I'm infected - please help!

apadgett21 · December 9, 2012

Good day. I've become infected and have attempted self-help forums to no avail. I have tried numerous scanners and see no difference. Please help. Logs attached.

Thanks! ;]

attach.txt

dds.txt

gringo_pr · December 9, 2012

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

apadgett21 · December 9, 2012

Hi, Gringo and thanks for the prompt reply! I successfully downloaded and ran Security Check, log below. I ran AdwCleaner which seemed like it was working but never produced a log. I tried downloading again and received an error, see attachment cannot save error. I then tried downloading RogueKiller and could not due to another error, see attachment cannot save error 2.

Results of screen317's Security Check version 0.99.56

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

AVG Anti-Virus Free Edition 2013

COMODO Antivirus

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

Java 7 Update 7

Java version out of Date!

Adobe Reader 9 Adobe Reader out of Date!

````````Process Check: objlist.exe by Laurent````````

AVG avgwdsvc.exe

Comodo Firewall cmdagent.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

gringo_pr · December 9, 2012

which browser are you using to download them - use IE

apadgett21 · December 9, 2012

I am using IE.

gringo_pr · December 10, 2012

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

apadgett21 · December 10, 2012

Please see ComboFix log below. Initially, the computer was excruciatingly slow and would occassionally BSOD pertaining to doing a memory dump. Running decent now. Next steps? In the meantime, thanks!! ;]

ComboFix 12-12-07.01 - Berto 12/09/2012 22:55:42.1.1 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1791.904 [GMT -5:00]

Running from: c:\users\Berto\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\ism_0_llatsni.pad

c:\programdata\Microsoft\Windows\DRM\DC82.tmp

c:\windows\svchost.exe

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

.

((((((((((((((((((((((((( Files Created from 2012-11-10 to 2012-12-10 )))))))))))))))))))))))))))))))

.

2012-12-10 04:04 . 2012-12-10 04:04 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-12-10 04:04 . 2012-12-10 04:04 -------- d-----w- c:\users\my stuff\AppData\Local\temp

2012-12-10 04:04 . 2012-12-10 04:04 -------- d-----w- c:\users\Guest\AppData\Local\temp

2012-12-10 04:04 . 2012-12-10 04:04 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-08 21:48 . 2012-12-08 21:48 0 ----a-w- c:\windows\SysWow64\shoF78B.tmp

2012-12-08 03:50 . 2012-12-08 03:50 -------- d-----w- C:\TDSSKiller_Quarantine

2012-12-04 02:51 . 2012-12-04 02:51 -------- d-----w- c:\users\Berto\AppData\Roaming\SUPERAntiSpyware.com

2012-12-04 02:50 . 2012-12-04 02:51 -------- d-----w- c:\program files\SUPERAntiSpyware

2012-12-04 02:50 . 2012-12-04 02:50 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2012-12-04 02:25 . 2012-12-04 23:04 -------- d-----w- c:\programdata\CPA_VA

2012-12-03 23:03 . 2012-12-10 03:46 -------- d-----w- c:\programdata\Comodo

2012-12-03 22:51 . 2012-12-03 22:51 -------- d-----w- c:\users\Berto\AppData\Local\Comodo

2012-12-03 22:51 . 2012-12-04 23:04 -------- d-----w- c:\program files (x86)\Comodo

2012-12-03 22:51 . 2012-12-03 22:51 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll

2012-12-03 22:51 . 2012-12-03 22:51 1700352 ----a-w- c:\windows\SysWow64\gdiplus.dll

2012-11-21 17:39 . 2012-11-21 17:39 -------- d-----w- c:\users\Berto\AppData\Local\SCE

2012-11-21 17:39 . 2012-11-21 17:39 -------- d-----w- C:\Crash

2012-11-21 17:39 . 2012-11-21 17:39 -------- d-----w- c:\users\Berto\AppData\Local\Sony Online Entertainment

2012-11-21 17:37 . 2010-06-02 09:55 77656 ----a-w- c:\windows\system32\XAPOFX1_5.dll

2012-11-21 17:37 . 2010-06-02 09:55 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_5.dll

2012-11-21 17:37 . 2010-06-02 09:55 527192 ----a-w- c:\windows\SysWow64\XAudio2_7.dll

2012-11-21 17:37 . 2010-06-02 09:55 518488 ----a-w- c:\windows\system32\XAudio2_7.dll

2012-11-21 17:37 . 2010-06-02 09:55 239960 ----a-w- c:\windows\SysWow64\xactengine3_7.dll

2012-11-21 17:37 . 2010-06-02 09:55 176984 ----a-w- c:\windows\system32\xactengine3_7.dll

2012-11-21 17:37 . 2010-05-26 16:41 2526056 ----a-w- c:\windows\system32\D3DCompiler_43.dll

2012-11-21 17:37 . 2010-05-26 16:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 1907552 ----a-w- c:\windows\system32\d3dcsx_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 511328 ----a-w- c:\windows\system32\d3dx10_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll

2012-11-21 17:36 . 2010-05-26 16:41 2401112 ----a-w- c:\windows\system32\D3DX9_43.dll

2012-11-21 17:35 . 2012-11-21 17:35 -------- d-----w- c:\users\Public\Sony Online Entertainment

2012-11-16 04:41 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

2012-11-16 04:41 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-11-16 04:41 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-11-16 04:41 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-11-16 04:29 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-11-16 04:29 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-11-16 04:29 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-11-16 04:29 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-11-16 04:29 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-11-16 04:29 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

2012-11-16 04:29 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

2012-11-15 08:20 . 2012-10-09 18:17 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

2012-11-15 08:20 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

2012-11-15 08:20 . 2012-10-09 17:40 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

2012-11-15 08:20 . 2012-10-09 17:40 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

2012-11-15 08:20 . 2012-10-18 18:25 3149824 ----a-w- c:\windows\system32\win32k.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-16 04:30 . 2011-02-26 01:09 66395536 ----a-w- c:\windows\system32\MRT.exe

2012-10-16 08:38 . 2012-11-28 08:56 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-28 08:56 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-28 08:56 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-10-09 20:55 . 2012-04-10 02:52 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-09 20:55 . 2012-04-10 02:52 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-09-29 23:54 . 2012-10-18 23:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-22 22:49 . 2012-09-22 22:49 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-09-22 22:49 . 2012-09-22 22:50 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-09-14 19:19 . 2012-10-10 20:23 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-14 18:28 . 2012-10-10 20:23 2048 ----a-w- c:\windows\SysWow64\tzres.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"Akamai NetSession Interface"="c:\users\Berto\AppData\Local\Akamai\netsession_win.exe" [2012-10-09 4441920]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 5629312]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

"OOTag"="c:\program files (x86)\eMachines\OOBEOffer\OOTag.exe" [2010-02-23 13856]

"D-Link D-Link DWA-125"="c:\program files (x86)\D-Link\DWA-125 revA\AirGCFG.exe" [2009-10-20 995328]

"WZCSLDR2"="c:\program files (x86)\D-Link\DWA-125 revA\WZCSLDR2.exe" [2009-10-19 122880]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20110303.001\IDSvia64.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 D_Link_DWA-125;D_Link_DWA-125 Service;c:\program files (x86)\D-Link\DWA-125 revA\ANIWZCSdS.exe [2009-08-21 126976]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 36328]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-09-03 227232]

R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2012-06-18 19032]

R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2012-06-18 12384]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-26 1255736]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]

R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]

R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]

S1 anodlwf;ANOD Network Security Filter driver;c:\windows\system32\DRIVERS\anodlwfx.sys [2009-03-06 15872]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 D_Link_DWA-125_WPS;D_Link_DWA-125_WPS Service;c:\program files (x86)\D-Link\DWA-125 revA\ANIWConnService.exe [2009-07-08 40960]

S2 Greg_Service;GRegService;c:\program files (x86)\eMachines\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [2010-01-28 243232]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-10 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 20:55]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-09 10060320]

