Another svchost trojan

JKDGuy · November 18, 2012

Greetings folks, I come to you with yet another case of the svchost trojan..! *applause* One day I turned on my computer, and it Blue Screened on me, and unfortunately for me, it started blue screening almost every time I restarted. After starting in safe mode, it randomly started working again on normal reboots, with it blue screening after I restart/start up when I get home from work. (picture of what hte Blue Screen says) http://img651.images...72/img0816q.jpg

I have purchased the awesome MBAM program, and am now taking the steps to try and rid myself of this ailment. upon scanning, I found that svchost was the problem, and I would personally rather not reinstall my OS, so I'll take my chances with you guys' expert service in removing it as best as possible. I have attatched the necessary files from DDS (at least I think I did >_< ) So if anyone has the time, 'twould be much appreciated if we could knock this out!

attach.txt

dds.txt

gringo_pr · November 18, 2012

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

JKDGuy · November 18, 2012

Alrighty! I got a couple of awesome blue-screens during this process, but I finally managed to get what I needed >_< Without further delay:

SECURITY CHECK LOG

Results of screen317's Security Check version 0.99.54

Windows 7 Service Pack 1 x64 (UAC is disabled!)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Windows Firewall Disabled!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

Java 6 Update 37

Java SE Development Kit 6 Update 25

Java version out of Date!

Adobe Flash Player 11.4.402.287

Adobe Reader X (10.1.4)

Mozilla Firefox (16.0.2)

