Microsoft.com trojan ?

Reaper · January 30, 2015

Started getting Access Denied errors for almost any operation, can't start my antivirus programs (AVG or MalWareBytes). Tried installing MWB in Safe Mode but that did not work either.

I accidentally launched RKill (Rkill.txt attached) before running FRST, will that be a problem?

Addition.txt attached

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-01-2015 01

Ran by Philip (administrator) on PJH01 on 29-01-2015 20:02:11

Running from C:\Documents and Settings\Philip\My Documents\Downloads

Loaded Profiles: Philip (Available profiles: Philip & Dad & Mom & UpdatusUser & Administrator)

Platform: Microsoft Windows XP Home Edition Service Pack 2 (X86) OS Language: English (United States)

Internet Explorer Version 6 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG2015\avgrsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG2015\avgcsrvx.exe

(Acronis) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG2015\avgidsagent.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe

(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe

(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Google Inc.) C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe

(Google Inc.) C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

(Seagate) C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe

(Acronis) C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe

(Acronis) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe

(Microsoft Corp.) C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe

(RealNetworks, Inc.) C:\Program Files\Real\realplayer\Update\realsched.exe

() C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe

() C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe

() C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe

() C:\Program Files\ASUS\AASP\1.00.91\aaCenter.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

(Google Inc.) C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe

(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DiscWizardMonitor.exe] => C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [1169744 2007-04-19] (Seagate)

HKLM\...\Run: [AcronisTimounterMonitor] => C:\Program Files\Seagate\DiscWizard\TimounterMonitor.exe [1945688 2007-04-19] (Acronis)

HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [149024 2007-04-19] (Acronis)

HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)

HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [116040 2008-07-10] (Apple Inc.)

HKLM\...\Run: [MRT] => "C:\WINDOWS\system32\MRT.exe" /R

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [77824 2009-07-23] (Apple Computer, Inc.)

HKLM\...\Run: [Malwarebytes Anti-Malware (reboot)] => "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-07-09] (Nero AG)

HKLM\...\Run: [iMJPMIG8.1] => C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [208952 2004-08-03] (Microsoft Corporation)

HKLM\...\Run: [MSPY2002] => C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [59392 2004-08-03] ()

HKLM\...\Run: [PHIME2002ASync] => C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2004-08-03] (Microsoft Corporation)

HKLM\...\Run: [PHIME2002A] => C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [455168 2004-08-03] (Microsoft Corporation)

HKLM\...\Run: [Logitech Utility] => C:\WINDOWS\Logi_MwX.Exe [19968 2003-12-17] (Logitech Inc.)

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\WINDOWS\KHALMNPR.EXE [55824 2009-06-17] (Logitech, Inc.)

HKLM\...\Run: [unlockerAssistant] => C:\Program Files\Unlocker\UnlockerAssistant.exe [17408 2010-07-04] ()

HKLM\...\Run: [bing Bar] => C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe [243544 2010-03-24] (Microsoft Corp.)

HKLM\...\Run: [Microsoft Default Manager] => C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288088 2009-11-11] (Microsoft Corporation)

HKLM\...\Run: [TkBellExe] => C:\program files\real\realplayer\update\realsched.exe [274608 2010-12-05] (RealNetworks, Inc.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16859648 2008-01-29] (Realtek Semiconductor Corp.)

HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [69632 2005-05-03] (Realtek Semiconductor Corp.)

HKLM\...\Run: [Ai Nap] => C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe [1431040 2009-05-25] ()

HKLM\...\Run: [QFan Help] => C:\Program Files\ASUS\Ai Suite\QFan3\QFanHelp.exe [598528 2009-04-30] ()

HKLM\...\Run: [CPU Power Monitor] => C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe [627200 2008-01-09] ()

HKLM\...\Run: [ASUS Energy Saving] => C:\Program Files\ASUS\Ai Suite\EnergySaving\PwSave.exe [1352704 2009-01-22] ()

HKLM\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [881152 2007-11-30] ()

HKLM\...\Run: [sunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [249064 2010-10-29] (Sun Microsystems, Inc.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

HKLM\...\Run: [NvMediaCenter] => RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login

HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [1632360 2011-05-04] ()

HKLM\...\Run: [vProt] => "C:\Program Files\AVG Secure Search\vprot.exe"

HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG2015\avgui.exe [0 ] (AVG Technologies CZ, s.r.o.)

Winlogon\Notify\avgrsstarter: avgrsstx.dll [X]

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\Run: [steam] => C:\Program Files\Valve\Steam\\Steam.exe [1938624 2014-10-21] (Valve Corporation)

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\Run: [DW6] => "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2008-06-24] (Nero AG)

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\Run: [Google Update] => C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [136176 2011-05-21] (Google Inc.)

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\Run: [setMyHomePage] => C:\Documents and Settings\Philip\Application Data\SetMyHomePage\setmyhomepage.exe

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\CurrentVersion\Windows: [Load] C:\WINDOWS\system32\Microsoft.com <===== ATTENTION

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\MountPoints2: D - D:\panel.exe

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\MountPoints2: {1c04fb32-ef46-11de-8870-806d6172696f} - D:\autorun.exe

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\MountPoints2: {2a19b408-eefe-11de-a0da-806d6172696f} - D:\autorun.exe

HKU\S-1-5-21-839522115-507921405-1343024091-1004\...\MountPoints2: {3991db60-a0ae-11dc-8f75-806d6172696f} - D:\setup.exe

HKU\S-1-5-18\...\RunOnce: [WindowsUpdate] => C:\WINDOWS\system32\Microsoft.com [339456 2014-04-07] ()

HKU\S-1-5-18\...\CurrentVersion\Windows: [Load] C:\WINDOWS\system32\Microsoft.com <===== ATTENTION

AppInit_DLLs: c:\windows\system32\natapafu.dll => c:\windows\system32\natapafu.dll File Not Found

AppInit_DLLs: C:\WINDOWS\system32\tetuluyu.dll => C:\WINDOWS\system32\tetuluyu.dll File Not Found

AppInit_DLLs: dbuemr.dll => dbuemr.dll File Not Found

AppInit_DLLs: c:\windows\system32\pabinula.dll => c:\windows\system32\pabinula.dll File Not Found

AppInit_DLLs: c:\windows\system32\, C:\WINDOWS\system32\nikonome.dll => C:\WINDOWS\system32\nikonome.dll File Not Found

IFEO\AAWService.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\AAWTray.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\Ad-AwareAdmin.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\AvastSvc.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\AvastUI.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avcenter.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avconfig.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avgchsvx.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avgemc.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avgnt.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avguard.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avp.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\avscan.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\bdagent.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\ccuac.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\ComboFix.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\egui.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\hijackthis.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\instup.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\keyscrambler.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\loggingserver.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\mbam.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\mbamgui.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\mbampt.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\mbamscheduler.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\mbamservice.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\MpCmdRun.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\MSASCui.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\MsMpEng.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\msseces.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\rstrui.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\spybotsd.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\ToolbarUpdater.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\vprot.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\wireshark.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