"OOTag"="c:\program files (x86)\eMachines\OOBEOffer\ootag.exe" [2010-02-23 13856]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=el1352g&r=17361110m103p0444v155r4751t229

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=el1352g&r=17361110m103p0444v155r4751t229

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{CE8789A5-E15B-4335-B643-5CE18BC80551}: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

SafeBoot-29779828.sys

Toolbar-Locked - (no file)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_ce5ba24.dll"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va009]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va011]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,

36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:f8,e0,8e,ec,4c,d0,cd,01

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-12-09 23:14:33

ComboFix-quarantined-files.txt 2012-12-10 04:14

.

Pre-Run: 62,955,446,272 bytes free

Post-Run: 64,086,323,200 bytes free

.

- - End Of File - - D530E67671DF1CE7EAEFCC8796A5BEC3

gringo_pr · December 10, 2012

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

apadgett21 · December 10, 2012

00:24:55.0675 3748 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

00:24:56.0111 3748 ============================================================

00:24:56.0111 3748 Current date / time: 2012/12/10 00:24:56.0111

00:24:56.0111 3748 SystemInfo:

00:24:56.0111 3748

00:24:56.0111 3748 OS Version: 6.1.7601 ServicePack: 1.0

00:24:56.0111 3748 Product type: Workstation

00:24:56.0111 3748 ComputerName: MYSHIT-PC

00:24:56.0155 3748 UserName: Berto

00:24:56.0155 3748 Windows directory: C:\windows

00:24:56.0155 3748 System windows directory: C:\windows

00:24:56.0155 3748 Running under WOW64

00:24:56.0155 3748 Processor architecture: Intel x64

00:24:56.0155 3748 Number of processors: 1

00:24:56.0155 3748 Page size: 0x1000

00:24:56.0155 3748 Boot type: Normal boot

00:24:56.0155 3748 ============================================================

00:24:59.0172 3748 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

00:24:59.0181 3748 ============================================================

00:24:59.0181 3748 \Device\Harddisk0\DR0:

00:24:59.0181 3748 MBR partitions:

00:24:59.0181 3748 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1E00800, BlocksNum 0x32000

00:24:59.0181 3748 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E32800, BlocksNum 0x38553000

00:24:59.0181 3748 ============================================================

00:24:59.0202 3748 C: <-> \Device\Harddisk0\DR0\Partition2

00:24:59.0203 3748 ============================================================

00:24:59.0203 3748 Initialize success

00:24:59.0203 3748 ============================================================

00:25:03.0438 3136 ============================================================

00:25:03.0438 3136 Scan started

00:25:03.0438 3136 Mode: Manual;

00:25:03.0438 3136 ============================================================

00:25:09.0001 3136 ================ Scan system memory ========================

00:25:09.0001 3136 System memory - ok

00:25:09.0003 3136 ================ Scan services =============================

00:25:09.0166 3136 [ 581D88B25C4D4121824FED2CA38E562F ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

00:25:09.0169 3136 !SASCORE - ok

00:25:09.0391 3136 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys

00:25:09.0399 3136 1394ohci - ok

00:25:09.0479 3136 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys

00:25:09.0479 3136 ACPI - ok

00:25:09.0529 3136 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys

00:25:09.0529 3136 AcpiPmi - ok

00:25:09.0805 3136 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

00:25:09.0809 3136 AdobeFlashPlayerUpdateSvc - ok

00:25:09.0855 3136 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\DRIVERS\adp94xx.sys

00:25:09.0875 3136 adp94xx - ok

00:25:09.0945 3136 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\DRIVERS\adpahci.sys

00:25:09.0952 3136 adpahci - ok

00:25:09.0984 3136 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\DRIVERS\adpu320.sys

00:25:09.0987 3136 adpu320 - ok

00:25:10.0017 3136 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll

00:25:10.0017 3136 AeLookupSvc - ok

00:25:10.0119 3136 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys

00:25:10.0124 3136 AFD - ok

00:25:10.0169 3136 [ 2173E070647AC68C16B8214FE5C05EC3 ] AGERESoftModem C:\windows\system32\DRIVERS\agrsm64.sys

00:25:10.0291 3136 AGERESoftModem - ok

00:25:10.0361 3136 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys

00:25:10.0362 3136 agp440 - ok

00:25:10.0574 3136 [ B9B98E08EC127900025F42462D3D0A66 ] Akamai c:\program files (x86)\common files\akamai/netsession_win_ce5ba24.dll

00:25:10.0574 3136 Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_ce5ba24.dll. md5: B9B98E08EC127900025F42462D3D0A66

00:25:10.0584 3136 Akamai ( HiddenFile.Multi.Generic ) - warning

00:25:10.0585 3136 Akamai - detected HiddenFile.Multi.Generic (1)

00:25:10.0618 3136 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\windows\System32\alg.exe

00:25:10.0619 3136 ALG - ok

00:25:10.0699 3136 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys

00:25:10.0699 3136 aliide - ok

00:25:10.0718 3136 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys

00:25:10.0719 3136 amdide - ok

00:25:10.0763 3136 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\DRIVERS\amdk8.sys

00:25:10.0764 3136 AmdK8 - ok

00:25:10.0807 3136 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\DRIVERS\amdppm.sys

00:25:10.0808 3136 AmdPPM - ok

00:25:10.0840 3136 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys

00:25:10.0869 3136 amdsata - ok

00:25:10.0902 3136 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\DRIVERS\amdsbs.sys

00:25:10.0905 3136 amdsbs - ok

00:25:10.0927 3136 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys

00:25:10.0928 3136 amdxata - ok

00:25:11.0001 3136 [ 4DE0D5D747A73797C95A97DCCE5018B5 ] androidusb C:\windows\system32\Drivers\ssadadb.sys

00:25:11.0031 3136 androidusb - ok

00:25:11.0123 3136 [ 4CCF421E6C4B2A4CBCE000715911F7CC ] anodlwf C:\windows\system32\DRIVERS\anodlwfx.sys

00:25:11.0123 3136 anodlwf - ok

00:25:11.0197 3136 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys

00:25:11.0198 3136 AppID - ok

00:25:11.0222 3136 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll

00:25:11.0223 3136 AppIDSvc - ok

00:25:11.0295 3136 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\windows\System32\appinfo.dll

00:25:11.0295 3136 Appinfo - ok

00:25:11.0345 3136 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\DRIVERS\arc.sys

00:25:11.0345 3136 arc - ok

00:25:11.0365 3136 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\DRIVERS\arcsas.sys

00:25:11.0365 3136 arcsas - ok

00:25:11.0411 3136 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys

00:25:11.0412 3136 AsyncMac - ok

00:25:11.0490 3136 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys

00:25:11.0491 3136 atapi - ok

00:25:11.0574 3136 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll

00:25:11.0580 3136 AudioEndpointBuilder - ok

00:25:11.0589 3136 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll

00:25:11.0599 3136 AudioSrv - ok

00:25:11.0674 3136 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll

00:25:11.0676 3136 AxInstSV - ok

00:25:11.0724 3136 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\DRIVERS\bxvbda.sys

00:25:11.0729 3136 b06bdrv - ok

00:25:11.0750 3136 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys

00:25:11.0753 3136 b57nd60a - ok

00:25:11.0797 3136 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll

00:25:11.0799 3136 BDESVC - ok

00:25:11.0821 3136 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys

00:25:11.0838 3136 Beep - ok

00:25:11.0999 3136 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll

00:25:12.0008 3136 BFE - ok

00:25:12.0055 3136 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\system32\qmgr.dll

00:25:12.0065 3136 BITS - ok

00:25:12.0131 3136 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys

00:25:12.0132 3136 blbdrive - ok

00:25:12.0194 3136 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys

00:25:12.0195 3136 bowser - ok

00:25:12.0221 3136 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\DRIVERS\BrFiltLo.sys

00:25:12.0223 3136 BrFiltLo - ok

00:25:12.0232 3136 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\DRIVERS\BrFiltUp.sys

00:25:12.0233 3136 BrFiltUp - ok

00:25:12.0253 3136 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\windows\system32\DRIVERS\bridge.sys

00:25:12.0254 3136 BridgeMP - ok

00:25:12.0313 3136 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll

00:25:12.0313 3136 Browser - ok

