Windows Command Processor

shmish · March 31, 2013

Hello,

I've found that in my windows 8 startup panel, there are 4 applications related to Windows Command Processor.

Everything I've searched for on this WCP talks about malware, but they also talk about getting popups. I don't have any popups, but I'm suspicious of the WCP.

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 10.0.9200.16519 BrowserJavaVersion: 10.17.2

Run by sluggo at 10:49:06 on 2013-03-31

Microsoft Windows 8 Pro with Media Center 6.2.9200.0.1252.1.1033.18.3327.1196 [GMT -7:00]

.

AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\WINDOWS\system32\wininit.exe

C:\WINDOWS\system32\atiesrxx.exe

C:\WINDOWS\system32\dwm.exe

C:\WINDOWS\system32\atieclxx.exe

C:\WINDOWS\System32\spoolsv.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\xampp\apache\bin\httpd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\dashost.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\mqsvc.exe

C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\WINDOWS\system32\taskhostex.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

C:\xampp\apache\bin\httpd.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\DllHost.exe

C:\Users\sluggo\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\WINDOWS\splwow64.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\WINDOWS\system32\Taskmgr.exe

C:\WINDOWS\system32\taskhost.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Adobe\Adobe Photoshop CS5\Photoshop.exe

C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\WINDOWS\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe

C:\WINDOWS\system32\DllHost.exe

C:\WINDOWS\system32\conhost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k RPCSS

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork

C:\WINDOWS\system32\svchost.exe -k apphost

C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\svchost.exe -k iissvcs

C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet

C:\WINDOWS\system32\svchost.exe -k GPSvcGroup

C:\WINDOWS\System32\svchost.exe -k swprv

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.ca/

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: LastPass Browser Helper Object: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL

BHO: Microsoft SPFS Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dll

EB: Developer Tools: {1A6FE369-F28C-4AD9-A3E6-2BCB50807CF1} - c:\program files\internet explorer\iedvtool.dll

uRun: [Google Update] "c:\users\sluggo\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [RTHDVCPL] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"

mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe

mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe

mRun: [bingDesktop] c:\program files\microsoft\bingdesktop\BingDesktop.exe /fromkey

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "c:\program files\amd avt\bin\kdbsync.exe" aml

mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\users\sluggo\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\sluggo\appdata\roaming\dropbox\bin\Dropbox.exe

StartupFolder: c:\users\sluggo\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office14\ONENOTEM.EXE

uPolicies-Explorer: NoDrives = dword:0

uPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:255

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\program files\microsoft office 15\root\office15\EXCEL.EXE/3000

IE: LastPass - c:\program files\lastpass\context.html?cmd=lastpass

IE: LastPass Fill Forms - c:\program files\lastpass\context.html?cmd=fillforms

IE: Se&nd to OneNote - c:\program files\microsoft office 15\root\office15\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

TCP: NameServer = 192.168.100.1

TCP: Interfaces\{B74A15E9-18B1-4402-9A5B-96341AC5C6F8} : NameServer = 208.122.23.22,208.122.23.23

TCP: Interfaces\{B74A15E9-18B1-4402-9A5B-96341AC5C6F8} : DHCPNameServer = 192.168.100.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files\turbotax 2011\ic2011pp.dll

Handler: intu-tt2012 - {02F985EF-502B-4597-993F-6BF9E004C138} - c:\program files\turbotax 2012\ic2012pp.dll

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} -

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

SSODL: WebCheck - <orphaned>

LSA: Authentication Packages = msv1_0 relog_ap

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\sluggo\appdata\roaming\mozilla\firefox\profiles\aw12le5i.default\

FF - prefs.js: keyword.URL - hxxps://duckduckgo.com/?q=

FF - plugin: c:\progra~1\micros~4\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\acrobat 9.0\acrobat\air\nppdf32.dll

FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\common files\adobe\oobe\pdapp\ccm\utilities\npAdobeAAMDetect32.dll

FF - plugin: c:\program files\common files\adobe\oobe\pdapp\ccm\utilities\npAdobeAAMDetect64.dll

FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\sluggo\appdata\local\google\update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: c:\users\sluggo\appdata\roaming\mozilla\firefox\profiles\aw12le5i.default\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll

FF - plugin: c:\windows\system32\adobe\director\np32dsw_1200112.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll

FF - plugin: c:\windows\system32\npdeployJava1.dll

FF - plugin: c:\windows\system32\npmproxy.dll

FF - ExtSQL: 2013-03-05 19:01; {E0B8C461-F8FB-49b4-8373-FE32E9252800}; c:\users\sluggo\appdata\roaming\mozilla\firefox\profiles\aw12le5i.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}

FF - ExtSQL: 2013-03-27 10:20; {a1109c2a-1187-4027-901d-13097b755625}; c:\users\sluggo\appdata\roaming\mozilla\firefox\profiles\aw12le5i.default\extensions\{a1109c2a-1187-4027-901d-13097b755625}.xpi

.