IFEO\zlclient.exe: [Debugger] C:\WINDOWS\system32\Microsoft.com

Lsa: [Authentication Packages] msv1_0 relog_ap

Lsa: [Notification Packages] scecli C:\WINDOWS\system32\suduvide.dll C:\WINDOWS\system32\gumakona.dll C:\WINDOWS\system32\tetuluyu.dll C:\WINDOWS\system32\nikonome.dll

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Windows Update.lnk

ShortcutTarget: Microsoft Windows Update.lnk -> C:\Documents and Settings\Philip\Application Data\Microsoft\schost.exe (Oracle Corporation)

ShellIconOverlayIdentifiers: [Offline Files] -> {750fdf0e-2a26-11d1-a3ea-080036587f03} => No File

BootExecute: autocheck autochk * C:\PROGRA~1\AVG2015\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKU\S-1-5-21-839522115-507921405-1343024091-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://terra.im/

HKU\S-1-5-21-839522115-507921405-1343024091-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://terra.im/

HKU\S-1-5-21-839522115-507921405-1343024091-1004\Software\Microsoft\Internet Explorer\Main,Search Bar = http://terra.im/

URLSearchHook: HKU\S-1-5-21-839522115-507921405-1343024091-1004 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "" <======= ATTENTION

SearchScopes: HKLM -> DefaultScope {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL =

SearchScopes: HKU\.DEFAULT -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}

SearchScopes: HKU\S-1-5-21-839522115-507921405-1343024091-1004 -> DefaultScope {4187F0FC-AF41-4E4B-AE67-84C8FD35A0AE} URL = http://terra.im/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-839522115-507921405-1343024091-1004 -> {4187F0FC-AF41-4E4B-AE67-84C8FD35A0AE} URL = http://terra.im/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-839522115-507921405-1343024091-1004 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={6DC35883-7579-4889-A170-C63D0EA0670C}&mid=881b997898b6f2b25fa352d5bbcfaa1b-0664d2e18c7e20d85f148e7837320b9bb2a9f558〈=us&ds=AVG&pr=fr&d=2011-12-2518:34:25&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}

BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

BHO: No Name -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> No File

BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File

BHO: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)

Toolbar: HKLM - @C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File

Toolbar: HKU\S-1-5-21-839522115-507921405-1343024091-1004 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1422515146750

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll (AVG Secure Search)

Winsock: Catalog5 01 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.1

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Philip\Application Data\Mozilla\Firefox\Profiles\i7gk6t8f.default

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.)

FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll (AVG Technologies)

FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @Microsoft.com/NpWinExt,version=5.0 -> C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=12.0.1.609 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=12.0.1.609 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprphtml5videoshim;version=12.0.1.609 -> C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=12.0.1.609 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.1 -> C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKU\S-1-5-21-839522115-507921405-1343024091-1004: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File

FF Plugin HKU\S-1-5-21-839522115-507921405-1343024091-1004: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-839522115-507921405-1343024091-1004: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF user.js: detected! => C:\Documents and Settings\Philip\Application Data\Mozilla\Firefox\Profiles\i7gk6t8f.default\user.js

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin8.dll (Apple Computer, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprjplug.dll (RealNetworks, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF SearchPlugin: C:\Documents and Settings\Philip\Application Data\Mozilla\Firefox\Profiles\i7gk6t8f.default\searchplugins\defaultsearch.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml

FF Extension: 1Click Downloader - C:\Documents and Settings\Philip\Application Data\Mozilla\Firefox\Profiles\i7gk6t8f.default\Extensions\OneClickDownloader@OneClickDownloader.com.xpi [2012-04-19]

FF Extension: FlashGot - C:\Documents and Settings\Philip\Application Data\Mozilla\Firefox\Profiles\i7gk6t8f.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011-05-13]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-17]

FF HKLM\...\Firefox\Extensions: [avg@igeared] - C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared

FF HKLM\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\Firefox

FF Extension: Bing Bar - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\Firefox [2010-08-01]

FF HKLM\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension

FF Extension: Search Helper Extension - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension [2010-08-01]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010-12-05]

FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Program Files\Java\jre6\lib\deploy\jqs\ff

FF Extension: Java Quick Starter - C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2011-04-12]

FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\Documents and Settings\All Users\Application Data\AVG Secure Search\FireFoxExt\17.3.0.49

Chrome:

=======

CHR Plugin: (Shockwave Flash) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\40.0.2214.93\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Computer, Inc.)

CHR Plugin: (QuickTime Plug-in 6.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin8.dll (Apple Computer, Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)

CHR Plugin: (Java Platform SE 6 U23) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)

CHR Plugin: (RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer HTML5VideoShim Plug-In (32-bit) ) - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Chrome PDF Viewer) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\40.0.2214.93\pdf.dll ()

CHR Plugin: (Chrome NaCl) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\40.0.2214.93\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Google Gears 0.5.33.0) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\40.0.2214.93\gears.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll (RealNetworks, Inc.)

CHR Plugin: (Microsoft® DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)

CHR Plugin: (Microsoft® DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Bing Bar) - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

CHR Plugin: (RealNetworks Rhapsody Player Engine) - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)

CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR Profile: C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\User Data\Default

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-28]

CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2011-05-21]

CHR Extension: (Google Wallet) - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-28]

CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2010-12-05]

CHR HKLM\...\Chrome\Extension: [jplinpmadfkdgipabgcdchbdikologlh] - C:\Program Files\1ClickDownload\1click10.crx [Not Found]

CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\Documents and Settings\All Users\Application Data\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [Not Found]

StartMenuInternet: Google Chrome - C:\Documents and Settings\Philip\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 6to4; C:\WINDOWS\System32\6to4svc.dll [100864 2010-02-11] (Microsoft Corporation) [File not signed]

R2 AcrSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [411168 2007-04-19] (Acronis)

S4 Alerter; C:\WINDOWS\system32\alrsvc.dll [17408 2004-08-04] (Microsoft Corporation) [File not signed]

S3 ALG; C:\WINDOWS\System32\alg.exe [44544 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [116040 2008-07-10] (Apple Inc.)

R2 AudioSrv; C:\WINDOWS\System32\audiosrv.dll [42496 2004-08-04] (Microsoft Corporation) [File not signed]

R2 AVGIDSAgent; C:\Program Files\AVG2015\avgidsagent.exe [0 ] (AVG Technologies CZ, s.r.o.) <==== ATTENTION (zero size file/folder)

S2 avgwd; C:\Program Files\AVG2015\avgwdsvc.exe [0 ] (AVG Technologies CZ, s.r.o.) <==== ATTENTION (zero size file/folder)

R2 BITS; C:\WINDOWS\system32\qmgr.dll [382464 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [229376 2007-07-24] (Apple Inc.) [File not signed]

S2 Browser; C:\WINDOWS\System32\browser.dll [77312 2004-08-04] (Microsoft Corporation) [File not signed]

S3 cisvc; C:\WINDOWS\system32\cisvc.exe [5632 2004-08-04] (Microsoft Corporation) [File not signed]

S4 ClipSrv; C:\WINDOWS\system32\clipsrv.exe [33280 2004-08-04] (Microsoft Corporation) [File not signed]

R2 CryptSvc; C:\WINDOWS\System32\cryptsvc.dll [60416 2004-08-04] (Microsoft Corporation) [File not signed]