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbam.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1%

````````````````````End of Log``````````````````````

AdwCleaner

# AdwCleaner v2.008 - Logfile created 11/18/2012 at 12:24:10

# Updated 17/11/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Aaron - BEAST

# Boot Mode : Normal

# Running from : C:\Users\Aaron\Desktop\Malware removal\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt

File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt

File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility

***** [Registry] *****

Key Deleted : HKCU\Software\Headlight

Key Deleted : HKCU\Software\IGearSettings

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\BHO.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default-1352605413830 [Profil par défaut]

File : C:\Users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\u44lvvmm.default-1352605413830\prefs.js

[OK] File is clean.

*************************

AdwCleaner[s2].txt - [3596 octets] - [18/11/2012 12:24:10]

########## EOF - C:\AdwCleaner[s2].txt - [3656 octets] ##########

RogueKiller (its report #2 since I had to redo it because of a bluescreen)

RogueKiller V8.3.0 [Nov 17 2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Aaron [Admin rights]

Mode : Remove -- Date : 11/18/2012 12:42:08

¤¤¤ Bad processes : 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 9 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : TpScrex (C:\ProgramData\TpScrex\TpScrex.exe /somering) -> DELETED

[TASK][sUSP PATH] {60BC2E72-0167-42CA-A79C-A5D52A1634B6} : C:\Users\Aaron\Desktop\ROCAM\rocam.exe -> DELETED

[TASK][sUSP PATH] {983C91DD-E38C-4375-A47F-31943562B670} : C:\Users\Aaron\Desktop\Desktop\Useful\ROCAM\rocam.exe -> DELETED

[TASK][sUSP PATH] {A7DF1426-B39F-471C-BE7C-93DFBFBB8B66} : C:\Users\Aaron\Desktop\Desktop\Useful\ROCAM\rocam.exe -> DELETED

[TASK][sUSP PATH] {DD037168-09C5-4293-A7E3-62F1D45B5A71} : C:\Users\Aaron\Desktop\Desktop\Useful\ROCAM\rocam.exe -> DELETED

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)

[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 activate.adobe.com

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST1000DL002-9TT153 ATA Device +++++

--- User ---

[MBR] 5adc99c6fa868368a85bcaff6017c2f9

[bSP] 0be8317992eb36f7aa95344ba181b1b7 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: ST1000DL002-9TT153 ATA Device +++++

--- User ---

[MBR] 1a48c9aee4041acf19ad17f132230566

[bSP] fbee5bd38d39a78a8066634f43a0a639 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive2: Hitachi HDS721050CLA362 ATA Device +++++

--- User ---

[MBR] ae5095bb70dced8847fbb40244778634

[bSP] 8abbab951ddaa4ba673c453ebc16d29a : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 2a4212a58af793b17b8f7fc6cddea8b4

[bSP] 8abbab951ddaa4ba673c453ebc16d29a : Windows 7/8 MBR Code

Partition table:

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo

Finished : << RKreport[2]_D_11182012_02d1242.txt >>

RKreport[1]_S_11182012_02d1241.txt ; RKreport[2]_D_11182012_02d1242.txt

And there it is! Thanks for your time Mr. Gringo!

gringo_pr · November 18, 2012

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

JKDGuy · November 18, 2012

Alright! Ran combofix, and here's the log:

ComboFix 12-11-16.02 - Aaron 11/18/2012 13:13:30.1.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10223 [GMT -8:00]

Running from: c:\users\Aaron\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\353D82383A.sys

c:\programdata\418977550

c:\programdata\909388599

c:\users\Aaron\AppData\Local\assembly\tmp

c:\windows\security\Database\tmp.edb

c:\windows\svchost.exe

c:\windows\SysWow64\DEBUG.log

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

c:\windows\UA000104.DLL

E:\install.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-18 to 2012-11-18 )))))))))))))))))))))))))))))))

.

2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\programdata\eSellerate

2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\program files (x86)\Common Files\eSellerate

2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files\NewBlue

2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files (x86)\NewBlue

2012-11-18 21:28 . 2012-11-18 21:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-18 20:11 . 2012-11-18 21:17 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4881AD12-ADFF-4E8F-945B-CBBAB95C95DE}\offreg.dll

2012-11-17 18:42 . 2012-11-17 18:42 -------- d-----w- c:\users\Aaron\AppData\Roaming\Malwarebytes

2012-11-17 18:41 . 2012-11-17 18:41 -------- d-----w- c:\programdata\Malwarebytes

2012-11-17 18:41 . 2012-11-17 18:41 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-11-17 18:41 . 2012-09-30 03:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-16 23:25 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4881AD12-ADFF-4E8F-945B-CBBAB95C95DE}\mpengine.dll

2012-11-16 01:43 . 2012-11-16 01:43 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-11-16 01:42 . 2012-11-16 01:42 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2012-11-16 01:38 . 2012-11-16 01:38 -------- d-----w- c:\programdata\McAfee

2012-11-14 08:26 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-11-14 08:26 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-11-14 08:26 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

2012-11-14 08:26 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-11-14 08:18 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

2012-11-14 08:18 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-11-14 08:18 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

2012-11-14 08:18 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-11-14 08:18 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-11-14 08:18 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-11-14 08:18 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-10-26 23:33 . 2012-10-26 23:33 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin

2012-10-23 23:47 . 2012-10-23 23:47 -------- d-----w- c:\programdata\ATI

2012-10-23 23:46 . 2012-10-23 23:46 -------- d-----w- c:\program files (x86)\AMD AVT

2012-10-23 23:46 . 2012-10-23 23:46 -------- d-----w- c:\program files (x86)\AMD APP

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-16 01:42 . 2011-04-27 00:44 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-11-14 08:19 . 2010-05-24 21:32 66395536 ----a-w- c:\windows\system32\MRT.exe

2012-10-19 06:09 . 2012-10-19 06:09 289768 ----a-w- c:\windows\system32\javaws.exe

2012-10-19 06:09 . 2012-10-19 06:09 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2012-10-19 06:09 . 2011-05-13 06:48 189416 ----a-w- c:\windows\system32\javaw.exe

2012-10-19 06:09 . 2012-10-19 06:09 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-10-19 06:09 . 2011-05-13 06:48 916456 ----a-w- c:\windows\system32\deployJava1.dll

2012-10-19 06:09 . 2011-05-13 06:48 188904 ----a-w- c:\windows\system32\java.exe

2012-10-10 23:28 . 2012-05-21 23:35 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-10 23:28 . 2011-05-31 22:57 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-09-28 22:37 . 2012-09-28 22:37 221696 ----a-w- c:\windows\system32\clinfo.exe

2012-09-28 22:36 . 2012-09-28 22:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll

2012-09-28 22:36 . 2012-09-28 22:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll

2012-09-28 22:36 . 2012-09-28 22:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll

2012-09-28 22:36 . 2012-09-28 22:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll

2012-09-28 22:36 . 2012-09-28 22:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll

2012-09-28 22:32 . 2012-09-28 22:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll

2012-09-28 02:23 . 2011-11-10 02:33 5557928 ----a-w- c:\windows\SysWow64\atiumdag.dll

2012-09-28 02:21 . 2012-09-28 02:21 10697216 ----a-w- c:\windows\system32\drivers\atikmdag.sys

2012-09-28 02:05 . 2012-09-28 02:05 70144 ----a-w- c:\windows\system32\coinst_9.002.dll

2012-09-28 02:03 . 2012-09-28 02:03 163840 ----a-w- c:\windows\system32\atiapfxx.exe

2012-09-28 02:02 . 2012-09-28 02:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll

2012-09-28 02:02 . 2012-09-28 02:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll

2012-09-28 02:02 . 2012-09-28 02:02 44544 ----a-w- c:\windows\system32\aticalcl64.dll

2012-09-28 02:02 . 2012-09-28 02:02 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll

2012-09-28 02:02 . 2012-09-28 02:02 16082432 ----a-w- c:\windows\system32\aticaldd64.dll

2012-09-28 01:59 . 2012-09-28 01:59 23825920 ----a-w- c:\windows\system32\atio6axx.dll

2012-09-28 01:57 . 2012-09-28 01:57 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll

2012-09-28 01:43 . 2010-11-26 02:58 935424 ----a-w- c:\windows\SysWow64\aticfx32.dll

2012-09-28 01:41 . 2010-09-29 01:54 1120768 ----a-w- c:\windows\system32\aticfx64.dll

2012-09-28 01:41 . 2012-09-28 01:41 19624960 ----a-w- c:\windows\SysWow64\atioglxx.dll

2012-09-28 01:39 . 2012-09-28 01:39 6536192 ----a-w- c:\windows\SysWow64\atidxx32.dll

2012-09-28 01:39 . 2012-09-28 01:39 442368 ----a-w- c:\windows\system32\atidemgy.dll

2012-09-28 01:39 . 2012-09-28 01:39 538112 ----a-w- c:\windows\system32\atieclxx.exe

2012-09-28 01:38 . 2012-09-28 01:38 239616 ----a-w- c:\windows\system32\atiesrxx.exe

2012-09-28 01:36 . 2012-09-28 01:36 120320 ----a-w- c:\windows\system32\atitmm64.dll

2012-09-28 01:36 . 2012-09-28 01:36 21504 ----a-w- c:\windows\system32\atimuixx.dll

2012-09-28 01:36 . 2012-09-28 01:36 59392 ----a-w- c:\windows\system32\atiedu64.dll

2012-09-28 01:36 . 2012-09-28 01:36 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll

2012-09-28 01:31 . 2012-09-28 01:31 3127296 ----a-w- c:\windows\system32\atiumd6a.dll

2012-09-28 01:25 . 2012-09-28 01:25 6704640 ----a-w- c:\windows\system32\atiumd64.dll

2012-09-28 01:22 . 2010-09-29 01:37 7167488 ----a-w- c:\windows\system32\atidxx64.dll

2012-09-28 01:22 . 2011-11-10 02:29 2691584 ----a-w- c:\windows\SysWow64\atiumdva.dll

2012-09-28 01:13 . 2012-09-28 01:13 595456 ----a-w- c:\windows\system32\atiadlxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 405504 ----a-w- c:\windows\SysWow64\atiadlxy.dll

2012-09-28 01:13 . 2012-09-28 01:13 17920 ----a-w- c:\windows\system32\atig6pxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\system32\atiglpxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 41984 ----a-w- c:\windows\system32\atig6txx.dll

2012-09-28 01:13 . 2012-09-28 01:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll

2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\atimpc64.dll

2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\amdpcom64.dll

2012-09-28 01:12 . 2012-09-28 01:12 460288 ----a-w- c:\windows\system32\drivers\atikmpag.sys

2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll

2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll

2012-09-28 01:11 . 2010-09-29 01:14 129536 ----a-w- c:\windows\system32\atiuxp64.dll

2012-09-28 01:11 . 2012-09-28 01:11 109568 ----a-w- c:\windows\SysWow64\atiuxpag.dll

2012-09-28 01:11 . 2012-09-28 01:11 103424 ----a-w- c:\windows\system32\atiu9p64.dll

2012-09-28 01:10 . 2011-09-08 16:51 82944 ----a-w- c:\windows\SysWow64\atiu9pag.dll

2012-09-28 01:09 . 2012-09-28 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2012-09-14 19:19 . 2012-10-09 21:43 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-14 18:28 . 2012-10-09 21:43 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-08-31 18:19 . 2012-10-09 21:43 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

2012-08-30 18:03 . 2012-10-09 21:43 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-08-30 17:12 . 2012-10-09 21:43 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-08-30 17:12 . 2012-10-09 21:43 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-08-24 18:05 . 2012-10-09 21:43 220160 ----a-w- c:\windows\system32\wintrust.dll

2012-08-24 16:57 . 2012-10-09 21:43 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

2012-08-22 18:12 . 2012-09-12 03:56 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-08-22 18:12 . 2012-09-12 03:56 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-12 03:56 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-08-21 21:01 . 2012-09-25 23:04 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

2012-08-21 20:01 . 2012-09-17 03:59 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-08-21 20:01 . 2011-01-14 00:23 125872 ----a-w- c:\windows\system32\GEARAspi64.dll

2012-08-21 20:01 . 2011-01-14 00:23 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 94208 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN1]

@="{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN2]

@="{CC8811D2-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D2-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN3]

@="{CC8811D3-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D3-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN4]

@="{CC8811D4-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D4-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN5]

@="{CC8811D5-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D5-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN6]

@="{CC8811D6-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D6-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN7]

@="{CC8811D7-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D7-1B32-4f3d-A9BF-D21C8F3C0366}]

2011-04-26 21:55 249856 ----a-w- c:\program files (x86)\SmartSVN 6.6\lib\shellext32.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-12 288088]

"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

.

c:\users\Aaron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Aaron\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-7-24 26909544]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

SmartSVN 6.6 (background).lnk - c:\program files (x86)\SmartSVN 6.6\bin\smartsvn.exe [2011-4-26 213504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R2 statuscached;SmartSVN Status Cache;c:\program files (x86)\SmartSVN 6.6\bin\statuscached.exe [2011-04-26 216576]

R3 ALSysIO;ALSysIO;c:\users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x]

R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]

R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [2010-06-07 35840]

R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-07-23 1432400]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 npkycryp;npkycryp;f:\games\Gravity\RO\Gravity\RO\npkycryp.sys [x]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-24 1255736]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]

R3 X6va005;X6va005;c:\users\Aaron\AppData\Local\Temp\005513E.tmp [x]

R4 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]

S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [2009-12-25 297512]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-23 283200]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432]

S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]

S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe [2010-11-30 336824]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2012-04-18 8518008]

S2 TouchServiceWacom;Wacom Professional Touch Service;c:\program files\Tablet\Wacom\Wacom_TouchService.exe [2012-04-18 567672]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

S3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2012-03-29 13688]

S3 MAUSBJAMLAB;Service for M-Audio JamLab;c:\windows\system32\DRIVERS\MAudioJamLab.sys [2009-09-03 187912]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-04-27 83080]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-04-27 184968]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2012-03-29 65912]

S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-03-29 15736]

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1673349048-1130703633-4174618188-1000Core.job

- c:\users\Aaron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-26 23:39]

.

2012-11-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1673349048-1130703633-4174618188-1000UA.job

- c:\users\Aaron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-26 23:39]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-06-30 04:19 97792 ----a-w- c:\users\Aaron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-29 10038304]

"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-03 798216]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-01-08 2328944]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.1.1

DPF: {20D5FC56-9F89-4966-94E1-122DDA4FA5E7} - hxxp://start1.gnjoy.com/cab/1004/GSystemInfo.cab

DPF: {8768D5EA-5412-4810-A032-09AD2A726C69} - hxxp://bgweb.nowcdn.co.kr/Bin/DownStarter2.cab

FF - ProfilePath - c:\users\Aaron\AppData\Roaming\Mozilla\Firefox\Profiles\u44lvvmm.default-1352605413830\

FF - prefs.js: browser.startup.homepage - google.com

FF - ExtSQL: 2012-11-15 17:42; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)

Toolbar-Locked - (no file)

AddRemove-LimitRO Installer Lite 2012-04-20 - f:\games\LimitRO\Uninstal.exe

AddRemove-LimitRONova - f:\games\LimitRO\uninst.exe

AddRemove-PunkBusterSvc - c:\program files (x86)\GAMERSFIRST\APB RELOADED\Binaries\pbsvc_apb.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]

"ImagePath"="\??\c:\users\Aaron\AppData\Local\Temp\005513E.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{61539ECD-CC67-4437-A03C-9AACCBD14326}"=hex:51,66,7a,6c,4c,1d,38,12,a3,9d,40,

65,55,82,59,01,df,2a,d9,ec,ce,8f,07,32

"{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}"=hex:51,66,7a,6c,4c,1d,38,12,ed,e2,e6,

8b,ec,e5,85,03,cf,88,91,ea,bc,02,ef,f7

"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,

89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b

"{00C6482D-C502-44C8-8409-FCE54AD9C208}"=hex:51,66,7a,6c,4c,1d,38,12,43,4b,d5,

04,30,8b,a6,01,fb,1f,bf,a5,4f,87,86,1c

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{B0CDA128-B425-4EEF-A174-61A11AC5DBF8}"=hex:51,66,7a,6c,4c,1d,38,12,46,a2,de,

b4,17,fa,81,0b,de,62,22,e1,1f,9b,9f,ec

"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,

d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:3b,52,4f,6f,c7,bf,cd,01

.

[HKEY_USERS\S-1-5-21-1673349048-1130703633-4174618188-1000\Software\SecuROM\License information*]

"datasecu"=hex:a7,84,5a,e4,88,5d,c0,ba,7e,91,61,c4,2c,c9,36,c1,92,2f,e0,dc,ce,

3e,cb,44,79,61,2b,84,e6,39,68,18,c3,a3,d6,d0,dc,5b,cd,02,f7,85,6a,f5,90,f0,\

"rkeysecu"=hex:94,de,f2,cd,22,e1,1f,e9,2c,ea,cd,c1,41,1c,26,29

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]

"value"="?\0a\03\13\12\19\"6"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-11-18 13:33:11

ComboFix-quarantined-files.txt 2012-11-18 21:33

.

Pre-Run: 87,366,266,880 bytes free

Post-Run: 88,686,940,160 bytes free

.

- - End Of File - - C8333A9F3E8D9A78EFD7DEFDF0551125

As for how the computer is running, it seems to be running fine, as it was before. The only issue I had was the blue-screens upon start-up, and sometimes at random times. But on that note, it hasn't blue-screened. I would have to restart to see if it does.

JKDGuy · November 18, 2012

Also, sorry I couldn't find how to edit my post, but I want to point out, I just scanned with MBAM real quick, and it found no malicious items! I like the sound of that~

gringo_pr · November 18, 2012

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

JKDGuy · November 18, 2012

Alrighty! here goes:

TDSSKiller

14:40:14.0988 6744 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

14:40:15.0499 6744 ============================================================

14:40:15.0499 6744 Current date / time: 2012/11/18 14:40:15.0499

14:40:15.0499 6744 SystemInfo:

14:40:15.0499 6744

14:40:15.0499 6744 OS Version: 6.1.7601 ServicePack: 1.0

14:40:15.0499 6744 Product type: Workstation

14:40:15.0499 6744 ComputerName: BEAST

14:40:15.0499 6744 UserName: Aaron

14:40:15.0499 6744 Windows directory: C:\Windows

14:40:15.0499 6744 System windows directory: C:\Windows

14:40:15.0499 6744 Running under WOW64

14:40:15.0499 6744 Processor architecture: Intel x64

14:40:15.0499 6744 Number of processors: 8

14:40:15.0499 6744 Page size: 0x1000

14:40:15.0499 6744 Boot type: Normal boot

14:40:15.0499 6744 ============================================================

14:40:16.0337 6744 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

14:40:16.0359 6744 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

14:40:16.0377 6744 Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

14:40:16.0380 6744 ============================================================

14:40:16.0380 6744 \Device\Harddisk0\DR0:

14:40:16.0380 6744 MBR partitions:

14:40:16.0380 6744 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

14:40:16.0380 6744 \Device\Harddisk1\DR1:

14:40:16.0381 6744 MBR partitions:

14:40:16.0381 6744 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705800

14:40:16.0381 6744 \Device\Harddisk2\DR2:

14:40:16.0381 6744 MBR partitions:

14:40:16.0381 6744 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

14:40:16.0381 6744 \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000

14:40:16.0381 6744 ============================================================

14:40:16.0412 6744 C: <-> \Device\Harddisk2\DR2\Partition2

14:40:16.0441 6744 E: <-> \Device\Harddisk1\DR1\Partition1

14:40:16.0469 6744 F: <-> \Device\Harddisk0\DR0\Partition1

14:40:16.0469 6744 ============================================================

14:40:16.0469 6744 Initialize success

14:40:16.0469 6744 ============================================================

14:55:59.0835 6184 ============================================================

14:55:59.0835 6184 Scan started

14:55:59.0835 6184 Mode: Manual;

14:55:59.0835 6184 ============================================================