00:25:12.0343 3136 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys

00:25:12.0343 3136 Brserid - ok

00:25:12.0369 3136 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys

00:25:12.0370 3136 BrSerWdm - ok

00:25:12.0387 3136 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys

00:25:12.0387 3136 BrUsbMdm - ok

00:25:12.0395 3136 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys

00:25:12.0395 3136 BrUsbSer - ok

00:25:12.0409 3136 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\DRIVERS\bthmodem.sys

00:25:12.0411 3136 BTHMODEM - ok

00:25:12.0449 3136 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll

00:25:12.0451 3136 bthserv - ok

00:25:12.0488 3136 catchme - ok

00:25:12.0510 3136 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys

00:25:12.0511 3136 cdfs - ok

00:25:12.0595 3136 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\drivers\cdrom.sys

00:25:12.0595 3136 cdrom - ok

00:25:12.0697 3136 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll

00:25:12.0697 3136 CertPropSvc - ok

00:25:12.0737 3136 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\DRIVERS\circlass.sys

00:25:12.0737 3136 circlass - ok

00:25:12.0809 3136 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys

00:25:12.0813 3136 CLFS - ok

00:25:12.0889 3136 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

00:25:12.0889 3136 clr_optimization_v2.0.50727_32 - ok

00:25:13.0001 3136 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

00:25:13.0001 3136 clr_optimization_v2.0.50727_64 - ok

00:25:13.0193 3136 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

00:25:13.0203 3136 clr_optimization_v4.0.30319_32 - ok

00:25:13.0265 3136 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

00:25:13.0268 3136 clr_optimization_v4.0.30319_64 - ok

00:25:13.0303 3136 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys

00:25:13.0304 3136 CmBatt - ok

00:25:13.0365 3136 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys

00:25:13.0365 3136 cmdide - ok

00:25:13.0437 3136 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\windows\system32\Drivers\cng.sys

00:25:13.0437 3136 CNG - ok

00:25:13.0467 3136 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\DRIVERS\compbatt.sys

00:25:13.0467 3136 Compbatt - ok

00:25:13.0503 3136 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\drivers\CompositeBus.sys

00:25:13.0504 3136 CompositeBus - ok

00:25:13.0539 3136 COMSysApp - ok

00:25:13.0575 3136 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\DRIVERS\crcdisk.sys

00:25:13.0577 3136 crcdisk - ok

00:25:13.0705 3136 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\windows\system32\cryptsvc.dll

00:25:13.0710 3136 CryptSvc - ok

00:25:13.0979 3136 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

00:25:13.0988 3136 cvhsvc - ok

00:25:14.0132 3136 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll

00:25:14.0139 3136 DcomLaunch - ok

00:25:14.0169 3136 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll

00:25:14.0173 3136 defragsvc - ok

00:25:14.0259 3136 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys

00:25:14.0279 3136 DfsC - ok

00:25:14.0401 3136 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll

00:25:14.0407 3136 Dhcp - ok

00:25:14.0429 3136 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\windows\system32\drivers\discache.sys

00:25:14.0430 3136 discache - ok

00:25:14.0453 3136 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\windows\system32\DRIVERS\disk.sys

00:25:14.0463 3136 Disk - ok

00:25:14.0563 3136 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\windows\System32\dnsrslvr.dll

00:25:14.0565 3136 Dnscache - ok

00:25:14.0666 3136 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\windows\System32\dot3svc.dll

00:25:14.0669 3136 dot3svc - ok

00:25:14.0727 3136 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\windows\system32\dps.dll

00:25:14.0727 3136 DPS - ok

00:25:14.0806 3136 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\windows\system32\drivers\drmkaud.sys

00:25:14.0829 3136 drmkaud - ok

00:25:14.0909 3136 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys

00:25:14.0920 3136 DXGKrnl - ok

00:25:15.0022 3136 [ F195FBC375342BD25C936982245A8FB0 ] D_Link_DWA-125 C:\Program Files (x86)\D-Link\DWA-125 revA\ANIWZCSdS.exe

00:25:15.0024 3136 D_Link_DWA-125 - ok

00:25:15.0042 3136 [ 4DB0907D750E0810309F8D8FA36625A6 ] D_Link_DWA-125_WPS C:\Program Files (x86)\D-Link\DWA-125 revA\ANIWConnService.exe

00:25:15.0043 3136 D_Link_DWA-125_WPS - ok

00:25:15.0066 3136 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\windows\System32\eapsvc.dll

00:25:15.0070 3136 EapHost - ok

00:25:15.0143 3136 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\windows\system32\DRIVERS\evbda.sys

00:25:15.0180 3136 ebdrv - ok

00:25:15.0239 3136 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\windows\System32\lsass.exe

00:25:15.0240 3136 EFS - ok

00:25:15.0354 3136 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\windows\ehome\ehRecvr.exe

00:25:15.0361 3136 ehRecvr - ok

00:25:15.0418 3136 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\windows\ehome\ehsched.exe

00:25:15.0420 3136 ehSched - ok

00:25:15.0453 3136 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\windows\system32\DRIVERS\elxstor.sys

00:25:15.0459 3136 elxstor - ok

00:25:15.0519 3136 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\windows\system32\drivers\errdev.sys

00:25:15.0520 3136 ErrDev - ok

00:25:15.0601 3136 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\windows\system32\es.dll

00:25:15.0605 3136 EventSystem - ok

00:25:15.0709 3136 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\windows\system32\drivers\exfat.sys

00:25:15.0751 3136 exfat - ok

00:25:15.0865 3136 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\windows\system32\drivers\fastfat.sys

00:25:15.0873 3136 fastfat - ok

00:25:16.0005 3136 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\windows\system32\fxssvc.exe

00:25:16.0015 3136 Fax - ok

00:25:16.0045 3136 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\windows\system32\DRIVERS\fdc.sys

00:25:16.0045 3136 fdc - ok

00:25:16.0125 3136 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\windows\system32\fdPHost.dll

00:25:16.0142 3136 fdPHost - ok

00:25:16.0161 3136 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\windows\system32\fdrespub.dll

00:25:16.0165 3136 FDResPub - ok

00:25:16.0184 3136 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\windows\system32\drivers\fileinfo.sys

00:25:16.0187 3136 FileInfo - ok

00:25:16.0197 3136 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\windows\system32\drivers\filetrace.sys

00:25:16.0207 3136 Filetrace - ok

00:25:16.0227 3136 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\windows\system32\DRIVERS\flpydisk.sys

00:25:16.0227 3136 flpydisk - ok

00:25:16.0330 3136 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\windows\system32\drivers\fltmgr.sys

00:25:16.0333 3136 FltMgr - ok

00:25:16.0419 3136 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\windows\system32\FntCache.dll

00:25:16.0463 3136 FontCache - ok

00:25:16.0531 3136 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

00:25:16.0531 3136 FontCache3.0.0.0 - ok

00:25:16.0663 3136 [ 52B58A46BEEFB238C580B69FD051CB5B ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

00:25:16.0673 3136 ForceWare Intelligent Application Manager (IAM) - ok

00:25:16.0703 3136 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\windows\system32\drivers\FsDepends.sys

00:25:16.0703 3136 FsDepends - ok

00:25:16.0778 3136 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys

00:25:16.0779 3136 Fs_Rec - ok

00:25:16.0899 3136 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\windows\system32\DRIVERS\fvevol.sys

00:25:16.0910 3136 fvevol - ok

00:25:16.0935 3136 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\windows\system32\DRIVERS\gagp30kx.sys

00:25:16.0937 3136 gagp30kx - ok

00:25:17.0059 3136 [ 6858C318E8DAA40E747E6FB9B214E104 ] GameConsoleService C:\Program Files (x86)\eMachines Games\eMachines Game Console\GameConsoleService.exe

00:25:17.0063 3136 GameConsoleService - ok

00:25:17.0150 3136 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\windows\System32\gpsvc.dll

00:25:17.0161 3136 gpsvc - ok

00:25:17.0219 3136 [ 816FD5A6F3C2F3D600900096632FC60E ] Greg_Service C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe

00:25:17.0229 3136 Greg_Service - ok

00:25:17.0259 3136 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys

00:25:17.0259 3136 hcw85cir - ok

00:25:17.0331 3136 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys

00:25:17.0331 3136 HdAudAddService - ok