R2 DcomLaunch; C:\WINDOWS\system32\rpcss.dll [399360 2009-02-09] (Microsoft Corporation) [File not signed]

R2 Dhcp; C:\WINDOWS\System32\dhcpcsvc.dll [111104 2004-08-04] (Microsoft Corporation) [File not signed]

S3 dmadmin; C:\WINDOWS\System32\dmadmin.exe [224768 2004-08-04] (Microsoft Corp., Veritas Software) [File not signed]

S3 dmserver; C:\WINDOWS\System32\dmserver.dll [23552 2004-08-04] (Microsoft Corp.) [File not signed]

R2 Dnscache; C:\WINDOWS\System32\dnsrslvr.dll [45568 2004-08-04] (Microsoft Corporation) [File not signed]

R2 ERSvc; C:\WINDOWS\System32\ersvc.dll [23040 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Eventlog; C:\WINDOWS\system32\services.exe [110592 2009-02-06] (Microsoft Corporation) [File not signed]

R3 EventSystem; C:\WINDOWS\system32\es.dll [253952 2008-07-07] (Microsoft Corporation) [File not signed]

R3 FastUserSwitchingCompatibility; C:\WINDOWS\System32\shsvcs.dll [134656 2004-08-04] (Microsoft Corporation) [File not signed]

R2 helpsvc; C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll [38912 2004-08-04] (Microsoft Corporation) [File not signed]

R2 HidServ; C:\WINDOWS\System32\hidserv.dll [21504 2004-08-04] (Microsoft Corporation) [File not signed]

S3 HTTPFilter; C:\WINDOWS\System32\w3ssl.dll [15872 2004-08-04] (Microsoft Corporation) [File not signed]

S3 ImapiService; C:\WINDOWS\system32\imapi.exe [150016 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Iprip; C:\WINDOWS\System32\iprip.dll [35328 2004-08-04] (Microsoft Corporation) [File not signed]

R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [153376 2011-02-02] (Sun Microsystems, Inc.)

R2 lanmanserver; C:\WINDOWS\System32\srvsvc.dll [96768 2004-08-04] (Microsoft Corporation) [File not signed]

R2 lanmanworkstation; C:\WINDOWS\System32\wkssvc.dll [132096 2009-06-09] (Microsoft Corporation) [File not signed]

R2 LmHosts; C:\WINDOWS\System32\lmhsvc.dll [13824 2004-08-04] (Microsoft Corporation) [File not signed]

S4 Messenger; C:\WINDOWS\System32\msgsvc.dll [33792 2004-08-04] (Microsoft Corporation) [File not signed]

S3 mnmsrvc; C:\WINDOWS\System32\mnmsrvc.exe [32768 2004-08-04] (Microsoft Corporation) [File not signed]

S3 MSDTC; C:\WINDOWS\System32\msdtc.exe [6144 2004-08-04] (Microsoft Corporation) [File not signed]

S3 MSIServer; C:\WINDOWS\System32\msiexec.exe [78848 2005-05-03] (Microsoft Corporation) [File not signed]

S4 NetDDE; C:\WINDOWS\system32\netdde.exe [111104 2004-08-04] (Microsoft Corporation) [File not signed]

S4 NetDDEdsdm; C:\WINDOWS\system32\netdde.exe [111104 2004-08-04] (Microsoft Corporation) [File not signed]

S3 Netlogon; C:\WINDOWS\system32\lsass.exe [13312 2004-08-04] (Microsoft Corporation) [File not signed]

R3 Netman; C:\WINDOWS\System32\netman.dll [198144 2004-08-04] (Microsoft Corporation) [File not signed]

R3 Nla; C:\WINDOWS\System32\mswsock.dll [245248 2008-06-20] (Microsoft Corporation) [File not signed]

S3 NtLmSsp; C:\WINDOWS\system32\lsass.exe [13312 2004-08-04] (Microsoft Corporation) [File not signed]

S3 NtmsSvc; C:\WINDOWS\system32\ntmssvc.dll [435200 2004-08-04] (Microsoft Corporation) [File not signed]

S2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2214504 2011-05-24] (NVIDIA Corporation)

S3 p2pgasvc; C:\WINDOWS\system32\p2pgasvc.dll [86016 2004-08-04] (Microsoft Corporation) [File not signed]

S3 p2pimsvc; C:\WINDOWS\system32\p2psvc.dll [526848 2004-08-04] (Microsoft Corporation) [File not signed]

S3 p2psvc; C:\WINDOWS\system32\p2psvc.dll [526848 2004-08-04] (Microsoft Corporation) [File not signed]

R2 PlugPlay; C:\WINDOWS\system32\services.exe [110592 2009-02-06] (Microsoft Corporation) [File not signed]

S3 PNRPSvc; C:\WINDOWS\system32\p2psvc.dll [526848 2004-08-04] (Microsoft Corporation) [File not signed]

R2 PolicyAgent; C:\WINDOWS\system32\lsass.exe [13312 2004-08-04] (Microsoft Corporation) [File not signed]

R2 ProtectedStorage; C:\WINDOWS\system32\lsass.exe [13312 2004-08-04] (Microsoft Corporation) [File not signed]

S3 RasAuto; C:\WINDOWS\System32\rasauto.dll [89088 2004-08-04] (Microsoft Corporation) [File not signed]

R3 RasMan; C:\WINDOWS\System32\rasmans.dll [174080 2004-08-04] (Microsoft Corporation) [File not signed]

S3 RDSessMgr; C:\WINDOWS\system32\sessmgr.exe [140800 2004-08-04] (Microsoft Corporation) [File not signed]

S4 RemoteAccess; C:\WINDOWS\System32\mprdim.dll [49152 2001-08-18] (Microsoft Corporation) [File not signed]

S3 RpcLocator; C:\WINDOWS\system32\locator.exe [75264 2004-08-04] (Microsoft Corporation) [File not signed]

R2 RpcSs; C:\WINDOWS\system32\rpcss.dll [399360 2009-02-09] (Microsoft Corporation) [File not signed]

S3 RSVP; C:\WINDOWS\system32\rsvp.exe [132608 2001-08-18] (Microsoft Corporation) [File not signed]

R2 SamSs; C:\WINDOWS\system32\lsass.exe [13312 2004-08-04] (Microsoft Corporation) [File not signed]

S3 SCardSvr; C:\WINDOWS\System32\SCardSvr.exe [95744 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Schedule; C:\WINDOWS\system32\schedsvc.dll [190976 2004-08-04] (Microsoft Corporation) [File not signed]

R2 seclogon; C:\WINDOWS\System32\seclogon.dll [18944 2004-08-04] (Microsoft Corporation) [File not signed]

R2 SENS; C:\WINDOWS\system32\sens.dll [38912 2004-08-04] (Microsoft Corporation) [File not signed]

R2 SharedAccess; C:\WINDOWS\System32\ipnathlp.dll [331264 2004-08-04] (Microsoft Corporation) [File not signed]

R2 ShellHWDetection; C:\WINDOWS\System32\shsvcs.dll [134656 2004-08-04] (Microsoft Corporation) [File not signed]

S2 SimpTcp; C:\WINDOWS\System32\tcpsvcs.exe [19456 2001-08-18] (Microsoft Corporation) [File not signed]