14:56:02.0073 6184 ================ Scan system memory ========================

14:56:02.0073 6184 System memory - ok

14:56:02.0073 6184 ================ Scan services =============================

14:56:02.0196 6184 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys

14:56:02.0197 6184 1394ohci - ok

14:56:02.0229 6184 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys

14:56:02.0230 6184 ACPI - ok

14:56:02.0252 6184 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys

14:56:02.0253 6184 AcpiPmi - ok

14:56:02.0297 6184 [ 2F0683FD2DF1D92E891CACA14B45A8C1 ] adfs C:\Windows\system32\drivers\adfs.sys

14:56:02.0297 6184 adfs - ok

14:56:02.0448 6184 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

14:56:02.0448 6184 AdobeARMservice - ok

14:56:02.0494 6184 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys

14:56:02.0496 6184 adp94xx - ok

14:56:02.0514 6184 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys

14:56:02.0516 6184 adpahci - ok

14:56:02.0526 6184 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys

14:56:02.0526 6184 adpu320 - ok

14:56:02.0554 6184 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll

14:56:02.0554 6184 AeLookupSvc - ok

14:56:02.0599 6184 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys

14:56:02.0601 6184 AFD - ok

14:56:02.0625 6184 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys

14:56:02.0626 6184 agp440 - ok

14:56:02.0661 6184 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe

14:56:02.0661 6184 ALG - ok

14:56:02.0666 6184 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys

14:56:02.0666 6184 aliide - ok

14:56:02.0698 6184 ALSysIO - ok

14:56:02.0750 6184 [ 4C1E3649C89C7D542CD18ECC5210099D ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe

14:56:02.0751 6184 AMD External Events Utility - ok

14:56:02.0760 6184 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys

14:56:02.0760 6184 amdide - ok

14:56:02.0793 6184 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys

14:56:02.0793 6184 AmdK8 - ok

14:56:03.0179 6184 [ A3C0A15B39F979E8F3EABA901D72ECD7 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys

14:56:03.0215 6184 amdkmdag - ok

14:56:03.0273 6184 [ 20F3CD38B107C1BD747C0EA37D450165 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys

14:56:03.0275 6184 amdkmdap - ok

14:56:03.0286 6184 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys

14:56:03.0286 6184 AmdPPM - ok

14:56:03.0310 6184 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys

14:56:03.0310 6184 amdsata - ok

14:56:03.0333 6184 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys

14:56:03.0333 6184 amdsbs - ok

14:56:03.0346 6184 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys

14:56:03.0346 6184 amdxata - ok

14:56:03.0397 6184 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys

14:56:03.0397 6184 AppID - ok

14:56:03.0420 6184 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll

14:56:03.0421 6184 AppIDSvc - ok

14:56:03.0458 6184 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll

14:56:03.0459 6184 Appinfo - ok

14:56:03.0574 6184 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

14:56:03.0575 6184 Apple Mobile Device - ok

14:56:03.0601 6184 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys

14:56:03.0602 6184 arc - ok

14:56:03.0604 6184 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys

14:56:03.0604 6184 arcsas - ok

14:56:03.0715 6184 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

14:56:03.0715 6184 aspnet_state - ok

14:56:03.0741 6184 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys

14:56:03.0741 6184 AsyncMac - ok

14:56:03.0756 6184 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys

14:56:03.0756 6184 atapi - ok

14:56:03.0803 6184 [ B0790FF0E25B7A2674296052F2162C1A ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys

14:56:03.0803 6184 AtiHDAudioService - ok

14:56:03.0864 6184 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

14:56:03.0866 6184 AudioEndpointBuilder - ok

14:56:03.0873 6184 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll

14:56:03.0875 6184 AudioSrv - ok

14:56:03.0917 6184 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll

14:56:03.0918 6184 AxInstSV - ok

14:56:03.0954 6184 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys

14:56:03.0956 6184 b06bdrv - ok

14:56:03.0977 6184 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys

14:56:03.0978 6184 b57nd60a - ok

14:56:04.0099 6184 [ A2494901E7226B356B8C1005C45F1C5F ] BBSvc C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe

14:56:04.0100 6184 BBSvc - ok

14:56:04.0155 6184 [ 63B1CBBAE4790B5BAC98F01BF9449722 ] BBUpdate C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe

14:56:04.0156 6184 BBUpdate - ok

14:56:04.0205 6184 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll

14:56:04.0205 6184 BDESVC - ok

14:56:04.0256 6184 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys

14:56:04.0257 6184 Beep - ok

14:56:04.0302 6184 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll

14:56:04.0304 6184 BFE - ok

14:56:04.0357 6184 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll

14:56:04.0360 6184 BITS - ok

14:56:04.0384 6184 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys

14:56:04.0385 6184 blbdrive - ok

14:56:04.0469 6184 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

14:56:04.0470 6184 Bonjour Service - ok

14:56:04.0512 6184 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys

14:56:04.0512 6184 bowser - ok

14:56:04.0520 6184 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys

14:56:04.0520 6184 BrFiltLo - ok

14:56:04.0530 6184 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys

14:56:04.0530 6184 BrFiltUp - ok

14:56:04.0533 6184 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys

14:56:04.0533 6184 BridgeMP - ok

14:56:04.0577 6184 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll

14:56:04.0577 6184 Browser - ok

14:56:04.0594 6184 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys

14:56:04.0595 6184 Brserid - ok

14:56:04.0605 6184 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys

14:56:04.0605 6184 BrSerWdm - ok

14:56:04.0616 6184 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys

14:56:04.0617 6184 BrUsbMdm - ok

14:56:04.0630 6184 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys

14:56:04.0630 6184 BrUsbSer - ok

14:56:04.0632 6184 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys

14:56:04.0632 6184 BTHMODEM - ok

14:56:04.0654 6184 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll

14:56:04.0654 6184 bthserv - ok

14:56:04.0706 6184 [ 9887CA12F407D7FBC7F48F3678F5F0B6 ] BVRPMPR5a64 C:\Windows\system32\drivers\BVRPMPR5a64.SYS

14:56:04.0706 6184 BVRPMPR5a64 - ok

14:56:04.0717 6184 catchme - ok

14:56:04.0748 6184 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys

14:56:04.0749 6184 cdfs - ok

14:56:04.0780 6184 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys

14:56:04.0780 6184 cdrom - ok

14:56:04.0828 6184 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll

14:56:04.0829 6184 CertPropSvc - ok

14:56:04.0848 6184 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys

14:56:04.0849 6184 circlass - ok

14:56:04.0879 6184 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys

14:56:04.0880 6184 CLFS - ok

14:56:04.0919 6184 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

14:56:04.0920 6184 clr_optimization_v2.0.50727_32 - ok

14:56:04.0938 6184 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

14:56:04.0938 6184 clr_optimization_v2.0.50727_64 - ok

14:56:05.0022 6184 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

14:56:05.0023 6184 clr_optimization_v4.0.30319_32 - ok

14:56:05.0047 6184 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

14:56:05.0048 6184 clr_optimization_v4.0.30319_64 - ok

14:56:05.0080 6184 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys

14:56:05.0081 6184 CmBatt - ok

14:56:05.0111 6184 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys

14:56:05.0111 6184 cmdide - ok

14:56:05.0157 6184 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys

14:56:05.0158 6184 CNG - ok

14:56:05.0183 6184 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys

14:56:05.0183 6184 Compbatt - ok

14:56:05.0235 6184 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys

14:56:05.0235 6184 CompositeBus - ok

14:56:05.0255 6184 COMSysApp - ok

14:56:05.0290 6184 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys

14:56:05.0290 6184 crcdisk - ok

14:56:05.0350 6184 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll

14:56:05.0351 6184 CryptSvc - ok

14:56:05.0457 6184 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

14:56:05.0460 6184 cvhsvc - ok

14:56:05.0508 6184 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll

14:56:05.0511 6184 DcomLaunch - ok

14:56:05.0538 6184 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll

14:56:05.0540 6184 defragsvc - ok

14:56:05.0579 6184 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys

14:56:05.0579 6184 DfsC - ok

14:56:05.0603 6184 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll

14:56:05.0604 6184 Dhcp - ok

14:56:05.0622 6184 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys

14:56:05.0622 6184 discache - ok

14:56:05.0638 6184 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys

14:56:05.0638 6184 Disk - ok

14:56:05.0677 6184 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll

14:56:05.0678 6184 Dnscache - ok

14:56:05.0726 6184 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll

14:56:05.0727 6184 dot3svc - ok

14:56:05.0765 6184 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll

14:56:05.0766 6184 DPS - ok

14:56:05.0789 6184 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys

14:56:05.0789 6184 drmkaud - ok

14:56:05.0815 6184 [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys

14:56:05.0816 6184 dtsoftbus01 - ok

14:56:05.0850 6184 dump_wmimmc - ok

14:56:05.0918 6184 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys

14:56:05.0921 6184 DXGKrnl - ok

14:56:05.0952 6184 EagleX64 - ok

14:56:05.0974 6184 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll

14:56:05.0975 6184 EapHost - ok

14:56:06.0035 6184 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys

14:56:06.0046 6184 ebdrv - ok

14:56:06.0068 6184 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe

14:56:06.0069 6184 EFS - ok

14:56:06.0158 6184 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe

14:56:06.0161 6184 ehRecvr - ok

14:56:06.0184 6184 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe

14:56:06.0185 6184 ehSched - ok

14:56:06.0211 6184 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys

14:56:06.0213 6184 elxstor - ok

14:56:06.0221 6184 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys

14:56:06.0222 6184 ErrDev - ok

14:56:06.0255 6184 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll

14:56:06.0257 6184 EventSystem - ok

14:56:06.0269 6184 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys

14:56:06.0270 6184 exfat - ok

14:56:06.0286 6184 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys

14:56:06.0287 6184 fastfat - ok

14:56:06.0337 6184 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe

14:56:06.0340 6184 Fax - ok

14:56:06.0349 6184 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys

14:56:06.0349 6184 fdc - ok

14:56:06.0371 6184 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll

14:56:06.0371 6184 fdPHost - ok

14:56:06.0380 6184 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll

14:56:06.0381 6184 FDResPub - ok

14:56:06.0397 6184 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys

14:56:06.0397 6184 FileInfo - ok

14:56:06.0412 6184 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys

14:56:06.0412 6184 Filetrace - ok

14:56:06.0483 6184 [ 1F63900E2EB00101B9ACA2B7A870704E ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

14:56:06.0485 6184 FLEXnet Licensing Service - ok

14:56:06.0528 6184 [ 64AB6F28047744B9B19C97459C2AB31B ] FLEXnet Licensing Service 64 C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe

14:56:06.0533 6184 FLEXnet Licensing Service 64 - ok

14:56:06.0550 6184 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys

14:56:06.0550 6184 flpydisk - ok

14:56:06.0599 6184 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys

14:56:06.0600 6184 FltMgr - ok

14:56:06.0645 6184 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll

14:56:06.0650 6184 FontCache - ok

14:56:06.0712 6184 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

14:56:06.0712 6184 FontCache3.0.0.0 - ok

14:56:06.0731 6184 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys

14:56:06.0731 6184 FsDepends - ok

14:56:06.0767 6184 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys

14:56:06.0767 6184 Fs_Rec - ok

14:56:06.0819 6184 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys

14:56:06.0820 6184 fvevol - ok

14:56:06.0833 6184 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys

14:56:06.0833 6184 gagp30kx - ok

14:56:06.0884 6184 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

14:56:06.0884 6184 GEARAspiWDM - ok

14:56:06.0935 6184 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll

14:56:06.0938 6184 gpsvc - ok

14:56:06.0951 6184 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys

14:56:06.0952 6184 hcw85cir - ok

14:56:06.0985 6184 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

14:56:06.0986 6184 HdAudAddService - ok

14:56:07.0015 6184 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys

14:56:07.0016 6184 HDAudBus - ok

14:56:07.0027 6184 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys

14:56:07.0027 6184 HidBatt - ok

14:56:07.0036 6184 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys

14:56:07.0037 6184 HidBth - ok

14:56:07.0051 6184 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys

14:56:07.0051 6184 HidIr - ok

14:56:07.0086 6184 [ 3CC53BC405F609F61D4A879F3E7EBC4A ] hidkmdf C:\Windows\system32\DRIVERS\hidkmdf.sys

14:56:07.0086 6184 hidkmdf - ok

14:56:07.0134 6184 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll

14:56:07.0134 6184 hidserv - ok

14:56:07.0173 6184 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys

14:56:07.0173 6184 HidUsb - ok

14:56:07.0219 6184 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll

14:56:07.0220 6184 hkmsvc - ok

14:56:07.0274 6184 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

14:56:07.0275 6184 HomeGroupListener - ok

14:56:07.0347 6184 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

14:56:07.0348 6184 HomeGroupProvider - ok

14:56:07.0372 6184 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys

14:56:07.0372 6184 HpSAMD - ok

14:56:07.0446 6184 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys

14:56:07.0448 6184 HTTP - ok

14:56:07.0479 6184 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys

14:56:07.0479 6184 hwpolicy - ok

14:56:07.0534 6184 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys

14:56:07.0535 6184 i8042prt - ok

14:56:07.0575 6184 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys

14:56:07.0576 6184 iaStorV - ok

14:56:07.0663 6184 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

14:56:07.0666 6184 idsvc - ok

14:56:07.0686 6184 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys

14:56:07.0686 6184 iirsp - ok

14:56:07.0732 6184 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll

14:56:07.0735 6184 IKEEXT - ok

14:56:07.0780 6184 [ A3BCBD0F710580A07D1B929D787D36CE ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys

14:56:07.0787 6184 IntcAzAudAddService - ok

14:56:07.0810 6184 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys

14:56:07.0811 6184 intelide - ok

14:56:07.0830 6184 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys

14:56:07.0830 6184 intelppm - ok

14:56:07.0851 6184 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll

14:56:07.0852 6184 IPBusEnum - ok

14:56:07.0891 6184 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys

14:56:07.0891 6184 IpFilterDriver - ok

14:56:07.0931 6184 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll

14:56:07.0933 6184 iphlpsvc - ok

14:56:07.0951 6184 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys

14:56:07.0951 6184 IPMIDRV - ok

14:56:07.0964 6184 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys

14:56:07.0964 6184 IPNAT - ok

14:56:08.0017 6184 [ 6E50CFA46527B39015B750AAD161C5CC ] iPod Service C:\Program Files\iPod\bin\iPodService.exe

14:56:08.0020 6184 iPod Service - ok

14:56:08.0045 6184 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys

14:56:08.0045 6184 IRENUM - ok

14:56:08.0070 6184 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys

14:56:08.0070 6184 isapnp - ok

14:56:08.0091 6184 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys

14:56:08.0092 6184 iScsiPrt - ok

14:56:08.0155 6184 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys

14:56:08.0155 6184 kbdclass - ok

14:56:08.0193 6184 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys

14:56:08.0193 6184 kbdhid - ok

14:56:08.0293 6184 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe

14:56:08.0293 6184 KeyIso - ok

14:56:08.0364 6184 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys

14:56:08.0365 6184 KSecDD - ok

14:56:08.0382 6184 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys

14:56:08.0383 6184 KSecPkg - ok

14:56:08.0430 6184 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys

14:56:08.0431 6184 ksthunk - ok

14:56:08.0490 6184 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll

14:56:08.0492 6184 KtmRm - ok

14:56:08.0560 6184 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll

14:56:08.0562 6184 LanmanServer - ok

14:56:08.0604 6184 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

14:56:08.0605 6184 LanmanWorkstation - ok

14:56:08.0628 6184 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys

14:56:08.0629 6184 lltdio - ok

14:56:08.0637 6184 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll

14:56:08.0638 6184 lltdsvc - ok

14:56:08.0651 6184 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll

14:56:08.0652 6184 lmhosts - ok

14:56:08.0675 6184 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys

14:56:08.0676 6184 LSI_FC - ok

14:56:08.0679 6184 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys

14:56:08.0679 6184 LSI_SAS - ok

14:56:08.0681 6184 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys

14:56:08.0681 6184 LSI_SAS2 - ok

14:56:08.0689 6184 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys

14:56:08.0690 6184 LSI_SCSI - ok

14:56:08.0708 6184 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys

14:56:08.0708 6184 luafv - ok

14:56:08.0758 6184 [ 221FD25930DDF5E8F7427FBEA2736A05 ] MAUSBJAMLAB C:\Windows\system32\DRIVERS\MAudioJamLab.sys

14:56:08.0759 6184 MAUSBJAMLAB - ok

14:56:08.0813 6184 [ A8FE8F2783B2929B56F5370A89356CE9 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys

14:56:08.0813 6184 MBAMProtector - ok

14:56:08.0865 6184 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

14:56:08.0866 6184 MBAMScheduler - ok

14:56:08.0887 6184 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

14:56:08.0890 6184 MBAMService - ok

14:56:08.0929 6184 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll

14:56:08.0930 6184 Mcx2Svc - ok

14:56:08.0958 6184 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys

14:56:08.0958 6184 megasas - ok

14:56:08.0962 6184 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys

14:56:08.0963 6184 MegaSR - ok

14:56:08.0992 6184 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll

14:56:08.0993 6184 MMCSS - ok

14:56:08.0995 6184 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys

14:56:08.0995 6184 Modem - ok

14:56:09.0012 6184 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys

14:56:09.0012 6184 monitor - ok

14:56:09.0042 6184 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys

14:56:09.0043 6184 mouclass - ok

14:56:09.0063 6184 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys

14:56:09.0063 6184 mouhid - ok

14:56:09.0102 6184 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys

14:56:09.0103 6184 mountmgr - ok

14:56:09.0153 6184 [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

14:56:09.0154 6184 MozillaMaintenance - ok

14:56:09.0182 6184 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys

14:56:09.0182 6184 mpio - ok

14:56:09.0223 6184 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys

14:56:09.0224 6184 mpsdrv - ok

14:56:09.0282 6184 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll

14:56:09.0285 6184 MpsSvc - ok

14:56:09.0330 6184 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys

14:56:09.0331 6184 MRxDAV - ok

14:56:09.0363 6184 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys

14:56:09.0364 6184 mrxsmb - ok

14:56:09.0419 6184 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys

14:56:09.0420 6184 mrxsmb10 - ok

14:56:09.0431 6184 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys

14:56:09.0431 6184 mrxsmb20 - ok

14:56:09.0452 6184 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys

14:56:09.0452 6184 msahci - ok

14:56:09.0480 6184 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys

14:56:09.0481 6184 msdsm - ok

14:56:09.0496 6184 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe

14:56:09.0497 6184 MSDTC - ok

14:56:09.0512 6184 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys

14:56:09.0512 6184 Msfs - ok

14:56:09.0518 6184 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys

14:56:09.0519 6184 mshidkmdf - ok

14:56:09.0530 6184 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys

14:56:09.0531 6184 msisadrv - ok

14:56:09.0563 6184 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll

14:56:09.0564 6184 MSiSCSI - ok