00:25:17.0361 3136 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\windows\system32\drivers\HDAudBus.sys

00:25:17.0361 3136 HDAudBus - ok

00:25:17.0381 3136 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\windows\system32\DRIVERS\HidBatt.sys

00:25:17.0381 3136 HidBatt - ok

00:25:17.0398 3136 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\windows\system32\DRIVERS\hidbth.sys

00:25:17.0399 3136 HidBth - ok

00:25:17.0431 3136 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\windows\system32\DRIVERS\hidir.sys

00:25:17.0467 3136 HidIr - ok

00:25:17.0491 3136 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\windows\System32\hidserv.dll

00:25:17.0492 3136 hidserv - ok

00:25:17.0573 3136 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys

00:25:17.0573 3136 HidUsb - ok

00:25:17.0645 3136 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\windows\system32\kmsvc.dll

00:25:17.0645 3136 hkmsvc - ok

00:25:17.0720 3136 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll

00:25:17.0723 3136 HomeGroupListener - ok

00:25:17.0797 3136 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll

00:25:17.0797 3136 HomeGroupProvider - ok

00:25:17.0847 3136 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys

00:25:17.0848 3136 HpSAMD - ok

00:25:17.0920 3136 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\windows\system32\drivers\HTTP.sys

00:25:17.0928 3136 HTTP - ok

00:25:17.0989 3136 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys

00:25:17.0989 3136 hwpolicy - ok

00:25:18.0074 3136 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\windows\system32\drivers\i8042prt.sys

00:25:18.0077 3136 i8042prt - ok

00:25:18.0101 3136 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\windows\system32\drivers\iaStorV.sys

00:25:18.0111 3136 iaStorV - ok

00:25:18.0186 3136 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

00:25:18.0196 3136 idsvc - ok

00:25:18.0262 3136 IDSVia64 - ok

00:25:18.0287 3136 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\windows\system32\DRIVERS\iirsp.sys

00:25:18.0288 3136 iirsp - ok

00:25:18.0363 3136 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\windows\System32\ikeext.dll

00:25:18.0373 3136 IKEEXT - ok

00:25:18.0461 3136 [ 2E3B99E8C23BE2BF32EBE1DB5261F275 ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys

00:25:18.0483 3136 IntcAzAudAddService - ok

00:25:18.0502 3136 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\windows\system32\drivers\intelide.sys

00:25:18.0503 3136 intelide - ok

00:25:18.0544 3136 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys

00:25:18.0546 3136 intelppm - ok

00:25:18.0567 3136 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\windows\system32\ipbusenum.dll

00:25:18.0569 3136 IPBusEnum - ok

00:25:18.0635 3136 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys

00:25:18.0635 3136 IpFilterDriver - ok

00:25:18.0707 3136 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\windows\System32\iphlpsvc.dll

00:25:18.0717 3136 iphlpsvc - ok

00:25:18.0779 3136 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys

00:25:18.0779 3136 IPMIDRV - ok

00:25:18.0799 3136 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\windows\system32\drivers\ipnat.sys

00:25:18.0799 3136 IPNAT - ok

00:25:18.0819 3136 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\windows\system32\drivers\irenum.sys

00:25:18.0829 3136 IRENUM - ok

00:25:18.0839 3136 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\windows\system32\drivers\isapnp.sys

00:25:18.0839 3136 isapnp - ok

00:25:18.0870 3136 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys

00:25:18.0904 3136 iScsiPrt - ok

00:25:18.0941 3136 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys

00:25:18.0941 3136 kbdclass - ok

00:25:18.0971 3136 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\windows\system32\DRIVERS\kbdhid.sys

00:25:18.0971 3136 kbdhid - ok

00:25:18.0981 3136 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\windows\system32\lsass.exe

00:25:18.0981 3136 KeyIso - ok

00:25:19.0046 3136 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys

00:25:19.0048 3136 KSecDD - ok

00:25:19.0113 3136 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys

00:25:19.0113 3136 KSecPkg - ok

00:25:19.0188 3136 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\windows\system32\drivers\ksthunk.sys

00:25:19.0193 3136 ksthunk - ok

00:25:19.0218 3136 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\windows\system32\msdtckrm.dll

00:25:19.0222 3136 KtmRm - ok

00:25:19.0295 3136 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\windows\System32\srvsvc.dll

00:25:19.0305 3136 LanmanServer - ok

00:25:19.0390 3136 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll

00:25:19.0397 3136 LanmanWorkstation - ok

00:25:19.0437 3136 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\windows\system32\DRIVERS\lltdio.sys

00:25:19.0437 3136 lltdio - ok

00:25:19.0512 3136 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\windows\System32\lltdsvc.dll

00:25:19.0520 3136 lltdsvc - ok

00:25:19.0537 3136 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\windows\System32\lmhsvc.dll

00:25:19.0539 3136 lmhosts - ok

00:25:19.0579 3136 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\windows\system32\DRIVERS\lsi_fc.sys

00:25:19.0579 3136 LSI_FC - ok

00:25:19.0589 3136 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\windows\system32\DRIVERS\lsi_sas.sys

00:25:19.0589 3136 LSI_SAS - ok

00:25:19.0655 3136 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\windows\system32\DRIVERS\lsi_sas2.sys

00:25:19.0657 3136 LSI_SAS2 - ok

00:25:19.0665 3136 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\windows\system32\DRIVERS\lsi_scsi.sys

00:25:19.0668 3136 LSI_SCSI - ok

00:25:19.0697 3136 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\windows\system32\drivers\luafv.sys

00:25:19.0701 3136 luafv - ok

00:25:19.0904 3136 [ FD3AD5E1ECDAA94A89D6697F5C5465D6 ] McComponentHostService C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe

00:25:19.0908 3136 McComponentHostService - ok

00:25:19.0974 3136 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll

00:25:19.0977 3136 Mcx2Svc - ok

00:25:19.0998 3136 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\windows\system32\DRIVERS\megasas.sys

00:25:19.0999 3136 megasas - ok

00:25:20.0013 3136 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\windows\system32\DRIVERS\MegaSR.sys

00:25:20.0018 3136 MegaSR - ok

00:25:20.0049 3136 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\windows\system32\mmcss.dll

00:25:20.0051 3136 MMCSS - ok

00:25:20.0072 3136 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\windows\system32\drivers\modem.sys

00:25:20.0073 3136 Modem - ok

00:25:20.0154 3136 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\windows\system32\DRIVERS\monitor.sys

00:25:20.0155 3136 monitor - ok

00:25:20.0178 3136 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\windows\system32\drivers\mouclass.sys

00:25:20.0179 3136 mouclass - ok

00:25:20.0222 3136 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys

00:25:20.0223 3136 mouhid - ok

00:25:20.0317 3136 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\windows\system32\drivers\mountmgr.sys

00:25:20.0319 3136 mountmgr - ok

00:25:20.0399 3136 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\windows\system32\drivers\mpio.sys

00:25:20.0401 3136 mpio - ok

00:25:20.0423 3136 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\windows\system32\drivers\mpsdrv.sys

00:25:20.0424 3136 mpsdrv - ok

00:25:20.0503 3136 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\windows\system32\mpssvc.dll

00:25:20.0503 3136 MpsSvc - ok

00:25:20.0578 3136 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys

00:25:20.0580 3136 MRxDAV - ok

00:25:20.0645 3136 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys

00:25:20.0645 3136 mrxsmb - ok

00:25:20.0724 3136 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys

00:25:20.0728 3136 mrxsmb10 - ok

00:25:20.0748 3136 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys

00:25:20.0749 3136 mrxsmb20 - ok

00:25:20.0772 3136 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\windows\system32\drivers\msahci.sys

00:25:20.0773 3136 msahci - ok

00:25:20.0817 3136 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\windows\system32\drivers\msdsm.sys

00:25:20.0827 3136 msdsm - ok

00:25:20.0889 3136 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\windows\System32\msdtc.exe

00:25:20.0891 3136 MSDTC - ok

00:25:20.0947 3136 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\windows\system32\drivers\Msfs.sys

00:25:20.0948 3136 Msfs - ok

00:25:20.0969 3136 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys

00:25:20.0969 3136 mshidkmdf - ok