S2 SNMP; C:\WINDOWS\System32\snmp.exe [33280 2006-11-20] (Microsoft Corporation) [File not signed]

S3 SNMPTRAP; C:\WINDOWS\System32\snmptrap.exe [8704 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Spooler; C:\WINDOWS\system32\spoolsv.exe [57856 2004-08-04] (Microsoft Corporation) [File not signed]

R2 srservice; C:\WINDOWS\system32\srsvc.dll [170496 2004-08-04] (Microsoft Corporation) [File not signed]

R3 SSDPSRV; C:\WINDOWS\System32\ssdpsrv.dll [71680 2004-08-04] (Microsoft Corporation) [File not signed]

S3 stisvc; C:\WINDOWS\system32\wiaservc.dll [333312 2004-08-04] (Microsoft Corporation) [File not signed]

S3 SysmonLog; C:\WINDOWS\system32\smlogsvc.exe [89600 2004-08-04] (Microsoft Corporation) [File not signed]

R3 TapiSrv; C:\WINDOWS\System32\tapisrv.dll [246272 2004-08-04] (Microsoft Corporation) [File not signed]

R3 TermService; C:\WINDOWS\System32\termsrv.dll [295424 2004-08-04] (Microsoft Corporation) [File not signed]

R2 Themes; C:\WINDOWS\System32\shsvcs.dll [134656 2004-08-04] (Microsoft Corporation) [File not signed]

R2 TrkWks; C:\WINDOWS\system32\trkwks.dll [90624 2004-08-04] (Microsoft Corporation) [File not signed]

S3 upnphost; C:\WINDOWS\System32\upnphost.dll [185344 2004-08-04] (Microsoft Corporation) [File not signed]

S3 UPS; C:\WINDOWS\System32\ups.exe [18432 2004-08-04] (Microsoft Corporation) [File not signed]

S3 VSS; C:\WINDOWS\System32\vssvc.exe [289792 2004-08-04] (Microsoft Corporation) [File not signed]

S2 vToolbarUpdater17.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [1771544 2014-01-08] (AVG Secure Search)

R2 W32Time; C:\WINDOWS\system32\w32time.dll [174592 2004-08-04] (Microsoft Corporation) [File not signed]

R2 WebClient; C:\WINDOWS\System32\webclnt.dll [67584 2004-08-04] (Microsoft Corporation) [File not signed]

R2 winmgmt; C:\WINDOWS\system32\wbem\WMIsvc.dll [144896 2004-08-04] (Microsoft Corporation) [File not signed]

S3 WmdmPmSN; C:\WINDOWS\System32\mspmsnsv.dll [52224 2004-08-04] (Microsoft Corporation) [File not signed]

S3 WmiApSrv; C:\WINDOWS\system32\wbem\wmiapsrv.exe [126464 2004-08-04] (Microsoft Corporation) [File not signed]

S3 WMPNetworkSvc; C:\Program Files\Windows Media Player\WMPNetwk.exe [913408 2006-10-18] (Microsoft Corporation) [File not signed]

R2 wscsvc; C:\WINDOWS\system32\wscsvc.dll [81408 2004-08-04] (Microsoft Corporation) [File not signed]

R2 wuauserv; C:\WINDOWS\system32\wuauserv.dll [6656 2004-08-04] (Microsoft Corporation) [File not signed]

S3 WudfSvc; C:\WINDOWS\System32\WUDFSvc.dll [55808 2006-09-28] (Microsoft Corporation) [File not signed]

R2 WZCSVC; C:\WINDOWS\System32\wzcsvc.dll [359936 2004-08-04] (Microsoft Corporation) [File not signed]

S3 xmlprov; C:\WINDOWS\System32\xmlprov.dll [129536 2004-08-04] (Microsoft Corporation) [File not signed]

S2 Lavasoft Ad-Aware Service; "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 ACPI; C:\WINDOWS\System32\DRIVERS\ACPI.sys [187776 2004-08-03] (Microsoft Corporation) [File not signed]

S4 ACPIEC; C:\WINDOWS\system32\Drivers\ACPIEC.sys [11648 2001-08-18] (Microsoft Corporation) [File not signed]

S3 aec; C:\WINDOWS\System32\drivers\aec.sys [142464 2004-08-04] (Microsoft Corporation) [File not signed]

R1 AFD; C:\WINDOWS\System32\drivers\afd.sys [138368 2008-08-14] (Microsoft Corporation) [File not signed]

S1 AmdK7; C:\WINDOWS\System32\DRIVERS\amdk7.sys [37376 2004-08-04] (Microsoft Corporation) [File not signed]

R3 Arp1394; C:\WINDOWS\System32\DRIVERS\arp1394.sys [60800 2004-08-04] (Microsoft Corporation) [File not signed]

R1 AsIO; C:\WINDOWS\System32\drivers\AsIO.sys [12400 2007-12-17] ()

S3 AsyncMac; C:\WINDOWS\System32\DRIVERS\asyncmac.sys [14336 2004-08-03] (Microsoft Corporation) [File not signed]

R0 atapi; C:\WINDOWS\System32\DRIVERS\atapi.sys [95360 2004-08-03] (Microsoft Corporation) [File not signed]

S3 Atmarpc; C:\WINDOWS\System32\DRIVERS\atmarpc.sys [59904 2004-08-03] (Microsoft Corporation) [File not signed]

R3 audstub; C:\WINDOWS\System32\DRIVERS\audstub.sys [3072 2001-08-17] (Microsoft Corporation) [File not signed]

R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriverl; C:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [192792 2014-12-08] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [154904 2014-11-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-12-25] (AVG Technologies)

S4 cbidf2k; C:\WINDOWS\system32\Drivers\cbidf2k.sys [13952 2001-08-18] (Microsoft Corporation) [File not signed]

S1 Cdaudio; C:\WINDOWS\system32\Drivers\Cdaudio.sys [18688 2001-08-18] (Microsoft Corporation) [File not signed]

R4 Cdfs; C:\WINDOWS\system32\Drivers\Cdfs.sys [63744 2004-08-03] (Microsoft Corporation) [File not signed]

R1 Cdrom; C:\WINDOWS\System32\DRIVERS\cdrom.sys [49536 2004-08-03] (Microsoft Corporation) [File not signed]

S3 ctljystk; C:\WINDOWS\System32\DRIVERS\ctljystk.sys [3712 2001-08-17] (Creative Technology Ltd.) [File not signed]

R0 Disk; C:\WINDOWS\System32\DRIVERS\disk.sys [36352 2004-08-03] (Microsoft Corporation) [File not signed]

S4 dmboot; C:\WINDOWS\System32\drivers\dmboot.sys [799744 2004-08-03] (Microsoft Corp., Veritas Software) [File not signed]

S4 dmio; C:\WINDOWS\system32\Drivers\dmio.sys [153344 2004-08-03] (Microsoft Corp., Veritas Software) [File not signed]

S4 dmload; C:\WINDOWS\system32\Drivers\dmload.sys [5888 2001-08-18] (Microsoft Corp., Veritas Software.) [File not signed]

S3 DMusic; C:\WINDOWS\System32\drivers\DMusic.sys [52864 2004-08-03] (Microsoft Corporation) [File not signed]