============= SERVICES / DRIVERS ===============

.

R1 cdrblock;cdrblock;c:\windows\system32\drivers\cdrblock.sys [2011-4-21 29272]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-7-3 217088]

R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2011-9-10 18432]

R2 BingDesktopUpdate;Bing Desktop Update service;c:\program files\microsoft\bingdesktop\BingDesktopUpdater.exe [2013-3-22 168536]

R2 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2011-8-9 163424]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2011-9-22 974944]

R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2011-8-4 103112]

R2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\common files\magix services\database\bin\FABS.exe [2011-5-24 1840128]

R2 NIHardwareService;NIHardwareService;c:\program files\common files\native instruments\hardware\NIHardwareService.exe [2010-10-19 3791872]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\l160x86.sys [2012-6-2 55808]

R3 echo3g;Echo3G Service;c:\windows\system32\drivers\echo3g.sys [2010-1-8 209880]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-1-8 161536]

S2 XAMPP;XAMPP Service;c:\xampp\service.exe [2007-12-20 60928]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\common files\magix services\database\bin\fbserver.exe [2011-4-26 2702848]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

.

=============== File Associations ===============

.

FileExt: .txt: txtfile=c:\windows\system32\NOTEPAD.EXE %1 [userChoice]

FileExt: .js: JSFile=c:\windows\system32\WScript.exe "%1" %* [userChoice]

.

=============== Created Last 30 ================

.

2013-03-31 16:38:05 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-31 16:37:53 -------- d-----w- c:\users\sluggo\appdata\local\Programs

2013-03-29 18:17:18 -------- d--h--w- C:\SkyDriveTemp

2013-03-27 19:18:54 187152 ----a-w- c:\programdata\microsoft\windows\sqm\manifest\Sqm10197.bin

2013-03-23 22:50:40 -------- d-----w- c:\users\sluggo\appdata\roaming\LibreOffice

2013-03-23 22:48:45 -------- d-----w- c:\windows\System64

2013-03-23 22:47:03 -------- d-----w- c:\program files\LibreOffice 4.0

2013-03-22 23:00:02 5664768 ----a-w- c:\programdata\microsoft\bingdesktop\updater\BingDesktop.msi

2013-03-18 19:46:28 -------- d-----w- c:\program files\AMD AVT

2013-03-18 19:46:26 -------- d-----w- c:\program files\AMD APP

2013-03-18 19:46:20 -------- d-----w- c:\program files\common files\ATI Technologies

2013-03-18 19:43:44 -------- d-----w- c:\program files\ATI Technologies

2013-03-18 14:51:43 -------- d-----w- c:\windows\LastGood.Tmp

2013-03-14 02:26:07 78168 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-14 02:26:07 692568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-03-13 01:32:59 8856576 ----a-w- c:\windows\system32\twinui.dll

2013-03-13 01:32:56 2033664 ----a-w- c:\windows\system32\authui.dll

2013-03-13 01:32:55 754176 ----a-w- c:\windows\system32\actxprxy.dll

2013-03-13 01:32:55 58088 ----a-w- c:\windows\system32\drivers\pdc.sys

2013-03-13 01:32:29 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-03-09 16:35:38 -------- d-----w- c:\program files\TurboTax 2012

2013-03-09 15:00:03 17536 ----a-w- c:\programdata\microsoft\windowssampling\sqm\manifest\Sqm3.bin

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2013-03-06 04:01:52 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2013-03-06 03:51:07 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-03-06 03:49:26 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll

.

==================== Find3M ====================

.