00:25:21.0037 3136 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\windows\system32\drivers\msisadrv.sys

00:25:21.0038 3136 msisadrv - ok

00:25:21.0062 3136 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\windows\system32\iscsiexe.dll

00:25:21.0064 3136 MSiSCSI - ok

00:25:21.0073 3136 msiserver - ok

00:25:21.0155 3136 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys

00:25:21.0157 3136 MSKSSRV - ok

00:25:21.0178 3136 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys

00:25:21.0179 3136 MSPCLOCK - ok

00:25:21.0189 3136 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\windows\system32\drivers\MSPQM.sys

00:25:21.0189 3136 MSPQM - ok

00:25:21.0253 3136 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\windows\system32\drivers\MsRPC.sys

00:25:21.0253 3136 MsRPC - ok

00:25:21.0323 3136 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\windows\system32\drivers\mssmbios.sys

00:25:21.0323 3136 mssmbios - ok

00:25:21.0353 3136 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\windows\system32\drivers\MSTEE.sys

00:25:21.0353 3136 MSTEE - ok

00:25:21.0374 3136 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\windows\system32\DRIVERS\MTConfig.sys

00:25:21.0375 3136 MTConfig - ok

00:25:21.0394 3136 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\windows\system32\Drivers\mup.sys

00:25:21.0395 3136 Mup - ok

00:25:21.0464 3136 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\windows\system32\qagentRT.dll

00:25:21.0465 3136 napagent - ok

00:25:21.0505 3136 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys

00:25:21.0505 3136 NativeWifiP - ok

00:25:21.0585 3136 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\windows\system32\drivers\ndis.sys

00:25:21.0607 3136 NDIS - ok

00:25:21.0631 3136 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys

00:25:21.0632 3136 NdisCap - ok

00:25:21.0647 3136 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys

00:25:21.0647 3136 NdisTapi - ok

00:25:21.0717 3136 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys

00:25:21.0717 3136 Ndisuio - ok

00:25:21.0781 3136 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys

00:25:21.0784 3136 NdisWan - ok

00:25:21.0839 3136 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\windows\system32\drivers\NDProxy.sys

00:25:21.0839 3136 NDProxy - ok

00:25:21.0953 3136 [ 07A623D0892A91B9E6285C5723E2EDF1 ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

00:25:21.0963 3136 Nero BackItUp Scheduler 4.0 - ok

00:25:21.0998 3136 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys

00:25:21.0999 3136 NetBIOS - ok

00:25:22.0063 3136 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\windows\system32\DRIVERS\netbt.sys

00:25:22.0067 3136 NetBT - ok

00:25:22.0089 3136 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\windows\system32\lsass.exe

00:25:22.0090 3136 Netlogon - ok

00:25:22.0135 3136 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\windows\System32\netman.dll

00:25:22.0140 3136 Netman - ok

00:25:22.0160 3136 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\windows\System32\netprofm.dll

00:25:22.0165 3136 netprofm - ok

00:25:22.0250 3136 [ EED1FBDE98CF5F6D5C0C5B27AB1F68EC ] netr28ux C:\windows\system32\DRIVERS\Dnetr28ux.sys

00:25:22.0262 3136 netr28ux - ok

00:25:22.0308 3136 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

00:25:22.0309 3136 NetTcpPortSharing - ok

00:25:22.0360 3136 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\windows\system32\DRIVERS\nfrd960.sys

00:25:22.0361 3136 nfrd960 - ok

00:25:22.0435 3136 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\windows\System32\nlasvc.dll

00:25:22.0445 3136 NlaSvc - ok

00:25:22.0455 3136 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\windows\system32\drivers\Npfs.sys

00:25:22.0455 3136 Npfs - ok

00:25:22.0491 3136 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\windows\system32\nsisvc.dll

00:25:22.0493 3136 nsi - ok

00:25:22.0506 3136 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys

00:25:22.0507 3136 nsiproxy - ok

00:25:22.0553 3136 [ 20E179A7FE78B37A02D30C4D34C870E7 ] nSvcIp C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

00:25:22.0556 3136 nSvcIp - ok

00:25:22.0680 3136 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\windows\system32\drivers\Ntfs.sys

00:25:22.0689 3136 Ntfs - ok

00:25:22.0719 3136 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\windows\system32\drivers\Null.sys

00:25:22.0719 3136 Null - ok

00:25:22.0791 3136 [ A85B4F2EF3A7304A5399EF0526423040 ] NVENETFD C:\windows\system32\DRIVERS\nvm62x64.sys

00:25:22.0812 3136 NVENETFD - ok

00:25:23.0138 3136 [ 0EB204639119370F5F8F2871FBF4E14B ] nvlddmkm C:\windows\system32\DRIVERS\nvlddmkm.sys

00:25:23.0332 3136 nvlddmkm - ok

00:25:23.0403 3136 [ 0AD267A4674805B61A5D7B911D2A978A ] NVNET C:\windows\system32\DRIVERS\nvmf6264.sys

00:25:23.0409 3136 NVNET - ok

00:25:23.0439 3136 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\windows\system32\drivers\nvraid.sys

00:25:23.0441 3136 nvraid - ok

00:25:23.0501 3136 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\windows\system32\drivers\nvstor.sys

00:25:23.0501 3136 nvstor - ok

00:25:23.0575 3136 [ 1E45F96342429D63DC30E0D9117DA3D8 ] nvstor64 C:\windows\system32\DRIVERS\nvstor64.sys

00:25:23.0578 3136 nvstor64 - ok

00:25:23.0623 3136 [ 32FF8EE6DCEE5C0CB91FF892FB1CA364 ] nvsvc C:\Windows\system32\nvvsvc.exe

00:25:23.0623 3136 nvsvc - ok

00:25:23.0805 3136 [ BD012DC22C78BE1071BC21EB125D782F ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

00:25:23.0860 3136 nvUpdatusService - ok

00:25:23.0923 3136 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\windows\system32\drivers\nv_agp.sys

00:25:23.0925 3136 nv_agp - ok

00:25:23.0987 3136 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys

00:25:24.0030 3136 ohci1394 - ok

00:25:24.0099 3136 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

00:25:24.0099 3136 ose - ok

00:25:24.0241 3136 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

00:25:24.0413 3136 osppsvc - ok

00:25:24.0512 3136 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\windows\system32\pnrpsvc.dll

00:25:24.0518 3136 p2pimsvc - ok

00:25:24.0542 3136 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\windows\system32\p2psvc.dll

00:25:24.0558 3136 p2psvc - ok

00:25:24.0578 3136 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\windows\system32\DRIVERS\parport.sys

00:25:24.0580 3136 Parport - ok

00:25:24.0628 3136 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\windows\system32\drivers\partmgr.sys

00:25:24.0631 3136 partmgr - ok

00:25:24.0655 3136 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\windows\System32\pcasvc.dll

00:25:24.0655 3136 PcaSvc - ok

00:25:24.0773 3136 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\windows\system32\drivers\pci.sys

00:25:24.0779 3136 pci - ok

00:25:24.0790 3136 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\windows\system32\drivers\pciide.sys

00:25:24.0791 3136 pciide - ok

00:25:24.0827 3136 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\windows\system32\DRIVERS\pcmcia.sys

00:25:24.0827 3136 pcmcia - ok

00:25:24.0847 3136 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\windows\system32\drivers\pcw.sys

00:25:24.0888 3136 pcw - ok

00:25:24.0947 3136 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\windows\system32\drivers\peauth.sys

00:25:24.0953 3136 PEAUTH - ok

00:25:25.0034 3136 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\windows\SysWow64\perfhost.exe

00:25:25.0035 3136 PerfHost - ok

00:25:25.0123 3136 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\windows\system32\pla.dll

00:25:25.0205 3136 pla - ok

00:25:25.0275 3136 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\windows\system32\umpnpmgr.dll

00:25:25.0281 3136 PlugPlay - ok

00:25:25.0301 3136 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll

00:25:25.0302 3136 PNRPAutoReg - ok

00:25:25.0353 3136 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\windows\system32\pnrpsvc.dll

00:25:25.0355 3136 PNRPsvc - ok

00:25:25.0457 3136 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\windows\System32\ipsecsvc.dll

00:25:25.0498 3136 PolicyAgent - ok

00:25:25.0530 3136 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\windows\system32\umpo.dll

00:25:25.0532 3136 Power - ok

00:25:25.0648 3136 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys

00:25:25.0674 3136 PptpMiniport - ok

00:25:25.0689 3136 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\windows\system32\DRIVERS\processr.sys

00:25:25.0790 3136 Processor - ok

00:25:25.0945 3136 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\windows\system32\profsvc.dll

00:25:25.0964 3136 ProfSvc - ok