S3 drmkaud; C:\WINDOWS\System32\drivers\drmkaud.sys [2944 2004-08-04] (Microsoft Corporation) [File not signed]

R4 Fastfat; C:\WINDOWS\system32\Drivers\Fastfat.sys [143360 2004-08-03] (Microsoft Corporation) [File not signed]

R3 Fdc; C:\WINDOWS\System32\DRIVERS\fdc.sys [27392 2004-08-03] (Microsoft Corporation) [File not signed]

R1 Fips; C:\WINDOWS\system32\Drivers\Fips.sys [34944 2001-08-18] (Microsoft Corporation) [File not signed]

R3 Flpydisk; C:\WINDOWS\System32\DRIVERS\flpydisk.sys [20480 2004-08-03] (Microsoft Corporation) [File not signed]

R0 FltMgr; C:\WINDOWS\System32\drivers\fltmgr.sys [124800 2004-08-03] (Microsoft Corporation) [File not signed]

U1 Fs_Rec; C:\WINDOWS\system32\Drivers\Fs_Rec.sys [7936 2001-08-18] (Microsoft Corporation) [File not signed]

R0 Ftdisk; C:\WINDOWS\System32\DRIVERS\ftdisk.sys [125056 2001-08-18] (Microsoft Corporation) [File not signed]

S3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2004-08-04] (Microsoft Corporation) [File not signed]

R3 Gpc; C:\WINDOWS\System32\DRIVERS\msgpc.sys [35072 2004-08-03] (Microsoft Corporation) [File not signed]

R3 HDAudBus; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [138752 2005-01-07] (Windows ® Server 2003 DDK provider) [File not signed]

R3 hidusb; C:\WINDOWS\System32\DRIVERS\hidusb.sys [9600 2001-08-18] (Microsoft Corporation) [File not signed]

R3 HTTP; C:\WINDOWS\System32\Drivers\HTTP.sys [263552 2009-10-20] (Microsoft Corporation) [File not signed]

R1 i8042prt; C:\WINDOWS\System32\DRIVERS\i8042prt.sys [52736 2004-08-03] (Microsoft Corporation) [File not signed]

R1 Imapi; C:\WINDOWS\System32\DRIVERS\imapi.sys [41856 2004-08-03] (Microsoft Corporation) [File not signed]

R3 IntcAzAudAddService; C:\WINDOWS\System32\drivers\RtkHDAud.sys [4725760 2008-01-30] (Realtek Semiconductor Corp.) [File not signed]

R1 intelppm; C:\WINDOWS\System32\DRIVERS\intelppm.sys [36096 2004-08-03] (Microsoft Corporation) [File not signed]

R3 ip6fw; C:\WINDOWS\System32\drivers\ip6fw.sys [29056 2004-08-03] (Microsoft Corporation) [File not signed]

S3 IpFilterDriver; C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [32896 2001-08-18] (Microsoft Corporation) [File not signed]

S3 IpInIp; C:\WINDOWS\System32\DRIVERS\ipinip.sys [20992 2004-08-03] (Microsoft Corporation) [File not signed]

R3 IpNat; C:\WINDOWS\System32\DRIVERS\ipnat.sys [134912 2004-08-03] (Microsoft Corporation) [File not signed]

R1 IPSec; C:\WINDOWS\System32\DRIVERS\ipsec.sys [74752 2004-08-03] (Microsoft Corporation) [File not signed]

S3 IRENUM; C:\WINDOWS\System32\DRIVERS\irenum.sys [11264 2004-08-03] (Microsoft Corporation) [File not signed]

R0 isapnp; C:\WINDOWS\System32\DRIVERS\isapnp.sys [35840 2001-08-18] (Microsoft Corporation) [File not signed]

R1 Kbdclass; C:\WINDOWS\System32\DRIVERS\kbdclass.sys [24576 2004-08-03] (Microsoft Corporation) [File not signed]

R1 kbdhid; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [14848 2004-08-03] (Microsoft Corporation) [File not signed]

R3 kmixer; C:\WINDOWS\System32\drivers\kmixer.sys [171776 2004-08-04] (Microsoft Corporation) [File not signed]

R0 KSecDD; C:\WINDOWS\system32\Drivers\KSecDD.sys [92544 2009-06-22] (Microsoft Corporation) [File not signed]

S3 L8042PR2; C:\WINDOWS\System32\Drivers\l8042pr2.sys [51729 2003-12-17] (Logitech, Inc.) [File not signed]

R0 Lbd; C:\WINDOWS\System32\DRIVERS\Lbd.sys [64512 2011-06-20] (Lavasoft AB)

S3 LHidFlt2; C:\WINDOWS\System32\DRIVERS\LHidFlt2.Sys [25505 2003-12-17] (Logitech, Inc.) [File not signed]

S3 LHidUsb; C:\WINDOWS\System32\Drivers\LHidUsb.Sys [37887 2003-12-17] (Logitech, Inc.) [File not signed]

S3 LMouFlt2; C:\WINDOWS\System32\Drivers\LMouFlt2.sys [70801 2003-12-17] (Logitech, Inc.) [File not signed]

R1 mnmdd; C:\WINDOWS\system32\Drivers\mnmdd.sys [4224 2001-08-18] (Microsoft Corporation) [File not signed]

S3 Modem; C:\WINDOWS\system32\Drivers\Modem.sys [30080 2004-08-04] (Microsoft Corporation) [File not signed]

R1 Mouclass; C:\WINDOWS\System32\DRIVERS\mouclass.sys [23040 2004-08-03] (Microsoft Corporation) [File not signed]

R3 mouhid; C:\WINDOWS\System32\DRIVERS\mouhid.sys [12160 2001-08-17] (Microsoft Corporation) [File not signed]

R0 MountMgr; C:\WINDOWS\system32\Drivers\MountMgr.sys [42240 2004-08-03] (Microsoft Corporation) [File not signed]

R3 MRxDAV; C:\WINDOWS\System32\DRIVERS\mrxdav.sys [181248 2004-08-03] (Microsoft Corporation) [File not signed]

R1 MRxSmb; C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [454016 2010-02-24] (Microsoft Corporation) [File not signed]

S3 MSKSSRV; C:\WINDOWS\System32\drivers\MSKSSRV.sys [7552 2004-08-04] (Microsoft Corporation) [File not signed]

S3 MSPCLOCK; C:\WINDOWS\System32\drivers\MSPCLOCK.sys [5376 2004-08-04] (Microsoft Corporation) [File not signed]

S3 MSPQM; C:\WINDOWS\System32\drivers\MSPQM.sys [4992 2004-08-04] (Microsoft Corporation) [File not signed]

R3 mssmbios; C:\WINDOWS\System32\DRIVERS\mssmbios.sys [15488 2004-08-04] (Microsoft Corporation) [File not signed]

R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-12] () [File not signed]

R0 Mup; C:\WINDOWS\system32\Drivers\Mup.sys [107904 2004-08-03] (Microsoft Corporation) [File not signed]

R0 NDIS; C:\WINDOWS\system32\Drivers\NDIS.sys [182912 2004-08-03] (Microsoft Corporation) [File not signed]

R3 NdisTapi; C:\WINDOWS\System32\DRIVERS\ndistapi.sys [9600 2001-08-18] (Microsoft Corporation) [File not signed]