2013-03-26 17:40:51 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

2013-03-06 03:50:57 861088 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-03-06 03:50:57 782240 ----a-w- c:\windows\system32\deployJava1.dll

2013-03-02 08:22:18 361984 ----a-w- c:\windows\system32\MFMediaEngine.dll

2013-02-15 06:35:40 444416 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-02-12 01:30:04 44032 ----a-w- c:\windows\system32\UXInit.dll

2013-02-12 00:27:30 3394048 ----a-w- c:\windows\system32\win32k.sys

2013-02-05 22:33:01 492544 ----a-w- c:\windows\system32\drivers\srv2.sys

2013-02-05 22:30:11 304128 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2013-02-05 22:29:51 195584 ----a-w- c:\windows\system32\drivers\srvnet.sys

2013-02-05 22:29:51 167424 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2013-02-05 04:58:01 1766912 ----a-w- c:\windows\system32\wininet.dll

2013-02-05 04:57:52 661504 ----a-w- c:\windows\system32\uxtheme.dll

2013-02-05 04:56:33 2877952 ----a-w- c:\windows\system32\jscript9.dll

2013-02-05 04:56:27 61440 ----a-w- c:\windows\system32\iesetup.dll

2013-02-05 04:56:27 109056 ----a-w- c:\windows\system32\iesysprep.dll

2013-02-05 03:55:27 2706432 ----a-w- c:\windows\system32\mshtml.tlb

2013-02-02 09:53:24 1614568 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-02-02 09:19:59 817384 ----a-w- c:\windows\system32\drivers\ndis.sys

2013-02-02 09:19:59 1817320 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-02-02 09:00:12 332520 ----a-w- c:\windows\system32\drivers\usbhub.sys

2013-02-02 09:00:11 361704 ----a-w- c:\windows\system32\drivers\USBHUB3.SYS

2013-02-02 09:00:08 302312 ----a-w- c:\windows\system32\drivers\storport.sys

2013-02-02 09:00:04 53992 ----a-w- c:\windows\system32\drivers\crashdmp.sys

2013-02-02 08:39:59 325632 ----a-w- c:\windows\system32\schannel.dll

2013-02-02 08:39:33 367104 ----a-w- c:\windows\system32\netprofmsvc.dll

2013-02-02 08:39:32 283136 ----a-w- c:\windows\system32\ncsi.dll

2013-02-02 08:39:28 5090816 ----a-w- c:\windows\system32\mstscax.dll

2013-02-02 08:39:15 157696 ----a-w- c:\windows\system32\mbsmsapi.dll

2013-02-02 08:39:04 179712 ----a-w- c:\windows\system32\hotspotauth.dll

2013-02-02 08:38:54 567808 ----a-w- c:\windows\system32\duser.dll

2013-02-02 07:32:14 242688 ----a-w- c:\windows\system32\drivers\ks.sys

2013-02-02 07:32:02 60416 ----a-w- c:\windows\system32\drivers\hidclass.sys

2013-02-02 07:31:49 30208 ----a-w- c:\windows\system32\drivers\BthAvrcpTg.sys

2013-02-02 05:41:57 1437184 ----a-w- c:\windows\system32\GdiPlus.dll

2013-01-29 00:02:46 29088 ----a-w- c:\windows\system32\drivers\WdBoot.sys

2013-01-28 23:07:34 193936 ----a-w- c:\windows\system32\drivers\WdFilter.sys

2013-01-14 00:23:04 5554408 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-01-10 01:07:00 24808 ----a-w- c:\windows\system32\drivers\msgpiowin32.sys

2013-01-10 00:08:30 74984 ----a-w- c:\windows\system32\drivers\partmgr.sys

2013-01-10 00:08:22 526960 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2013-01-10 00:02:20 158952 ----a-w- c:\windows\system32\drivers\sdbus.sys

2013-01-10 00:02:15 104168 ----a-w- c:\windows\system32\drivers\dumpsd.sys

2013-01-09 23:51:38 259816 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2013-01-09 23:51:38 1229032 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2013-01-09 23:25:58 741376 ----a-w- c:\windows\system32\iphlpsvc.dll

2013-01-09 23:25:57 125440 ----a-w- c:\windows\system32\inetpp.dll

2013-01-09 23:25:55 582144 ----a-w- c:\windows\system32\gpprefcl.dll

2013-01-09 23:25:55 40960 ----a-w- c:\windows\system32\drivers\umdf\HidBthLE.dll

2013-01-09 23:25:43 1505280 ----a-w- c:\windows\system32\wbem\cimwin32.dll

2013-01-09 03:57:47 277504 ----a-w- c:\windows\system32\drivers\HdAudio.sys

.

============= FINISH: 10:49:14.69 ===============

Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8 Pro with Media Center

Boot Device: \Device\HarddiskVolume1

Install Date: 12/20/2012 6:39:32 AM

System Uptime: 3/31/2013 9:00:16 AM (1 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P5KC

Processor: Intel® Core2 Quad CPU @ 2.40GHz | LGA775 | 2394/266mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 260 GiB total, 81.011 GiB free.

D: is FIXED (NTFS) - 4 GiB total, 3.954 GiB free.

