2012 4:05:34 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

11/10/2012 4:05:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

11/10/2012 4:05:09 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx64 Avgmfx64 Avgtdia CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx TPPWRIF Wanarpv6 WfpLwf

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

11/10/2012 4:05:09 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

.

==== End Of File ===========================

DDS (Ver_2012-11-07.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16450

Run by Ed at 8:47:34 on 2012-11-11

Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.8088.6631 [GMT -5:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\ibmpmsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\Dwm.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe

C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe

C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwssvc.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe

C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSOEMON.EXE

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Users\Ed\AppData\Local\fTalk\ftalk.exe

C:\Program Files (x86)\GamesBar\update\SearchEngineProtection.exe

C:\Program Files (x86)\W3i\InstallIQUpdater\InstallIQUpdater.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Ask.com\Updater\Updater.exe

C:\Program Files (x86)\Iminent\IMBooster\IMBooster.exe

C:\Windows\system32\rundll32.exe

C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe

\\.\globalroot\systemroot\svchost.exe -netsvcs

C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k HsfXAudioService

C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE

C:\Program Files (x86)\Intel\AMT\LMS.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://start.gamesagogo.iplay.com/?o=shp

uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language

mStart Page = hxxp://www.yahoo.com/?ilc=8

mDefault_Page_URL = hxxp://www.yahoo.com/?ilc=8

uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

uURLSearchHooks: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - <orphaned>

uURLSearchHooks: Game Master 2.1 Toolbar: {22dfbf5b-a7cd-4b25-9471-3dc68c71855f} - C:\Program Files (x86)\Game_Master_2.1\prxtbGame.dll

uURLSearchHooks: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - <orphaned>

uURLSearchHooks: {2be1e5a2-f105-4bef-a622-88fe50899422} - <orphaned>

uURLSearchHooks: {3bbd3c14-4c16-4989-8366-95bc9179779d} - <orphaned>

uURLSearchHooks: <No Name>: {00A6FAF6-072E-44cf-8957-5838F569A31D} -

mURLSearchHooks: Game Master 2.1 Toolbar: {22dfbf5b-a7cd-4b25-9471-3dc68c71855f} - C:\Program Files (x86)\Game_Master_2.1\prxtbGame.dll

dURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>

mWinlogon: Userinit = userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: {1036AD63-AEAC-460B-9060-C96005D4DC86} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Game Master 2.1 Toolbar: {22dfbf5b-a7cd-4b25-9471-3dc68c71855f} - C:\Program Files (x86)\Game_Master_2.1\prxtbGame.dll

BHO: GamesBar (W): {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files (x86)\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll

BHO: FriendsChecker: {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} - C:\Program Files (x86)\FriendsChecker\IE\common.dll

BHO: PinPhotoZoom: {4a0c8953-9d4e-4790-b732-2b9fc9ebce05} - C:\Users\Ed\AppData\Roaming\PinPhotoZoom\AutocompletePro.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - <orphaned>

BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} -

BHO: IMinent WebBooster (BHO): {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll

BHO: Privacy Safeguard BHO: {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: WeCareReminder Class: {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

TB: Game Master 2.1 Toolbar: {22DFBF5B-A7CD-4B25-9471-3DC68C71855F} - C:\Program Files (x86)\Game_Master_2.1\prxtbGame.dll

TB: My Web Search: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -

TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB: Game Master 2.1 Toolbar: {22dfbf5b-a7cd-4b25-9471-3dc68c71855f} - C:\Program Files (x86)\Game_Master_2.1\prxtbGame.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

uRun: [MyWebSearch Email Plugin] C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwsoemon.exe

uRun: [fTalk] "C:\Users\Ed\AppData\Local\fTalk\ftalk.exe" -autorun

uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe"

uRun: [searchEngineProtection] C:\Program Files (x86)\GamesBar\update\SearchEngineProtection.exe

uRun: [installIQUpdater] "C:\Program Files (x86)\W3i\InstallIQUpdater\InstallIQUpdater.exe" /silent /autorun

mRun: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~2\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w /h

mRun: [MyWebSearch Email Plugin] C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwsoemon.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12

mRun: [tsnp2uvc] C:\Windows\tsnp2uvc.exe

mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

mRun: [DATAMNGR] C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE

mRun: [iMBooster] C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe /warmup

mRun: [HF_G_Jul] "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction

mRun: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

TCP: Interfaces\{10AFBD46-70F6-4285-B79D-64335C14762A}\36F6D636163747 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{10AFBD46-70F6-4285-B79D-64335C14762A}\370796B656D616E6 : DHCPNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{10AFBD46-70F6-4285-B79D-64335C14762A}\C696E6B6379737 : DHCPNameServer = 192.168.1.1 75.75.75.75 75.75.76.76

TCP: Interfaces\{2DD92AE8-3FAE-434F-A425-5C131931C5C9}\3686F6461607 : DHCPNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{2DD92AE8-3FAE-434F-A425-5C131931C5C9}\370796B656D616E6 : DHCPNameServer = 65.32.5.111 65.32.5.112

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

LSA: Notification Packages = scecli ACGina

x64-BHO: Privacy Safeguard BHO: {1036AD63-AEAC-460B-9060-C96005D4DC86} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard-x64.dll

x64-BHO: PinPhotoZoom: {4a0c8953-9d4e-4790-b732-2b9fc9ebce05} - C:\Users\Ed\AppData\Roaming\PinPhotoZoom\64\AutocompletePro64.dll

x64-BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} -

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [smartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t

x64-Run: [picon] "C:\Program Files (x86)\Common Files\Intel\Privacy Icon\PIconStartup.exe"

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [AcWin7Hlpr] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe

x64-Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

x64-Run: [PC Optimizer Pro] "C:\Program Files\PC Optimizer Pro\StartApps.exe" "C:\Program Files\PC Optimizer Pro\PCOptimizerPro.exe -w3i"

x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Ed\AppData\Roaming\Mozilla\Firefox\Profiles\4t67uvg3.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000031&locale=en_US&apn_uid=8D9B914B-13FF-4E29-8296-60B5BD1CCD7B&apn_ptnrs=TV&apn_sauid=3299338D-5522-4F88-9A93-3F2256CCD797&apn_dtid=OSJ000YYUS&&q=

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\npsitesafety.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\MyWebSearch\bar\1.bin\NPMYWEBS.DLL

FF - plugin: C:\Users\Ed\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll

FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2012-11-05 16:01; avg@toolbar; C:\ProgramData\AVG Secure Search\12.2.5.32

FF - ExtSQL: 2012-11-10 17:07; m3ffxtbr@mywebsearch.com; C:\Program Files (x86)\MyWebSearch\bar\1.bin

.

============= SERVICES / DRIVERS ===============

.

R?2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2011-12-30 2058776]

R0 DzHDD64;DzHDD64;C:\Windows\System32\drivers\DZHDD64.SYS [2011-12-30 31344]

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]

R1 MpKsl6bdb5dbb;MpKsl6bdb5dbb;C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\MpKsl6bdb5dbb.sys [2012-11-11 35664]

R2 HsfXAudioService;HsfXAudioService;C:\Windows\System32\svchost.exe -k HsfXAudioService [2009-7-13 27136]

R2 LENOVO.CAMMUTE;Lenovo Camera Mute;C:\Program Files\Lenovo\Communications Utility\CamMute.exe [2011-12-30 41320]

R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2011-12-30 65896]

R2 MyWebSearchService;My Web Search Service;C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwssvc.exe [2012-1-14 34320]

R2 PwmEWSvc;Cisco EnergyWise Enabler;C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe [2011-12-30 148840]

R3 CAXHWAZL;CAXHWAZL;C:\Windows\System32\drivers\CAXHWAZL.sys [2011-12-30 299648]

R3 DozeSvc;Lenovo Doze Mode Service;C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-12-30 477032]

R3 e1yexpress;Intel® Gigabit Network Connections Driver;C:\Windows\System32\drivers\e1y60x64.sys [2008-8-22 316544]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-12-30 56344]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;C:\Windows\System32\drivers\ATSwpWDF.sys [2009-12-3 716872]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-8-30 128456]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]

S3 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe [2011-12-30 83304]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2011-12-30 20992]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-12-30 59392]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-12-30 1255736]

.

=============== Created Last 30 ================

.

2012-11-11 13:44:20 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\offreg.dll

2012-11-11 13:44:16 35664 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\MpKsl6bdb5dbb.sys

2012-11-11 11:22:32 9291768 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\mpengine.dll

2012-11-11 11:09:45 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2012-11-11 11:09:34 -------- d-----w- C:\Program Files\Microsoft Security Client

2012-11-11 00:42:34 20480 ----a-w- C:\Windows\svchost.exe

2012-11-10 21:53:59 -------- d-----w- C:\Users\Ed\AppData\Roaming\Malwarebytes

2012-11-10 21:53:48 -------- d-----w- C:\ProgramData\Malwarebytes

2012-11-10 21:53:46 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-11-10 21:53:44 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-11-03 14:52:37 -------- d--h--w- C:\Users\Ed\AppData\Local\APN

2012-11-03 14:52:19 -------- d--h--w- C:\Firefox

2012-11-03 14:46:07 477168 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll

2012-11-02 12:54:24 -------- d--h--w- C:\ProgramData\vjxfojifumeifor

2012-10-29 12:51:42 -------- d--h--w- C:\Users\Ed\AppData\Roaming\PinPhotoZoom

2012-10-29 12:51:42 -------- d--h--w- C:\Program Files (x86)\PinPhotoZoom

2012-10-29 12:51:01 -------- d--h--w- C:\Users\Ed\AppData\Roaming\Oberon Media

2012-10-29 12:50:58 -------- d--h--w- C:\ProgramData\Oberon Media

2012-10-29 12:50:55 -------- d-----w- C:\Program Files (x86)\gamesagogo_w3i

2012-10-29 12:50:54 -------- d--h--w- C:\Users\Ed\AppData\Roaming\DefaultTab

2012-10-29 12:50:53 -------- d--h--w- C:\Users\Ed\AppData\Roaming\VisicomToolBar

2012-10-29 12:50:50 -------- d-----w- C:\Program Files (x86)\GamesBar

2012-10-18 20:33:06 -------- d-----w- C:\Program Files (x86)\BabylonToolbar

2012-10-18 20:32:35 -------- d--h--w- C:\Users\Ed\AppData\Local\Savings Sidekick

2012-10-18 20:32:34 -------- d-----w- C:\Program Files (x86)\Savings Sidekick

2012-10-18 20:32:33 -------- d-----w- C:\Windows\SysWow64\searchplugins

2012-10-18 20:32:33 -------- d-----w- C:\Windows\SysWow64\Extensions

2012-10-18 20:32:30 -------- d--h--w- C:\ProgramData\Video Performer Manager

2012-10-18 20:32:21 -------- d--h--w- C:\ProgramData\IBUpdaterService

.

==================== Find3M ====================

.

2012-11-03 14:45:59 473072 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-10-08 23:00:33 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-08 23:00:33 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-08-31 03:03:48 228768 ----a-w- C:\Windows\System32\drivers\MpFilter.sys

2012-08-31 03:03:48 128456 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys

2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll

2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-08-22 18:12:50 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2012-08-22 18:12:40 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys

2012-08-22 18:12:40 376688 ----a-w- C:\Windows\System32\drivers\netio.sys

2012-08-22 18:12:33 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

.

============= FINISH: 8:54:40.20 ===============

gringo_pr · November 11, 2012

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

dandelionhead · November 11, 2012

Thank you Gringo for your help. It's much appreciated.

Those programs seemed to run fine. I've gained some new folders that were hidden before and the Start Menu looks improved with new options that weren't there before. I don't know if it's back to normal, but it definitely looks better. Internet Explorer tried to load tigzy's blog but it just spins forever and never finishes loading. The page loads fine on my Linux box, though. RK also posted two logs instead of one. They seemed to have differences so I'm posting them both, if that's okay.