00:25:25.0980 3136 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe

00:25:25.0981 3136 ProtectedStorage - ok

00:25:26.0023 3136 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\windows\system32\DRIVERS\pacer.sys

00:25:26.0023 3136 Psched - ok

00:25:26.0128 3136 [ D8589A43B352E7F2317194C98447149F ] pwdrvio C:\windows\system32\pwdrvio.sys

00:25:26.0134 3136 pwdrvio - ok

00:25:26.0165 3136 [ 4B8FDA635F4D2E7D638B2B3817B5AFC8 ] pwdspio C:\windows\system32\pwdspio.sys

00:25:26.0175 3136 pwdspio - ok

00:25:26.0547 3136 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\windows\system32\DRIVERS\ql2300.sys

00:25:26.0571 3136 ql2300 - ok

00:25:26.0611 3136 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\windows\system32\DRIVERS\ql40xx.sys

00:25:26.0611 3136 ql40xx - ok

00:25:26.0682 3136 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\windows\system32\qwave.dll

00:25:26.0687 3136 QWAVE - ok

00:25:26.0708 3136 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys

00:25:26.0733 3136 QWAVEdrv - ok

00:25:26.0793 3136 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys

00:25:26.0805 3136 RasAcd - ok

00:25:26.0865 3136 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys

00:25:26.0885 3136 RasAgileVpn - ok

00:25:26.0925 3136 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\windows\System32\rasauto.dll

00:25:26.0964 3136 RasAuto - ok

00:25:27.0027 3136 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys

00:25:27.0027 3136 Rasl2tp - ok

00:25:27.0100 3136 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\windows\System32\rasmans.dll

00:25:27.0104 3136 RasMan - ok

00:25:27.0127 3136 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys

00:25:27.0128 3136 RasPppoe - ok

00:25:27.0150 3136 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys

00:25:27.0151 3136 RasSstp - ok

00:25:27.0215 3136 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\windows\system32\DRIVERS\rdbss.sys

00:25:27.0218 3136 rdbss - ok

00:25:27.0232 3136 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\windows\system32\DRIVERS\rdpbus.sys

00:25:27.0232 3136 rdpbus - ok

00:25:27.0247 3136 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys

00:25:27.0248 3136 RDPCDD - ok

00:25:27.0274 3136 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys

00:25:27.0276 3136 RDPENCDD - ok

00:25:27.0287 3136 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys

00:25:27.0288 3136 RDPREFMP - ok

00:25:27.0379 3136 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\windows\system32\drivers\RDPWD.sys

00:25:27.0389 3136 RDPWD - ok

00:25:27.0501 3136 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\windows\system32\drivers\rdyboost.sys

00:25:27.0531 3136 rdyboost - ok

00:25:27.0578 3136 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\windows\System32\mprdim.dll

00:25:27.0580 3136 RemoteAccess - ok

00:25:27.0604 3136 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\windows\system32\regsvc.dll

00:25:27.0608 3136 RemoteRegistry - ok

00:25:27.0633 3136 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\windows\System32\RpcEpMap.dll

00:25:27.0635 3136 RpcEptMapper - ok

00:25:27.0659 3136 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\windows\system32\locator.exe

00:25:27.0683 3136 RpcLocator - ok

00:25:27.0795 3136 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\windows\System32\rpcss.dll

00:25:27.0795 3136 RpcSs - ok

00:25:27.0944 3136 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\windows\system32\DRIVERS\rspndr.sys

00:25:27.0969 3136 rspndr - ok

00:25:27.0999 3136 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\windows\system32\lsass.exe

00:25:27.0999 3136 SamSs - ok

00:25:28.0121 3136 [ 3289766038DB2CB14D07DC84392138D5 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

00:25:28.0121 3136 SASDIFSV - ok

00:25:28.0131 3136 [ 58A38E75F3316A83C23DF6173D41F2B5 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

00:25:28.0131 3136 SASKUTIL - ok

00:25:28.0191 3136 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\windows\system32\drivers\sbp2port.sys

00:25:28.0191 3136 sbp2port - ok

00:25:28.0225 3136 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\windows\System32\SCardSvr.dll

00:25:28.0228 3136 SCardSvr - ok

00:25:28.0283 3136 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\windows\system32\DRIVERS\scfilter.sys

00:25:28.0283 3136 scfilter - ok

00:25:28.0363 3136 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\windows\system32\schedsvc.dll

00:25:28.0418 3136 Schedule - ok

00:25:28.0475 3136 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\windows\System32\certprop.dll

00:25:28.0475 3136 SCPolicySvc - ok

00:25:28.0567 3136 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\windows\System32\SDRSVC.dll

00:25:28.0567 3136 SDRSVC - ok

00:25:28.0597 3136 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\windows\system32\drivers\secdrv.sys

00:25:28.0607 3136 secdrv - ok

00:25:28.0699 3136 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\windows\system32\seclogon.dll

00:25:28.0699 3136 seclogon - ok

00:25:28.0719 3136 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\windows\system32\sens.dll

00:25:28.0719 3136 SENS - ok

00:25:28.0729 3136 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\windows\system32\sensrsvc.dll

00:25:28.0729 3136 SensrSvc - ok

00:25:28.0749 3136 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\windows\system32\DRIVERS\serenum.sys

00:25:28.0749 3136 Serenum - ok

00:25:28.0828 3136 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\windows\system32\DRIVERS\serial.sys

00:25:28.0830 3136 Serial - ok

00:25:28.0911 3136 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\windows\system32\DRIVERS\sermouse.sys

00:25:28.0911 3136 sermouse - ok

00:25:28.0993 3136 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\windows\system32\sessenv.dll

00:25:29.0003 3136 SessionEnv - ok

00:25:29.0023 3136 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\windows\system32\drivers\sffdisk.sys

00:25:29.0023 3136 sffdisk - ok

00:25:29.0033 3136 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys

00:25:29.0043 3136 sffp_mmc - ok

00:25:29.0063 3136 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys

00:25:29.0063 3136 sffp_sd - ok

00:25:29.0130 3136 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\windows\system32\DRIVERS\sfloppy.sys

00:25:29.0135 3136 sfloppy - ok

00:25:29.0205 3136 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\windows\system32\DRIVERS\Sftfslh.sys

00:25:29.0215 3136 Sftfs - ok

00:25:29.0367 3136 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

00:25:29.0377 3136 sftlist - ok

00:25:29.0397 3136 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\windows\system32\DRIVERS\Sftplaylh.sys

00:25:29.0417 3136 Sftplay - ok

00:25:29.0489 3136 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\windows\system32\DRIVERS\Sftredirlh.sys

00:25:29.0489 3136 Sftredir - ok

00:25:29.0509 3136 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\windows\system32\DRIVERS\Sftvollh.sys

00:25:29.0509 3136 Sftvol - ok

00:25:29.0602 3136 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

00:25:29.0614 3136 sftvsa - ok

00:25:29.0651 3136 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\windows\System32\ipnathlp.dll

00:25:29.0661 3136 SharedAccess - ok

00:25:29.0750 3136 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll

00:25:29.0756 3136 ShellHWDetection - ok

00:25:29.0843 3136 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\windows\system32\DRIVERS\SiSRaid2.sys

00:25:29.0899 3136 SiSRaid2 - ok

00:25:29.0939 3136 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\windows\system32\DRIVERS\sisraid4.sys

00:25:29.0941 3136 SiSRaid4 - ok

00:25:30.0019 3136 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\windows\system32\DRIVERS\smb.sys

00:25:30.0022 3136 Smb - ok

00:25:30.0178 3136 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\windows\System32\snmptrap.exe

00:25:30.0180 3136 SNMPTRAP - ok

00:25:30.0193 3136 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\windows\system32\drivers\spldr.sys

00:25:30.0194 3136 spldr - ok

00:25:30.0265 3136 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\windows\System32\spoolsv.exe

00:25:30.0272 3136 Spooler - ok

00:25:30.0387 3136 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\windows\system32\sppsvc.exe

00:25:30.0421 3136 sppsvc - ok

00:25:30.0440 3136 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\windows\system32\sppuinotify.dll

00:25:30.0443 3136 sppuinotify - ok

00:25:30.0510 3136 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\windows\system32\DRIVERS\srv.sys

00:25:30.0515 3136 srv - ok

00:25:30.0582 3136 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\windows\system32\DRIVERS\srv2.sys

00:25:30.0587 3136 srv2 - ok

00:25:30.0601 3136 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys

00:25:30.0603 3136 srvnet - ok

00:25:30.0674 3136 [ 8F8324ED1DE63FFC7B1A02CD2D963C72 ] ssadbus C:\windows\system32\DRIVERS\ssadbus.sys

00:25:30.0677 3136 ssadbus - ok

00:25:30.0693 3136 [ 58221EFCB74167B73667F0024C661CE0 ] ssadmdfl C:\windows\system32\DRIVERS\ssadmdfl.sys

00:25:30.0694 3136 ssadmdfl - ok

00:25:30.0730 3136 [ 4DA7C71BFAC5AD71255B7E4CAB980163 ] ssadmdm C:\windows\system32\DRIVERS\ssadmdm.sys

00:25:30.0732 3136 ssadmdm - ok

00:25:30.0765 3136 [ D33D1BD3EC0E766211A234F56A12726D ] ssadserd C:\windows\system32\DRIVERS\ssadserd.sys

00:25:30.0803 3136 ssadserd - ok

00:25:30.0847 3136 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\windows\System32\ssdpsrv.dll

00:25:30.0847 3136 SSDPSRV - ok

00:25:30.0867 3136 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\windows\system32\sstpsvc.dll

00:25:30.0867 3136 SstpSvc - ok

00:25:30.0900 3136 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\windows\system32\DRIVERS\stexstor.sys

00:25:30.0901 3136 stexstor - ok

00:25:30.0979 3136 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\windows\System32\wiaservc.dll

00:25:30.0989 3136 stisvc - ok

00:25:31.0049 3136 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\windows\system32\drivers\swenum.sys

00:25:31.0049 3136 swenum - ok

00:25:31.0094 3136 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\windows\System32\swprv.dll

00:25:31.0100 3136 swprv - ok

00:25:31.0191 3136 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\windows\system32\sysmain.dll

00:25:31.0211 3136 SysMain - ok

00:25:31.0273 3136 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll

00:25:31.0273 3136 TabletInputService - ok

00:25:31.0293 3136 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\windows\System32\tapisrv.dll

00:25:31.0293 3136 TapiSrv - ok

00:25:31.0334 3136 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\windows\System32\tbssvc.dll

00:25:31.0336 3136 TBS - ok

00:25:31.0425 3136 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\windows\system32\drivers\tcpip.sys

00:25:31.0445 3136 Tcpip - ok

00:25:31.0535 3136 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys

00:25:31.0547 3136 TCPIP6 - ok

00:25:31.0639 3136 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys

00:25:31.0651 3136 tcpipreg - ok

00:25:31.0698 3136 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\windows\system32\drivers\tdpipe.sys

00:25:31.0701 3136 TDPIPE - ok

00:25:31.0772 3136 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\windows\system32\drivers\tdtcp.sys

00:25:31.0789 3136 TDTCP - ok

00:25:31.0853 3136 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\windows\system32\DRIVERS\tdx.sys

00:25:31.0853 3136 tdx - ok

00:25:31.0932 3136 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\windows\system32\drivers\termdd.sys

00:25:31.0933 3136 TermDD - ok

00:25:31.0967 3136 [ 2E648163254233755035B46DD7B89123 ] TermService C:\windows\System32\termsrv.dll

00:25:31.0975 3136 TermService - ok

00:25:32.0005 3136 [ F0344071948D1A1FA732231785A0664C ] Themes C:\windows\system32\themeservice.dll

00:25:32.0005 3136 Themes - ok

00:25:32.0070 3136 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\windows\system32\mmcss.dll

00:25:32.0071 3136 THREADORDER - ok

00:25:32.0100 3136 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\windows\System32\trkwks.dll

00:25:32.0102 3136 TrkWks - ok

00:25:32.0182 3136 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe

00:25:32.0184 3136 TrustedInstaller - ok

00:25:32.0247 3136 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys

00:25:32.0248 3136 tssecsrv - ok

00:25:32.0304 3136 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys

00:25:32.0305 3136 TsUsbFlt - ok

00:25:32.0398 3136 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys

00:25:32.0400 3136 tunnel - ok

00:25:32.0419 3136 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\windows\system32\DRIVERS\uagp35.sys

00:25:32.0419 3136 uagp35 - ok

00:25:32.0479 3136 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\windows\system32\DRIVERS\udfs.sys

00:25:32.0521 3136 udfs - ok

00:25:32.0570 3136 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\windows\system32\UI0Detect.exe

00:25:32.0571 3136 UI0Detect - ok

00:25:32.0591 3136 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys

00:25:32.0591 3136 uliagpkx - ok

00:25:32.0703 3136 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\windows\system32\drivers\umbus.sys

00:25:32.0703 3136 umbus - ok

00:25:32.0723 3136 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\windows\system32\DRIVERS\umpass.sys

00:25:32.0723 3136 UmPass - ok

00:25:32.0804 3136 [ F9EC9ACD504D823D9B9CA98A4F8D3CA2 ] Updater Service C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe

00:25:32.0810 3136 Updater Service - ok

00:25:32.0845 3136 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\windows\System32\upnphost.dll

00:25:32.0855 3136 upnphost - ok

00:25:32.0925 3136 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\windows\system32\drivers\usbccgp.sys

00:25:32.0945 3136 usbccgp - ok

00:25:33.0057 3136 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\windows\system32\drivers\usbcir.sys

00:25:33.0074 3136 usbcir - ok

00:25:33.0097 3136 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\windows\system32\DRIVERS\usbehci.sys

00:25:33.0098 3136 usbehci - ok

00:25:33.0129 3136 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys

00:25:33.0129 3136 usbhub - ok

00:25:33.0197 3136 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\windows\system32\DRIVERS\usbohci.sys

00:25:33.0207 3136 usbohci - ok

00:25:33.0238 3136 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\windows\system32\DRIVERS\usbprint.sys

00:25:33.0240 3136 usbprint - ok

00:25:33.0261 3136 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\windows\system32\DRIVERS\USBSTOR.SYS

00:25:33.0261 3136 USBSTOR - ok

00:25:33.0321 3136 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\windows\system32\drivers\usbuhci.sys

00:25:33.0321 3136 usbuhci - ok

00:25:33.0391 3136 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\windows\System32\uxsms.dll

00:25:33.0399 3136 UxSms - ok

00:25:33.0416 3136 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\windows\system32\lsass.exe

00:25:33.0418 3136 VaultSvc - ok

00:25:33.0443 3136 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys

00:25:33.0453 3136 vdrvroot - ok

00:25:33.0555 3136 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\windows\System32\vds.exe

00:25:33.0555 3136 vds - ok

00:25:33.0595 3136 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\windows\system32\DRIVERS\vgapnp.sys

00:25:33.0595 3136 vga - ok

00:25:33.0625 3136 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\windows\System32\drivers\vga.sys

00:25:33.0655 3136 VgaSave - ok

00:25:33.0717 3136 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\windows\system32\drivers\vhdmp.sys

00:25:33.0717 3136 vhdmp - ok

00:25:33.0797 3136 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\windows\system32\drivers\viaide.sys

00:25:33.0815 3136 viaide - ok

00:25:33.0834 3136 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\windows\system32\drivers\volmgr.sys

00:25:33.0835 3136 volmgr - ok

00:25:33.0909 3136 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\windows\system32\drivers\volmgrx.sys

00:25:33.0929 3136 volmgrx - ok

00:25:34.0001 3136 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\windows\system32\drivers\volsnap.sys

00:25:34.0001 3136 volsnap - ok

00:25:34.0031 3136 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\windows\system32\DRIVERS\vsmraid.sys

00:25:34.0031 3136 vsmraid - ok

00:25:34.0163 3136 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\windows\system32\vssvc.exe

00:25:34.0183 3136 VSS - ok

00:25:34.0203 3136 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\windows\system32\DRIVERS\vwifibus.sys

00:25:34.0203 3136 vwifibus - ok

00:25:34.0243 3136 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\windows\system32\DRIVERS\vwififlt.sys

00:25:34.0255 3136 vwififlt - ok

00:25:34.0281 3136 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\windows\system32\w32time.dll

00:25:34.0287 3136 W32Time - ok

00:25:34.0319 3136 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\windows\system32\DRIVERS\wacompen.sys

00:25:34.0320 3136 WacomPen - ok

00:25:34.0395 3136 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\windows\system32\DRIVERS\wanarp.sys

00:25:34.0395 3136 WANARP - ok

00:25:34.0405 3136 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys

00:25:34.0405 3136 Wanarpv6 - ok

00:25:34.0507 3136 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\windows\system32\Wat\WatAdminSvc.exe

00:25:34.0517 3136 WatAdminSvc - ok

00:25:34.0614 3136 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\windows\system32\wbengine.exe

00:25:34.0631 3136 wbengine - ok

00:25:34.0664 3136 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\windows\System32\wbiosrvc.dll

00:25:34.0668 3136 WbioSrvc - ok

00:25:34.0746 3136 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\windows\System32\wcncsvc.dll

00:25:34.0758 3136 wcncsvc - ok

00:25:34.0779 3136 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll

00:25:34.0781 3136 WcsPlugInService - ok

00:25:34.0791 3136 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\windows\system32\DRIVERS\wd.sys

00:25:34.0791 3136 Wd - ok

00:25:34.0887 3136 [ A3D04EBF5227886029B4532F20D026F7 ] WDC_SAM C:\windows\system32\DRIVERS\wdcsam64.sys

00:25:34.0888 3136 WDC_SAM - ok

00:25:35.0039 3136 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys

00:25:35.0048 3136 Wdf01000 - ok

00:25:35.0075 3136 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\windows\system32\wdi.dll

00:25:35.0078 3136 WdiServiceHost - ok

00:25:35.0085 3136 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\windows\system32\wdi.dll

00:25:35.0088 3136 WdiSystemHost - ok

00:25:35.0152 3136 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\windows\System32\webclnt.dll

00:25:35.0157 3136 WebClient - ok

00:25:35.0185 3136 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\windows\system32\wecsvc.dll

00:25:35.0189 3136 Wecsvc - ok

00:25:35.0205 3136 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\windows\System32\wercplsupport.dll

00:25:35.0209 3136 wercplsupport - ok

00:25:35.0237 3136 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\windows\System32\WerSvc.dll

00:25:35.0239 3136 WerSvc - ok

00:25:35.0269 3136 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys

00:25:35.0270 3136 WfpLwf - ok

00:25:35.0288 3136 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\windows\system32\drivers\wimmount.sys

00:25:35.0289 3136 WIMMount - ok

00:25:35.0317 3136 WinDefend - ok

00:25:35.0327 3136 WinHttpAutoProxySvc - ok

00:25:35.0388 3136 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll

00:25:35.0390 3136 Winmgmt - ok

00:25:35.0483 3136 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\windows\system32\WsmSvc.dll

00:25:35.0529 3136 WinRM - ok

00:25:35.0584 3136 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\windows\System32\wlansvc.dll

00:25:35.0598 3136 Wlansvc - ok

00:25:35.0707 3136 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

00:25:35.0730 3136 wlidsvc - ok

00:25:35.0792 3136 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\windows\system32\drivers\wmiacpi.sys

00:25:35.0793 3136 WmiAcpi - ok

00:25:35.0837 3136 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe

00:25:35.0840 3136 wmiApSrv - ok

00:25:35.0867 3136 WMPNetworkSvc - ok

00:25:35.0889 3136 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\windows\System32\wpcsvc.dll

00:25:35.0890 3136 WPCSvc - ok

00:25:35.0953 3136 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\windows\system32\wpdbusenum.dll

00:25:35.0955 3136 WPDBusEnum - ok

00:25:35.0978 3136 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys

00:25:35.0980 3136 ws2ifsl - ok

00:25:35.0995 3136 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\windows\system32\wscsvc.dll

00:25:35.0995 3136 wscsvc - ok

00:25:36.0005 3136 WSearch - ok

00:25:36.0107 3136 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\windows\system32\wuaueng.dll

00:25:36.0137 3136 wuauserv - ok

00:25:36.0204 3136 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\windows\system32\drivers\WudfPf.sys

00:25:36.0206 3136 WudfPf - ok

00:25:36.0229 3136 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys

00:25:36.0229 3136 WUDFRd - ok

00:25:36.0249 3136 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\windows\System32\WUDFSvc.dll

00:25:36.0259 3136 wudfsvc - ok

00:25:36.0281 3136 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\windows\System32\wwansvc.dll

00:25:36.0285 3136 WwanSvc - ok

00:25:36.0373 3136 X6va009 - ok

00:25:36.0393 3136 X6va011 - ok

00:25:36.0434 3136 ================ Scan global ===============================

00:25:36.0464 3136 [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll

00:25:36.0530 3136 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\windows\system32\winsrv.dll

00:25:36.0540 3136 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\windows\system32\winsrv.dll

00:25:36.0560 3136 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll

00:25:36.0574 3136 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe

00:25:36.0575 3136 [Global] - ok

00:25:36.0575 3136 ================ Scan MBR ==================================

00:25:36.0595 3136 [ 8C9F9E03865C35F0F3829A23CDA42F5D ] \Device\Harddisk0\DR0

00:25:41.0486 3136 \Device\Harddisk0\DR0 - ok

00:25:41.0489 3136 ================ Scan VBR ==================================

00:25:41.0501 3136 [ 08DFFF07B24C0147CA23DFFA55ED02A1 ] \Device\Harddisk0\DR0\Partition1

00:25:41.0502 3136 \Device\Harddisk0\DR0\Partition1 - ok

00:25:41.0548 3136 [ 43CF0D52F30950456E42B849FDC23D7E ] \Device\Harddisk0\DR0\Partition2

00:25:41.0550 3136 \Device\Harddisk0\DR0\Partition2 - ok

00:25:41.0554 3136 ============================================================

00:25:41.0554 3136 Scan finished

00:25:41.0554 3136 ============================================================

00:25:41.0568 3604 Detected object count: 1

00:25:41.0568 3604 Actual detected object count: 1

00:26:15.0718 3604 Akamai ( HiddenFile.Multi.Generic ) - skipped by user

00:26:15.0718 3604 Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip

_________________________________________________________________________________________________________

Run date: 2012-12-10 00:28:39

-----------------------------

00:28:39.658 OS Version: Windows x64 6.1.7601 Service Pack 1

00:28:39.658 Number of processors: 1 586 0x603

00:28:39.659 ComputerName: MYSHIT-PC UserName: Berto

00:28:46.895 Initialize success

00:29:50.514 AVAST engine defs: 12120902

00:30:08.941 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000061

00:30:08.951 Disk 0 Vendor: Hitachi_ JP2O Size: 476940MB BusType: 3

00:30:08.961 Disk 0 MBR read successfully

00:30:08.961 Disk 0 MBR scan

00:30:09.174 Disk 0 unknown MBR code

00:30:09.179 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 15360 MB offset 2048

00:30:09.212 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 31459328

00:30:09.222 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 461478 MB offset 31664128

00:30:09.245 Disk 0 scanning C:\windows\system32\drivers

00:30:23.707 Service scanning

00:31:14.545 Modules scanning

00:31:14.553 Disk 0 trace - called modules:

00:31:14.583 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys

00:31:14.938 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80026ab060]

00:31:14.943 3 CLASSPNP.SYS[fffff8800197343f] -> nt!IofCallDriver -> [0xfffffa800239cc90]

00:31:14.949 5 ACPI.sys[fffff88000f957a1] -> nt!IofCallDriver -> \Device\00000061[0xfffffa800217a9c0]

00:31:16.970 AVAST engine scan C:\windows

00:31:22.246 AVAST engine scan C:\windows\system32

00:35:08.443 AVAST engine scan C:\windows\system32\drivers

00:35:25.702 AVAST engine scan C:\Users\Berto

00:38:58.023 AVAST engine scan C:\ProgramData

00:40:55.438 Scan finished successfully

00:42:11.381 Disk 0 MBR has been saved successfully to "C:\Users\Berto\Desktop\MBR.dat"

00:42:11.391 The log file has been saved successfully to "C:\Users\Berto\Desktop\aswMBR.txt"

gringo_pr · December 10, 2012

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

apadgett21 · December 11, 2012

Running a lot smoother than before. It appears that whatever was hindering my system is now gone. Is there anything you would suggest I delete or install for added security? Combofix log below:

ComboFix 12-12-07.01 - Berto 12/10/2012 17:50:58.2.1 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1791.1161 [GMT -5:00]

Running from: c:\users\Berto\Desktop\ComboFix.exe

Command switches used :: c:\users\Berto\Desktop\CFScript.txt

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-11-10 to 2012-12-10 )))))))))))))))))))))))))))))))

.

2012-12-10 22:58 . 2012-12-10 22:58 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-12-10 22:58 . 2012-12-10 22:58 -------- d-----w- c:\users\my stuff\AppData\Local\temp

2012-12-10 22:58 . 2012-12-10 22:58 -------- d-----w- c:\users\Guest\AppData\Local\temp

2012-12-10 22:58 . 2012-12-10 22:58 -------- d-----w- c:\users\Default\AppData\Local\temp