E: is CDROM ()

F: is Removable

G: is Removable

H: is Removable

I: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e96b-e325-11ce-bfc1-08002be10318}

Description: Standard PS/2 Keyboard

Device ID: ACPI\PNP0303\4&20D7719E&0

Manufacturer: (Standard keyboards)

Name: Standard PS/2 Keyboard

PNP Device ID: ACPI\PNP0303\4&20D7719E&0

Service: i8042prt

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Intel® 82566DC-2 Gigabit Network Connection

Device ID: PCI\VEN_8086&DEV_294C&SUBSYS_00008086&REV_02\3&11583659&0&C8

Manufacturer: Intel

Name: Intel® 82566DC-2 Gigabit Network Connection

PNP Device ID: PCI\VEN_8086&DEV_294C&SUBSYS_00008086&REV_02\3&11583659&0&C8

Service: e1express

.

==== System Restore Points ===================

.

RP23: 3/12/2013 6:36:55 PM - Windows Update

RP24: 3/21/2013 3:35:43 AM - Scheduled Checkpoint

RP25: 3/22/2013 6:48:09 PM - Removed MAGIX Screenshare

RP26: 3/27/2013 9:42:26 AM - Removed Adobe Photoshop Lightroom 4.3 .

RP28: 3/31/2013 9:43:11 AM - Removed DWA-552

.

==== Installed Programs ======================

.

7-Zip 9.20

Ableton Live 8

Acronis Disk Director Suite

Acronis True Image Home

ActiveState ActivePython 2.7.2.5 (32-bit)

Admiral Quality Poly-Ana 1.x

Adobe Acrobat 9 Pro - English, Français, Deutsch

Adobe Acrobat 9.5.4 - CPSID_83708

Adobe AIR

Adobe Community Help

Adobe Creative Suite 5 Design Standard

Adobe Digital Editions

Adobe Download Assistant

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.02)

Adobe Shockwave Player 12.0

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Media Foundation Decoders

AnswerWorks 5.0 English Runtime

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Applied Acoustics Systems - Ultra Analog VA-1 v1.1.2

ASIO4ALL

Audacity 2.0.2

Bing Desktop

BlackBerry Device Manager 7.0

BlackBerry Tablet OS Graphical Aid

Bonjour

Box for Office

calibre

Camtasia Studio 8

Cartes du Ciel V3.4.1

Catalyst Control Center

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

CheckSum Tool 0.7.0

Circuit Construction Kit (DC Only)

ClPhpEd(remove only)

CodeMeter Runtime Kit v3.20c

ComicRack v0.9.155

D3DX10

DDPB Installer

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Dropbox

DVDFab 8.1.6.3 (11/02/2012) Qt

Echo3G PCI

Energy Skate Park

EPSON TWAIN 5

eReg

ESET NOD32 Antivirus

Extreme Sample Converter 3.5.9

Faraday's Electromagnetic Lab

Firebird SQL Server - MAGIX Edition

foobar2000 v1.1.10

FreeFileSync 5.10

Garmin BlueChart Americas v8.5

Garmin Communicator Plugin

Garmin MapSource

Garmin USB Drivers

Generator

GeoSetter 3.4.16

Google Chrome

Google Earth

Google Update Helper

Guru

IHMC CmapTools v5.04.02

ImgBurn

Internet TV for Windows Media Center

iTunes

Java 7 Update 17

Java Auto Updater

JavaFX 2.1.1

LastPass (uninstall only)

LEGO MINDSTORMS NXT - English Language Pack

LEGO MINDSTORMS NXT Driver

LEGO MINDSTORMS NXT Software v2.0

LibreOffice 4.0.1.2

Line 6 Uninstaller

LinuxLive USB Creator

Logitech SetPoint 6.32

M4a/Flac/Ogg/Ape/Mpc Tag Support Plugin for Media Player v 1.1

Magic Bullet Quick Looks (for MAGIX)

Malwarebytes Anti-Malware version 1.70.0.1100

MapSource

MapSource - Topo Canada v2

MediaMonkey 4.0

Microsoft Application Error Reporting

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Home and Student 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Sync Framework 2.0 Core Components (x86) ENU

Microsoft Sync Framework 2.0 Provider Services (x86) ENU

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

Mozilla Thunderbird 17.0.4 (x86 en-US)

Mp3tag v2.52

MSM32Installer

MSVCRT

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB2758694)

MSXML 4.0 SP3 Parser (KB973685)