R3 Ndisuio; C:\WINDOWS\System32\DRIVERS\ndisuio.sys [12928 2004-08-04] (Microsoft Corporation) [File not signed]

R3 NdisWan; C:\WINDOWS\System32\DRIVERS\ndiswan.sys [91776 2004-08-03] (Microsoft Corporation) [File not signed]

R3 NDProxy; C:\WINDOWS\system32\Drivers\NDProxy.sys [38016 2001-08-18] (Microsoft Corporation) [File not signed]

R1 NetBIOS; C:\WINDOWS\System32\DRIVERS\netbios.sys [34560 2004-08-03] (Microsoft Corporation) [File not signed]

R1 NetBT; C:\WINDOWS\System32\DRIVERS\netbt.sys [162816 2004-08-03] (Microsoft Corporation) [File not signed]

R3 NIC1394; C:\WINDOWS\System32\DRIVERS\nic1394.sys [61824 2004-08-04] (Microsoft Corporation) [File not signed]

R1 Npfs; C:\WINDOWS\system32\Drivers\Npfs.sys [30848 2004-08-03] (Microsoft Corporation) [File not signed]

R4 Ntfs; C:\WINDOWS\system32\Drivers\Ntfs.sys [574592 2004-08-03] (Microsoft Corporation) [File not signed]

R1 Null; C:\WINDOWS\system32\Drivers\Null.sys [2944 2001-08-18] (Microsoft Corporation) [File not signed]

R3 nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [12753664 2011-05-24] (NVIDIA Corporation) [File not signed]

R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [54784 2008-07-31] (NVIDIA Corporation) [File not signed]

R0 nvgts; C:\WINDOWS\System32\DRIVERS\nvgts.sys [164896 2009-06-30] (NVIDIA Corporation)

R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [22016 2008-07-31] (NVIDIA Corporation) [File not signed]

S3 NwlnkFlt; C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [12416 2001-08-18] (Microsoft Corporation) [File not signed]

S3 NwlnkFwd; C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [32512 2001-08-18] (Microsoft Corporation) [File not signed]

R0 ohci1394; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [61056 2004-08-03] (Microsoft Corporation) [File not signed]

S3 ousb2hub; C:\WINDOWS\System32\DRIVERS\ousb2hub.sys [56960 2005-06-15] (OrangeWare Corporation) [File not signed]

S2 ousbehci; C:\WINDOWS\System32\Drivers\ousbehci.sys [45440 2005-06-15] (OrangeWare Corporation) [File not signed]

R3 Parport; C:\WINDOWS\System32\DRIVERS\parport.sys [80128 2004-08-04] (Microsoft Corporation) [File not signed]

R0 PartMgr; C:\WINDOWS\system32\Drivers\PartMgr.sys [18688 2001-08-18] (Microsoft Corporation) [File not signed]

R2 ParVdm; C:\WINDOWS\system32\Drivers\ParVdm.sys [6784 2001-08-18] (Microsoft Corporation) [File not signed]

R0 PCI; C:\WINDOWS\System32\DRIVERS\pci.sys [68224 2004-08-03] (Microsoft Corporation) [File not signed]

R0 PCIIde; C:\WINDOWS\System32\DRIVERS\pciide.sys [3328 2001-08-18] (Microsoft Corporation) [File not signed]

S4 Pcmcia; C:\WINDOWS\system32\Drivers\Pcmcia.sys [119936 2004-08-03] (Microsoft Corporation) [File not signed]

R3 PptpMiniport; C:\WINDOWS\System32\DRIVERS\raspptp.sys [48384 2004-08-03] (Microsoft Corporation) [File not signed]

S1 Processor; C:\WINDOWS\System32\DRIVERS\processr.sys [35328 2004-08-04] (Microsoft Corporation) [File not signed]

R3 PSched; C:\WINDOWS\System32\DRIVERS\psched.sys [69120 2004-08-03] (Microsoft Corporation) [File not signed]

R3 Ptilink; C:\WINDOWS\System32\DRIVERS\ptilink.sys [17792 2001-08-18] (Parallel Technologies, Inc.) [File not signed]

R1 RasAcd; C:\WINDOWS\System32\DRIVERS\rasacd.sys [8832 2001-08-18] (Microsoft Corporation) [File not signed]

R3 Rasl2tp; C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [51328 2004-08-03] (Microsoft Corporation) [File not signed]

R3 RasPppoe; C:\WINDOWS\System32\DRIVERS\raspppoe.sys [41472 2004-08-03] (Microsoft Corporation) [File not signed]

R3 Raspti; C:\WINDOWS\System32\DRIVERS\raspti.sys [16512 2001-08-18] (Microsoft Corporation) [File not signed]

R1 Rdbss; C:\WINDOWS\System32\DRIVERS\rdbss.sys [176512 2004-08-03] (Microsoft Corporation) [File not signed]

R1 RDPCDD; C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [4224 2001-08-18] (Microsoft Corporation) [File not signed]

R1 redbook; C:\WINDOWS\System32\DRIVERS\redbook.sys [57472 2004-08-03] (Microsoft Corporation) [File not signed]

S3 RTLE8023xp; C:\WINDOWS\System32\DRIVERS\Rtenicxp.sys [111360 2008-08-07] (Realtek Semiconductor Corporation ) [File not signed]

S3 Secdrv; C:\WINDOWS\System32\DRIVERS\secdrv.sys [27440 2004-07-17] () [File not signed]

R3 serenum; C:\WINDOWS\System32\DRIVERS\serenum.sys [15488 2004-08-03] (Microsoft Corporation) [File not signed]

R1 Serial; C:\WINDOWS\System32\DRIVERS\serial.sys [64896 2004-08-03] (Microsoft Corporation) [File not signed]

S3 splitter; C:\WINDOWS\System32\drivers\splitter.sys [6400 2004-08-03] (Microsoft Corporation) [File not signed]

R0 sr; C:\WINDOWS\System32\DRIVERS\sr.sys [73472 2004-08-03] (Microsoft Corporation) [File not signed]

R3 Srv; C:\WINDOWS\System32\DRIVERS\srv.sys [352640 2009-12-31] (Microsoft Corporation) [File not signed]

R3 swenum; C:\WINDOWS\System32\DRIVERS\swenum.sys [4352 2004-08-04] (Microsoft Corporation) [File not signed]

S3 swmidi; C:\WINDOWS\System32\drivers\swmidi.sys [54272 2001-08-18] (Microsoft Corporation) [File not signed]

R3 sysaudio; C:\WINDOWS\System32\drivers\sysaudio.sys [60800 2004-08-04] (Microsoft Corporation) [File not signed]

R1 Tcpip; C:\WINDOWS\System32\DRIVERS\tcpip.sys [360320 2008-06-20] (Microsoft Corporation) [File not signed]

R1 Tcpip6; C:\WINDOWS\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation) [File not signed]

S3 TDPIPE; C:\WINDOWS\system32\Drivers\TDPIPE.sys [12040 2004-08-04] (Microsoft Corporation) [File not signed]

S3 TDTCP; C:\WINDOWS\system32\Drivers\TDTCP.sys [21896 2004-08-04] (Microsoft Corporation) [File not signed]