CHECKUP.TXT:

Results of screen317's Security Check version 0.99.54

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

AVG Anti-Virus Free Edition 2012

Antivirus up to date! (On Access scanning disabled!)

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

Java™ 6 Update 37

Java version out of Date!

Adobe Reader X (10.1.4)

Mozilla Firefox (16.0.2)

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1%

````````````````````End of Log``````````````````````

ADWCLEANER.TXT:

# AdwCleaner v2.007 - Logfile created 11/11/2012 at 09:47:57

# Updated 06/11/2012 by Xplode

# Operating system : Windows 7 Enterprise Service Pack 1 (64 bits)

# User : Ed - ED-PC

# Boot Mode : Normal

# Running from : C:\Users\Ed\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

Stopped & Deleted : MyWebSearchService

***** [Files / Folders] *****

File Deleted : C:\user.js

File Deleted : C:\Users\Ed\AppData\Local\Temp\searchqutoolbar-manifest.xml

File Deleted : C:\Users\Ed\AppData\Local\Temp\Uninstall.exe

Folder Deleted : C:\Program Files (x86)\Ask.com

Folder Deleted : C:\Program Files (x86)\BabylonToolbar

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Program Files (x86)\FunWebProducts

Folder Deleted : C:\Program Files (x86)\Game_Master_2.1

Folder Deleted : C:\Program Files (x86)\GamesBar

Folder Deleted : C:\Program Files (x86)\Iminent

Folder Deleted : C:\Program Files (x86)\MyWebSearch

Folder Deleted : C:\Program Files (x86)\Savings Sidekick

Folder Deleted : C:\Program Files (x86)\Yontoo

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\ProgramData\Babylon

Folder Deleted : C:\ProgramData\IBUpdaterService

Folder Deleted : C:\ProgramData\Iminent

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\ProgramData\WeCareReminder

Folder Deleted : C:\Users\Ed\AppData\Local\APN

Folder Deleted : C:\Users\Ed\AppData\Local\Conduit

Folder Deleted : C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok

Folder Deleted : C:\Users\Ed\AppData\Local\Savings Sidekick

Folder Deleted : C:\Users\Ed\AppData\LocalLow\AskToolbar

Folder Deleted : C:\Users\Ed\AppData\LocalLow\BabylonToolbar

Folder Deleted : C:\Users\Ed\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Ed\AppData\LocalLow\FunWebProducts

Folder Deleted : C:\Users\Ed\AppData\LocalLow\Game_Master_2.1

Folder Deleted : C:\Users\Ed\AppData\LocalLow\MyWebSearch

Folder Deleted : C:\Users\Ed\AppData\Roaming\Babylon

Folder Deleted : C:\Users\Ed\AppData\Roaming\DefaultTab

Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll

Data Deleted : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll

Key Deleted : HKCU\Software\APN

Key Deleted : HKCU\Software\APN DTX

Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

Key Deleted : HKCU\Software\AppDataLow\Software\Fun Web Products

Key Deleted : HKCU\Software\AppDataLow\Software\FunWebProducts

Key Deleted : HKCU\Software\AppDataLow\Software\Game_Master_2.1

Key Deleted : HKCU\Software\AppDataLow\Software\MyWebSearch

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\AppDataLow\Toolbar

Key Deleted : HKCU\Software\Ask.com

Key Deleted : HKCU\Software\Cr_Installer

Key Deleted : HKCU\Software\DataMngr

Key Deleted : HKCU\Software\Default Tab

Key Deleted : HKCU\Software\FunWebProducts

Key Deleted : HKCU\Software\Iminent

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{40674F68-B251-43DE-84F5-6366F20F23E7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Deleted : HKCU\Software\MyWebSearch

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\wecarereminder

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

Key Deleted : HKLM\Software\APN

Key Deleted : HKLM\Software\AskToolbar

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\AutocompletePro.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.DataControl

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.DataControl.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.2

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton.1

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl

Key Deleted : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl.1

Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder

Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler

Key Deleted : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.MultipleButton

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.MultipleButton.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.ThirdPartyInstaller

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.ThirdPartyInstaller.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.UrlAlertButton

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearch.UrlAlertButton.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin.1

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin

Key Deleted : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin.1

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\ScreenSaverControl.ScreenSaverInstaller

Key Deleted : HKLM\SOFTWARE\Classes\ScreenSaverControl.ScreenSaverInstaller.1

Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard

Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1

Key Deleted : HKLM\SOFTWARE\Classes\SuggestMeYes.SuggestMeYesBHO

Key Deleted : HKLM\SOFTWARE\Classes\SuggestMeYes.SuggestMeYesBHO.1

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3018509

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3185123

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3201318

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8FFDF636-0D87-4B33-B9E9-79A53F6E1DAE}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\Software\Default Tab

Key Deleted : HKLM\Software\FocusInteractive

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\Software\Fun Web Products

Key Deleted : HKLM\Software\Game_Master_2.1

Key Deleted : HKLM\Software\Iminent

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll

Key Deleted : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss

Key Deleted : HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin

Key Deleted : HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{08858AF6-42AD-4914-95D2-AC3AB0DC8E28}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011461139}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{40674F68-B251-43DE-84F5-6366F20F23E7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@mywebsearch.com/Plugin

Key Deleted : HKLM\Software\MyWebSearch

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{08858AF6-42AD-4914-95D2-AC3AB0DC8E28}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{40674F68-B251-43DE-84F5-6366F20F23E7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7473D292-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7473D296-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{799391D3-EB86-4BAC-9BD3-CBFEA58A0E15}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A4730EBE-43A6-443E-9776-36915D323AD3}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A9571378-68A1-443D-B082-284F960C6D17}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D858DAFC-9573-4811-B323-7011A3AA7E61}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DC811B17-E59F-4335-8A9A-298D65762AF1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FD9E4788-10D5-4F91-8CD2-95B5F899E2CB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Game_Master_2.1 Toolbar

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Windows Searchqu Toolbar

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}

Key Deleted : HKLM\SOFTWARE\DataMngr

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : HKLM\SOFTWARE\Tarma Installer

Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{07B18EA9-A523-4961-B6BB-170DE4475CCA}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00A6FAF6-072E-44CF-8957-5838F569A31D}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D3D233D5-9F6D-436C-B6C7-E63F77503B30}]

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [MyWebSearch Email Plugin]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows Media\Wmsdk\Sources [F3PopularScreenSavers]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform [FunWebProducts]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform [FunWebProducts]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [My Web Search Bar Search Scope Monitor]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [MyWebSearch Email Plugin]

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [m3ffxtbr@mywebsearch.com]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{07B18EA9-A523-4961-B6BB-170DE4475CCA}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language --> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default

File : C:\Users\Ed\AppData\Roaming\Mozilla\Firefox\Profiles\4t67uvg3.default\prefs.js

Deleted : user_pref("browser.search.selectedEngine", "Ask.com");

Deleted : user_pref("browser.search.order.1", "Ask.com");

Deleted : user_pref("browser.search.defaultengine", "Ask.com");

Deleted : user_pref("browser.search.defaultenginename", "Ask.com");

Deleted : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000031&loca[...]

Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");

-\\ Google Chrome v [unable to get version]

File : C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [39991 octets] - [11/11/2012 09:47:57]

########## EOF - C:\AdwCleaner[s1].txt - [40052 octets] ##########

RKREPORT[1].TXT:

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo...13-roguekiller/

Website: http://tigzy.geeksto...roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Ed [Admin rights]

Mode : Scan -- Date : 11/11/2012 09:55:39

¤¤¤ Bad processes : 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 26 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : fTalk ("C:\Users\Ed\AppData\Local\fTalk\ftalk.exe" -autorun) -> FOUND

[RUN][sUSP PATH] HKCU\[...]\Run : DW6 ("C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe") -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1483352220-944649602-3276702464-1000[...]\Run : fTalk ("C:\Users\Ed\AppData\Local\fTalk\ftalk.exe" -autorun) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1483352220-944649602-3276702464-1000[...]\Run : DW6 ("C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe") -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1483352220-944649602-3276702464-1000_Classes[...]\Run : Diagnostics (rundll32.exe "C:\Users\Ed\AppData\Local\Google\Diagnostics\kcnyblaww.dll",DllRegisterServerW) -> FOUND

[TASK][sUSP PATH] CandyUpdater.job : C:\Users\Ed\AppData\Local\ArcadeCandy\candyUpdater.exe -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyDocs (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRun (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\n.) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\@ --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\U --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\L --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\L --> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS545016B9A300 ATA Device +++++

--- User ---

[MBR] a4b8cb00f7c4b40ee2ec64f29d2e9649

[bSP] 3f0bea591548473e241f89eec863b3e8 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 152525 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] ad36d1f62b8a628ea4febc63d96ebb7e

[bSP] 3f0bea591548473e241f89eec863b3e8 : Windows 7/8 MBR Code

Partition table:

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 152525 Mo

Finished : << RKreport[1]_S_11112012_02d0955.txt >>

RKreport[1]_S_11112012_02d0955.txt

RKREPORT[2].TXT:

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo...13-roguekiller/

Website: http://tigzy.geeksto...roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Ed [Admin rights]

Mode : Remove -- Date : 11/11/2012 09:57:35

¤¤¤ Bad processes : 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 23 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : fTalk ("C:\Users\Ed\AppData\Local\fTalk\ftalk.exe" -autorun) -> DELETED

[RUN][sUSP PATH] HKCU\[...]\Run : DW6 ("C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe") -> DELETED

[RUN][sUSP PATH] HKUS\S-1-5-21-1483352220-944649602-3276702464-1000_Classes[...]\Run : Diagnostics (rundll32.exe "C:\Users\Ed\AppData\Local\Google\Diagnostics\kcnyblaww.dll",DllRegisterServerW) -> DELETED

[TASK][sUSP PATH] CandyUpdater.job : C:\Users\Ed\AppData\Local\ArcadeCandy\candyUpdater.exe -> DELETED

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyDocs (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowUser (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRun (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> REPLACED (1)

[HJ SMENU] HKCU\[...]\Advanced : Start_TrackProgs (0) -> REPLACED (1)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\n.) -> REPLACED (C:\Windows\system32\shell32.dll)