14:56:09.0566 6184 msiserver - ok

14:56:09.0581 6184 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys

14:56:09.0581 6184 MSKSSRV - ok

14:56:09.0594 6184 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys

14:56:09.0594 6184 MSPCLOCK - ok

14:56:09.0607 6184 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys

14:56:09.0608 6184 MSPQM - ok

14:56:09.0652 6184 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys

14:56:09.0653 6184 MsRPC - ok

14:56:09.0674 6184 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys

14:56:09.0674 6184 mssmbios - ok

14:56:09.0681 6184 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys

14:56:09.0681 6184 MSTEE - ok

14:56:09.0695 6184 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys

14:56:09.0696 6184 MTConfig - ok

14:56:09.0729 6184 [ 19B006B181E3875FD254F7B67ACF1E7C ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys

14:56:09.0730 6184 MTsensor - ok

14:56:09.0750 6184 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys

14:56:09.0750 6184 Mup - ok

14:56:09.0779 6184 [ 8DB5861A8DB19ABAF430FCD001EF5E93 ] mv91xx C:\Windows\system32\DRIVERS\mv91xx.sys

14:56:09.0780 6184 mv91xx - ok

14:56:09.0820 6184 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll

14:56:09.0823 6184 napagent - ok

14:56:09.0847 6184 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys

14:56:09.0848 6184 NativeWifiP - ok

14:56:09.0899 6184 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys

14:56:09.0902 6184 NDIS - ok

14:56:09.0913 6184 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys

14:56:09.0913 6184 NdisCap - ok

14:56:09.0936 6184 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys

14:56:09.0937 6184 NdisTapi - ok

14:56:09.0977 6184 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys

14:56:09.0977 6184 Ndisuio - ok

14:56:10.0018 6184 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys

14:56:10.0018 6184 NdisWan - ok

14:56:10.0052 6184 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys

14:56:10.0052 6184 NDProxy - ok

14:56:10.0079 6184 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys

14:56:10.0079 6184 NetBIOS - ok

14:56:10.0114 6184 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys

14:56:10.0115 6184 NetBT - ok

14:56:10.0126 6184 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe

14:56:10.0126 6184 Netlogon - ok

14:56:10.0170 6184 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll

14:56:10.0172 6184 Netman - ok

14:56:10.0216 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:56:10.0217 6184 NetMsmqActivator - ok

14:56:10.0219 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:56:10.0219 6184 NetPipeActivator - ok

14:56:10.0234 6184 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll

14:56:10.0236 6184 netprofm - ok

14:56:10.0239 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:56:10.0239 6184 NetTcpActivator - ok

14:56:10.0241 6184 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:56:10.0242 6184 NetTcpPortSharing - ok

14:56:10.0253 6184 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys

14:56:10.0253 6184 nfrd960 - ok

14:56:10.0390 6184 [ 0BCB418C2906852C6F9347A258FD5711 ] NIHardwareService C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

14:56:10.0408 6184 NIHardwareService - ok

14:56:10.0430 6184 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll

14:56:10.0432 6184 NlaSvc - ok

14:56:10.0440 6184 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys

14:56:10.0440 6184 Npfs - ok

14:56:10.0479 6184 npggsvc - ok

14:56:10.0549 6184 [ AAF9B4DF67938753CB21808EA3574242 ] npkcrypt F:\Games\Gravity\RO\Gravity\RO\npkcrypt.sys

14:56:10.0550 6184 npkcrypt - ok

14:56:10.0552 6184 npkycryp - ok

14:56:10.0554 6184 NPPTNT2 - ok

14:56:10.0573 6184 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll

14:56:10.0574 6184 nsi - ok

14:56:10.0591 6184 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys

14:56:10.0592 6184 nsiproxy - ok

14:56:10.0647 6184 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys

14:56:10.0652 6184 Ntfs - ok

14:56:10.0661 6184 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys

14:56:10.0662 6184 Null - ok

14:56:10.0688 6184 [ 285ACEC1B13A15BA520AAE06BACB9CFF ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys

14:56:10.0688 6184 nusb3hub - ok

14:56:10.0699 6184 [ F6D625FF7B56BB6EA063F0D3A5BBC996 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys

14:56:10.0700 6184 nusb3xhc - ok

14:56:10.0728 6184 [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys

14:56:10.0729 6184 NVENETFD - ok

14:56:10.0869 6184 [ DD81FBC57AB9134CDDC5CE90880BFD80 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys

14:56:10.0907 6184 nvlddmkm - ok

14:56:10.0939 6184 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys

14:56:10.0940 6184 nvraid - ok

14:56:10.0969 6184 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys

14:56:10.0970 6184 nvstor - ok

14:56:10.0989 6184 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys

14:56:10.0990 6184 nv_agp - ok

14:56:11.0001 6184 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys

14:56:11.0001 6184 ohci1394 - ok

14:56:11.0058 6184 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

14:56:11.0059 6184 ose - ok

14:56:11.0214 6184 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

14:56:11.0230 6184 osppsvc - ok

14:56:11.0252 6184 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll

14:56:11.0253 6184 p2pimsvc - ok

14:56:11.0284 6184 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll

14:56:11.0286 6184 p2psvc - ok

14:56:11.0315 6184 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys

14:56:11.0316 6184 Parport - ok

14:56:11.0350 6184 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys

14:56:11.0351 6184 partmgr - ok

14:56:11.0369 6184 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll

14:56:11.0370 6184 PcaSvc - ok

14:56:11.0394 6184 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys

14:56:11.0394 6184 pci - ok

14:56:11.0400 6184 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys

14:56:11.0400 6184 pciide - ok

14:56:11.0413 6184 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys

14:56:11.0414 6184 pcmcia - ok

14:56:11.0427 6184 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys

14:56:11.0427 6184 pcw - ok

14:56:11.0444 6184 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys

14:56:11.0446 6184 PEAUTH - ok

14:56:11.0505 6184 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe

14:56:11.0506 6184 PerfHost - ok

14:56:11.0566 6184 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll

14:56:11.0571 6184 pla - ok

14:56:11.0610 6184 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll

14:56:11.0612 6184 PlugPlay - ok

14:56:11.0626 6184 PnkBstrA - ok

14:56:11.0645 6184 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll

14:56:11.0645 6184 PNRPAutoReg - ok

14:56:11.0660 6184 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll

14:56:11.0662 6184 PNRPsvc - ok

14:56:11.0709 6184 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll

14:56:11.0711 6184 PolicyAgent - ok

14:56:11.0719 6184 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll

14:56:11.0721 6184 Power - ok

14:56:11.0772 6184 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys

14:56:11.0773 6184 PptpMiniport - ok

14:56:11.0800 6184 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys

14:56:11.0800 6184 Processor - ok

14:56:11.0847 6184 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll

14:56:11.0849 6184 ProfSvc - ok

14:56:11.0859 6184 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

14:56:11.0860 6184 ProtectedStorage - ok

14:56:11.0906 6184 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys

14:56:11.0907 6184 Psched - ok

14:56:11.0981 6184 [ 788CB65D49D1162C5EE6814AFE5B0A70 ] PSI_SVC_2_x64 c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

14:56:11.0982 6184 PSI_SVC_2_x64 - ok

14:56:12.0019 6184 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys

14:56:12.0025 6184 ql2300 - ok

14:56:12.0038 6184 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys

14:56:12.0039 6184 ql40xx - ok

14:56:12.0063 6184 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll

14:56:12.0064 6184 QWAVE - ok

14:56:12.0071 6184 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys

14:56:12.0072 6184 QWAVEdrv - ok

14:56:12.0093 6184 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys

14:56:12.0093 6184 RasAcd - ok

14:56:12.0119 6184 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys

14:56:12.0120 6184 RasAgileVpn - ok

14:56:12.0134 6184 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll

14:56:12.0135 6184 RasAuto - ok

14:56:12.0176 6184 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys

14:56:12.0177 6184 Rasl2tp - ok

14:56:12.0202 6184 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll

14:56:12.0204 6184 RasMan - ok

14:56:12.0222 6184 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys

14:56:12.0222 6184 RasPppoe - ok

14:56:12.0281 6184 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys

14:56:12.0282 6184 RasSstp - ok

14:56:12.0305 6184 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys

14:56:12.0306 6184 rdbss - ok

14:56:12.0319 6184 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys

14:56:12.0319 6184 rdpbus - ok

14:56:12.0332 6184 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys

14:56:12.0332 6184 RDPCDD - ok

14:56:12.0343 6184 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys

14:56:12.0343 6184 RDPENCDD - ok

14:56:12.0346 6184 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys

14:56:12.0347 6184 RDPREFMP - ok

14:56:12.0377 6184 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys

14:56:12.0378 6184 RDPWD - ok

14:56:12.0420 6184 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys

14:56:12.0420 6184 rdyboost - ok

14:56:12.0469 6184 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll

14:56:12.0470 6184 RemoteAccess - ok

14:56:12.0486 6184 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll

14:56:12.0487 6184 RemoteRegistry - ok

14:56:12.0506 6184 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll

14:56:12.0507 6184 RpcEptMapper - ok

14:56:12.0521 6184 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe

14:56:12.0522 6184 RpcLocator - ok

14:56:12.0557 6184 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll

14:56:12.0560 6184 RpcSs - ok

14:56:12.0580 6184 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys

14:56:12.0581 6184 rspndr - ok

14:56:12.0617 6184 [ BAEFEE35D27A5440D35092CE10267BEC ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys

14:56:12.0618 6184 RTL8167 - ok

14:56:12.0634 6184 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe

14:56:12.0635 6184 SamSs - ok

14:56:12.0654 6184 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys

14:56:12.0654 6184 sbp2port - ok

14:56:12.0683 6184 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll

14:56:12.0684 6184 SCardSvr - ok

14:56:12.0729 6184 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys

14:56:12.0730 6184 scfilter - ok

14:56:12.0777 6184 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll

14:56:12.0781 6184 Schedule - ok

14:56:12.0819 6184 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll

14:56:12.0820 6184 SCPolicySvc - ok

14:56:12.0858 6184 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll

14:56:12.0859 6184 SDRSVC - ok

14:56:12.0879 6184 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys

14:56:12.0879 6184 secdrv - ok

14:56:12.0889 6184 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll

14:56:12.0890 6184 seclogon - ok

14:56:12.0909 6184 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll

14:56:12.0910 6184 SENS - ok

14:56:12.0933 6184 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll

14:56:12.0934 6184 SensrSvc - ok

14:56:12.0964 6184 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys

14:56:12.0964 6184 Serenum - ok

14:56:12.0978 6184 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys

14:56:12.0979 6184 Serial - ok

14:56:13.0006 6184 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys

14:56:13.0006 6184 sermouse - ok

14:56:13.0049 6184 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll

14:56:13.0050 6184 SessionEnv - ok

14:56:13.0076 6184 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys

14:56:13.0076 6184 sffdisk - ok

14:56:13.0085 6184 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys

14:56:13.0085 6184 sffp_mmc - ok

14:56:13.0096 6184 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys

14:56:13.0096 6184 sffp_sd - ok

14:56:13.0112 6184 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys

14:56:13.0112 6184 sfloppy - ok

14:56:13.0180 6184 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys

14:56:13.0182 6184 Sftfs - ok

14:56:13.0285 6184 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

14:56:13.0287 6184 sftlist - ok

14:56:13.0332 6184 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys

14:56:13.0333 6184 Sftplay - ok

14:56:13.0355 6184 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys

14:56:13.0356 6184 Sftredir - ok

14:56:13.0401 6184 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys

14:56:13.0402 6184 Sftvol - ok

14:56:13.0417 6184 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

14:56:13.0418 6184 sftvsa - ok

14:56:13.0463 6184 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll

14:56:13.0465 6184 SharedAccess - ok

14:56:13.0516 6184 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

14:56:13.0518 6184 ShellHWDetection - ok

14:56:13.0539 6184 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys

14:56:13.0539 6184 SiSRaid2 - ok

14:56:13.0669 6184 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys

14:56:13.0669 6184 SiSRaid4 - ok

14:56:13.0824 6184 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe

14:56:13.0825 6184 SkypeUpdate - ok

14:56:13.0872 6184 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys

14:56:13.0872 6184 Smb - ok

14:56:13.0910 6184 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe

14:56:13.0911 6184 SNMPTRAP - ok

14:56:13.0940 6184 [ 12583AF6CBE0050651EAF2723B3AD7B3 ] speedfan C:\Windows\syswow64\speedfan.sys

14:56:13.0941 6184 speedfan - ok

14:56:13.0956 6184 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys

14:56:13.0957 6184 spldr - ok

14:56:14.0005 6184 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe

14:56:14.0008 6184 Spooler - ok

14:56:14.0079 6184 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe

14:56:14.0091 6184 sppsvc - ok

14:56:14.0108 6184 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll

14:56:14.0110 6184 sppuinotify - ok

14:56:14.0136 6184 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys

14:56:14.0137 6184 srv - ok

14:56:14.0153 6184 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys

14:56:14.0154 6184 srv2 - ok

14:56:14.0167 6184 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys

14:56:14.0168 6184 srvnet - ok

14:56:14.0191 6184 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll

14:56:14.0192 6184 SSDPSRV - ok

14:56:14.0214 6184 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll

14:56:14.0215 6184 SstpSvc - ok

14:56:14.0305 6184 [ 969FBE32D34E257A4285BD40E89D72D2 ] statuscached C:\Program Files (x86)\SmartSVN 6.6\bin\statuscached.exe

14:56:14.0306 6184 statuscached - ok

14:56:14.0343 6184 Steam Client Service - ok

14:56:14.0364 6184 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys

14:56:14.0364 6184 stexstor - ok

14:56:14.0411 6184 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll

14:56:14.0414 6184 stisvc - ok

14:56:14.0430 6184 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys

14:56:14.0431 6184 swenum - ok

14:56:14.0533 6184 [ F577910A133A592234EBAAD3F3AFA258 ] SwitchBoard C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

14:56:14.0535 6184 SwitchBoard - ok

14:56:14.0555 6184 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll

14:56:14.0558 6184 swprv - ok

14:56:14.0608 6184 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll

14:56:14.0614 6184 SysMain - ok

14:56:14.0657 6184 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

14:56:14.0658 6184 TabletInputService - ok

14:56:14.0806 6184 [ 17A341D41F30FEA2EFF7223148899FEC ] TabletServiceWacom C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe

14:56:14.0834 6184 TabletServiceWacom - ok

14:56:14.0869 6184 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll

14:56:14.0871 6184 TapiSrv - ok

14:56:14.0893 6184 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll

14:56:14.0894 6184 TBS - ok

14:56:14.0976 6184 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys

14:56:14.0982 6184 Tcpip - ok

14:56:14.0998 6184 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys

14:56:15.0004 6184 TCPIP6 - ok

14:56:15.0023 6184 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys

14:56:15.0024 6184 tcpipreg - ok

14:56:15.0059 6184 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys

14:56:15.0059 6184 TDPIPE - ok

14:56:15.0096 6184 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys

14:56:15.0096 6184 TDTCP - ok

14:56:15.0130 6184 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys

14:56:15.0130 6184 tdx - ok

14:56:15.0154 6184 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys

14:56:15.0155 6184 TermDD - ok

14:56:15.0175 6184 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll

14:56:15.0178 6184 TermService - ok

14:56:15.0210 6184 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll

14:56:15.0211 6184 Themes - ok

14:56:15.0233 6184 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll

14:56:15.0234 6184 THREADORDER - ok

14:56:15.0299 6184 [ A15A789141C74AAD7971FBCB4847A593 ] TouchServiceWacom C:\Program Files\Tablet\Wacom\Wacom_TouchService.exe

14:56:15.0301 6184 TouchServiceWacom - ok

14:56:15.0321 6184 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll

14:56:15.0322 6184 TrkWks - ok

14:56:15.0381 6184 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

14:56:15.0382 6184 TrustedInstaller - ok

14:56:15.0427 6184 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys

14:56:15.0428 6184 tssecsrv - ok

14:56:15.0477 6184 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys

14:56:15.0477 6184 TsUsbFlt - ok

14:56:15.0550 6184 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys

14:56:15.0550 6184 tunnel - ok

14:56:15.0576 6184 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys

14:56:15.0576 6184 uagp35 - ok

14:56:15.0635 6184 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys

14:56:15.0637 6184 udfs - ok

14:56:15.0659 6184 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe

14:56:15.0661 6184 UI0Detect - ok

14:56:15.0675 6184 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys

14:56:15.0675 6184 uliagpkx - ok

14:56:15.0716 6184 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys

14:56:15.0716 6184 umbus - ok

14:56:15.0731 6184 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys

14:56:15.0732 6184 UmPass - ok

14:56:15.0751 6184 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll

14:56:15.0753 6184 upnphost - ok

14:56:15.0801 6184 [ AF1B9474D67897D0C2CFF58E0ACEACCC ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys

14:56:15.0802 6184 USBAAPL64 - ok

14:56:15.0851 6184 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys

14:56:15.0851 6184 usbaudio - ok

14:56:15.0865 6184 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys

14:56:15.0866 6184 usbccgp - ok

14:56:15.0908 6184 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys

14:56:15.0908 6184 usbcir - ok

14:56:15.0934 6184 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys

14:56:15.0934 6184 usbehci - ok

14:56:15.0978 6184 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys

14:56:15.0979 6184 usbhub - ok

14:56:16.0008 6184 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys

14:56:16.0008 6184 usbohci - ok

14:56:16.0033 6184 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys

14:56:16.0033 6184 usbprint - ok

14:56:16.0052 6184 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS

14:56:16.0053 6184 USBSTOR - ok

14:56:16.0075 6184 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys

14:56:16.0076 6184 usbuhci - ok

14:56:16.0095 6184 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll

14:56:16.0096 6184 UxSms - ok

14:56:16.0108 6184 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe

14:56:16.0109 6184 VaultSvc - ok

14:56:16.0149 6184 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys

14:56:16.0150 6184 vdrvroot - ok

14:56:16.0232 6184 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe

14:56:16.0234 6184 vds - ok

14:56:16.0246 6184 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys

14:56:16.0246 6184 vga - ok

14:56:16.0277 6184 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys

14:56:16.0277 6184 VgaSave - ok

14:56:16.0306 6184 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys

14:56:16.0307 6184 vhdmp - ok

14:56:16.0323 6184 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys

14:56:16.0324 6184 viaide - ok

14:56:16.0335 6184 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys

14:56:16.0335 6184 volmgr - ok

14:56:16.0369 6184 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys

14:56:16.0371 6184 volmgrx - ok

14:56:16.0385 6184 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys

14:56:16.0386 6184 volsnap - ok

14:56:16.0399 6184 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys

14:56:16.0399 6184 vsmraid - ok

14:56:16.0460 6184 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe

14:56:16.0466 6184 VSS - ok

14:56:16.0485 6184 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys

14:56:16.0485 6184 vwifibus - ok

14:56:16.0514 6184 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll

14:56:16.0516 6184 W32Time - ok

14:56:16.0554 6184 [ 7CB1898A29188FB8DB102406EF0D8D9E ] WacHidRouter C:\Windows\system32\DRIVERS\wachidrouter.sys

14:56:16.0555 6184 WacHidRouter - ok

14:56:16.0556 6184 WacomPen - ok

14:56:16.0590 6184 [ B59EC4DD1026F059CD95C1627562F3F3 ] wacomrouterfilter C:\Windows\system32\DRIVERS\wacomrouterfilter.sys

14:56:16.0590 6184 wacomrouterfilter - ok

14:56:16.0634 6184 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys

14:56:16.0635 6184 WANARP - ok

14:56:16.0637 6184 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys

14:56:16.0637 6184 Wanarpv6 - ok

14:56:16.0675 6184 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe

14:56:16.0680 6184 WatAdminSvc - ok

14:56:16.0724 6184 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe

14:56:16.0730 6184 wbengine - ok

14:56:16.0759 6184 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll

14:56:16.0761 6184 WbioSrvc - ok

14:56:16.0800 6184 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll

14:56:16.0802 6184 wcncsvc - ok

14:56:16.0814 6184 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

14:56:16.0815 6184 WcsPlugInService - ok

14:56:16.0843 6184 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys

14:56:16.0843 6184 Wd - ok

14:56:16.0893 6184 [ A3D04EBF5227886029B4532F20D026F7 ] WDC_SAM C:\Windows\system32\DRIVERS\wdcsam64.sys

14:56:16.0893 6184 WDC_SAM - ok

14:56:16.0939 6184 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys

14:56:16.0941 6184 Wdf01000 - ok

14:56:16.0949 6184 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll

14:56:16.0950 6184 WdiServiceHost - ok

14:56:16.0952 6184 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll

14:56:16.0953 6184 WdiSystemHost - ok

14:56:16.0999 6184 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll

14:56:17.0001 6184 WebClient - ok

14:56:17.0023 6184 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll

14:56:17.0024 6184 Wecsvc - ok

14:56:17.0032 6184 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll

14:56:17.0033 6184 wercplsupport - ok

14:56:17.0049 6184 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll

14:56:17.0050 6184 WerSvc - ok

14:56:17.0076 6184 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys

14:56:17.0076 6184 WfpLwf - ok

14:56:17.0087 6184 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys

14:56:17.0087 6184 WIMMount - ok

14:56:17.0093 6184 WinDefend - ok

14:56:17.0096 6184 WinHttpAutoProxySvc - ok

14:56:17.0133 6184 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll

14:56:17.0134 6184 Winmgmt - ok

14:56:17.0219 6184 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll

14:56:17.0226 6184 WinRM - ok

14:56:17.0284 6184 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys

14:56:17.0284 6184 WinUsb - ok

14:56:17.0320 6184 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll

14:56:17.0324 6184 Wlansvc - ok

14:56:17.0429 6184 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

14:56:17.0437 6184 wlidsvc - ok

14:56:17.0472 6184 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys

14:56:17.0472 6184 WmiAcpi - ok

14:56:17.0502 6184 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe

14:56:17.0503 6184 wmiApSrv - ok

14:56:17.0560 6184 WMPNetworkSvc - ok

14:56:17.0590 6184 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll

14:56:17.0591 6184 WPCSvc - ok

14:56:17.0647 6184 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll

14:56:17.0649 6184 WPDBusEnum - ok

14:56:17.0683 6184 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys

14:56:17.0683 6184 ws2ifsl - ok

14:56:17.0703 6184 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll

14:56:17.0704 6184 wscsvc - ok

14:56:17.0706 6184 WSearch - ok

14:56:17.0780 6184 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll

14:56:17.0789 6184 wuauserv - ok

14:56:17.0823 6184 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys

14:56:17.0824 6184 WudfPf - ok

14:56:17.0874 6184 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys

14:56:17.0875 6184 WUDFRd - ok

14:56:17.0910 6184 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll

14:56:17.0912 6184 wudfsvc - ok

14:56:17.0964 6184 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll

14:56:17.0966 6184 WwanSvc - ok

14:56:18.0062 6184 X6va005 - ok

14:56:18.0152 6184 [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

14:56:18.0154 6184 YahooAUService - ok

14:56:18.0161 6184 ================ Scan global ===============================

14:56:18.0176 6184 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

14:56:18.0210 6184 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll

14:56:18.0215 6184 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll

14:56:18.0235 6184 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

14:56:18.0247 6184 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

14:56:18.0248 6184 [Global] - ok

14:56:18.0249 6184 ================ Scan MBR ==================================

14:56:18.0250 6184 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

14:56:18.0253 6184 \Device\Harddisk0\DR0 - ok

14:56:18.0254 6184 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1

14:56:18.0256 6184 \Device\Harddisk1\DR1 - ok

14:56:18.0262 6184 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2

14:56:18.0263 6184 Suspicious mbr (Forged): \Device\Harddisk2\DR2

14:56:18.0328 6184 \Device\Harddisk2\DR2 ( Rootkit.Boot.Pihar.c ) - infected

14:56:18.0328 6184 \Device\Harddisk2\DR2 - detected Rootkit.Boot.Pihar.c (0)

14:56:18.0328 6184 ================ Scan VBR ==================================

14:56:18.0330 6184 [ A80D245D8195F033687356E2DF8192FD ] \Device\Harddisk0\DR0\Partition1

14:56:18.0331 6184 \Device\Harddisk0\DR0\Partition1 - ok

14:56:18.0333 6184 [ 6BC2F79692F5FC05AD218EB4F7043E75 ] \Device\Harddisk1\DR1\Partition1

14:56:18.0334 6184 \Device\Harddisk1\DR1\Partition1 - ok

14:56:18.0335 6184 [ 26C0867F5037620F16DDA73962CC25F5 ] \Device\Harddisk2\DR2\Partition1

14:56:18.0336 6184 \Device\Harddisk2\DR2\Partition1 - ok

14:56:18.0342 6184 [ FD89F2BBB09886EA3AED76C2DC78189A ] \Device\Harddisk2\DR2\Partition2

14:56:18.0343 6184 \Device\Harddisk2\DR2\Partition2 - ok

14:56:18.0343 6184 ============================================================

14:56:18.0343 6184 Scan finished

14:56:18.0343 6184 ============================================================

14:56:18.0348 3200 Detected object count: 1

14:56:18.0348 3200 Actual detected object count: 1

14:56:36.0271 3200 \Device\Harddisk2\DR2\# - copied to quarantine

14:56:36.0272 3200 \Device\Harddisk2\DR2 - copied to quarantine

14:56:36.0314 3200 \Device\Harddisk2\DR2\TDLFS\cmd.dll - copied to quarantine

14:56:36.0315 3200 \Device\Harddisk2\DR2\TDLFS\cmd64.dll - copied to quarantine

14:56:36.0330 3200 \Device\Harddisk2\DR2\TDLFS\drv32 - copied to quarantine

14:56:36.0338 3200 \Device\Harddisk2\DR2\TDLFS\drv64 - copied to quarantine

14:56:36.0338 3200 \Device\Harddisk2\DR2\TDLFS\servers.dat - copied to quarantine

14:56:36.0339 3200 \Device\Harddisk2\DR2\TDLFS\config.ini - copied to quarantine

14:56:36.0340 3200 \Device\Harddisk2\DR2\TDLFS\ldr16 - copied to quarantine

14:56:36.0341 3200 \Device\Harddisk2\DR2\TDLFS\ldr32 - copied to quarantine

14:56:36.0343 3200 \Device\Harddisk2\DR2\TDLFS\ldr64 - copied to quarantine

14:56:36.0344 3200 \Device\Harddisk2\DR2\TDLFS\s - copied to quarantine

14:56:36.0344 3200 \Device\Harddisk2\DR2\TDLFS\ldrm - copied to quarantine

14:56:36.0345 3200 \Device\Harddisk2\DR2\TDLFS\u - copied to quarantine

14:56:36.0396 3200 \Device\Harddisk2\DR2 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot

14:56:36.0494 3200 \Device\Harddisk2\DR2 - ok

14:56:36.0497 3200 \Device\Harddisk2\DR2 ( Rootkit.Boot.Pihar.c ) - User select action: Cure

14:56:44.0787 6520 Deinitialize success

asw

Run date: 2012-11-18 15:03:05

-----------------------------

15:03:05.222 OS Version: Windows x64 6.1.7601 Service Pack 1

15:03:05.222 Number of processors: 8 586 0x1A05

15:03:05.222 ComputerName: BEAST UserName: Aaron

15:03:06.356 Initialize success

15:05:10.131 AVAST engine defs: 12111801

15:07:52.481 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2

15:07:52.482 Disk 0 Vendor: ST1000DL002-9TT153 CC32 Size: 953869MB BusType: 3

15:07:52.484 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-3

15:07:52.485 Disk 1 Vendor: ST1000DL002-9TT153 CC32 Size: 953869MB BusType: 3

15:07:52.487 Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP4T0L0-5

15:07:52.489 Disk 2 Vendor: Hitachi_HDS721050CLA362 JP2OA3MA Size: 476940MB BusType: 3

15:07:52.499 Disk 2 MBR read successfully

15:07:52.501 Disk 2 MBR scan

15:07:52.504 Disk 2 Windows 7 default MBR code

15:07:52.506 Disk 2 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

15:07:52.520 Disk 2 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848

15:07:52.536 Disk 2 scanning C:\Windows\system32\drivers

15:08:01.355 Service scanning

15:08:23.940 Modules scanning

15:08:23.947 Disk 2 trace - called modules:

15:08:23.964 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys

15:08:23.967 1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa800af0f060]

15:08:23.970 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa800abbc520]

15:08:23.974 5 ACPI.sys[fffff8800100b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-5[0xfffffa800abab680]

15:08:25.248 AVAST engine scan C:\Windows

15:08:28.014 AVAST engine scan C:\Windows\system32

15:11:07.023 AVAST engine scan C:\Windows\system32\drivers

15:11:17.365 AVAST engine scan C:\Users\Aaron

15:12:10.740 Disk 2 MBR has been saved successfully to "C:\Users\Aaron\Desktop\MBR.dat"

15:12:10.745 The log file has been saved successfully to "C:\Users\Aaron\Desktop\aswMBR.txt"

gringo_pr · November 19, 2012

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

JKDGuy · November 19, 2012

alright, here's the next log report from combofix with CFScript dragged on to it!

ComboFix 12-11-16.02 - Aaron 11/18/2012 19:07:26.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.10098 [GMT -8:00]

Running from: c:\users\Aaron\Desktop\ComboFix.exe

Command switches used :: c:\users\Aaron\Desktop\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-19 to 2012-11-19 )))))))))))))))))))))))))))))))

.

2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\programdata\eSellerate

2051-12-02 05:00 . 2051-12-02 05:00 -------- d-----w- c:\program files (x86)\Common Files\eSellerate

2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files\NewBlue

2051-12-02 04:59 . 2051-12-02 05:15 -------- d-----w- c:\program files (x86)\NewBlue

2012-11-19 03:17 . 2012-11-19 03:17 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-18 22:56 . 2012-11-18 22:56 -------- d-----w- C:\TDSSKiller_Quarantine