R1 TermDD; C:\WINDOWS\System32\DRIVERS\termdd.sys [40840 2004-08-04] (Microsoft Corporation) [File not signed]

R2 tifsfilter; C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [32768 2007-12-03] (Acronis) [File not signed]

R0 timounter; C:\WINDOWS\System32\DRIVERS\timntr.sys [392320 2007-12-03] (Acronis) [File not signed]

R3 tunmp; C:\WINDOWS\System32\DRIVERS\tunmp.sys [12416 2004-08-04] (Microsoft Corporation) [File not signed]

S4 Udfs; C:\WINDOWS\system32\Drivers\Udfs.sys [66176 2004-08-03] (Microsoft Corporation) [File not signed]

R3 Update; C:\WINDOWS\System32\DRIVERS\update.sys [209408 2004-08-03] (Microsoft Corporation) [File not signed]

R3 usbccgp; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [31616 2004-08-03] (Microsoft Corporation) [File not signed]

R3 usbehci; C:\WINDOWS\System32\DRIVERS\usbehci.sys [26624 2004-08-03] (Microsoft Corporation) [File not signed]

R3 usbhub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [57600 2004-08-03] (Microsoft Corporation) [File not signed]

R3 usbohci; C:\WINDOWS\System32\DRIVERS\usbohci.sys [17024 2004-08-03] (Microsoft Corporation) [File not signed]

R3 USBSTOR; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [26496 2004-08-03] (Microsoft Corporation) [File not signed]

S3 usbuhci; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [20480 2004-08-03] (Microsoft Corporation) [File not signed]

R1 VgaSave; C:\WINDOWS\System32\drivers\vga.sys [20992 2004-08-03] (Microsoft Corporation) [File not signed]

R0 viaagp; C:\WINDOWS\System32\DRIVERS\viaagp.sys [42240 2004-08-03] (Microsoft Corporation) [File not signed]

R0 ViaIde; C:\WINDOWS\System32\DRIVERS\viaide.sys [5376 2004-08-03] (Microsoft Corporation) [File not signed]

R0 VolSnap; C:\WINDOWS\system32\Drivers\VolSnap.sys [52352 2004-08-03] (Microsoft Corporation) [File not signed]

R3 Wanarp; C:\WINDOWS\System32\DRIVERS\wanarp.sys [34560 2004-08-03] (Microsoft Corporation) [File not signed]

R3 wdmaud; C:\WINDOWS\System32\drivers\wdmaud.sys [82944 2004-08-04] (Microsoft Corporation) [File not signed]

S3 WudfPf; C:\WINDOWS\System32\DRIVERS\WudfPf.sys [77568 2006-09-28] (Microsoft Corporation) [File not signed]

S3 WudfRd; C:\WINDOWS\System32\DRIVERS\wudfrd.sys [82944 2006-09-28] (Microsoft Corporation) [File not signed]

S3 cportclm; \??\C:\DOCUME~1\Philip\LOCALS~1\Temp\cportclm.sys [X]

S3 estream; \??\C:\DOCUME~1\Philip\LOCALS~1\Temp\estream.sys [X]

S4 hpt3xx; No ImagePath

S4 IntelIde; No ImagePath

S3 rtl8139; System32\DRIVERS\RTL8139.SYS [X]

U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96256 2004-08-03] (Microsoft Corporation) [File not signed]

U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]

U1 WS2IFSL; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-29 20:02 - 2015-01-29 20:02 - 00000000 ____D () C:\FRST

2015-01-29 19:48 - 2015-01-29 19:52 - 00313832 _____ () C:\Documents and Settings\Philip\Desktop\Rkill.txt

2015-01-29 19:48 - 2015-01-29 19:48 - 00000000 ____D () C:\Documents and Settings\Philip\Desktop\rkill

2015-01-28 23:16 - 2015-01-28 23:16 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Adobe

2015-01-28 22:57 - 2015-01-28 22:57 - 00000000 ____D () C:\Documents and Settings\Philip\Application Data\AVG2015

2015-01-28 22:55 - 2015-01-28 22:55 - 00000000 ____D () C:\Documents and Settings\Philip\Local Settings\Application Data\Avg2015

2015-01-28 22:54 - 2015-01-28 22:54 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\AVG2015

2015-01-28 22:53 - 2015-01-28 22:53 - 00000642 _____ () C:\Documents and Settings\All Users\Desktop\AVG 2015.lnk

2015-01-28 22:53 - 2015-01-28 22:53 - 00000000 ___HD () C:\$AVG

2015-01-28 22:53 - 2015-01-28 22:53 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\AVG

2015-01-28 22:53 - 2015-01-28 22:53 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVG2015

2015-01-28 22:53 - 2015-01-28 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\TuneUp Software

2015-01-28 22:52 - 2015-01-28 22:53 - 00000000 ____D () C:\Program Files\AVG2015

2015-01-28 22:48 - 2015-01-28 22:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla

2015-01-28 22:48 - 2015-01-28 22:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Mozilla

2015-01-28 22:11 - 2015-01-29 12:44 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\MFAData

2015-01-28 22:11 - 2015-01-28 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Avg2015

2015-01-28 22:11 - 2015-01-28 22:11 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\MFAData

2015-01-28 21:55 - 2015-01-28 21:55 - 00020072 _____ () C:\Documents and Settings\UpdatusUser\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2015-01-28 21:51 - 2015-01-28 21:51 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-01-28 21:51 - 2015-01-28 21:51 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-28 21:51 - 2014-11-21 06:14 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-01-28 21:51 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-01-28 21:11 - 2015-01-28 21:11 - 00020072 _____ () C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2015-01-28 20:50 - 2015-01-29 18:45 - 00000178 ___SH () C:\Documents and Settings\Administrator\ntuser.ini

2015-01-28 20:50 - 2015-01-28 22:53 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Temp

2015-01-28 20:50 - 2015-01-28 20:50 - 00000000 ____D () C:\Documents and Settings\Administrator

2015-01-28 20:50 - 2010-06-28 19:49 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Macromedia

2015-01-28 20:50 - 2009-12-22 13:48 - 00001599 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk

2015-01-28 20:50 - 2009-12-22 13:48 - 00000792 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk

2015-01-28 20:50 - 2009-12-22 13:47 - 00000000 ___RD () C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories

2015-01-28 18:16 - 2015-01-28 23:32 - 00000000 ____D () C:\TEMP

2015-01-25 10:19 - 2015-01-25 10:19 - 00000000 ____D () C:\WINDOWS\system32\Adobe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-29 20:02 - 2007-12-01 23:39 - 00000000 ____D () C:\Documents and Settings\Philip\Local Settings\Temp

2015-01-29 19:57 - 2007-12-01 23:39 - 00000000 ____D () C:\Documents and Settings\Philip

2015-01-29 19:48 - 2011-04-22 00:47 - 00000316 ___SH () C:\WINDOWS\Tasks\okoalmjjj.job

2015-01-29 19:48 - 2011-04-22 00:47 - 00000316 ___SH () C:\WINDOWS\Tasks\Ixsrtjjfv.job

2015-01-29 19:48 - 2011-04-22 00:47 - 00000312 ___SH () C:\WINDOWS\Tasks\QPORHAZNL.job