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\n.) -> REPLACED (C:\Windows\system32\wbem\fastprox.dll)

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\@ --> REMOVED

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\@ --> REMOVED

[ZeroAccess][FOLDER] ROOT : C:\$recycle.bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\U --> REMOVED

[ZeroAccess][FOLDER] ROOT : C:\$recycle.bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\U --> REMOVED

[ZeroAccess][FOLDER] ROOT : C:\$recycle.bin\S-1-5-18\$46227fc88b5e9f5594767c9989e53681\L --> REMOVED

[ZeroAccess][FOLDER] ROOT : C:\$recycle.bin\S-1-5-21-1483352220-944649602-3276702464-1000\$46227fc88b5e9f5594767c9989e53681\L --> REMOVED

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS545016B9A300 ATA Device +++++

--- User ---

[MBR] a4b8cb00f7c4b40ee2ec64f29d2e9649

[bSP] 3f0bea591548473e241f89eec863b3e8 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 152525 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] ad36d1f62b8a628ea4febc63d96ebb7e

[bSP] 3f0bea591548473e241f89eec863b3e8 : Windows 7/8 MBR Code

Partition table:

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 152525 Mo

Finished : << RKreport[2]_D_11112012_02d0957.txt >>

RKreport[1]_S_11112012_02d0955.txt ; RKreport[2]_D_11112012_02d0957.txt

gringo_pr · November 11, 2012

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

dandelionhead · November 11, 2012

There's a LOT of new icons now! It looks like a lot of the desktop was restored (the wallpaper is still blank but there are a lot of icons that reappeared) and the Start Menu has a LOT of restored icons and folders. Explorer, too.

Firefox and IE seem to load, though IE strangely won't load images on Google's frontpage. The logo and Chrome icon show Xs, but if I do a search, Google Images shows the first twenty images and then none after that. It looks like parts of the site are missing. Firefox loads them fine. Tigzy's RK blog still won't load on either of them, though. I don't know about Chrome -- it seems to have vanished.

MSE popped up after a reboot, still complaining about threats that it claims to have suspended. Real-time protection is still turned off, though, so I don't know what to make of that.

COMBOFIX.TXT:

ComboFix 12-11-10.01 - Ed 11/11/2012 11:24:29.1.2 - x64

Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.8088.6475 [GMT -5:00]

Running from: c:\users\Ed\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Windows Live\Messenger\msacm32.dll

c:\program files\PrivacySafeGuard\PrIVacysafeguard.dll

c:\programdata\JKudXnNPNA4ZKu

c:\programdata\Roaming

c:\users\Ed\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PC Optimizer Pro.lnk

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-11 to 2012-11-11 )))))))))))))))))))))))))))))))

.

2012-11-11 16:32 . 2012-11-11 16:32 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\offreg.dll

2012-11-11 16:32 . 2012-11-11 16:32 35664 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\MpKsl66e17433.sys

2012-11-11 11:22 . 2012-10-17 06:31 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\mpengine.dll

2012-11-11 11:09 . 2012-11-11 11:09 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2012-11-11 11:09 . 2012-11-11 11:10 -------- d-----w- c:\program files\Microsoft Security Client

2012-11-10 21:53 . 2012-11-10 21:53 -------- d-----w- c:\users\Ed\AppData\Roaming\Malwarebytes

2012-11-10 21:53 . 2012-11-10 21:53 -------- d-----w- c:\programdata\Malwarebytes

2012-11-10 21:53 . 2012-09-30 00:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-10 21:53 . 2012-11-10 21:53 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-11-03 14:52 . 2012-11-05 20:57 -------- d-----w- C:\Firefox

2012-11-03 14:46 . 2012-11-03 14:45 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2012-11-03 14:45 . 2012-11-03 14:45 -------- d-----w- c:\program files (x86)\Java

2012-11-02 12:54 . 2012-11-02 12:54 -------- d--h--w- c:\programdata\vjxfojifumeifor

2012-11-02 12:52 . 2012-11-02 12:52 -------- d-----w- c:\windows\Sun

2012-10-29 12:51 . 2012-11-05 21:01 -------- d--h--w- c:\users\Ed\AppData\Roaming\PinPhotoZoom

2012-10-29 12:51 . 2012-11-05 21:00 -------- d--h--w- c:\program files (x86)\PinPhotoZoom

2012-10-29 12:51 . 2012-11-03 17:30 -------- d-----w- c:\program files (x86)\7-Zip

2012-10-29 12:51 . 2012-11-05 21:01 -------- d--h--w- c:\users\Ed\AppData\Roaming\Oberon Media

2012-10-29 12:50 . 2012-10-29 12:50 -------- d--h--w- c:\programdata\Oberon Media

2012-10-29 12:50 . 2012-11-03 17:30 -------- d-----w- c:\program files (x86)\gamesagogo_w3i

2012-10-29 12:50 . 2012-11-05 21:01 -------- d--h--w- c:\users\Ed\AppData\Roaming\VisicomToolBar

2012-10-18 20:32 . 2012-10-18 20:32 -------- d-----w- c:\windows\SysWow64\searchplugins

2012-10-18 20:32 . 2012-10-18 20:32 -------- d-----w- c:\windows\SysWow64\Extensions

2012-10-18 20:32 . 2012-10-18 20:32 -------- d--h--w- c:\programdata\Video Performer Manager

2012-10-14 17:19 . 2012-10-14 17:19 -------- d--h--w- c:\programdata\McAfee

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-03 14:45 . 2012-01-24 14:48 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-10-08 23:00 . 2012-04-04 11:45 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-08 23:00 . 2012-01-12 00:17 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-09-13 13:04 . 2011-12-31 01:58 64462936 ----a-w- c:\windows\system32\MRT.exe

2012-08-31 03:03 . 2012-08-31 03:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

2012-08-31 03:03 . 2012-08-31 03:03 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

2012-08-24 11:15 . 2012-09-22 18:29 17810944 ----a-w- c:\windows\system32\mshtml.dll

2012-08-24 10:39 . 2012-09-22 18:29 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-08-24 10:31 . 2012-09-22 18:29 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 10:22 . 2012-09-22 18:29 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-08-24 10:21 . 2012-09-22 18:29 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 10:20 . 2012-09-22 18:29 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 10:18 . 2012-09-22 18:29 237056 ----a-w- c:\windows\system32\url.dll

2012-08-24 10:17 . 2012-09-22 18:29 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-08-24 10:14 . 2012-09-22 18:29 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 10:14 . 2012-09-22 18:29 816640 ----a-w- c:\windows\system32\jscript.dll

2012-08-24 10:13 . 2012-09-22 18:29 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 10:12 . 2012-09-22 18:29 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-08-24 10:11 . 2012-09-22 18:29 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-08-24 10:10 . 2012-09-22 18:29 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-08-24 10:09 . 2012-09-22 18:29 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-24 10:04 . 2012-09-22 18:29 248320 ----a-w- c:\windows\system32\ieui.dll

2012-08-24 06:59 . 2012-09-22 18:29 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-08-24 06:51 . 2012-09-22 18:29 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-08-24 06:51 . 2012-09-22 18:29 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-08-24 06:47 . 2012-09-22 18:29 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-08-24 06:47 . 2012-09-22 18:29 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-08-24 06:43 . 2012-09-22 18:29 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-08-22 18:12 . 2012-09-12 11:00 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-08-22 18:12 . 2012-09-12 11:00 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-08-22 18:12 . 2012-09-12 11:00 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-12 11:00 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{2e94b700-eafb-4c9e-a696-77200aa3f89b}]

2012-10-17 19:10 88264 ----a-w- c:\program files (x86)\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}]

2012-06-02 04:01 377960 ----a-w- c:\program files (x86)\FriendsChecker\IE\common.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{4a0c8953-9d4e-4790-b732-2b9fc9ebce05}]

2012-07-23 08:44 142040 ---ha-w- c:\users\Ed\AppData\Roaming\PinPhotoZoom\AutocompletePro.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"InstallIQUpdater"="c:\program files (x86)\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2011-10-11 1179648]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-05-10 1553256]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-12-03 716872]

R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-05-10 477032]

S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys [2011-05-10 31344]

S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]

S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2011-01-14 41320]

S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2011-01-14 65896]

S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [2010-12-17 299648]

S3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2008-08-23 316544]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-06-23 56344]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MPKSL66E17433

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 23:00]

.

2012-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cdbfaa90c57f77.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-12 00:18]

.

2012-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-12 00:18]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4a0c8953-9d4e-4790-b732-2b9fc9ebce05}]

2012-07-23 08:44 169688 ---ha-w- c:\users\Ed\AppData\Roaming\PinPhotoZoom\64\AutocompletePro64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-19 307768]

"picon"="c:\program files (x86)\Common Files\Intel\Privacy Icon\PIconStartup.exe" [2010-02-04 111640]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-01 162328]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-01 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-01 415256]

"AcWin7Hlpr"="c:\program files (x86)\Lenovo\Access Connections\AcTBenabler.exe" [2011-04-14 31592]

"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-01-14 54632]

"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2010-09-02 2045440]

"PC Optimizer Pro"="c:\program files\PC Optimizer Pro\StartApps.exe" [2012-03-23 433944]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://start.gamesagogo.iplay.com/?o=shp

mDefault_Page_URL = hxxp://www.yahoo.com/?ilc=8

mStart Page = hxxp://www.yahoo.com/?ilc=8

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearchAssistant =

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

FF - ProfilePath - c:\users\Ed\AppData\Roaming\Mozilla\Firefox\Profiles\4t67uvg3.default\

FF - ExtSQL: 2012-11-05 16:01; avg@toolbar; c:\programdata\AVG Secure Search\12.2.5.32

FF - ExtSQL: 2012-11-10 17:07; m3ffxtbr@mywebsearch.com; c:\program files (x86)\MyWebSearch\bar\1.bin

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{2be1e5a2-f105-4bef-a622-88fe50899422} - (no file)

URLSearchHooks-{3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)

BHO-{1036AD63-AEAC-460B-9060-C96005D4DC86} - (no file)

BHO-{A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - c:\program files\PrivacySafeGuard\PrivacySafeGuard.dll

Toolbar-10 - (no file)

Toolbar-!{2be1e5a2-f105-4bef-a622-88fe50899422} - (no file)

Toolbar-!{2e94b700-eafb-4c9e-a696-77200aa3f89b} - (no file)

Toolbar-!{348bd83c-b2cd-4319-a605-c96bb458dd80} - (no file)

Toolbar-!{3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)

Toolbar-!{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)

Toolbar-!{98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - (no file)

Toolbar-!{c98d5b61-b0ea-4d48-9839-1079d352d880} - (no file)

Wow6432Node-HKCU-Run-SearchEngineProtection - c:\program files (x86)\GamesBar\update\SearchEngineProtection.exe

Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe

Wow6432Node-HKLM-Run-tsnp2uvc - c:\windows\tsnp2uvc.exe

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

Wow6432Node-HKLM-Run-IMBooster - c:\program files (x86)\Iminent\IMBooster\imbooster.exe

Wow6432Node-HKLM-Run-HF_G_Jul - c:\program files (x86)\AVG Secure Search\HF_G_Jul.exe

Wow6432Node-HKLM-Run-ROC_ROC_JULY_P1 - c:\program files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe

Toolbar-10 - (no file)

Toolbar-!{2be1e5a2-f105-4bef-a622-88fe50899422} - (no file)

Toolbar-!{2e94b700-eafb-4c9e-a696-77200aa3f89b} - (no file)

Toolbar-!{348bd83c-b2cd-4319-a605-c96bb458dd80} - (no file)

Toolbar-!{3bbd3c14-4c16-4989-8366-95bc9179779d} - (no file)

Toolbar-!{977AE9CC-AF83-45E8-9E03-E2798216E2D5} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,

eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c

"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,

91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27

"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"=hex:51,66,7a,6c,4c,1d,38,12,c7,8d,a2,

03,11,eb,0f,0c,c9,ad,54,4d,e1,19,18,de

"{D7E97865-918F-41E4-9CD0-25AB1C574CE8}"=hex:51,66,7a,6c,4c,1d,38,12,0b,7b,fa,

d3,bd,df,8a,04,e3,c6,66,eb,19,09,08,fc

"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,

d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54

"{A531D99C-5A22-449B-83DA-872725C6D0ED}"=hex:51,66,7a,6c,4c,1d,38,12,f2,da,22,

a1,10,14,f5,01,fc,cc,c4,67,20,98,94,f9

"{22DFBF5B-A7CD-4B25-9471-3DC68C71855F}"=hex:51,66,7a,6c,4c,1d,38,12,35,bc,cc,

26,ff,e9,4b,0e,eb,67,7e,86,89,2f,c1,4b

"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,

27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b

"{99079A25-328F-4BD4-BE04-00955ACAA0A7}"=hex:51,66,7a,6c,4c,1d,38,12,4b,99,14,

9d,bd,7c,ba,0e,c1,12,43,d5,5f,94,e4,b3

"{977AE9CC-AF83-45E8-9E03-E2798216E2D5}"=hex:51,66,7a,6c,4c,1d,38,12,a2,ea,69,

93,b1,e1,86,00,e1,15,a1,39,87,48,a6,c1

"{C98D5B61-B0EA-4D48-9839-1079D352D880}"=hex:51,66,7a,6c,4c,1d,38,12,0f,58,9e,

cd,d8,fe,26,08,e7,2f,53,39,d6,0c,9c,94

"{00A6FAF1-072E-44CF-8957-5838F569A31D}"=hex:51,66,7a,6c,4c,1d,38,12,9f,f9,b5,

04,1c,49,a1,01,f6,41,1b,78,f0,37,e7,09

"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,

06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64

"{07B18EA1-A523-4961-B6BB-170DE4475CCA}"=hex:51,66,7a,6c,4c,1d,38,12,cf,8d,a2,

03,11,eb,0f,0c,c9,ad,54,4d,e1,19,18,de

"{11111111-1111-1111-1111-110011221158}"=hex:51,66,7a,6c,4c,1d,38,12,7f,12,02,

15,23,5f,7f,54,6e,07,52,40,14,7c,55,4c

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,

38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4

"{58124A0B-DC32-4180-9BFF-E0E21AE34026}"=hex:51,66,7a,6c,4c,1d,38,12,65,49,01,

5c,00,92,ee,04,e4,e9,a3,a2,1f,bd,04,32

"{5D79F641-C168-40DF-A32F-BACEA7509E75}"=hex:51,66,7a,6c,4c,1d,38,12,2f,f5,6a,

59,5a,8f,b1,05,dc,39,f9,8e,a2,0e,da,61

"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,

76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{85F5CF95-EC8F-49FC-BB3F-38C79455CBA2}"=hex:51,66,7a,6c,4c,1d,38,12,fb,cc,e6,

81,bd,a2,92,0c,c4,29,7b,87,91,0b,8f,b6

"{9D717F81-9148-4F12-8568-69135F087DB0}"=hex:51,66,7a,6c,4c,1d,38,12,ef,7c,62,

99,7a,df,7c,0a,fa,7e,2a,53,5a,56,39,a4

"{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}"=hex:51,66,7a,6c,4c,1d,38,12,85,b5,89,

a4,87,7f,22,00,e8,fa,d8,69,48,cc,aa,3e

"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,

ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3

"{CB41FC95-F1B3-4797-8BB6-1012FF62ABBA}"=hex:51,66,7a,6c,4c,1d,38,12,fb,ff,52,

cf,81,bf,f9,02,f4,a0,53,52,fa,3c,ef,ae

"{D3D233D5-9F6D-436C-B6C7-E63F77503B30}"=hex:51,66,7a,6c,4c,1d,38,12,bb,30,c1,

d7,5f,d1,02,06,c9,d1,a5,7f,72,0e,7f,24

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,

f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95

"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,

2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

"{2BE1E5A2-F105-4BEF-A622-88FE50899422}"=hex:51,66,7a,6c,4c,1d,38,12,cc,e6,f2,

2f,37,bf,81,0e,d9,34,cb,be,55,d7,d0,36

"{348BD83C-B2CD-4319-A605-C96BB458DD80}"=hex:51,66,7a,6c,4c,1d,38,12,52,db,98,

30,ff,fc,77,06,d9,13,8a,2b,b1,06,99,94

"{1631550F-191D-4826-B069-D9439253D926}"=hex:51,66,7a,6c,4c,1d,38,12,61,56,22,

12,2f,57,48,0d,cf,7f,9a,03,97,0d,9d,32

"{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}"=hex:51,66,7a,6c,4c,1d,38,12,8c,9a,fe,

40,94,58,e7,0e,ff,c0,18,61,ca,1c,a3,9f

"{A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE}"=hex:51,66,7a,6c,4c,1d,38,12,da,2d,3e,

a0,03,93,db,0e,f5,b3,ce,0e,01,de,29,aa

"{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"=hex:51,66,7a,6c,4c,1d,38,12,70,05,61,

f9,ec,d1,23,0d,da,9c,48,eb,44,0f,8e,cc

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:a4,e7,86,da,d4,a7,cd,01

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Lenovo\Access Connections\AcSvc.exe

c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE

c:\program files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe

c:\\.\globalroot\systemroot\svchost.exe

c:\program files (x86)\Intel\AMT\LMS.exe

c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe

.

**************************************************************************

.

Completion time: 2012-11-11 11:50:44 - machine was rebooted

ComboFix-quarantined-files.txt 2012-11-11 16:50

.

Pre-Run: 106,380,718,080 bytes free

Post-Run: 109,600,481,280 bytes free

.

- - End Of File - - 76FEF1BFCBD26898E70AAB7923E9EFCA

gringo_pr · November 11, 2012

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

dandelionhead · November 11, 2012

TDSSKILLER.TXT:

12:42:18.0717 4236 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

12:42:19.0092 4236 ============================================================

12:42:19.0092 4236 Current date / time: 2012/11/11 12:42:19.0092

12:42:19.0092 4236 SystemInfo:

12:42:19.0092 4236

12:42:19.0092 4236 OS Version: 6.1.7601 ServicePack: 1.0

12:42:19.0092 4236 Product type: Workstation

12:42:19.0092 4236 ComputerName: ED-PC

12:42:19.0092 4236 UserName: Ed

12:42:19.0092 4236 Windows directory: C:\Windows

12:42:19.0092 4236 System windows directory: C:\Windows

12:42:19.0092 4236 Running under WOW64

12:42:19.0092 4236 Processor architecture: Intel x64

12:42:19.0092 4236 Number of processors: 2

12:42:19.0092 4236 Page size: 0x1000

12:42:19.0092 4236 Boot type: Normal boot

12:42:19.0092 4236 ============================================================

12:42:20.0433 4236 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x50C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040

12:42:20.0433 4236 Drive \Device\Harddisk1\DR3 - Size: 0x1E7C00000 (7.62 Gb), SectorSize: 0x200, Cylinders: 0x3E2, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

12:42:20.0433 4236 ============================================================

12:42:20.0433 4236 \Device\Harddisk0\DR0:

12:42:20.0433 4236 MBR partitions:

12:42:20.0433 4236 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

12:42:20.0433 4236 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x129E6800

12:42:20.0433 4236 \Device\Harddisk1\DR3:

12:42:20.0433 4236 GPT partitions:

12:42:20.0433 4236 \Device\Harddisk1\DR3\Partition1: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {9C7DDAAC-1C3E-4A5F-83A0-980ECB52775E}, Name: , StartLBA 0x800, BlocksNum 0xF3D000

12:42:20.0433 4236 MBR partitions:

12:42:20.0433 4236 ============================================================

12:42:20.0574 4236 C: <-> \Device\Harddisk0\DR0\Partition2

12:42:20.0574 4236 ============================================================

12:42:20.0574 4236 Initialize success

12:42:20.0574 4236 ============================================================

12:42:36.0954 2072 ============================================================

12:42:36.0954 2072 Scan started

12:42:36.0954 2072 Mode: Manual;

12:42:36.0954 2072 ============================================================

12:42:39.0590 2072 ================ Scan system memory ========================

12:42:39.0590 2072 System memory - ok

12:42:39.0590 2072 ================ Scan services =============================

12:42:40.0074 2072 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys

12:42:40.0074 2072 1394ohci - ok

12:42:40.0121 2072 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys

12:42:40.0136 2072 ACPI - ok

12:42:40.0167 2072 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys

12:42:40.0167 2072 AcpiPmi - ok

12:42:40.0339 2072 [ DEECCADBD25F65D65293A09721B3A447 ] AcPrfMgrSvc C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe

12:42:40.0339 2072 AcPrfMgrSvc - ok

12:42:40.0386 2072 [ A7753804C6C66C9C80F4E29659FD721C ] AcSvc C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe

12:42:40.0386 2072 AcSvc - ok

12:42:40.0495 2072 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

12:42:40.0495 2072 AdobeARMservice - ok

12:42:40.0620 2072 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

12:42:40.0620 2072 AdobeFlashPlayerUpdateSvc - ok

12:42:40.0682 2072 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys

12:42:40.0682 2072 adp94xx - ok

12:42:40.0745 2072 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys

12:42:40.0760 2072 adpahci - ok

12:42:40.0776 2072 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys

12:42:40.0776 2072 adpu320 - ok

12:42:40.0807 2072 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll

12:42:40.0807 2072 AeLookupSvc - ok

12:42:40.0869 2072 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys

12:42:40.0869 2072 AFD - ok

12:42:40.0932 2072 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys

12:42:40.0932 2072 agp440 - ok

12:42:40.0947 2072 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe

12:42:40.0979 2072 ALG - ok

12:42:41.0041 2072 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys

12:42:41.0041 2072 aliide - ok

12:42:41.0057 2072 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys

12:42:41.0057 2072 amdide - ok

12:42:41.0103 2072 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys

12:42:41.0103 2072 AmdK8 - ok

12:42:41.0119 2072 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys

12:42:41.0119 2072 AmdPPM - ok

12:42:41.0166 2072 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys

12:42:41.0166 2072 amdsata - ok

12:42:41.0197 2072 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys

12:42:41.0197 2072 amdsbs - ok

12:42:41.0213 2072 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys

12:42:41.0213 2072 amdxata - ok

12:42:41.0306 2072 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys

12:42:41.0322 2072 AppID - ok

12:42:41.0353 2072 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll

12:42:41.0353 2072 AppIDSvc - ok

12:42:41.0384 2072 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll

12:42:41.0384 2072 Appinfo - ok

12:42:41.0415 2072 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll

12:42:41.0415 2072 AppMgmt - ok

12:42:41.0478 2072 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys

12:42:41.0478 2072 arc - ok

12:42:41.0493 2072 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys

12:42:41.0493 2072 arcsas - ok

12:42:41.0540 2072 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys

12:42:41.0540 2072 AsyncMac - ok

12:42:41.0556 2072 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys

12:42:41.0556 2072 atapi - ok

12:42:41.0634 2072 [ EA512F43F4A28D18B52CAFE8C93984FB ] ATSwpWDF C:\Windows\system32\Drivers\ATSwpWDF.sys

12:42:41.0649 2072 ATSwpWDF - ok

12:42:41.0727 2072 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

12:42:41.0743 2072 AudioEndpointBuilder - ok

12:42:41.0759 2072 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll

12:42:41.0759 2072 AudioSrv - ok

12:42:41.0821 2072 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll

12:42:41.0821 2072 AxInstSV - ok

12:42:41.0868 2072 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys

12:42:41.0883 2072 b06bdrv - ok

12:42:41.0930 2072 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys

12:42:41.0930 2072 b57nd60a - ok

12:42:42.0039 2072 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll

12:42:42.0039 2072 BDESVC - ok

12:42:42.0086 2072 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys

12:42:42.0086 2072 Beep - ok

12:42:42.0149 2072 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll

12:42:42.0164 2072 BFE - ok

12:42:42.0336 2072 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll

12:42:42.0351 2072 BITS - ok

12:42:42.0414 2072 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys

12:42:42.0414 2072 blbdrive - ok

12:42:42.0476 2072 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys

12:42:42.0476 2072 bowser - ok

12:42:42.0507 2072 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys

12:42:42.0507 2072 BrFiltLo - ok

12:42:42.0523 2072 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys

12:42:42.0523 2072 BrFiltUp - ok

12:42:42.0539 2072 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys

12:42:42.0539 2072 BridgeMP - ok

12:42:42.0570 2072 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll

12:42:42.0570 2072 Browser - ok

12:42:42.0585 2072 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys

12:42:42.0601 2072 Brserid - ok

12:42:42.0601 2072 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys

12:42:42.0617 2072 BrSerWdm - ok

12:42:42.0617 2072 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys

12:42:42.0617 2072 BrUsbMdm - ok

12:42:42.0632 2072 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys

12:42:42.0632 2072 BrUsbSer - ok

12:42:42.0710 2072 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys

12:42:42.0710 2072 BthEnum - ok

12:42:42.0741 2072 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys

12:42:42.0741 2072 BTHMODEM - ok

12:42:42.0788 2072 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys

12:42:42.0788 2072 BthPan - ok

12:42:42.0835 2072 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys

12:42:42.0851 2072 BTHPORT - ok

12:42:42.0882 2072 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll

12:42:42.0882 2072 bthserv - ok

12:42:42.0929 2072 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys

12:42:42.0929 2072 BTHUSB - ok

12:42:42.0991 2072 catchme - ok

12:42:43.0053 2072 [ 9C4E50BEA239E2D45099EC919F779DB0 ] CAXHWAZL C:\Windows\system32\DRIVERS\CAXHWAZL.sys

12:42:43.0053 2072 CAXHWAZL - ok

12:42:43.0116 2072 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys

12:42:43.0116 2072 cdfs - ok

12:42:43.0178 2072 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys

12:42:43.0178 2072 cdrom - ok

12:42:43.0241 2072 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll

12:42:43.0241 2072 CertPropSvc - ok

12:42:43.0272 2072 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys

12:42:43.0272 2072 circlass - ok

12:42:43.0303 2072 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys

12:42:43.0303 2072 CLFS - ok

12:42:43.0412 2072 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:42:43.0412 2072 clr_optimization_v2.0.50727_32 - ok

12:42:43.0459 2072 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

12:42:43.0459 2072 clr_optimization_v2.0.50727_64 - ok

12:42:43.0568 2072 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:42:43.0568 2072 clr_optimization_v4.0.30319_32 - ok

12:42:43.0615 2072 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

12:42:43.0615 2072 clr_optimization_v4.0.30319_64 - ok

12:42:43.0677 2072 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys

12:42:43.0677 2072 CmBatt - ok

12:42:43.0693 2072 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys

12:42:43.0693 2072 cmdide - ok

12:42:43.0724 2072 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys

12:42:43.0740 2072 CNG - ok

12:42:43.0818 2072 [ D3C4F72E8F8DC523B02A0C313CEEEA99 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys

12:42:43.0833 2072 CnxtHdAudService - ok

12:42:43.0880 2072 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys

12:42:43.0880 2072 Compbatt - ok

12:42:43.0927 2072 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys

12:42:43.0927 2072 CompositeBus - ok

12:42:43.0958 2072 COMSysApp - ok

12:42:43.0989 2072 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys

12:42:43.0989 2072 crcdisk - ok

12:42:44.0021 2072 [ 4F5414602E2544A4554D95517948B705 ] CryptSvc C:\Windows\system32\cryptsvc.dll

12:42:44.0021 2072 CryptSvc - ok

12:42:44.0052 2072 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys

12:42:44.0067 2072 CSC - ok

12:42:44.0114 2072 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll

12:42:44.0130 2072 CscService - ok

12:42:44.0192 2072 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll

12:42:44.0208 2072 DcomLaunch - ok

12:42:44.0270 2072 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll

12:42:44.0270 2072 defragsvc - ok

12:42:44.0317 2072 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys

12:42:44.0317 2072 DfsC - ok

12:42:44.0379 2072 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll

12:42:44.0395 2072 Dhcp - ok

12:42:44.0411 2072 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys

12:42:44.0411 2072 discache - ok

12:42:44.0457 2072 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys

12:42:44.0457 2072 Disk - ok

12:42:44.0473 2072 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll

12:42:44.0489 2072 Dnscache - ok

12:42:44.0535 2072 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll

12:42:44.0535 2072 dot3svc - ok

12:42:44.0613 2072 [ 7719FB1A82B2972B1F326AD2F80C2606 ] DozeSvc C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE

12:42:44.0629 2072 DozeSvc - ok

12:42:44.0660 2072 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll

12:42:44.0660 2072 DPS - ok

12:42:44.0707 2072 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys

12:42:44.0723 2072 drmkaud - ok

12:42:44.0801 2072 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys

12:42:44.0801 2072 DXGKrnl - ok

12:42:44.0832 2072 [ CE4CFFD9F64B86BCEB1C343FC9924D72 ] DzHDD64 C:\Windows\system32\DRIVERS\DzHDD64.sys

12:42:44.0832 2072 DzHDD64 - ok

12:42:44.0894 2072 [ D608110ADB132E683360FCA0F6B2BB53 ] e1yexpress C:\Windows\system32\DRIVERS\e1y60x64.sys

12:42:44.0894 2072 e1yexpress - ok

12:42:44.0957 2072 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll

12:42:44.0957 2072 EapHost - ok

12:42:45.0050 2072 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys

12:42:45.0128 2072 ebdrv - ok

12:42:45.0175 2072 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe

12:42:45.0175 2072 EFS - ok

12:42:45.0237 2072 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe

12:42:45.0237 2072 ehRecvr - ok

12:42:45.0269 2072 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe

12:42:45.0269 2072 ehSched - ok

12:42:45.0300 2072 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys

12:42:45.0315 2072 elxstor - ok

12:42:45.0347 2072 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys

12:42:45.0347 2072 ErrDev - ok

12:42:45.0409 2072 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll

12:42:45.0409 2072 EventSystem - ok

12:42:45.0612 2072 [ 8B6C9924B0D333DBF76086B8258A0891 ] EvtEng C:\Program Files\Intel\WiFi\bin\EvtEng.exe

12:42:45.0627 2072 EvtEng - ok

12:42:45.0659 2072 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys

12:42:45.0659 2072 exfat - ok

12:42:45.0659 2072 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys

12:42:45.0659 2072 fastfat - ok

12:42:45.0737 2072 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe

12:42:45.0752 2072 Fax - ok

12:42:45.0768 2072 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys

12:42:45.0768 2072 fdc - ok

12:42:45.0799 2072 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll

12:42:45.0799 2072 fdPHost - ok

12:42:45.0815 2072 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll

12:42:45.0815 2072 FDResPub - ok

12:42:45.0830 2072 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys

12:42:45.0830 2072 FileInfo - ok

12:42:45.0846 2072 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys

12:42:45.0846 2072 Filetrace - ok

12:42:45.0877 2072 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys

12:42:45.0877 2072 flpydisk - ok

12:42:45.0908 2072 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys

12:42:45.0908 2072 FltMgr - ok

12:42:45.0955 2072 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll

12:42:45.0986 2072 FontCache - ok

12:42:46.0017 2072 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

12:42:46.0017 2072 FontCache3.0.0.0 - ok

12:42:46.0064 2072 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys

12:42:46.0064 2072 FsDepends - ok

12:42:46.0095 2072 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys

12:42:46.0095 2072 Fs_Rec - ok

12:42:46.0158 2072 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys

12:42:46.0173 2072 fvevol - ok

12:42:46.0189 2072 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys

12:42:46.0189 2072 gagp30kx - ok

12:42:46.0236 2072 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll

12:42:46.0251 2072 gpsvc - ok

12:42:46.0361 2072 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

12:42:46.0361 2072 gupdate - ok

12:42:46.0392 2072 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

12:42:46.0392 2072 gupdatem - ok

12:42:46.0454 2072 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

12:42:46.0454 2072 gusvc - ok

12:42:46.0501 2072 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys

12:42:46.0501 2072 hcw85cir - ok

12:42:46.0563 2072 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

12:42:46.0563 2072 HdAudAddService - ok

12:42:46.0641 2072 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys

12:42:46.0641 2072 HDAudBus - ok

12:42:46.0673 2072 [ 15C9789470B8855AC2F54FDF96802D13 ] HECIx64 C:\Windows\system32\DRIVERS\HECIx64.sys

12:42:46.0673 2072 HECIx64 - ok

12:42:46.0688 2072 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys

12:42:46.0688 2072 HidBatt - ok

12:42:46.0735 2072 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys

12:42:46.0735 2072 HidBth - ok

12:42:46.0735 2072 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys

12:42:46.0735 2072 HidIr - ok

12:42:46.0797 2072 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll

12:42:46.0797 2072 hidserv - ok

12:42:46.0875 2072 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys

12:42:46.0875 2072 HidUsb - ok

12:42:46.0907 2072 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll

12:42:46.0907 2072 hkmsvc - ok

12:42:46.0969 2072 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

12:42:46.0969 2072 HomeGroupListener - ok

12:42:47.0047 2072 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

12:42:47.0063 2072 HomeGroupProvider - ok

12:42:47.0078 2072 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys

12:42:47.0078 2072 HpSAMD - ok

12:42:47.0203 2072 [ 75D9D5C4DD0A18E3E7F50683734E0077 ] HsfXAudioService C:\Windows\SysWOW64\XAudio64.dll

12:42:47.0219 2072 HsfXAudioService - ok

12:42:47.0281 2072 [ 5A518B63D408B2DBC1778788456E1A66 ] HSF_DPV C:\Windows\system32\DRIVERS\CAX_DPV.sys

12:42:47.0297 2072 HSF_DPV - ok

12:42:47.0375 2072 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys

12:42:47.0375 2072 HTTP - ok

12:42:47.0406 2072 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys

12:42:47.0406 2072 hwpolicy - ok

12:42:47.0499 2072 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys

12:42:47.0499 2072 i8042prt - ok

12:42:47.0593 2072 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys

12:42:47.0593 2072 iaStorV - ok

12:42:47.0640 2072 [ 16A43ABB5A334C7842F4A60CF9FF8041 ] IBMPMDRV C:\Windows\system32\DRIVERS\ibmpmdrv.sys

12:42:47.0640 2072 IBMPMDRV - ok

12:42:47.0671 2072 [ 32B778CCF1F3B1458EDDA98FB8431EAC ] IBMPMSVC C:\Windows\system32\ibmpmsvc.exe

12:42:47.0671 2072 IBMPMSVC - ok

12:42:47.0749 2072 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

12:42:47.0749 2072 idsvc - ok

12:42:48.0077 2072 [ D926F1C76A78A69A154187CEB487E863 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys

12:42:48.0357 2072 igfx - ok

12:42:48.0389 2072 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys

12:42:48.0389 2072 iirsp - ok

12:42:48.0513 2072 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll

12:42:48.0513 2072 IKEEXT - ok

12:42:48.0545 2072 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys

12:42:48.0545 2072 intelide - ok

12:42:48.0591 2072 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys

12:42:48.0591 2072 intelppm - ok

12:42:48.0623 2072 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll

12:42:48.0623 2072 IPBusEnum - ok

12:42:48.0685 2072 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys

12:42:48.0685 2072 IpFilterDriver - ok

12:42:48.0747 2072 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll

12:42:48.0747 2072 iphlpsvc - ok

12:42:48.0779 2072 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys

12:42:48.0779 2072 IPMIDRV - ok

12:42:48.0810 2072 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys

12:42:48.0810 2072 IPNAT - ok

12:42:48.0857 2072 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys

12:42:48.0857 2072 IRENUM - ok

12:42:48.0919 2072 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys

12:42:48.0919 2072 isapnp - ok

12:42:48.0935 2072 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys

12:42:48.0950 2072 iScsiPrt - ok

12:42:48.0981 2072 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys

12:42:48.0981 2072 kbdclass - ok

12:42:49.0028 2072 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys

12:42:49.0028 2072 kbdhid - ok

12:42:49.0044 2072 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe

12:42:49.0059 2072 KeyIso - ok

12:42:49.0075 2072 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys

12:42:49.0091 2072 KSecDD - ok

12:42:49.0106 2072 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys

12:42:49.0106 2072 KSecPkg - ok

12:42:49.0137 2072 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys

12:42:49.0137 2072 ksthunk - ok

12:42:49.0200 2072 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll

12:42:49.0215 2072 KtmRm - ok

12:42:49.0293 2072 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll

12:42:49.0309 2072 LanmanServer - ok

12:42:49.0371 2072 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

12:42:49.0371 2072 LanmanWorkstation - ok

12:42:49.0434 2072 [ 8B5EB24FCE3926128138B769D50CEE1B ] LENOVO.CAMMUTE C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe

12:42:49.0434 2072 LENOVO.CAMMUTE - ok

12:42:49.0496 2072 [ F1A055E1381528E947CDB959117B67D0 ] LENOVO.TPKNRSVC C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

12:42:49.0496 2072 LENOVO.TPKNRSVC - ok

12:42:49.0527 2072 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys

12:42:49.0527 2072 lltdio - ok

12:42:49.0559 2072 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll

12:42:49.0574 2072 lltdsvc - ok

12:42:49.0590 2072 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll

12:42:49.0590 2072 lmhosts - ok

12:42:49.0652 2072 [ 7F697D6EB3E47FBC7757229DAEE406B4 ] LMS C:\Program Files (x86)\Intel\AMT\LMS.exe

12:42:49.0652 2072 LMS - ok

12:42:49.0715 2072 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys

12:42:49.0715 2072 LSI_FC - ok

12:42:49.0746 2072 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys

12:42:49.0746 2072 LSI_SAS - ok

12:42:49.0761 2072 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys

12:42:49.0761 2072 LSI_SAS2 - ok

12:42:49.0777 2072 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys

12:42:49.0793 2072 LSI_SCSI - ok

12:42:49.0824 2072 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys

12:42:49.0824 2072 luafv - ok

12:42:49.0855 2072 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll

12:42:49.0855 2072 Mcx2Svc - ok

12:42:49.0871 2072 [ FC631425ED761EA1F24738AA15FF5A7D ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys

12:42:49.0871 2072 mdmxsdk - ok

12:42:49.0886 2072 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys

12:42:49.0886 2072 megasas - ok

12:42:49.0933 2072 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys

12:42:49.0933 2072 MegaSR - ok

12:42:50.0011 2072 [ FAFE367D032ED82E9332B4C741A20216 ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

12:42:50.0011 2072 Microsoft Office Groove Audit Service - ok

12:42:50.0058 2072 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll

12:42:50.0058 2072 MMCSS - ok

12:42:50.0089 2072 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys

12:42:50.0089 2072 Modem - ok

12:42:50.0151 2072 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys

12:42:50.0151 2072 monitor - ok

12:42:50.0198 2072 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys

12:42:50.0198 2072 mouclass - ok

12:42:50.0261 2072 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys

12:42:50.0261 2072 mouhid - ok

12:42:50.0276 2072 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys

12:42:50.0292 2072 mountmgr - ok

12:42:50.0417 2072 [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

12:42:50.0417 2072 MozillaMaintenance - ok

12:42:50.0479 2072 [ 05BF204EC0E82CC4A054DB189C8A3D84 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys

12:42:50.0479 2072 MpFilter - ok

12:42:50.0526 2072 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys

12:42:50.0526 2072 mpio - ok

12:42:50.0619 2072 [ 0EBB390B7AEEC45EC061D9870A34FD42 ] MpKslbdcc2d85 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\MpKslbdcc2d85.sys

12:42:50.0619 2072 MpKslbdcc2d85 - ok

12:42:50.0682 2072 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys

12:42:50.0682 2072 mpsdrv - ok

12:42:50.0775 2072 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll

12:42:50.0775 2072 MpsSvc - ok

12:42:50.0807 2072 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys

12:42:50.0807 2072 MRxDAV - ok

12:42:50.0853 2072 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys

12:42:50.0853 2072 mrxsmb - ok

12:42:50.0885 2072 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys

12:42:50.0885 2072 mrxsmb10 - ok

12:42:50.0916 2072 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys

12:42:50.0931 2072 mrxsmb20 - ok

12:42:50.0963 2072 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys

12:42:50.0963 2072 msahci - ok

12:42:50.0994 2072 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys

12:42:50.0994 2072 msdsm - ok

12:42:51.0009 2072 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe

12:42:51.0009 2072 MSDTC - ok

12:42:51.0087 2072 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys

12:42:51.0087 2072 Msfs - ok

12:42:51.0103 2072 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys

12:42:51.0103 2072 mshidkmdf - ok

12:42:51.0134 2072 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys

12:42:51.0134 2072 msisadrv - ok

12:42:51.0181 2072 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll

12:42:51.0197 2072 MSiSCSI - ok

12:42:51.0197 2072 msiserver - ok

12:42:51.0228 2072 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys

12:42:51.0228 2072 MSKSSRV - ok

12:42:51.0337 2072 [ CC8E4F72F21340A4D3A3D4DB50313EF5 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe

12:42:51.0337 2072 MsMpSvc - ok

12:42:51.0337 2072 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys

12:42:51.0337 2072 MSPCLOCK - ok

12:42:51.0368 2072 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys

12:42:51.0368 2072 MSPQM - ok

12:42:51.0399 2072 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys

12:42:51.0399 2072 MsRPC - ok

12:42:51.0431 2072 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys

12:42:51.0431 2072 mssmbios - ok

12:42:51.0462 2072 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys

12:42:51.0477 2072 MSTEE - ok

12:42:51.0477 2072 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys

12:42:51.0477 2072 MTConfig - ok

12:42:51.0524 2072 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys

12:42:51.0524 2072 Mup - ok

12:42:51.0571 2072 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll

12:42:51.0571 2072 napagent - ok

12:42:51.0649 2072 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys

12:42:51.0649 2072 NativeWifiP - ok

12:42:51.0727 2072 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys

12:42:51.0727 2072 NDIS - ok

12:42:51.0789 2072 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys

12:42:51.0789 2072 NdisCap - ok

12:42:51.0836 2072 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys

12:42:51.0836 2072 NdisTapi - ok

12:42:51.0867 2072 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys

12:42:51.0867 2072 Ndisuio - ok

12:42:51.0883 2072 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys

12:42:51.0883 2072 NdisWan - ok

12:42:51.0914 2072 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys

12:42:51.0914 2072 NDProxy - ok

12:42:51.0930 2072 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys

12:42:51.0930 2072 NetBIOS - ok

12:42:51.0961 2072 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys

12:42:51.0961 2072 NetBT - ok

12:42:51.0977 2072 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe

12:42:51.0977 2072 Netlogon - ok

12:42:52.0008 2072 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll

12:42:52.0023 2072 Netman - ok

12:42:52.0039 2072 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll

12:42:52.0039 2072 netprofm - ok

12:42:52.0070 2072 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:42:52.0070 2072 NetTcpPortSharing - ok

12:42:52.0257 2072 [ 64428DFDAF6E88366CB51F45A79C5F69 ] netw5v64 C:\Windows\system32\DRIVERS\netw5v64.sys

12:42:52.0398 2072 netw5v64 - ok

12:42:52.0413 2072 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys

12:42:52.0413 2072 nfrd960 - ok

12:42:52.0507 2072 [ 5FF89F20317309D28AC1EDEB0CD1BA72 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys

12:42:52.0507 2072 NisDrv - ok

12:42:52.0616 2072 [ 79E80B10FE8F6662E0C9162A68C43444 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe

12:42:52.0616 2072 NisSrv - ok

12:42:52.0679 2072 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll

12:42:52.0694 2072 NlaSvc - ok

12:42:52.0725 2072 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys

12:42:52.0725 2072 Npfs - ok

12:42:52.0741 2072 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll

12:42:52.0741 2072 nsi - ok

12:42:52.0772 2072 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys

12:42:52.0772 2072 nsiproxy - ok

12:42:52.0850 2072 [ A2F74975097F52A00745F9637451FDD8 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys

12:42:52.0881 2072 Ntfs - ok

12:42:52.0897 2072 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys

12:42:52.0913 2072 Null - ok

12:42:52.0944 2072 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys

12:42:52.0959 2072 nvraid - ok

12:42:52.0991 2072 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys

12:42:52.0991 2072 nvstor - ok

12:42:53.0022 2072 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys

12:42:53.0022 2072 nv_agp - ok

12:42:53.0131 2072 [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

12:42:53.0131 2072 odserv - ok

12:42:53.0162 2072 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys

12:42:53.0162 2072 ohci1394 - ok

12:42:53.0209 2072 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

12:42:53.0209 2072 ose - ok

12:42:53.0271 2072 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll

12:42:53.0287 2072 p2pimsvc - ok

12:42:53.0318 2072 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll

12:42:53.0334 2072 p2psvc - ok

12:42:53.0349 2072 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys

12:42:53.0349 2072 Parport - ok

12:42:53.0381 2072 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys

12:42:53.0381 2072 partmgr - ok

12:42:53.0396 2072 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll

12:42:53.0396 2072 PcaSvc - ok

12:42:53.0412 2072 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys

12:42:53.0412 2072 pci - ok

12:42:53.0443 2072 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys

12:42:53.0443 2072 pciide - ok

12:42:53.0459 2072 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys

12:42:53.0459 2072 pcmcia - ok

12:42:53.0474 2072 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys

12:42:53.0474 2072 pcw - ok

12:42:53.0505 2072 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys

12:42:53.0505 2072 PEAUTH - ok

12:42:53.0583 2072 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll

12:42:53.0599 2072 PeerDistSvc - ok

12:42:53.0630 2072 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe

12:42:53.0630 2072 PerfHost - ok

12:42:53.0708 2072 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll

12:42:53.0724 2072 pla - ok

12:42:53.0786 2072 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll

12:42:53.0802 2072 PlugPlay - ok

12:42:53.0817 2072 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll

12:42:53.0817 2072 PNRPAutoReg - ok

12:42:53.0880 2072 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll

12:42:53.0880 2072 PNRPsvc - ok

12:42:53.0942 2072 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll

12:42:53.0942 2072 PolicyAgent - ok

12:42:53.0973 2072 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll

12:42:53.0973 2072 Power - ok

12:42:54.0051 2072 [ 2DB6404B68AA554F4805BCB645ED8E11 ] Power Manager DBC Service C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE

12:42:54.0067 2072 Power Manager DBC Service - ok

12:42:54.0114 2072 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys

12:42:54.0114 2072 PptpMiniport - ok

12:42:54.0145 2072 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys

12:42:54.0145 2072 Processor - ok

12:42:54.0176 2072 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll

12:42:54.0176 2072 ProfSvc - ok

12:42:54.0192 2072 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

12:42:54.0192 2072 ProtectedStorage - ok

12:42:54.0239 2072 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys

12:42:54.0239 2072 Psched - ok

12:42:54.0270 2072 [ EF283BC7E0091713C15414AAF64074EB ] PwmEWSvc C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE

12:42:54.0270 2072 PwmEWSvc - ok

12:42:54.0332 2072 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys

12:42:54.0348 2072 ql2300 - ok

12:42:54.0395 2072 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys

12:42:54.0395 2072 ql40xx - ok

12:42:54.0426 2072 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll

12:42:54.0426 2072 QWAVE - ok

12:42:54.0457 2072 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys

12:42:54.0457 2072 QWAVEdrv - ok

12:42:54.0473 2072 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys

12:42:54.0473 2072 RasAcd - ok

12:42:54.0519 2072 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys

12:42:54.0519 2072 RasAgileVpn - ok

12:42:54.0535 2072 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll

12:42:54.0566 2072 RasAuto - ok

12:42:54.0629 2072 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys

12:42:54.0629 2072 Rasl2tp - ok

12:42:54.0644 2072 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll

12:42:54.0660 2072 RasMan - ok

12:42:54.0691 2072 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys

12:42:54.0691 2072 RasPppoe - ok

12:42:54.0707 2072 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys

12:42:54.0707 2072 RasSstp - ok

12:42:54.0722 2072 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys

12:42:54.0738 2072 rdbss - ok

12:42:54.0769 2072 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys

12:42:54.0785 2072 rdpbus - ok

12:42:54.0816 2072 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys

12:42:54.0816 2072 RDPCDD - ok

12:42:54.0847 2072 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys

12:42:54.0863 2072 RDPDR - ok

12:42:54.0894 2072 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys

12:42:54.0894 2072 RDPENCDD - ok

12:42:54.0909 2072 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys

12:42:54.0909 2072 RDPREFMP - ok

12:42:54.0987 2072 [ 70CBA1A0C98600A2AA1863479B35CB90 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

12:42:55.0003 2072 RdpVideoMiniport - ok

12:42:55.0034 2072 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys

12:42:55.0034 2072 RDPWD - ok

12:42:55.0081 2072 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys

12:42:55.0097 2072 rdyboost - ok

12:42:55.0190 2072 [ 189C5A8D2098E0AA14FD157A954B34FC ] RegSrvc C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

12:42:55.0206 2072 RegSrvc - ok

12:42:55.0253 2072 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll

12:42:55.0268 2072 RemoteAccess - ok

12:42:55.0284 2072 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll

12:42:55.0284 2072 RemoteRegistry - ok

12:42:55.0346 2072 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys

12:42:55.0362 2072 RFCOMM - ok

12:42:55.0409 2072 [ F45D6E12EB99A668F52201637C67C8F5 ] rimmptsk C:\Windows\system32\DRIVERS\rimmpx64.sys

12:42:55.0409 2072 rimmptsk - ok

12:42:55.0440 2072 [ EAC02ED935A9C1F2DDD8D985C465B854 ] rimsptsk C:\Windows\system32\DRIVERS\rimspx64.sys

12:42:55.0440 2072 rimsptsk - ok

12:42:55.0502 2072 [ 931A8F843B4120DF527C3684DAF77FD9 ] rismxdp C:\Windows\system32\DRIVERS\rixdpx64.sys

12:42:55.0502 2072 rismxdp - ok

12:42:55.0533 2072 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll

12:42:55.0533 2072 RpcEptMapper - ok

12:42:55.0565 2072 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe

12:42:55.0565 2072 RpcLocator - ok

12:42:55.0596 2072 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll

12:42:55.0611 2072 RpcSs - ok

12:42:55.0674 2072 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys

12:42:55.0674 2072 rspndr - ok

12:42:55.0705 2072 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys

12:42:55.0705 2072 s3cap - ok

12:42:55.0736 2072 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe

12:42:55.0736 2072 SamSs - ok

12:42:55.0752 2072 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys

12:42:55.0752 2072 sbp2port - ok

12:42:55.0799 2072 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll

12:42:55.0799 2072 SCardSvr - ok

12:42:55.0861 2072 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys

12:42:55.0861 2072 scfilter - ok

12:42:55.0939 2072 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll

12:42:55.0955 2072 Schedule - ok

12:42:55.0986 2072 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll

12:42:55.0986 2072 SCPolicySvc - ok

12:42:56.0033 2072 [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus C:\Windows\system32\drivers\sdbus.sys

12:42:56.0033 2072 sdbus - ok

12:42:56.0079 2072 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll

12:42:56.0079 2072 SDRSVC - ok

12:42:56.0126 2072 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys

12:42:56.0126 2072 secdrv - ok

12:42:56.0157 2072 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll

12:42:56.0157 2072 seclogon - ok

12:42:56.0189 2072 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll

12:42:56.0189 2072 SENS - ok

12:42:56.0204 2072 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll

12:42:56.0204 2072 SensrSvc - ok

12:42:56.0251 2072 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys

12:42:56.0251 2072 Serenum - ok

12:42:56.0298 2072 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys

12:42:56.0298 2072 Serial - ok

12:42:56.0313 2072 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys

12:42:56.0313 2072 sermouse - ok

12:42:56.0391 2072 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll

12:42:56.0407 2072 SessionEnv - ok

12:42:56.0438 2072 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys

12:42:56.0438 2072 sffdisk - ok

12:42:56.0454 2072 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys

12:42:56.0454 2072 sffp_mmc - ok

12:42:56.0469 2072 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys

12:42:56.0469 2072 sffp_sd - ok

12:42:56.0485 2072 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys

12:42:56.0485 2072 sfloppy - ok

12:42:56.0547 2072 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll

12:42:56.0547 2072 SharedAccess - ok

12:42:56.0594 2072 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

12:42:56.0610 2072 ShellHWDetection - ok

12:42:56.0625 2072 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys

12:42:56.0625 2072 SiSRaid2 - ok

12:42:56.0641 2072 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys

12:42:56.0641 2072 SiSRaid4 - ok

12:42:56.0688 2072 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys

12:42:56.0688 2072 Smb - ok

12:42:56.0766 2072 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe

12:42:56.0766 2072 SNMPTRAP - ok

12:42:56.0906 2072 [ 3BCD7556F3222221C31B1577B5527ED7 ] SNP2UVC C:\Windows\system32\DRIVERS\snp2uvc.sys

12:42:57.0015 2072 SNP2UVC - ok

12:42:57.0062 2072 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys

12:42:57.0062 2072 spldr - ok

12:42:57.0093 2072 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe

12:42:57.0109 2072 Spooler - ok

12:42:57.0234 2072 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe

12:42:57.0327 2072 sppsvc - ok

12:42:57.0359 2072 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll

12:42:57.0359 2072 sppuinotify - ok

12:42:57.0405 2072 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys

12:42:57.0405 2072 srv - ok

12:42:57.0421 2072 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys

12:42:57.0421 2072 srv2 - ok

12:42:57.0483 2072 [ 0C4540311E11664B245A263E1154CEF8 ] SrvHsfHDA C:\Windows\system32\DRIVERS\VSTAZL6.SYS

12:42:57.0499 2072 SrvHsfHDA - ok

12:42:57.0577 2072 [ 02071D207A9858FBE3A48CBFD59C4A04 ] SrvHsfV92 C:\Windows\system32\DRIVERS\VSTDPV6.SYS

12:42:57.0593 2072 SrvHsfV92 - ok

12:42:57.0655 2072 [ 18E40C245DBFAF36FD0134A7EF2DF396 ] SrvHsfWinac C:\Windows\system32\DRIVERS\VSTCNXT6.SYS

12:42:57.0655 2072 SrvHsfWinac - ok

12:42:57.0702 2072 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys

12:42:57.0717 2072 srvnet - ok

12:42:57.0780 2072 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll

12:42:57.0780 2072 SSDPSRV - ok

12:42:57.0811 2072 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll

12:42:57.0811 2072 SstpSvc - ok

12:42:57.0842 2072 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys

12:42:57.0842 2072 stexstor - ok

12:42:57.0905 2072 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll

12:42:57.0920 2072 stisvc - ok

12:42:57.0951 2072 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys

12:42:57.0951 2072 storflt - ok

12:42:57.0983 2072 [ C40841817EF57D491F22EB103DA587CC ] StorSvc C:\Windows\system32\storsvc.dll

12:42:57.0983 2072 StorSvc - ok

12:42:58.0014 2072 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys

12:42:58.0014 2072 storvsc - ok

12:42:58.0029 2072 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys

12:42:58.0029 2072 swenum - ok

12:42:58.0076 2072 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll

12:42:58.0092 2072 swprv - ok

12:42:58.0107 2072 Synth3dVsc - ok

12:42:58.0201 2072 [ 7E8902F9929A5D9FFD0F545332CE0F10 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys

12:42:58.0217 2072 SynTP - ok

12:42:58.0295 2072 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll

12:42:58.0326 2072 SysMain - ok

12:42:58.0373 2072 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

12:42:58.0373 2072 TabletInputService - ok

12:42:58.0419 2072 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll

12:42:58.0435 2072 TapiSrv - ok

12:42:58.0482 2072 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll

12:42:58.0482 2072 TBS - ok

12:42:58.0560 2072 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip C:\Windows\system32\drivers\tcpip.sys

12:42:58.0575 2072 Tcpip - ok

12:42:58.0638 2072 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys

12:42:58.0638 2072 TCPIP6 - ok

12:42:58.0700 2072 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys

12:42:58.0716 2072 tcpipreg - ok

12:42:58.0747 2072 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys

12:42:58.0747 2072 TDPIPE - ok

12:42:58.0778 2072 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys

12:42:58.0794 2072 TDTCP - ok

12:42:58.0841 2072 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys

12:42:58.0856 2072 tdx - ok

12:42:58.0872 2072 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys

12:42:58.0887 2072 TermDD - ok

12:42:58.0919 2072 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll

12:42:58.0934 2072 TermService - ok

12:42:58.0965 2072 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll

12:42:58.0965 2072 Themes - ok

12:42:58.0997 2072 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll

12:42:58.0997 2072 THREADORDER - ok

12:42:59.0059 2072 [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM C:\Windows\system32\drivers\tpm.sys

12:42:59.0059 2072 TPM - ok

12:42:59.0090 2072 [ 7165B5A9B4867F64A6D6935F57D4196B ] TPPWRIF C:\Windows\system32\drivers\Tppwr64v.sys

12:42:59.0090 2072 TPPWRIF - ok

12:42:59.0106 2072 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll

12:42:59.0121 2072 TrkWks - ok

12:42:59.0184 2072 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

12:42:59.0184 2072 TrustedInstaller - ok

12:42:59.0231 2072 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys

12:42:59.0231 2072 tssecsrv - ok

12:42:59.0246 2072 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys

12:42:59.0246 2072 TsUsbFlt - ok

12:42:59.0262 2072 tsusbhub - ok

12:42:59.0340 2072 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys

12:42:59.0340 2072 tunnel - ok

12:42:59.0371 2072 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys

12:42:59.0371 2072 uagp35 - ok

12:42:59.0418 2072 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys

12:42:59.0418 2072 udfs - ok

12:42:59.0465 2072 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe

12:42:59.0465 2072 UI0Detect - ok

12:42:59.0480 2072 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys

12:42:59.0496 2072 uliagpkx - ok

12:42:59.0543 2072 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys

12:42:59.0558 2072 umbus - ok

12:42:59.0574 2072 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys

12:42:59.0574 2072 UmPass - ok

12:42:59.0605 2072 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll

12:42:59.0605 2072 UmRdpService - ok

12:42:59.0745 2072 [ 86DEAC5CED845D55C63B125E0908685E ] UNS C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe

12:42:59.0777 2072 UNS - ok

12:42:59.0808 2072 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll

12:42:59.0823 2072 upnphost - ok

12:42:59.0855 2072 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys

12:42:59.0855 2072 usbccgp - ok

12:42:59.0901 2072 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys

12:42:59.0901 2072 usbcir - ok

12:42:59.0933 2072 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys

12:42:59.0948 2072 usbehci - ok

12:42:59.0995 2072 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys

12:42:59.0995 2072 usbhub - ok

12:43:00.0026 2072 [ 58E546BBAF87664FC57E0F6081E4F609 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys

12:43:00.0026 2072 usbohci - ok

12:43:00.0042 2072 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys

12:43:00.0057 2072 usbprint - ok

12:43:00.0073 2072 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS

12:43:00.0073 2072 USBSTOR - ok

12:43:00.0089 2072 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys

12:43:00.0089 2072 usbuhci - ok

12:43:00.0151 2072 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys

12:43:00.0151 2072 usbvideo - ok

12:43:00.0182 2072 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll

12:43:00.0182 2072 UxSms - ok

12:43:00.0198 2072 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe

12:43:00.0198 2072 VaultSvc - ok

12:43:00.0245 2072 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys

12:43:00.0245 2072 vdrvroot - ok

12:43:00.0307 2072 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe

12:43:00.0307 2072 vds - ok

12:43:00.0354 2072 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys

12:43:00.0354 2072 vga - ok

12:43:00.0354 2072 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys

12:43:00.0354 2072 VgaSave - ok

12:43:00.0369 2072 VGPU - ok

12:43:00.0401 2072 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys

12:43:00.0401 2072 vhdmp - ok

12:43:00.0463 2072 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys

12:43:00.0463 2072 viaide - ok

12:43:00.0588 2072 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys

12:43:00.0588 2072 vmbus - ok

12:43:00.0635 2072 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys

12:43:00.0635 2072 VMBusHID - ok

12:43:00.0681 2072 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys

12:43:00.0681 2072 volmgr - ok

12:43:00.0713 2072 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys

12:43:00.0713 2072 volmgrx - ok

12:43:00.0759 2072 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys

12:43:00.0759 2072 volsnap - ok

12:43:00.0853 2072 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys

12:43:00.0853 2072 vsmraid - ok

12:43:00.0915 2072 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe

12:43:00.0931 2072 VSS - ok

12:43:00.0947 2072 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys

12:43:00.0962 2072 vwifibus - ok

12:43:00.0993 2072 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll

12:43:00.0993 2072 W32Time - ok

12:43:01.0056 2072 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys

12:43:01.0056 2072 WacomPen - ok

12:43:01.0118 2072 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys

12:43:01.0118 2072 WANARP - ok

12:43:01.0134 2072 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys

12:43:01.0134 2072 Wanarpv6 - ok

12:43:01.0212 2072 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe

12:43:01.0227 2072 WatAdminSvc - ok

12:43:01.0290 2072 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe

12:43:01.0321 2072 wbengine - ok

12:43:01.0352 2072 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll

12:43:01.0352 2072 WbioSrvc - ok

12:43:01.0415 2072 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll

12:43:01.0415 2072 wcncsvc - ok

12:43:01.0430 2072 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

12:43:01.0430 2072 WcsPlugInService - ok

12:43:01.0461 2072 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys

12:43:01.0461 2072 Wd - ok

12:43:01.0493 2072 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys

12:43:01.0508 2072 Wdf01000 - ok

12:43:01.0539 2072 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll

12:43:01.0539 2072 WdiServiceHost - ok

12:43:01.0539 2072 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll

12:43:01.0539 2072 WdiSystemHost - ok

12:43:01.0586 2072 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll

12:43:01.0602 2072 WebClient - ok

12:43:01.0617 2072 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll

12:43:01.0617 2072 Wecsvc - ok

12:43:01.0633 2072 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll

12:43:01.0649 2072 wercplsupport - ok

12:43:01.0680 2072 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll

12:43:01.0680 2072 WerSvc - ok

12:43:01.0727 2072 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys

12:43:01.0727 2072 WfpLwf - ok

12:43:01.0758 2072 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys

12:43:01.0758 2072 WIMMount - ok

12:43:01.0820 2072 [ 7387CE6730BAAB8254DA0CE3776A4B28 ] winachsf C:\Windows\system32\DRIVERS\CAX_CNXT.sys

12:43:01.0820 2072 winachsf - ok

12:43:01.0851 2072 WinDefend - ok

12:43:01.0851 2072 WinHttpAutoProxySvc - ok

12:43:01.0914 2072 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll

12:43:01.0914 2072 Winmgmt - ok

12:43:01.0992 2072 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll

12:43:02.0023 2072 WinRM - ok

12:43:02.0101 2072 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll

12:43:02.0101 2072 Wlansvc - ok

12:43:02.0132 2072 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys

12:43:02.0132 2072 WmiAcpi - ok

12:43:02.0163 2072 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe

12:43:02.0163 2072 wmiApSrv - ok

12:43:02.0226 2072 WMPNetworkSvc - ok

12:43:02.0241 2072 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll

12:43:02.0257 2072 WPCSvc - ok

12:43:02.0273 2072 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll

12:43:02.0273 2072 WPDBusEnum - ok

12:43:02.0304 2072 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys

12:43:02.0304 2072 ws2ifsl - ok

12:43:02.0304 2072 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll

12:43:02.0319 2072 wscsvc - ok

12:43:02.0319 2072 WSearch - ok

12:43:02.0397 2072 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll

12:43:02.0413 2072 wuauserv - ok

12:43:02.0444 2072 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys

12:43:02.0460 2072 WudfPf - ok

12:43:02.0507 2072 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys

12:43:02.0507 2072 WUDFRd - ok

12:43:02.0522 2072 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll

12:43:02.0522 2072 wudfsvc - ok

12:43:02.0553 2072 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll

12:43:02.0553 2072 WwanSvc - ok

12:43:02.0616 2072 [ 9907BC1CC78C37073AC78A4541710B61 ] XAudio C:\Windows\system32\DRIVERS\XAudio64.sys

12:43:02.0616 2072 XAudio - ok

12:43:02.0663 2072 ================ Scan global ===============================

12:43:02.0694 2072 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

12:43:02.0725 2072 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll

12:43:02.0741 2072 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll

12:43:02.0772 2072 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

12:43:02.0819 2072 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

12:43:02.0819 2072 [Global] - ok

12:43:02.0819 2072 ================ Scan MBR ==================================

12:43:02.0834 2072 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

12:43:02.0834 2072 Suspicious mbr (Forged): \Device\Harddisk0\DR0

12:43:02.0897 2072 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected

12:43:02.0897 2072 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)

12:43:02.0912 2072 [ 1BB4D404D8A3BA5C2E5761D5BF042B65 ] \Device\Harddisk1\DR3

12:43:02.0943 2072 \Device\Harddisk1\DR3 - ok

12:43:02.0943 2072 ================ Scan VBR ==================================

12:43:02.0959 2072 [ 7B310E3DA2086A7FC2B1333C33DA13DC ] \Device\Harddisk0\DR0\Partition1

12:43:02.0959 2072 \Device\Harddisk0\DR0\Partition1 - ok

12:43:02.0990 2072 [ 41DA73BF4BD8DE5C07EDA207AB4BEA7F ] \Device\Harddisk0\DR0\Partition2

12:43:02.0990 2072 \Device\Harddisk0\DR0\Partition2 - ok

12:43:02.0990 2072 [ 11C81B77B4C637D7456D76625315B8EF ] \Device\Harddisk1\DR3\Partition1

12:43:02.0990 2072 \Device\Harddisk1\DR3\Partition1 - ok

12:43:02.0990 2072 ============================================================

12:43:02.0990 2072 Scan finished

12:43:02.0990 2072 ============================================================

12:43:03.0006 4932 Detected object count: 1

12:43:03.0006 4932 Actual detected object count: 1

12:43:20.0759 4932 \Device\Harddisk0\DR0\# - copied to quarantine

12:43:20.0774 4932 \Device\Harddisk0\DR0 - copied to quarantine

12:43:20.0790 4932 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine

12:43:20.0790 4932 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine

12:43:20.0790 4932 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine

12:43:20.0805 4932 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine

12:43:20.0805 4932 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine

12:43:20.0805 4932 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine

12:43:20.0805 4932 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine

12:43:20.0805 4932 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

12:43:20.0821 4932 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot

12:43:20.0821 4932 \Device\Harddisk0\DR0 - ok

12:43:20.0837 4932 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure

12:43:27.0311 4380 Deinitialize success

ASWMBR.TXT:

Run date: 2012-11-11 12:47:49

-----------------------------

12:47:49.356 OS Version: Windows x64 6.1.7601 Service Pack 1

12:47:49.356 Number of processors: 2 586 0x170A

12:47:49.356 ComputerName: ED-PC UserName: Ed

12:47:50.229 Initialize success

12:48:31.602 AVAST engine defs: 12111100

12:48:42.148 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

12:48:42.148 Disk 0 Vendor: Hitachi_HTS545016B9A300 PBBOC63G Size: 152627MB BusType: 11

12:48:42.179 Disk 0 MBR read successfully

12:48:42.179 Disk 0 MBR scan

12:48:42.195 Disk 0 Windows 7 default MBR code

12:48:42.210 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

12:48:42.226 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 152525 MB offset 206848

12:48:42.242 Disk 0 scanning C:\Windows\system32\drivers

12:48:57.810 Service scanning

12:49:42.442 Modules scanning

12:49:42.458 Disk 0 trace - called modules:

12:49:42.520 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys

12:49:42.520 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007bea580]

12:49:42.536 3 CLASSPNP.SYS[fffff88000fbb43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800764a560]

12:49:43.284 AVAST engine scan C:\Windows

12:49:45.796 AVAST engine scan C:\Windows\system32

12:53:26.068 AVAST engine scan C:\Windows\system32\drivers

12:53:58.189 AVAST engine scan C:\Users\Ed

13:03:39.945 AVAST engine scan C:\ProgramData

13:04:22.096 Scan finished successfully

13:07:02.839 Disk 0 MBR has been saved successfully to "C:\Users\Ed\Desktop\MBR.dat"

13:07:02.839 The log file has been saved successfully to "C:\Users\Ed\Desktop\aswMBR.txt"

gringo_pr · November 11, 2012

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

Folder::
c:\programdata\vjxfojifumeifor
c:\users\Ed\AppData\Roaming\PinPhotoZoom

Firefox::
FF - ProfilePath - c:\users\Ed\AppData\Roaming\Mozilla\Firefox\Profiles\4t67uvg3.default\
FF - ExtSQL: 2012-11-10 17:07; m3ffxtbr@mywebsearch.com; c:\program files (x86)\MyWebSearch\bar\1.bin

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

dandelionhead · November 11, 2012

Fabulous, IE looks to be back to normal. I have access to Tigzy's RK blog again. Is it safe to reboot if I'm not prompted first, to check how things start up?

COMBOFIX.TXT:

ComboFix 12-11-10.01 - Ed 11/11/2012 13:29:44.2.2 - x64

Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.8088.6461 [GMT -5:00]

Running from: c:\users\Ed\Desktop\ComboFix.exe

Command switches used :: c:\users\Ed\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\vjxfojifumeifor

c:\programdata\vjxfojifumeifor\arr-next.gif

c:\programdata\vjxfojifumeifor\b-sep.gif

c:\programdata\vjxfojifumeifor\btn-sq.gif

c:\programdata\vjxfojifumeifor\btn.png

c:\programdata\vjxfojifumeifor\card.jpg

c:\programdata\vjxfojifumeifor\green-l.png

c:\programdata\vjxfojifumeifor\green-r.png

c:\programdata\vjxfojifumeifor\ie7.css

c:\programdata\vjxfojifumeifor\larr.gif

c:\programdata\vjxfojifumeifor\lock.png

c:\programdata\vjxfojifumeifor\locked-text-en.png

c:\programdata\vjxfojifumeifor\logo-img.png

c:\programdata\vjxfojifumeifor\logo-text.gif

c:\programdata\vjxfojifumeifor\main.html

c:\programdata\vjxfojifumeifor\mainbg.gif

c:\programdata\vjxfojifumeifor\mcafee-lock.png

c:\programdata\vjxfojifumeifor\money.gif

c:\programdata\vjxfojifumeifor\moneypak.png

c:\programdata\vjxfojifumeifor\payments-en.png

c:\programdata\vjxfojifumeifor\side-block.png

c:\programdata\vjxfojifumeifor\step.gif

c:\programdata\vjxfojifumeifor\step.png

c:\programdata\vjxfojifumeifor\style.css

c:\programdata\vjxfojifumeifor\wait.html

c:\programdata\vjxfojifumeifor\webcam.swf

c:\users\Ed\AppData\Roaming\PinPhotoZoom

c:\users\Ed\AppData\Roaming\PinPhotoZoom\64\AutocompletePro64.dll

c:\users\Ed\AppData\Roaming\PinPhotoZoom\64\KeepMeUpdated.exe

c:\users\Ed\AppData\Roaming\PinPhotoZoom\AutocompletePro.dll

c:\users\Ed\AppData\Roaming\PinPhotoZoom\KeepMeUpdated.exe

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-11 to 2012-11-11 )))))))))))))))))))))))))))))))

.

2012-11-11 18:34 . 2012-11-11 18:34 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-11 17:45 . 2012-11-11 17:45 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F41C8E69-604E-4DC4-8231-D4C1FE14C3A3}\offreg.dll

2012-11-11 17:43 . 2012-11-11 17:43 -------- d-----w- C:\TDSSKiller_Quarantine