Native Instruments Controller Editor

Native Instruments Service Center

Native Instruments Traktor

Native Instruments Traktor Kontrol X1

Netflix in Windows Media Center

NI VC2008MSMs x86

Notepad++

OhmForce Ohmboyz VST2

OverDrive Media Console

OziExplorer 3.95

PDF Settings CS5

Picasa 3

PlayReady PC Runtime x86

Project5 Version 2.5

Python 2.7 pycrypto-2.3

Python 2.7.3

PythonTurtle 0.1

Quicken 2011

QuickTime

Rapture 1.1

Realtek High Definition Audio Driver

Revo Uninstaller 1.94

Safari

Samplitude 10 10.0.0.0 (US)

Scratch

Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition

Security Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition

Security Update for Microsoft OneNote 2010 (KB2760600) 32-Bit Edition

Security Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit Edition

Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition

Sketchpad

Skype™ 6.1

SopCast 3.4.0

SPORE™

SportTracks 3.1

States of Matter

Stellarium 0.11.1

StreamTorrent 1.0

swMSM

Tracker

TrainingPeaks WKO+

TrueCrypt

TurboTax 2011

TurboTax 2012

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition

Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition

Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition

VLC media player 2.0.5

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0)

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Media Center Add-in for Flash

WinHTTrack Website Copier 3.46-1

WinSCP 4.3.8

XAMPP 1.7.7

Xiph.Org Open Codecs 0.85.17777

.

==== Event Viewer Messages From Past Week ========

.

3/31/2013 9:10:07 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} and APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

3/31/2013 9:03:22 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {7022A3B3-D004-4F52-AF11-E9E987FEE25F} and APPID {ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D} to the user sluggo-PC\sluggo SID (S-1-5-21-4213201847-2594826557-910303953-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

3/31/2013 9:02:40 AM, Error: Microsoft-Windows-IIS-W3SVC [1004] - The World Wide Web Publishing Service (WWW Service) did not register the URL prefix http://*:80/ for site 1. The site has been disabled. The data field contains the error number.

3/31/2013 9:02:40 AM, Error: Microsoft-Windows-HttpEvent [15005] - Unable to bind to the underlying transport for [::]:80. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number.

3/29/2013 4:48:00 PM, Error: Microsoft-Windows-Diagnostics-Networking [5300] - An error occurred. The Network Diagnostics Framework failed to complete the repair phase of operation. A Windows Error Report was generated. [2147942487]

3/28/2013 4:43:14 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {14286318-B6CF-49A1-81FC-D74AD94902F9}. The error: "3" Happened while starting this command: "C:\Program Files\Microsoft Office 15\Root\Client\AppVLp.exe" "C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE" "C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE" -Embedding

3/28/2013 2:08:34 PM, Error: Service Control Manager [7024] - The Apache2.2 service terminated with the following service-specific error: Incorrect function.

.

==== End Of File ===========================

thanks

Maniac · March 31, 2013

Hello shmish and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Step 1

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 2

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
aswMBR log
a new fresh DDS log

shmish · March 31, 2013

aswMBR keeps crashing when I run it: avast! Antirootkit has stopped working.

MBAM

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.03.31.04

Windows 8 x86 NTFS

Internet Explorer 10.0.9200.16519

sluggo :: SLUGGO-PC [administrator]

3/31/2013 1:51:31 PM

mbam-log-2013-03-31 (13-51-31).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 325895

Time elapsed: 9 minute(s), 11 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 10.0.9200.16519 BrowserJavaVersion: 10.17.2

Run by sluggo at 15:17:44 on 2013-03-31

Microsoft Windows 8 Pro with Media Center 6.2.9200.0.1252.1.1033.18.3327.1334 [GMT -7:00]

.

AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\WINDOWS\system32\wininit.exe

C:\WINDOWS\system32\atiesrxx.exe

C:\WINDOWS\system32\dwm.exe

C:\WINDOWS\system32\atieclxx.exe

C:\WINDOWS\System32\spoolsv.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\xampp\apache\bin\httpd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\dashost.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\mqsvc.exe

C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe

C:\WINDOWS\system32\taskhostex.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

C:\xampp\apache\bin\httpd.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\DllHost.exe

C:\Users\sluggo\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\WINDOWS\splwow64.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\WINDOWS\system32\taskhost.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Adobe\Adobe Photoshop CS5\Photoshop.exe

C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\notepad.exe

C:\WINDOWS\system32\conhost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k RPCSS

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork

C:\WINDOWS\system32\svchost.exe -k apphost

C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\svchost.exe -k iissvcs

C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet

C:\WINDOWS\System32\svchost.exe -k WerSvcGroup