2015-01-29 19:45 - 2007-12-01 23:59 - 01523271 _____ () C:\WINDOWS\WindowsUpdate.log

2015-01-29 19:42 - 2007-12-02 14:04 - 00000000 ____D () C:\Program Files\BitComet

2015-01-29 19:39 - 2012-04-04 02:13 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-01-29 19:31 - 2011-05-21 12:34 - 00000982 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-507921405-1343024091-1004UA.job

2015-01-29 18:58 - 2011-05-21 12:35 - 00002315 _____ () C:\Documents and Settings\Philip\Desktop\Google Chrome.lnk

2015-01-29 18:56 - 2007-12-01 23:30 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-01-29 18:41 - 2007-12-01 23:39 - 00000178 ___SH () C:\Documents and Settings\Philip\ntuser.ini

2015-01-29 18:41 - 2007-12-01 23:35 - 00032298 _____ () C:\WINDOWS\SchedLgU.Txt

2015-01-29 17:31 - 2011-05-21 12:34 - 00000930 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-507921405-1343024091-1004Core.job

2015-01-28 23:29 - 2009-02-04 00:57 - 00000000 ____D () C:\Documents and Settings\Philip\Start Menu\Programs\PINKBELLSOFTWARE

2015-01-28 23:29 - 2007-12-03 12:02 - 00000000 ____D () C:\Documents and Settings\Philip\Start Menu\Programs\Thief The Dark Theme

2015-01-28 23:25 - 2014-10-06 10:51 - 00000000 __SHD () C:\Program Files\Windows Manager

2015-01-28 23:07 - 2014-05-20 17:46 - 00000280 _____ () C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-839522115-507921405-1343024091-1004.job

2015-01-28 23:07 - 2010-12-05 17:30 - 00000288 _____ () C:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-839522115-507921405-1343024091-1004.job

2015-01-28 23:07 - 2001-08-18 04:00 - 00001374 _____ () C:\WINDOWS\system32\wpa.dbl

2015-01-28 22:53 - 2009-12-22 13:35 - 01111583 _____ () C:\WINDOWS\setupapi.log

2015-01-28 21:48 - 2011-04-20 19:50 - 00000064 _____ () C:\WINDOWS\system32\rp_stats.dat

2015-01-28 21:48 - 2011-04-20 19:50 - 00000044 _____ () C:\WINDOWS\system32\rp_rules.dat

2015-01-28 21:11 - 2009-10-09 00:56 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes

2015-01-28 20:09 - 2011-05-12 22:53 - 00000178 ___SH () C:\Documents and Settings\UpdatusUser\ntuser.ini

2015-01-28 17:27 - 2012-04-25 20:34 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2015-01-28 09:26 - 2014-10-14 18:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2015-01-25 10:14 - 2008-03-13 06:30 - 00000000 ____D () C:\Documents and Settings\Philip\Local Settings\Application Data\Adobe

2015-01-25 08:39 - 2012-04-04 02:13 - 00701616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe

2015-01-25 08:39 - 2011-05-21 12:24 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

2015-01-23 12:28 - 2008-03-20 20:55 - 00000284 _____ () C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

2015-01-23 01:33 - 2010-09-22 02:48 - 00000000 ___HD () C:\Documents and Settings\Philip\Application Data\vlc

2015-01-09 03:17 - 2009-12-29 21:03 - 00000069 _____ () C:\WINDOWS\NeroDigital.ini

2015-01-09 03:17 - 2007-12-02 15:25 - 00045056 _____ () C:\Documents and Settings\Philip\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-01-08 15:23 - 2007-12-01 15:21 - 00000216 _____ () C:\WINDOWS\wiadebug.log

2015-01-07 20:41 - 2007-12-01 15:21 - 00000048 _____ () C:\WINDOWS\wiaservc.log

==================== Files in the root of some directories =======

2013-06-26 04:39 - 2014-01-08 06:33 - 0003728 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml

2010-03-27 04:48 - 2010-03-27 04:48 - 0000135 ____H () C:\Documents and Settings\Philip\Application Data\default.pls

2011-04-12 22:26 - 2011-04-13 02:27 - 0014688 ___SH () C:\Documents and Settings\Philip\Local Settings\Application Data\1064911305

2011-04-22 22:00 - 2011-04-22 22:50 - 0017738 ___SH () C:\Documents and Settings\Philip\Local Settings\Application Data\b2t5a3uth3e15m2xs3s8l52f31plit8

2007-12-02 15:25 - 2015-01-09 03:17 - 0045056 _____ () C:\Documents and Settings\Philip\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some content of TEMP:

====================

C:\Documents and Settings\Philip\Local Settings\Temp\stuprt.exe

C:\Documents and Settings\Philip\Local Settings\Temp\_is4.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => MD5 is legit

C:\WINDOWS\system32\winlogon.exe => MD5 is legit

C:\WINDOWS\system32\svchost.exe => MD5 is legit

C:\WINDOWS\system32\services.exe => MD5 is legit

C:\WINDOWS\system32\User32.dll => MD5 is legit

C:\WINDOWS\system32\userinit.exe => MD5 is legit

C:\WINDOWS\system32\rpcss.dll

[2004-08-04 00:56] - [2009-02-09 02:20] - 0399360 ____A (Microsoft Corporation) 01095febf33beea00c2a0730b9b3ec28

ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.

C:\WINDOWS\system32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

FRST.txt

Addition.txt

Rkill.txt

dbreeze · January 30, 2015

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Running Rkill first is not a problem. I am reviewing your logs now and will have a start on the clean up soon.

Can you tell me if you are having any strange audio ads playing in the background or anything similar?

dbreeze · January 30, 2015

Much work to be done on your system but it is do-able!!! Let's get started, ok??

Download the attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST by double clicking on the FRST.exe file. The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show that it is ready to use (meaning there is no update found) and you can continue on. Press the Fix button just once and wait. The tool will create a restore point, process the script and ask for a restart of your system.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post the log in your next reply.

Fixlist.txt

Reaper · January 30, 2015

Thanks very much for taking this on dbreeze...

P2P/Piracy Warning:

Running Rkill first is not a problem. I am reviewing your logs now and will have a start on the clean up soon.

Can you tell me if you are having any strange audio ads playing in the background or anything similar?

As this is my son's machine, I'll have to ask him tonight, but he didn't mention any audio weirdness.

Much work to be done on your system but it is do-able!!! Let's get started, ok??

Download the attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST by double clicking on the FRST.exe file. The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show that it is ready to use (meaning there is no update found) and you can continue on. Press the Fix button just once and wait. The tool will create a restore point, process the script and ask for a restart of your system.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post the log in your next reply.

We're living on different 'shifts' here (we keep strange hours) so a reply to these tasks will need to wait until I get back from work in about 14 hours; then I can get back on his machine again. Thanks again!

Reaper · January 31, 2015

Running FRST it crashed just before restart,relaunched it and restarted.

Fixlog.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 28-01-2015 01

Ran by Philip at 2015-01-30 22:32:50 Run:2

Running from C:\Documents and Settings\Philip\My Documents\Downloads

Loaded Profiles: Philip (Available profiles: Philip & Dad & Mom & UpdatusUser & Administrator)

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

start

CreateRestorePoint:

CloseProcesses: