10 replies to this topic

[dmw18045]

Hi,

I managed to get a trojan on my PC yesterday (always fun). I started searching in Google and came across the advise posted on this forum in the post titled: Trojan Agent 3 and winrscmde

I started by running Malwarebytes last evening it took almost 21 hours to complete but it did find some nasty stuff as follows from the log:
Files Detected: 7
C:\ProgramData\Microsoft\Windows\DRM\87D2.tmp (Rootkit.ZeroAccess) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\DRM\87D2.tmp.dat (Trojan.Agent.EXPD1) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\DRM\87F2.tmp (Rootkit.ZeroAccess) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\DRM\BB11.tmp (Trojan.Agent.EXPD1) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\DRM\ncrypt.dll (Trojan.Agent.EXPD1) -> Quarantined and deleted successfully.
C:\Users\dmweiss\AppData\Local\Temp\889E.tmp (Trojan.Agent.EXPD1) -> Quarantined and deleted successfully.
C:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

After I rebooted the winrscmde was still making an appearance. Based on the post I found above I wasn't surprised. I then downloaded TDSSKiller as advised in that post and it found some other items. After the cure ran, I let the PC reboot and the winrscmde seems to now be gone. I'm posting my last TDSSKiller scan directly below. There are 2 lines at the very end (related to TDSS filesystem). The final step suggested in the Trojan Agent 3 and winrscmde post was to delete these. I'm assuming that meant running TDSSKiller one more time and selecting the option to delete the threat entitled TDSS File system.

I just want to check before doing so.... I certainly don't want to hose up my PC.


The output from my final TDSSKiller scan follows. I've bolded the 2 lines that I'm referencing.

Malwarebytes team input very greatly appreciated!

Thanks!
Denise Weiss


20:13:35.0875 5368 TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
20:13:36.0397 5368 ============================================================
20:13:36.0397 5368 Current date / time: 2012/07/26 20:13:36.0397
20:13:36.0397 5368 SystemInfo:
20:13:36.0397 5368
20:13:36.0397 5368 OS Version: 6.0.6001 ServicePack: 1.0
20:13:36.0397 5368 Product type: Workstation
20:13:36.0398 5368 ComputerName: DMWEISS2
20:13:36.0398 5368 UserName: dmweiss
20:13:36.0398 5368 Windows directory: C:\Windows
20:13:36.0398 5368 System windows directory: C:\Windows
20:13:36.0398 5368 Running under WOW64
20:13:36.0398 5368 Processor architecture: Intel x64
20:13:36.0398 5368 Number of processors: 8
20:13:36.0398 5368 Page size: 0x1000
20:13:36.0398 5368 Boot type: Normal boot
20:13:36.0398 5368 ============================================================
20:13:36.0846 5368 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:13:36.0973 5368 ============================================================
20:13:36.0973 5368 \Device\Harddisk0\DR0:
20:13:36.0973 5368 MBR partitions:
20:13:36.0973 5368 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C000
20:13:36.0973 5368 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x557E5EF0
20:13:36.0973 5368 ============================================================
20:13:36.0997 5368 C: <-> \Device\Harddisk0\DR0\Partition1
20:13:37.0024 5368 D: <-> \Device\Harddisk0\DR0\Partition0
20:13:37.0024 5368 ============================================================
20:13:37.0024 5368 Initialize success
20:13:37.0024 5368 ============================================================
20:13:45.0407 1004 ============================================================
20:13:45.0407 1004 Scan started
20:13:45.0407 1004 Mode: Manual; SigCheck; TDLFS;
20:13:45.0407 1004 ============================================================
20:13:47.0302 1004 ACPI (af3a1aa81f875169dd9e55b1320057d6) C:\Windows\system32\drivers\acpi.sys
20:13:47.0497 1004 ACPI - ok
20:13:47.0864 1004 AdobeActiveFileMonitor9.0 (c004f38974f4d321b4c20a240e1175c0) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
20:13:47.0916 1004 AdobeActiveFileMonitor9.0 - ok
20:13:47.0951 1004 adp94xx (f14215e37cf124104575073f782111d2) C:\Windows\system32\drivers\adp94xx.sys
20:13:47.0969 1004 adp94xx - ok
20:13:47.0997 1004 adpahci (7d05a75e3066861a6610f7ee04ff085c) C:\Windows\system32\drivers\adpahci.sys
20:13:48.0014 1004 adpahci - ok
20:13:48.0047 1004 adpu160m (820a201fe08a0c345b3bedbc30e1a77c) C:\Windows\system32\drivers\adpu160m.sys
20:13:48.0057 1004 adpu160m - ok
20:13:48.0073 1004 adpu320 (9b4ab6854559dc168fbb4c24fc52e794) C:\Windows\system32\drivers\adpu320.sys
20:13:48.0084 1004 adpu320 - ok
20:13:48.0125 1004 AeLookupSvc (0f421175574bfe0bf2f4d8e910a253bb) C:\Windows\System32\aelupsvc.dll
20:13:48.0170 1004 AeLookupSvc - ok
20:13:48.0206 1004 AFD (9bb97042fa331a0fb4bdd98b9280a50a) C:\Windows\system32\drivers\afd.sys
20:13:48.0266 1004 AFD - ok
20:13:48.0319 1004 agp440 (f6f6793b7f17b550ecfdbd3b229173f7) C:\Windows\system32\drivers\agp440.sys
20:13:48.0331 1004 agp440 - ok
20:13:48.0350 1004 aic78xx (222cb641b4b8a1d1126f8033f9fd6a00) C:\Windows\system32\drivers\djsvs.sys
20:13:48.0362 1004 aic78xx - ok
20:13:48.0378 1004 ALG (5922f4f59b7868f3d74bbbbeb7b825a3) C:\Windows\System32\alg.exe
20:13:48.0411 1004 ALG - ok
20:13:48.0460 1004 aliide (9544c2c55541c0c6bfd7b489d0e7d430) C:\Windows\system32\drivers\aliide.sys
20:13:48.0510 1004 aliide - ok
20:13:48.0562 1004 amdide (970fa5059e61e30d25307b99903e991e) C:\Windows\system32\drivers\amdide.sys
20:13:48.0572 1004 amdide - ok
20:13:48.0586 1004 AmdK8 (cdc3632a3a5ea4dbb83e46076a3165a1) C:\Windows\system32\drivers\amdk8.sys
20:13:48.0617 1004 AmdK8 - ok
20:13:48.0669 1004 Appinfo (9c37b3fd5615477cb9a0cd116cf43f5c) C:\Windows\System32\appinfo.dll
20:13:48.0689 1004 Appinfo - ok
20:13:48.0938 1004 Apple Mobile Device (2e3e53a6aef23e24f402c7855b9b1542) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:13:49.0003 1004 Apple Mobile Device - ok
20:13:49.0024 1004 AppMgmt (3da98c07b18a676180fe7eed924d1673) C:\Windows\System32\appmgmts.dll
20:13:49.0039 1004 AppMgmt - ok
20:13:49.0053 1004 arc (ba8417d4765f3988ff921f30f630e303) C:\Windows\system32\drivers\arc.sys
20:13:49.0065 1004 arc - ok
20:13:49.0074 1004 arcsas (9d41c435619733b34cc16a511e644b11) C:\Windows\system32\drivers\arcsas.sys
20:13:49.0086 1004 arcsas - ok
20:13:49.0117 1004 AsyncMac (22d13ff3dafec2a80634752b1eaa2de6) C:\Windows\system32\DRIVERS\asyncmac.sys
20:13:49.0153 1004 AsyncMac - ok
20:13:49.0174 1004 atapi (f988bb0690cd660318037908e9b8dbf7) C:\Windows\system32\drivers\atapi.sys
20:13:49.0230 1004 atapi - ok
20:13:49.0252 1004 AudioEndpointBuilder (2a54b6a48ab6d2166271b05e9469326e) C:\Windows\System32\Audiosrv.dll
20:13:49.0291 1004 AudioEndpointBuilder - ok
20:13:49.0295 1004 AudioSrv (2a54b6a48ab6d2166271b05e9469326e) C:\Windows\System32\Audiosrv.dll
20:13:49.0330 1004 AudioSrv - ok
20:13:49.0365 1004 BCM42RLY (a7c9995ba861fce78b2ceaae61d39fd7) C:\Windows\system32\drivers\BCM42RLY.sys
20:13:49.0427 1004 BCM42RLY - ok
20:13:49.0510 1004 BCM43XX (d32f962b71fee6bdaaee630bb2c17280) C:\Windows\system32\DRIVERS\bcmwl664.sys
20:13:49.0583 1004 BCM43XX - ok
20:13:49.0691 1004 BcmSqlStartupSvc (6163664c7e9cd110af70180c126c3fdc) C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
20:13:49.0749 1004 BcmSqlStartupSvc - ok
20:13:49.0916 1004 BFE (bc4737aaffa5964e4f8827c9b8c0eb8e) C:\Windows\System32\bfe.dll
20:13:49.0953 1004 BFE - ok
20:13:50.0026 1004 BITS (d896a0d43f8ab81ecb1fc6c24decfd58) C:\Windows\System32\qmgr.dll
20:13:50.0068 1004 BITS - ok
20:13:50.0114 1004 blbdrive (79feeb40056683f8f61398d81dda65d2) C:\Windows\system32\drivers\blbdrive.sys
20:13:50.0144 1004 blbdrive - ok
20:13:50.0214 1004 Bonjour Service (5ab58c337ac65837fe404462ad6265ab) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
20:13:50.0280 1004 Bonjour Service - ok
20:13:50.0300 1004 bowser (f0f035fcec3554cc1b70c5611bd87951) C:\Windows\system32\DRIVERS\bowser.sys
20:13:50.0357 1004 bowser - ok
20:13:50.0380 1004 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\drivers\brfiltlo.sys
20:13:50.0414 1004 BrFiltLo - ok
20:13:50.0427 1004 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\drivers\brfiltup.sys
20:13:50.0462 1004 BrFiltUp - ok
20:13:50.0489 1004 Browser (a1b39de453433b115b4ea69ee0343816) C:\Windows\System32\browser.dll
20:13:50.0515 1004 Browser - ok
20:13:50.0544 1004 Brserid (f0f0ba4d815be446aa6a4583ca3bca9b) C:\Windows\system32\drivers\brserid.sys
20:13:50.0605 1004 Brserid - ok
20:13:50.0680 1004 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\system32\drivers\brserwdm.sys
20:13:50.0721 1004 BrSerWdm - ok
20:13:50.0808 1004 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\system32\drivers\brusbmdm.sys
20:13:50.0850 1004 BrUsbMdm - ok
20:13:50.0902 1004 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\system32\drivers\brusbser.sys
20:13:50.0945 1004 BrUsbSer - ok
20:13:51.0056 1004 BTHMODEM (e0777b34e05f8a82a21856efc900c29f) C:\Windows\system32\drivers\bthmodem.sys
20:13:51.0101 1004 BTHMODEM - ok
20:13:51.0234 1004 cdfs (b4d787db8d30793a4d4df9feed18f136) C:\Windows\system32\DRIVERS\cdfs.sys
20:13:51.0267 1004 cdfs - ok
20:13:51.0290 1004 cdrom (3b2fb35363423ed60c8fbf15fc8680bd) C:\Windows\system32\DRIVERS\cdrom.sys
20:13:51.0321 1004 cdrom - ok
20:13:51.0345 1004 CertPropSvc (edfffc8b6afb609bf33dbe0a900426b6) C:\Windows\System32\certprop.dll
20:13:51.0376 1004 CertPropSvc - ok
20:13:51.0425 1004 cfwids (274ce03459896006f7a5069266e0469e) C:\Windows\system32\drivers\cfwids.sys
20:13:51.0475 1004 cfwids - ok
20:13:51.0543 1004 CinemaNow Service (127d4d0e9f78834ffd1eeea3fcfb47c1) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
20:13:51.0600 1004 CinemaNow Service - ok
20:13:51.0661 1004 circlass (02ea568d498bbdd4ba55bf3fce34d456) C:\Windows\system32\DRIVERS\circlass.sys
20:13:51.0694 1004 circlass - ok
20:13:52.0105 1004 CLFS (c12c4ee07843b595036da0baa6317936) C:\Windows\system32\CLFS.sys
20:13:52.0174 1004 CLFS - ok
20:13:52.0248 1004 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:13:52.0293 1004 clr_optimization_v2.0.50727_32 - ok
20:13:52.0388 1004 clr_optimization_v2.0.50727_64 (fa58b51ed71c9133e141164eaa7c54eb) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:13:52.0432 1004 clr_optimization_v2.0.50727_64 - ok
20:13:52.0688 1004 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:13:52.0739 1004 clr_optimization_v4.0.30319_32 - ok
20:13:52.0926 1004 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:13:52.0982 1004 clr_optimization_v4.0.30319_64 - ok
20:13:53.0014 1004 cmdide (e5d5499a1c50a54b5161296b6afe6192) C:\Windows\system32\drivers\cmdide.sys
20:13:53.0024 1004 cmdide - ok
20:13:53.0052 1004 Compbatt (34a6aa82aa36c87fc8816f2097efa345) C:\Windows\system32\drivers\compbatt.sys
20:13:53.0102 1004 Compbatt - ok
20:13:53.0104 1004 COMSysApp - ok
20:13:53.0152 1004 crcdisk (a8585b6412253803ce8efcbd6d6dc15c) C:\Windows\system32\drivers\crcdisk.sys
20:13:53.0163 1004 crcdisk - ok
20:13:53.0306 1004 Creative ALchemy AL6 Licensing Service (c8bd651e13895b93ed9ec5b4f1df42bc) C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
20:13:53.0373 1004 Creative ALchemy AL6 Licensing Service ( UnsignedFile.Multi.Generic ) - warning
20:13:53.0373 1004 Creative ALchemy AL6 Licensing Service - detected UnsignedFile.Multi.Generic (1)
20:13:53.0405 1004 Creative Audio Engine Licensing Service (c0ead9f8ab83d41ff07303c75589c2b8) C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
20:13:53.0469 1004 Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - warning
20:13:53.0469 1004 Creative Audio Engine Licensing Service - detected UnsignedFile.Multi.Generic (1)
20:13:53.0502 1004 CryptSvc (4374f784121d8b3bb466b03f5e5ebd33) C:\Windows\system32\cryptsvc.dll
20:13:53.0535 1004 CryptSvc - ok
20:13:53.0574 1004 CSC (a25e4dd707714da07fe1febf1dc91d86) C:\Windows\system32\drivers\csc.sys
20:13:53.0595 1004 CSC - ok
20:13:53.0623 1004 CscService (06af83c429743f3b85f1224c50254bef) C:\Windows\System32\cscsvc.dll
20:13:53.0647 1004 CscService - ok
20:13:53.0716 1004 CTAudSvcService (07ba6d17e66879018b30b6c3f976ebed) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
20:13:53.0833 1004 CTAudSvcService ( UnsignedFile.Multi.Generic ) - warning
20:13:53.0833 1004 CTAudSvcService - detected UnsignedFile.Multi.Generic (1)
20:13:53.0886 1004 DcomLaunch (52cdade8289ff21f1f2215ff51a5f36c) C:\Windows\system32\rpcss.dll
20:13:53.0915 1004 DcomLaunch - ok
20:13:53.0974 1004 DfsC (3725c43c9e90731eca651d506cc599a3) C:\Windows\system32\Drivers\dfsc.sys
20:13:54.0038 1004 DfsC - ok
20:13:54.0205 1004 DFSR (1781f99840979ee7b126c9073c377fd0) C:\Windows\system32\DFSR.exe
20:13:54.0311 1004 DFSR - ok
20:13:54.0423 1004 Dhcp (fdaa0edfcfb70cd529589ad654651b40) C:\Windows\System32\dhcpcsvc.dll
20:13:54.0454 1004 Dhcp - ok
20:13:54.0497 1004 disk (2dc415fc05fb8a079f896cbbacb19324) C:\Windows\system32\drivers\disk.sys
20:13:54.0510 1004 disk - ok
20:13:54.0555 1004 Dnscache (daf05293c1264e251d3a25e7e24b2ddf) C:\Windows\System32\dnsrslvr.dll
20:13:54.0570 1004 Dnscache - ok
20:13:54.0648 1004 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe
20:13:54.0691 1004 DockLoginService ( UnsignedFile.Multi.Generic ) - warning
20:13:54.0691 1004 DockLoginService - detected UnsignedFile.Multi.Generic (1)
20:13:54.0703 1004 dot3svc (cc661867677627f2911c2a4970dee0f1) C:\Windows\System32\dot3svc.dll
20:13:54.0734 1004 dot3svc - ok
20:13:54.0749 1004 DPS (1583b39790db3eaec7edb0cb0140c708) C:\Windows\system32\dps.dll
20:13:54.0780 1004 DPS - ok
20:13:54.0808 1004 drmkaud (97dc2a789c1be458976507846a1a8ced) C:\Windows\system32\drivers\drmkaud.sys
20:13:54.0860 1004 drmkaud - ok
20:13:54.0892 1004 dsNcAdpt (0040a0132aac1004e50055f8fbb14c08) C:\Windows\system32\DRIVERS\dsNcAdpt.sys
20:13:54.0945 1004 dsNcAdpt - ok
20:13:55.0010 1004 dsNcService (f383b60e7468d613990f8aca59269573) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
20:13:55.0104 1004 dsNcService - ok
20:13:55.0159 1004 DXGKrnl (412964040ce920ff83aff6b5b551bf99) C:\Windows\System32\drivers\dxgkrnl.sys
20:13:55.0228 1004 DXGKrnl - ok
20:13:55.0293 1004 e1express (17d40652ef3e55eeae187a89df40965a) C:\Windows\system32\DRIVERS\e1e6032e.sys
20:13:55.0334 1004 e1express - ok
20:13:55.0358 1004 E1G60 (264cee7b031a9d6c827f3d0cb031f2fe) C:\Windows\system32\DRIVERS\E1G6032E.sys
20:13:55.0388 1004 E1G60 - ok
20:13:55.0438 1004 EapHost (c2303883fd9be49dc36a6400643002ea) C:\Windows\System32\eapsvc.dll
20:13:55.0465 1004 EapHost - ok
20:13:55.0491 1004 Ecache (7343d950a34a95dcb7441642e3e6beef) C:\Windows\system32\drivers\ecache.sys
20:13:55.0505 1004 Ecache - ok
20:13:55.0564 1004 ehRecvr (14ce384d2e27b64c256bda4dc39c312d) C:\Windows\ehome\ehRecvr.exe
20:13:55.0582 1004 ehRecvr - ok
20:13:55.0596 1004 ehSched (b93159c1313d66fdfbbe876f5189cd52) C:\Windows\ehome\ehsched.exe
20:13:55.0607 1004 ehSched - ok
20:13:55.0615 1004 ehstart (f5ee2527d74449868e3c3227a59bcd28) C:\Windows\ehome\ehstart.dll
20:13:55.0628 1004 ehstart - ok
20:13:55.0650 1004 elxstor (c4636d6e10469404ab5308d9fd45ed07) C:\Windows\system32\drivers\elxstor.sys
20:13:55.0668 1004 elxstor - ok
20:13:55.0691 1004 EMDMgmt (e4eb76d0a8fc43db7f36302e1f33791f) C:\Windows\system32\emdmgmt.dll
20:13:55.0708 1004 EMDMgmt - ok
20:13:55.0797 1004 EpsonBidirectionalService (abdd5ad016affd34ad40e944ce94bf59) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
20:13:55.0855 1004 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - warning
20:13:55.0855 1004 EpsonBidirectionalService - detected UnsignedFile.Multi.Generic (1)
20:13:55.0858 1004 ErrDev (991fab6aa066e1214efb5b496fb7959a) C:\Windows\system32\drivers\errdev.sys
20:13:55.0911 1004 ErrDev - ok
20:13:55.0945 1004 EventSystem (6b1a97bf9fefbdc83f3c7c7d0f826c66) C:\Windows\system32\es.dll
20:13:55.0990 1004 EventSystem - ok
20:13:56.0003 1004 exfat (2a546b9a84658b0554b1ec35cd9adaf5) C:\Windows\system32\drivers\exfat.sys
20:13:56.0035 1004 exfat - ok
20:13:56.0059 1004 fastfat (fe731d345ed9eeabbc72a59b35941834) C:\Windows\system32\drivers\fastfat.sys
20:13:56.0090 1004 fastfat - ok
20:13:56.0116 1004 Fax (989a776a2ff32a148fcf15c44058b129) C:\Windows\system32\fxssvc.exe
20:13:56.0142 1004 Fax - ok
20:13:56.0147 1004 fdc (81b79b6df71fa1d2c6d688d830616e39) C:\Windows\system32\DRIVERS\fdc.sys
20:13:56.0178 1004 fdc - ok
20:13:56.0181 1004 fdPHost (bb9267acacd8b7533dd936c34a0cba5e) C:\Windows\system32\fdPHost.dll
20:13:56.0212 1004 fdPHost - ok
20:13:56.0220 1004 FDResPub (300c80931eabbe1db7591c516efe8d0f) C:\Windows\system32\fdrespub.dll
20:13:56.0262 1004 FDResPub - ok
20:13:56.0268 1004 FileInfo (457b7d1d533e4bd62a99aed9c7bb4c59) C:\Windows\system32\drivers\fileinfo.sys
20:13:56.0278 1004 FileInfo - ok
20:13:56.0282 1004 Filetrace (d421327fd6efccaf884a54c58e1b0d7f) C:\Windows\system32\drivers\filetrace.sys
20:13:56.0311 1004 Filetrace - ok
20:13:56.0448 1004 FirebirdServerMAGIXInstance (167d24a045499ebef438f231976158df) C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe
20:13:56.0602 1004 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
20:13:56.0602 1004 FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
20:13:56.0676 1004 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
20:13:56.0737 1004 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
20:13:56.0737 1004 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
20:13:56.0819 1004 flpydisk (230923ea2b80f79b0f88d90f87b87ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
20:13:56.0847 1004 flpydisk - ok
20:13:56.0865 1004 FltMgr (7dacf1a3a4219575070c6dc7c957428a) C:\Windows\system32\drivers\fltmgr.sys
20:13:56.0879 1004 FltMgr - ok
20:13:56.0914 1004 FontCache3.0.0.0 (73d0f1d32edae3dcc4e84468bf910add) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:13:56.0962 1004 FontCache3.0.0.0 - ok
20:13:56.0966 1004 Fs_Rec (29d99e860a1ca0a03c6a733fdd0da703) C:\Windows\system32\drivers\Fs_Rec.sys
20:13:56.0994 1004 Fs_Rec - ok
20:13:57.0005 1004 fvevol (5cd88ce69bc24e5cfc0edcfc338b79e1) C:\Windows\system32\DRIVERS\fvevol.sys
20:13:57.0017 1004 fvevol - ok
20:13:57.0030 1004 gagp30kx (c8e416668d3dc2be3d4fe4c79224997f) C:\Windows\system32\drivers\gagp30kx.sys
20:13:57.0040 1004 gagp30kx - ok
20:13:57.0065 1004 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:13:57.0111 1004 GEARAspiWDM - ok
20:13:57.0147 1004 GoToAssist (d3316f6e3c011435f36e3d6e49b3196c) C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe
20:13:57.0208 1004 GoToAssist - ok
20:13:57.0242 1004 gpsvc (9e5b254d58232ec8921ec3c5a94c81ed) C:\Windows\System32\gpsvc.dll
20:13:57.0284 1004 gpsvc - ok
20:13:57.0354 1004 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:13:57.0429 1004 gupdate - ok
20:13:57.0433 1004 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:13:57.0441 1004 gupdatem - ok
20:13:57.0499 1004 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
20:13:57.0563 1004 gusvc - ok
20:13:57.0604 1004 HdAudAddService (df45f8142dc6df9d18c39b3effbd0409) C:\Windows\system32\drivers\HdAudio.sys
20:13:57.0687 1004 HdAudAddService - ok
20:13:57.0703 1004 HDAudBus (0c0d0f8a3ff09ecc81963d09ec6a0a84) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:13:57.0752 1004 HDAudBus - ok
20:13:57.0763 1004 HidBth (b4881c84a180e75b8c25dc1d726c375f) C:\Windows\system32\drivers\hidbth.sys
20:13:57.0802 1004 HidBth - ok
20:13:57.0821 1004 HidIr (5f47839455d01ff6403b008d481a6f5b) C:\Windows\system32\DRIVERS\hidir.sys
20:13:57.0849 1004 HidIr - ok
20:13:57.0852 1004 hidserv (77e34697087cfdbcfd9e0009704fb5af) C:\Windows\system32\hidserv.dll
20:13:57.0864 1004 hidserv - ok
20:13:57.0873 1004 HidUsb (128e2da8483fdd4dd0c7b3f9abd6f323) C:\Windows\system32\DRIVERS\hidusb.sys
20:13:57.0900 1004 HidUsb - ok
20:13:57.0917 1004 hkmsvc (b12f367ea39c0795fd57e31242ce1a5a) C:\Windows\system32\kmsvc.dll
20:13:57.0945 1004 hkmsvc - ok
20:13:58.0005 1004 hnmsvc (583431a6989fd8b901d1883c0299c471) c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
20:13:58.0095 1004 hnmsvc - ok
20:13:58.0119 1004 HpCISSs (d7109a1e6bd2dfdbcba72a6bc626a13b) C:\Windows\system32\drivers\hpcisss.sys
20:13:58.0129 1004 HpCISSs - ok
20:13:58.0183 1004 HTTP (e690736da6c543f5d99c8fa27bea31db) C:\Windows\system32\drivers\HTTP.sys
20:13:58.0210 1004 HTTP - ok
20:13:58.0215 1004 i2omp (da94c854cea5fac549d4e1f6e88349e8) C:\Windows\system32\drivers\i2omp.sys
20:13:58.0229 1004 i2omp - ok
20:13:58.0243 1004 i8042prt (cbb597659a2713ce0c9cc20c88c7591f) C:\Windows\system32\DRIVERS\i8042prt.sys
20:13:58.0271 1004 i8042prt - ok
20:13:58.0333 1004 IAANTMON (3e42c4691aad4b1e8d0466f9cbf05cbe) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
20:13:58.0429 1004 IAANTMON - ok
20:13:58.0481 1004 iaStor (fc28e90f2204d8fd147fa9bfa8a51c01) C:\Windows\system32\drivers\iastor.sys
20:13:58.0492 1004 iaStor - ok
20:13:58.0512 1004 iaStorV (3e3bf3627d886736d0b4e90054f929f6) C:\Windows\system32\drivers\iastorv.sys
20:13:58.0526 1004 iaStorV - ok
20:13:58.0634 1004 idsvc (76ea63cdb2d88dae7209691d089bef1d) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:13:58.0703 1004 idsvc - ok
20:13:58.0709 1004 iirsp (8c3951ad2fe886ef76c7b5027c3125d3) C:\Windows\system32\drivers\iirsp.sys
20:13:58.0723 1004 iirsp - ok
20:13:58.0762 1004 IKEEXT (3a3b232140c33376e134e7b61a0eaa44) C:\Windows\System32\ikeext.dll
20:13:58.0829 1004 IKEEXT - ok
20:13:58.0834 1004 intelide (df797a12176f11b2d301c5b234bb200e) C:\Windows\system32\drivers\intelide.sys
20:13:58.0844 1004 intelide - ok
20:13:58.0856 1004 intelppm (bfd84af32fa1bad6231c4585cb469630) C:\Windows\system32\DRIVERS\intelppm.sys
20:13:58.0884 1004 intelppm - ok
20:13:58.0892 1004 IPBusEnum (5624bc1bc5eeb49c0ab76a8114f05ea3) C:\Windows\system32\ipbusenum.dll
20:13:58.0920 1004 IPBusEnum - ok
20:13:58.0952 1004 IpFilterDriver (99b821f5bebd6a3cc3fe564f802ae0fd) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:13:58.0983 1004 IpFilterDriver - ok
20:13:59.0021 1004 iphlpsvc (3a0427f35e7f8c16bbc5b1be32b8de76) C:\Windows\System32\iphlpsvc.dll
20:13:59.0038 1004 iphlpsvc - ok
20:13:59.0039 1004 IpInIp - ok
20:13:59.0047 1004 IPMIDRV (9c2ee2e6e5a7203bfae15c299475ec67) C:\Windows\system32\drivers\ipmidrv.sys
20:13:59.0075 1004 IPMIDRV - ok
20:13:59.0223 1004 IPNAT (b7e6212f581ea5f6ab0c3a6ceeeb89be) C:\Windows\system32\DRIVERS\ipnat.sys
20:13:59.0253 1004 IPNAT - ok
20:13:59.0375 1004 iPod Service (056ab99a00e2023a24ab4f067880cc3e) C:\Program Files\iPod\bin\iPodService.exe
20:13:59.0440 1004 iPod Service - ok
20:13:59.0443 1004 IRENUM (8c42ca155343a2f11d29feca67faa88d) C:\Windows\system32\drivers\irenum.sys
20:13:59.0484 1004 IRENUM - ok
20:13:59.0504 1004 isapnp (0672bfcedc6fc468a2b0500d81437f4f) C:\Windows\system32\drivers\isapnp.sys
20:13:59.0517 1004 isapnp - ok
20:13:59.0567 1004 iScsiPrt (49e4ccbf74783fce5d2cc1ff6480e1f4) C:\Windows\system32\DRIVERS\msiscsi.sys
20:13:59.0579 1004 iScsiPrt - ok
20:13:59.0584 1004 iteatapi (63c766cdc609ff8206cb447a65abba4a) C:\Windows\system32\drivers\iteatapi.sys
20:13:59.0592 1004 iteatapi - ok
20:13:59.0628 1004 iteraid (1281fe73b17664631d12f643cbea3f59) C:\Windows\system32\drivers\iteraid.sys
20:13:59.0637 1004 iteraid - ok
20:13:59.0884 1004 iWinTrusted (fe1a970e7ce330bb844e333c374c6599) C:\Program Files (x86)\iWin Games\iWinTrusted.exe
20:13:59.0937 1004 iWinTrusted - ok
20:13:59.0954 1004 JRAID (db85fe8d6cbaa2047cb4da1b2c193d76) C:\Windows\system32\drivers\jraid.sys
20:14:00.0009 1004 JRAID - ok
20:14:00.0053 1004 kbdclass (423696f3ba6472dd17699209b933bc26) C:\Windows\system32\DRIVERS\kbdclass.sys
20:14:00.0061 1004 kbdclass - ok
20:14:00.0081 1004 kbdhid (bf8783a5066cfecf45095459e8010fa7) C:\Windows\system32\DRIVERS\kbdhid.sys
20:14:00.0108 1004 kbdhid - ok
20:14:00.0139 1004 KeyIso (80f4593e92ff960e4763380d3168e498) C:\Windows\system32\lsass.exe
20:14:00.0153 1004 KeyIso - ok
20:14:00.0239 1004 Kodak AiO Network Discovery Service (162a5e3a691b903111526147c8d29e6d) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
20:14:00.0318 1004 Kodak AiO Network Discovery Service - ok
20:14:00.0390 1004 Kodak AiO Status Monitor Service (b5e53fca219a6491e9a1ba146a5d2452) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
20:14:00.0450 1004 Kodak AiO Status Monitor Service ( UnsignedFile.Multi.Generic ) - warning
20:14:00.0450 1004 Kodak AiO Status Monitor Service - detected UnsignedFile.Multi.Generic (1)
20:14:00.0522 1004 KSecDD (ccdcce6224e1e207e953af826b98a9d9) C:\Windows\system32\Drivers\ksecdd.sys
20:14:00.0542 1004 KSecDD - ok
20:14:00.0579 1004 ksthunk (1d419cf43db29396ecd7113d129d94eb) C:\Windows\system32\drivers\ksthunk.sys
20:14:00.0623 1004 ksthunk - ok
20:14:00.0652 1004 KtmRm (1faf6926f3416d3da05c5b265491bdae) C:\Windows\system32\msdtckrm.dll
20:14:00.0692 1004 KtmRm - ok
20:14:00.0924 1004 LanmanServer (3f27c9cdae606d74431e3ab39571a7f3) C:\Windows\system32\srvsvc.dll
20:14:00.0965 1004 LanmanServer - ok
20:14:01.0278 1004 LanmanWorkstation (6e25ffc6fead6544c6e9f1d23329570c) C:\Windows\System32\wkssvc.dll
20:14:01.0298 1004 LanmanWorkstation - ok
20:14:01.0361 1004 lltdio (96ece2659b6654c10a0c310ae3a6d02c) C:\Windows\system32\DRIVERS\lltdio.sys
20:14:01.0393 1004 lltdio - ok
20:14:01.0596 1004 lltdsvc (961ccbd0b1ccb5675d64976fae37d092) C:\Windows\System32\lltdsvc.dll
20:14:01.0631 1004 lltdsvc - ok
20:14:01.0709 1004 lmhosts (a47f8080cacc23c91fe823ad19aa5612) C:\Windows\System32\lmhsvc.dll
20:14:01.0739 1004 lmhosts - ok
20:14:01.0924 1004 LSI_FC (acbe1af32d3123e330a07bfbc5ec4a9b) C:\Windows\system32\drivers\lsi_fc.sys
20:14:01.0937 1004 LSI_FC - ok
20:14:02.0075 1004 LSI_SAS (799ffb2fc4729fa46d2157c0065b3525) C:\Windows\system32\drivers\lsi_sas.sys
20:14:02.0087 1004 LSI_SAS - ok
20:14:02.0111 1004 LSI_SCSI (f445ff1daad8a226366bfaf42551226b) C:\Windows\system32\drivers\lsi_scsi.sys
20:14:02.0123 1004 LSI_SCSI - ok
20:14:02.0253 1004 luafv (52f87b9cc8932c2a7375c3b2a9be5e3e) C:\Windows\system32\drivers\luafv.sys
20:14:02.0291 1004 luafv - ok
20:14:02.0606 1004 McMPFSvc (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
20:14:02.0618 1004 McMPFSvc - ok
20:14:02.0631 1004 mcmscsvc (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
20:14:02.0643 1004 mcmscsvc - ok
20:14:02.0648 1004 McNaiAnn (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
20:14:02.0659 1004 McNaiAnn - ok
20:14:02.0663 1004 McNASvc (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
20:14:02.0673 1004 McNASvc - ok
20:14:03.0359 1004 McODS (dd2321925274f2902929d76ce2b0eb45) C:\Program Files\McAfee\VirusScan\mcods.exe
20:14:03.0377 1004 McODS - ok
20:14:03.0393 1004 McProxy (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
20:14:03.0406 1004 McProxy - ok
20:14:03.0497 1004 McShield (e998e3b12101288d716558466cbf6ae1) C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
20:14:03.0509 1004 McShield - ok
20:14:03.0531 1004 Mcx2Svc (76a58df02bd4ea29f189b82d0bef17f8) C:\Windows\system32\Mcx2Svc.dll
20:14:03.0549 1004 Mcx2Svc - ok
20:14:03.0597 1004 megasas (5c5cd6aaced32fb26c3fb34b3dcf972f) C:\Windows\system32\drivers\megasas.sys
20:14:03.0613 1004 megasas - ok
20:14:03.0630 1004 MegaSR (859bc2436b076c77c159ed694acfe8f8) C:\Windows\system32\drivers\megasr.sys
20:14:03.0655 1004 MegaSR - ok
20:14:03.0720 1004 mfeapfk (01884cb7655c8908b43ff5e364fe6fd2) C:\Windows\system32\drivers\mfeapfk.sys
20:14:03.0794 1004 mfeapfk - ok
20:14:04.0130 1004 mfeavfk (dab9a9cdfb04e4d68924492aa043019d) C:\Windows\system32\drivers\mfeavfk.sys
20:14:04.0210 1004 mfeavfk - ok
20:14:04.0236 1004 mfeavfk01 - ok
20:14:04.0264 1004 mfefire (b26782c3d6045b4464017d7926877560) C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
20:14:04.0342 1004 mfefire - ok
20:14:04.0396 1004 mfefirek (ce9a3680675c0907ade16404ca967b49) C:\Windows\system32\drivers\mfefirek.sys
20:14:04.0481 1004 mfefirek - ok
20:14:04.0607 1004 mfehidk (60cf67458dd29cd17e77f2327b1a9a54) C:\Windows\system32\drivers\mfehidk.sys
20:14:04.0662 1004 mfehidk - ok
20:14:04.0700 1004 mfenlfk (a8129cfb919347f8533c934b365e9202) C:\Windows\system32\DRIVERS\mfenlfk.sys
20:14:04.0742 1004 mfenlfk - ok
20:14:04.0776 1004 mferkdet (5041fa2bd2b3a2693b015771bfbf6dca) C:\Windows\system32\drivers\mferkdet.sys
20:14:04.0821 1004 mferkdet - ok
20:14:04.0850 1004 mfevtp (723a5eb6cef7f408c3d0f15a82a6bff8) C:\Windows\system32\mfevtps.exe
20:14:04.0896 1004 mfevtp - ok
20:14:04.0928 1004 mfewfpk (919c56db14a0e1e2ab6da5d2821dc26e) C:\Windows\system32\drivers\mfewfpk.sys
20:14:04.0979 1004 mfewfpk - ok
20:14:05.0069 1004 MMCSS (3cbe4995e80e13ccfbc42e5dcf3ac81a) C:\Windows\system32\mmcss.dll
20:14:05.0101 1004 MMCSS - ok
20:14:05.0167 1004 Modem (59848d5cc74606f0ee7557983bb73c2e) C:\Windows\system32\drivers\modem.sys
20:14:05.0197 1004 Modem - ok
20:14:05.0247 1004 monitor (c247cc2a57e0a0c8c6dccf7807b3e9e5) C:\Windows\system32\DRIVERS\monitor.sys
20:14:05.0279 1004 monitor - ok
20:14:05.0329 1004 mouclass (9367304e5e412b120cf5f4ea14e4e4f1) C:\Windows\system32\DRIVERS\mouclass.sys
20:14:05.0339 1004 mouclass - ok
20:14:05.0369 1004 mouhid (c2c2bd5c5ce5aaf786ddd74b75d2ac69) C:\Windows\system32\DRIVERS\mouhid.sys
20:14:05.0402 1004 mouhid - ok
20:14:05.0418 1004 MountMgr (11bc9b1e8801b01f7f6adb9ead30019b) C:\Windows\system32\drivers\mountmgr.sys
20:14:05.0428 1004 MountMgr - ok
20:14:05.0589 1004 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:14:05.0651 1004 MozillaMaintenance - ok
20:14:05.0683 1004 mpio (f8276eb8698142884498a528dfea8478) C:\Windows\system32\drivers\mpio.sys
20:14:05.0696 1004 mpio - ok
20:14:05.0786 1004 mpsdrv (c92b9abdb65a5991e00c28f13491dba2) C:\Windows\system32\drivers\mpsdrv.sys
20:14:05.0823 1004 mpsdrv - ok
20:14:05.0966 1004 MpsSvc (8a670648c755867a3aa38da50ba569aa) C:\Windows\system32\mpssvc.dll
20:14:06.0013 1004 MpsSvc - ok
20:14:06.0018 1004 Mraid35x (3c200630a89ef2c0864d515b7a75802e) C:\Windows\system32\drivers\mraid35x.sys
20:14:06.0030 1004 Mraid35x - ok
20:14:06.0234 1004 MRxDAV (fe2706c15f8345c342820e4e4583fea0) C:\Windows\system32\drivers\mrxdav.sys
20:14:06.0256 1004 MRxDAV - ok
20:14:06.0375 1004 mrxsmb (b698eb9acc7ecd4927d99d268918f912) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:14:06.0450 1004 mrxsmb - ok
20:14:06.0606 1004 mrxsmb10 (9a797e27fd28500ee13d43000c931435) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:14:06.0676 1004 mrxsmb10 - ok
20:14:06.0718 1004 mrxsmb20 (f9425d610712533107a264e2d5b2154b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:14:06.0787 1004 mrxsmb20 - ok
20:14:06.0856 1004 msahci (730b784962d22d2c6481eae2370e7c8c) C:\Windows\system32\drivers\msahci.sys
20:14:06.0934 1004 msahci - ok
20:14:07.0058 1004 msdsm (264bbb4aaf312a485f0e44b65a6b7202) C:\Windows\system32\drivers\msdsm.sys
20:14:07.0074 1004 msdsm - ok
20:14:07.0282 1004 MSDTC (7ec02ce772f068ed0beafa3da341a9bc) C:\Windows\System32\msdtc.exe
20:14:07.0332 1004 MSDTC - ok
20:14:07.0363 1004 Msfs (704f59bfc4512d2bb0146aec31b10a7c) C:\Windows\system32\drivers\Msfs.sys
20:14:07.0412 1004 Msfs - ok
20:14:07.0437 1004 msisadrv (00ebc952961664780d43dca157e79b27) C:\Windows\system32\drivers\msisadrv.sys
20:14:07.0447 1004 msisadrv - ok
20:14:07.0476 1004 MSiSCSI (366b0c1f4478b519c181e37d43dcda32) C:\Windows\system32\iscsiexe.dll
20:14:07.0504 1004 MSiSCSI - ok
20:14:07.0506 1004 msiserver - ok
20:14:07.0618 1004 MSK80Service (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
20:14:07.0627 1004 MSK80Service - ok
20:14:07.0652 1004 MSKSSRV (0ea73e498f53b96d83dbfca074ad4cf8) C:\Windows\system32\drivers\MSKSSRV.sys
20:14:07.0679 1004 MSKSSRV - ok
20:14:07.0747 1004 MSPCLOCK (52e59b7e992a58e740aa63f57edbae8b) C:\Windows\system32\drivers\MSPCLOCK.sys
20:14:07.0775 1004 MSPCLOCK - ok
20:14:07.0805 1004 MSPQM (49084a75bae043ae02d5b44d02991bb2) C:\Windows\system32\drivers\MSPQM.sys
20:14:07.0835 1004 MSPQM - ok
20:14:07.0859 1004 MsRPC (b8e32e6103fbba9fbb1d0c11ff0d13b5) C:\Windows\system32\drivers\MsRPC.sys
20:14:07.0872 1004 MsRPC - ok
20:14:07.0904 1004 mssmbios (855796e59df77ea93af46f20155bf55b) C:\Windows\system32\DRIVERS\mssmbios.sys
20:14:07.0915 1004 mssmbios - ok
20:14:07.0960 1004 MSSQL$MSSMLBIZ - ok
20:14:08.0039 1004 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe
20:14:08.0101 1004 MSSQLServerADHelper - ok
20:14:08.0114 1004 MSTEE (86d632d75d05d5b7c7c043fa3564ae86) C:\Windows\system32\drivers\MSTEE.sys
20:14:08.0146 1004 MSTEE - ok
20:14:08.0172 1004 Mup (ddf133501f68d6988a0f55dfa88637b4) C:\Windows\system32\Drivers\mup.sys
20:14:08.0183 1004 Mup - ok
20:14:08.0240 1004 napagent (c25022cdd18980846973b598900915f8) C:\Windows\system32\qagentRT.dll
20:14:08.0274 1004 napagent - ok
20:14:08.0299 1004 NativeWifiP (73b99c98fa3a2ed1566e02d6fe1913a5) C:\Windows\system32\DRIVERS\nwifi.sys
20:14:08.0349 1004 NativeWifiP - ok
20:14:08.0405 1004 NDIS (f9a3ae5c9f047d71a36a99f9abca7d02) C:\Windows\system32\drivers\ndis.sys
20:14:08.0474 1004 NDIS - ok
20:14:08.0478 1004 NdisTapi (64df698a425478e321981431ac171334) C:\Windows\system32\DRIVERS\ndistapi.sys
20:14:08.0512 1004 NdisTapi - ok
20:14:08.0525 1004 Ndisuio (8baa43196d7b5bb972c9a6b2bbf61a19) C:\Windows\system32\DRIVERS\ndisuio.sys
20:14:08.0557 1004 Ndisuio - ok
20:14:08.0609 1004 NdisWan (52e3e8e35101399be9b2938c992aa087) C:\Windows\system32\DRIVERS\ndiswan.sys
20:14:08.0644 1004 NdisWan - ok
20:14:08.0743 1004 NDProxy (9cb77ed7cb72850253e973a2d6afdf49) C:\Windows\system32\drivers\NDProxy.sys
20:14:08.0779 1004 NDProxy - ok
20:14:08.0840 1004 NetBIOS (a499294f5029a7862adc115bda7371ce) C:\Windows\system32\DRIVERS\netbios.sys
20:14:08.0874 1004 NetBIOS - ok
20:14:09.0204 1004 netbt (7a29ca243a629230799754162d80120f) C:\Windows\system32\DRIVERS\netbt.sys
20:14:09.0244 1004 netbt - ok
20:14:09.0258 1004 Netlogon (80f4593e92ff960e4763380d3168e498) C:\Windows\system32\lsass.exe
20:14:09.0271 1004 Netlogon - ok
20:14:09.0364 1004 Netman (9b63b29defc0f3115a559d2597bf5d75) C:\Windows\System32\netman.dll
20:14:09.0404 1004 Netman - ok
20:14:09.0431 1004 netprofm (7846d0136cc2b264926a73047ba7688a) C:\Windows\System32\netprofm.dll
20:14:09.0469 1004 netprofm - ok
20:14:09.0605 1004 NetTcpPortSharing (b84613b469b98e09f50a748c1d02e132) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:14:09.0654 1004 NetTcpPortSharing - ok
20:14:09.0718 1004 nfrd960 (4ac08bd6af2df42e0c3196d826c8aea7) C:\Windows\system32\drivers\nfrd960.sys
20:14:09.0727 1004 nfrd960 - ok
20:14:09.0746 1004 NlaSvc (f145bf4c4668e7e312069f81ef847cfc) C:\Windows\System32\nlasvc.dll
20:14:09.0776 1004 NlaSvc - ok
20:14:09.0783 1004 Npfs (b06154e2a2c91e9be5599fca53bc4cd0) C:\Windows\system32\drivers\Npfs.sys
20:14:09.0813 1004 Npfs - ok
20:14:09.0817 1004 nsi (acb62baa1c319b17752553df3026eeeb) C:\Windows\system32\nsisvc.dll
20:14:09.0860 1004 nsi - ok
20:14:09.0865 1004 nsiproxy (1523af19ee8b030ba682f7a53537eaeb) C:\Windows\system32\drivers\nsiproxy.sys
20:14:09.0906 1004 nsiproxy - ok
20:14:09.0958 1004 Ntfs (fe86ba5ac3b50e2ca911e9c60c07b638) C:\Windows\system32\drivers\Ntfs.sys
20:14:10.0002 1004 Ntfs - ok
20:14:10.0094 1004 NT_NvcA (2492e06249b7284b74b87776cc14006c) C:\Windows\system32\DRIVERS\ntnvca.sys
20:14:10.0146 1004 NT_NvcA - ok
20:14:10.0149 1004 Null (dd5d684975352b85b52e3fd5347c20cb) C:\Windows\system32\drivers\Null.sys
20:14:10.0176 1004 Null - ok
20:14:10.0276 1004 NvcSvcMgr (e5b00188958e1c3eb6e750f451425c4e) C:\Program Files (x86)\Nortel\Nortel VPN Client\NvcSvcMgr.exe
20:14:10.0341 1004 NvcSvcMgr - ok
20:14:10.0394 1004 nvcwfpco (ff6f2b2c7f06210a5d0648637dd1afee) C:\Windows\system32\DRIVERS\nvcwfpco.sys
20:14:10.0439 1004 nvcwfpco - ok
20:14:10.0479 1004 NVHDA (ad37248bd442d41c9a896e53eb8a85ee) C:\Windows\system32\drivers\nvhda64v.sys
20:14:10.0526 1004 NVHDA - ok
20:14:10.0863 1004 nvlddmkm (68fa1d402873cd7c06096584d8c3c403) C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:14:11.0180 1004 nvlddmkm - ok
20:14:11.0240 1004 nvraid (2c040b7ada5b06f6facadac8514aa034) C:\Windows\system32\drivers\nvraid.sys
20:14:11.0250 1004 nvraid - ok
20:14:11.0253 1004 nvstor (f7ea0fe82842d05eda3efdd376dbfdba) C:\Windows\system32\drivers\nvstor.sys
20:14:11.0262 1004 nvstor - ok
20:14:11.0294 1004 nvsvc (d7199e2828ca6e6c682495c439fb53ef) C:\Windows\system32\nvvsvc.exe
20:14:11.0342 1004 nvsvc - ok
20:14:11.0350 1004 nv_agp (19067ca93075ef4823e3938a686f532f) C:\Windows\system32\drivers\nv_agp.sys
20:14:11.0362 1004 nv_agp - ok
20:14:11.0364 1004 NwlnkFlt - ok
20:14:11.0366 1004 NwlnkFwd - ok
20:14:11.0438 1004 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:14:11.0493 1004 odserv - ok
20:14:11.0551 1004 ohci1394 (1b30103fde512915a9214b108b6e7a9c) C:\Windows\system32\DRIVERS\ohci1394.sys
20:14:11.0576 1004 ohci1394 - ok
20:14:11.0628 1004 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:14:11.0679 1004 ose - ok
20:14:11.0750 1004 p2pimsvc (430f35c5592d253f43a26b4f5a523dbf) C:\Windows\system32\p2psvc.dll
20:14:11.0775 1004 p2pimsvc - ok
20:14:11.0780 1004 p2psvc (430f35c5592d253f43a26b4f5a523dbf) C:\Windows\system32\p2psvc.dll
20:14:11.0800 1004 p2psvc - ok
20:14:11.0846 1004 Packet (99e6aa0ae2d05389ba7f7dff6866b569) C:\Windows\system32\DRIVERS\packet.sys
20:14:11.0892 1004 Packet - ok
20:14:11.0906 1004 Parport (aecd57f94c887f58919f307c35498ea0) C:\Windows\system32\drivers\parport.sys
20:14:11.0955 1004 Parport - ok
20:14:11.0973 1004 partmgr (5ab40c36894f4c06bdab0c9a2fba282d) C:\Windows\system32\drivers\partmgr.sys
20:14:11.0983 1004 partmgr - ok
20:14:11.0997 1004 PcaSvc (9ab157b374192ff276c1628fbdba2b0e) C:\Windows\System32\pcasvc.dll
20:14:12.0010 1004 PcaSvc - ok
20:14:12.0026 1004 pci (2a5b2a51559066ea84742909b5b2cd69) C:\Windows\system32\drivers\pci.sys
20:14:12.0039 1004 pci - ok
20:14:12.0042 1004 pciide (8d618c829034479985a9ed56106cc732) C:\Windows\system32\drivers\pciide.sys
20:14:12.0053 1004 pciide - ok
20:14:12.0088 1004 pcmcia (037661f3d7c507c9993b7010ceee6288) C:\Windows\system32\drivers\pcmcia.sys
20:14:12.0106 1004 pcmcia - ok
20:14:12.0149 1004 PEAUTH (58865916f53592a61549b04941bfd80d) C:\Windows\system32\drivers\peauth.sys
20:14:12.0218 1004 PEAUTH - ok
20:14:12.0276 1004 PerfHost (0ed8727ea0172860f47258456c06caea) C:\Windows\SysWow64\perfhost.exe
20:14:12.0302 1004 PerfHost - ok
20:14:12.0364 1004 pla (e9e68c1a0f25cf4a7ac966eea74ee89e) C:\Windows\system32\pla.dll
20:14:12.0416 1004 pla - ok
20:14:12.0456 1004 PlugPlay (5aaa0c5534b05ed49919fcd9dbd11a5b) C:\Windows\system32\umpnpmgr.dll
20:14:12.0488 1004 PlugPlay - ok
20:14:12.0539 1004 PNRPAutoReg (430f35c5592d253f43a26b4f5a523dbf) C:\Windows\system32\p2psvc.dll
20:14:12.0559 1004 PNRPAutoReg - ok
20:14:12.0564 1004 PNRPsvc (430f35c5592d253f43a26b4f5a523dbf) C:\Windows\system32\p2psvc.dll
20:14:12.0584 1004 PNRPsvc - ok
20:14:12.0640 1004 PolicyAgent (eef3688d5e9592cbbbed00de71dda1ef) C:\Windows\System32\ipsecsvc.dll
20:14:12.0688 1004 PolicyAgent - ok
20:14:12.0729 1004 PptpMiniport (f5739f2c6db2534c384ad5150808e8f5) C:\Windows\system32\DRIVERS\raspptp.sys
20:14:12.0760 1004 PptpMiniport - ok
20:14:12.0766 1004 Processor (5080e59ecee0bc923f14018803aa7a01) C:\Windows\system32\drivers\processr.sys
20:14:12.0797 1004 Processor - ok
20:14:12.0848 1004 ProfSvc (b21fe10dad3ab59e78df7aa3fbf41e70) C:\Windows\system32\profsvc.dll
20:14:12.0878 1004 ProfSvc - ok
20:14:12.0907 1004 ProtectedStorage (80f4593e92ff960e4763380d3168e498) C:\Windows\system32\lsass.exe
20:14:12.0919 1004 ProtectedStorage - ok
20:14:12.0931 1004 PSched (0e0e205a296095fe4c631e6a4775ad6c) C:\Windows\system32\DRIVERS\pacer.sys
20:14:12.0984 1004 PSched - ok
20:14:13.0091 1004 PSI_SVC_2 (543a4ef0923bf70d126625b034ef25af) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
20:14:13.0206 1004 PSI_SVC_2 - ok
20:14:13.0322 1004 PxHlpa64 (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
20:14:13.0370 1004 PxHlpa64 - ok
20:14:13.0415 1004 ql2300 (0b83f4e681062f3839be2ec1d98fd94a) C:\Windows\system32\drivers\ql2300.sys
20:14:13.0447 1004 ql2300 - ok
20:14:13.0457 1004 ql40xx (e1c80f8d4d1e39ef9595809c1369bf2a) C:\Windows\system32\drivers\ql40xx.sys
20:14:13.0467 1004 ql40xx - ok
20:14:13.0529 1004 QWAVE (90574842c3da781e279061a3eff91f07) C:\Windows\system32\qwave.dll
20:14:13.0545 1004 QWAVE - ok
20:14:13.0552 1004 QWAVEdrv (e8d76edab77ec9c634c27b8eac33adc5) C:\Windows\system32\drivers\qwavedrv.sys
20:14:13.0565 1004 QWAVEdrv - ok
20:14:13.0674 1004 R300 (2a09a6b271d1f50adf5e33b37d460de6) C:\Windows\system32\DRIVERS\atikmdag.sys
20:14:13.0815 1004 R300 - ok
20:14:13.0871 1004 RasAcd (1013b3b663a56d3ddd784f581c1bd005) C:\Windows\system32\DRIVERS\rasacd.sys
20:14:13.0901 1004 RasAcd - ok
20:14:13.0913 1004 RasAuto (b2ae18f847d07f0044404ddf7cb04497) C:\Windows\System32\rasauto.dll
20:14:13.0945 1004 RasAuto - ok
20:14:13.0959 1004 Rasl2tp (3b9085f91ef00abd15a6f36570e90e12) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:14:13.0989 1004 Rasl2tp - ok
20:14:14.0006 1004 RasMan (d0c346d7df0df9b4899631796f177d56) C:\Windows\System32\rasmans.dll
20:14:14.0054 1004 RasMan - ok
20:14:14.0069 1004 RasPppoe (2ce1703c27196094fb6e4c6e439f2c21) C:\Windows\system32\DRIVERS\raspppoe.sys
20:14:14.0099 1004 RasPppoe - ok
20:14:14.0107 1004 RasSstp (fcd04fa67e8b40fa0ad361dd38593942) C:\Windows\system32\DRIVERS\rassstp.sys
20:14:14.0137 1004 RasSstp - ok
20:14:14.0149 1004 rdbss (33fa5b6136d92ee0f53f021c79091300) C:\Windows\system32\DRIVERS\rdbss.sys
20:14:14.0182 1004 rdbss - ok
20:14:14.0185 1004 RDPCDD (603900cc05f6be65ccbf373800af3716) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:14:14.0212 1004 RDPCDD - ok
20:14:14.0234 1004 rdpdr (c045d1fb111c28df0d1be8d4bda22c06) C:\Windows\system32\DRIVERS\rdpdr.sys
20:14:14.0266 1004 rdpdr - ok
20:14:14.0270 1004 RDPENCDD (cab9421daf3d97b33d0d055858e2c3ab) C:\Windows\system32\drivers\rdpencdd.sys
20:14:14.0300 1004 RDPENCDD - ok
20:14:14.0322 1004 RDPWD (7747082f672aa2846235c9cea42e2e72) C:\Windows\system32\drivers\RDPWD.sys
20:14:14.0368 1004 RDPWD - ok
20:14:14.0389 1004 RemoteAccess (c612b9557da73f70d41f8a6fbc8e5344) C:\Windows\System32\mprdim.dll
20:14:14.0417 1004 RemoteAccess - ok
20:14:14.0430 1004 RemoteRegistry (416c611369cbe49074b89cee2f83abef) C:\Windows\system32\regsvc.dll
20:14:14.0462 1004 RemoteRegistry - ok
20:14:14.0602 1004 RoxLiveShare10 - ok
20:14:15.0399 1004 RoxMediaDB10 (05fc44d32a144925eae45570029fd6e1) C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
20:14:15.0488 1004 RoxMediaDB10 - ok
20:14:15.0563 1004 RpcLocator (f46c457840d4b7a4daafee739ce04102) C:\Windows\system32\locator.exe
20:14:15.0581 1004 RpcLocator - ok
20:14:15.0628 1004 RpcSs (52cdade8289ff21f1f2215ff51a5f36c) C:\Windows\system32\rpcss.dll
20:14:15.0651 1004 RpcSs - ok
20:14:15.0931 1004 rspndr (22a9cb08b1a6707c1550c6bf099aae73) C:\Windows\system32\DRIVERS\rspndr.sys
20:14:15.0968 1004 rspndr - ok
20:14:16.0013 1004 RTL8169 (8b91737da75add21cb1554b38089196a) C:\Windows\system32\DRIVERS\Rtlh64.sys
20:14:16.0082 1004 RTL8169 - ok
20:14:16.0213 1004 RTSTOR (0851174830dafad4eacc4dd818d803d1) C:\Windows\system32\drivers\RTSTOR64.SYS
20:14:16.0280 1004 RTSTOR - ok
20:14:16.0283 1004 RxFilter - ok
20:14:16.0321 1004 SamSs (80f4593e92ff960e4763380d3168e498) C:\Windows\system32\lsass.exe
20:14:16.0336 1004 SamSs - ok
20:14:16.0357 1004 sbp2port (cd9c693589c60ad59bbbcfb0e524e01b) C:\Windows\system32\drivers\sbp2port.sys
20:14:16.0369 1004 sbp2port - ok
20:14:16.0555 1004 SCardSvr (f024d560fea06f8b56d673849eb89ae6) C:\Windows\System32\SCardSvr.dll
20:14:16.0599 1004 SCardSvr - ok
20:14:17.0375 1004 Schedule (ce75d26e0a1106129f4d156851e298ed) C:\Windows\system32\schedsvc.dll
20:14:17.0413 1004 Schedule - ok
20:14:17.0440 1004 SCPolicySvc (edfffc8b6afb609bf33dbe0a900426b6) C:\Windows\System32\certprop.dll
20:14:17.0483 1004 SCPolicySvc - ok
20:14:17.0593 1004 SDRSVC (4ff71b076a7760fe75ea5ae2d0ee0018) C:\Windows\System32\SDRSVC.dll
20:14:17.0622 1004 SDRSVC - ok
20:14:17.0769 1004 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
20:14:17.0836 1004 secdrv - ok
20:14:17.0890 1004 seclogon (5acdcbc67fcf894a1815b9f96d704490) C:\Windows\system32\seclogon.dll
20:14:17.0934 1004 seclogon - ok
20:14:18.0030 1004 SENS (90973a64b96cd647ff81c79443618eed) C:\Windows\System32\sens.dll
20:14:18.0076 1004 SENS - ok
20:14:18.0114 1004 Serenum (f71bfe7ac6c52273b7c82cbf1bb2a222) C:\Windows\system32\drivers\serenum.sys
20:14:18.0184 1004 Serenum - ok
20:14:18.0301 1004 Serial (e62fac91ee288db29a9696a9d279929c) C:\Windows\system32\drivers\serial.sys
20:14:18.0380 1004 Serial - ok
20:14:18.0405 1004 sermouse (a842f04833684bceea7336211be478df) C:\Windows\system32\drivers\sermouse.sys
20:14:18.0436 1004 sermouse - ok
20:14:18.0469 1004 SessionEnv (a8e4a4407a09f35dccc3771af590b0c4) C:\Windows\system32\sessenv.dll
20:14:18.0501 1004 SessionEnv - ok
20:14:18.0527 1004 SessionLauncher - ok
20:14:18.0531 1004 sffdisk (14d4b4465193a87c127933978e8c4106) C:\Windows\system32\drivers\sffdisk.sys
20:14:18.0561 1004 sffdisk - ok
20:14:18.0565 1004 sffp_mmc (7073aee3f82f3d598e3825962aa98ab2) C:\Windows\system32\drivers\sffp_mmc.sys
20:14:18.0593 1004 sffp_mmc - ok
20:14:18.0596 1004 sffp_sd (35e59ebe4a01a0532ed67975161c7b82) C:\Windows\system32\drivers\sffp_sd.sys
20:14:18.0624 1004 sffp_sd - ok
20:14:18.0627 1004 sfloppy (6b7838c94135768bd455cbdc23e39e5f) C:\Windows\system32\drivers\sfloppy.sys
20:14:18.0686 1004 sfloppy - ok
20:14:18.0744 1004 SftService (52434693713bdd905972617e21ac0cfc) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
20:14:18.0828 1004 SftService - ok
20:14:18.0893 1004 SharedAccess (4c5aee179da7e1ee9a9ccb9da289af34) C:\Windows\System32\ipnathlp.dll
20:14:18.0929 1004 SharedAccess - ok
20:14:18.0964 1004 ShellHWDetection (9235ec680d3db17464b39c7c7decb4dd) C:\Windows\System32\shsvcs.dll
20:14:18.0980 1004 ShellHWDetection - ok
20:14:18.0998 1004 SiSRaid2 (7a5de502aeb719d4594c6471060a78b3) C:\Windows\system32\drivers\sisraid2.sys
20:14:19.0008 1004 SiSRaid2 - ok
20:14:19.0016 1004 SiSRaid4 (3a2f769fab9582bc720e11ea1dfb184d) C:\Windows\system32\drivers\sisraid4.sys
20:14:19.0026 1004 SiSRaid4 - ok
20:14:19.0182 1004 Skype C2C Service (2a99850c2a6edd6c6602e822c716edaf) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
20:14:19.0308 1004 Skype C2C Service - ok
20:14:19.0393 1004 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe
20:14:21.0918 1004 SkypeUpdate - ok
20:14:22.0022 1004 slsvc (a301d2cefb4747dfe0c24425dcbe0b78) C:\Windows\system32\SLsvc.exe
20:14:22.0086 1004 slsvc - ok
20:14:22.0147 1004 SLUINotify (f5ddf7c0af85eb72cb295171f8c3cb35) C:\Windows\system32\SLUINotify.dll
20:14:22.0177 1004 SLUINotify - ok
20:14:22.0192 1004 Smb (41eb2e8e005feedcafce301983eff932) C:\Windows\system32\DRIVERS\smb.sys
20:14:22.0225 1004 Smb - ok
20:14:22.0240 1004 SNMPTRAP (f8f47f38909823b1af28d60b96340cff) C:\Windows\System32\snmptrap.exe
20:14:22.0256 1004 SNMPTRAP - ok
20:14:22.0260 1004 spldr (f9cb0672162f7f04248e2b82c1ff4617) C:\Windows\system32\drivers\spldr.sys
20:14:22.0270 1004 spldr - ok
20:14:22.0301 1004 Spooler (92e6738d25c2123be9515c0eac0776cd) C:\Windows\System32\spoolsv.exe
20:14:22.0359 1004 Spooler - ok
20:14:22.0404 1004 SQLBrowser (86ebd8b1f23e743aad21f4d5b4d40985) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
20:14:22.0414 1004 SQLBrowser - ok
20:14:22.0465 1004 SQLWriter (3c432a96363097870995e2a3c8b66abd) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
20:14:22.0516 1004 SQLWriter - ok
20:14:22.0567 1004 srv (a8abd7d0d907b45cf3831f4dd8644349) C:\Windows\system32\DRIVERS\srv.sys
20:14:22.0626 1004 srv - ok
20:14:22.0658 1004 srv2 (6c72eea39e1c37b436a6d1532999f9ec) C:\Windows\system32\DRIVERS\srv2.sys
20:14:22.0734 1004 srv2 - ok
20:14:22.0757 1004 srvnet (7f69bcf9e6fa3d93c82ee6b87812666d) C:\Windows\system32\DRIVERS\srvnet.sys
20:14:22.0810 1004 srvnet - ok
20:14:22.0832 1004 SSDPSRV (192c74646ec5725aef3f80d19ff75f6a) C:\Windows\System32\ssdpsrv.dll
20:14:22.0863 1004 SSDPSRV - ok
20:14:22.0898 1004 SstpSvc (2ee3fa0308e6185ba64a9a7f2e74332b) C:\Windows\system32\sstpsvc.dll
20:14:22.0949 1004 SstpSvc - ok
20:14:23.0004 1004 stisvc (f14f7d7d68a66777fb999d5d0f21138d) C:\Windows\System32\wiaservc.dll
20:14:23.0026 1004 stisvc - ok
20:14:23.0201 1004 stllssvr (5889618eebd7d2ff13c30d73fcff8cd0) C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
20:14:23.0256 1004 stllssvr - ok
20:14:23.0286 1004 swenum (8a851ca908b8b974f89c50d2e18d4f0c) C:\Windows\system32\DRIVERS\swenum.sys
20:14:23.0296 1004 swenum - ok
20:14:23.0382 1004 swprv (da34d6eb4a3154c0bebaeb0a2483ef3e) C:\Windows\System32\swprv.dll
20:14:23.0419 1004 swprv - ok
20:14:23.0473 1004 Symc8xx (2f26a2c6fc96b29beff5d8ed74e6625b) C:\Windows\system32\drivers\symc8xx.sys
20:14:23.0484 1004 Symc8xx - ok
20:14:23.0489 1004 Sym_hi (a909667976d3bccd1df813fed517d837) C:\Windows\system32\drivers\sym_hi.sys
20:14:23.0501 1004 Sym_hi - ok
20:14:23.0524 1004 Sym_u3 (36887b56ec2d98b9c362f6ae4de5b7b0) C:\Windows\system32\drivers\sym_u3.sys
20:14:23.0533 1004 Sym_u3 - ok
20:14:23.0608 1004 SysMain (bea0d5521ed21df8f6ffeed86daede7b) C:\Windows\system32\sysmain.dll
20:14:23.0648 1004 SysMain - ok
20:14:24.0367 1004 t3 (6b153e518dbe6ef59191152e1ecf7ed4) C:\Windows\system32\drivers\t3.sys
20:14:24.0441 1004 t3 - ok
20:14:24.0480 1004 TabletInputService (005ce42567f9113a3bccb3b20073b029) C:\Windows\System32\TabSvc.dll
20:14:24.0495 1004 TabletInputService - ok
20:14:24.0515 1004 TapiSrv (52091001caf20ae84cf47023ee21b4bb) C:\Windows\System32\tapisrv.dll
20:14:24.0554 1004 TapiSrv - ok
20:14:24.0604 1004 TBS (cdbe8d7c1e201b911cdc346d06617fb5) C:\Windows\System32\tbssvc.dll
20:14:24.0638 1004 TBS - ok
20:14:25.0403 1004 Tcpip (7d86275fb640011b372fd566c0eafa8d) C:\Windows\system32\drivers\tcpip.sys
20:14:25.0587 1004 Tcpip - ok
20:14:26.0625 1004 Tcpip6 (7d86275fb640011b372fd566c0eafa8d) C:\Windows\system32\DRIVERS\tcpip.sys
20:14:26.0709 1004 Tcpip6 - ok
20:14:26.0822 1004 tcpipreg (c29d4b3b08ad0b7e8564814e4ff6a57b) C:\Windows\system32\drivers\tcpipreg.sys
20:14:26.0871 1004 tcpipreg - ok
20:14:26.0885 1004 TDPIPE (1d8bf4aaa5fb7a2761475781dc1195bc) C:\Windows\system32\drivers\tdpipe.sys
20:14:26.0930 1004 TDPIPE - ok
20:14:26.0945 1004 TDTCP (7f7e00cdf609df657f4cda02dd1c9bb1) C:\Windows\system32\drivers\tdtcp.sys
20:14:26.0993 1004 TDTCP - ok
20:14:27.0101 1004 tdx (8c39c72e0e853de04748c0337d9b9216) C:\Windows\system32\DRIVERS\tdx.sys
20:14:27.0148 1004 tdx - ok
20:14:27.0621 1004 TeamViewer7 (a4d2ce94b028ef1e437cf4ac3d8ff26c) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
20:14:27.0832 1004 TeamViewer7 - ok
20:14:28.0373 1004 TermDD (3f0ebf6ee609f2a276c0d5faf244ec90) C:\Windows\system32\DRIVERS\termdd.sys
20:14:28.0388 1004 TermDD - ok
20:14:28.0523 1004 TermService (f870a5589d6a94b426efb13689023946) C:\Windows\System32\termsrv.dll
20:14:28.0576 1004 TermService - ok
20:14:28.0612 1004 Themes (9235ec680d3db17464b39c7c7decb4dd) C:\Windows\system32\shsvcs.dll
20:14:28.0634 1004 Themes - ok
20:14:28.0780 1004 THREADORDER (3cbe4995e80e13ccfbc42e5dcf3ac81a) C:\Windows\system32\mmcss.dll
20:14:28.0829 1004 THREADORDER - ok
20:14:28.0965 1004 TrkWks (f4689f05af472a651a7b1b7b02d200e7) C:\Windows\System32\trkwks.dll
20:14:29.0010 1004 TrkWks - ok
20:14:29.0084 1004 TrustedInstaller (ac6ff1df22ed90bad6417ee5a4c6e2f0) C:\Windows\servicing\TrustedInstaller.exe
20:14:29.0130 1004 TrustedInstaller - ok
20:14:29.0167 1004 tssecsrv (9e5409cd17c8bef193aad498f3bc2cb8) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:14:29.0212 1004 tssecsrv - ok
20:14:29.0228 1004 tunmp (89ec74a9e602d16a75a4170511029b3c) C:\Windows\system32\DRIVERS\tunmp.sys
20:14:29.0252 1004 tunmp - ok
20:14:29.0310 1004 tunnel (2dc2c423572946e9a3131425bda73cb6) C:\Windows\system32\DRIVERS\tunnel.sys
20:14:29.0329 1004 tunnel - ok
20:14:29.0348 1004 uagp35 (fec266ef401966311744bd0f359f7f56) C:\Windows\system32\drivers\uagp35.sys
20:14:29.0362 1004 uagp35 - ok
20:14:29.0395 1004 udfs (eca6629e33f122afff18a2ab7c3eb033) C:\Windows\system32\DRIVERS\udfs.sys
20:14:29.0449 1004 udfs - ok
20:14:29.0498 1004 UI0Detect (060507c4113391394478f6953a79eedc) C:\Windows\system32\UI0Detect.exe
20:14:29.0548 1004 UI0Detect - ok
20:14:29.0577 1004 uliagpkx (4ec9447ac3ab462647f60e547208ca00) C:\Windows\system32\drivers\uliagpkx.sys
20:14:29.0593 1004 uliagpkx - ok
20:14:29.0621 1004 uliahci (697f0446134cdc8f99e69306184fbbb4) C:\Windows\system32\drivers\uliahci.sys
20:14:29.0645 1004 uliahci - ok
20:14:29.0658 1004 UlSata (31707f09846056651ea2c37858f5ddb0) C:\Windows\system32\drivers\ulsata.sys
20:14:29.0676 1004 UlSata - ok
20:14:29.0860 1004 ulsata2 (85e5e43ed5b48c8376281bab519271b7) C:\Windows\system32\drivers\ulsata2.sys
20:14:29.0880 1004 ulsata2 - ok
20:14:29.0951 1004 umbus (46e9a994c4fed537dd951f60b86ad3f4) C:\Windows\system32\DRIVERS\umbus.sys
20:14:30.0000 1004 umbus - ok
20:14:30.0241 1004 UmRdpService (658c50524e470516067708babfb08738) C:\Windows\System32\umrdp.dll
20:14:30.0266 1004 UmRdpService - ok
20:14:30.0367 1004 upnphost (7093799ff80e9deca0680d2e3535be60) C:\Windows\System32\upnphost.dll
20:14:30.0421 1004 upnphost - ok
20:14:30.0550 1004 UPnPService (7ce0fe34fd8fb7f52d1e503b0c1e4fa9) C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
20:14:30.0786 1004 UPnPService ( UnsignedFile.Multi.Generic ) - warning
20:14:30.0786 1004 UPnPService - detected UnsignedFile.Multi.Generic (1)
20:14:30.0802 1004 USB28xxBGA - ok
20:14:30.0806 1004 USB28xxOEM - ok
20:14:30.0840 1004 usbaudio (471474efa0640b426e9f8aa5a5fc2673) C:\Windows\system32\drivers\usbaudio.sys
20:14:30.0887 1004 usbaudio - ok
20:14:30.0953 1004 usbccgp (cee5090e3c2f23df52b732dc3cc16ad8) C:\Windows\system32\DRIVERS\usbccgp.sys
20:14:31.0002 1004 usbccgp - ok
20:14:31.0105 1004 usbcir (8c39d53e1a343f4c47ee8f3c052126d8) C:\Windows\system32\DRIVERS\usbcir.sys
20:14:31.0136 1004 usbcir - ok
20:14:31.0158 1004 usbehci (3bb628ad6e7391e801ce4bda9a52bb1d) C:\Windows\system32\DRIVERS\usbehci.sys
20:14:31.0206 1004 usbehci - ok
20:14:31.0374 1004 usbhub (d02090110a4d92b4b9a9a2e17729e997) C:\Windows\system32\DRIVERS\usbhub.sys
20:14:31.0425 1004 usbhub - ok
20:14:31.0465 1004 usbohci (eba14ef0c07cec233f1529c698d0d154) C:\Windows\system32\drivers\usbohci.sys
20:14:31.0510 1004 usbohci - ok
20:14:31.0579 1004 usbprint (28b693b6d31e7b9332c1bdcefef228c1) C:\Windows\system32\DRIVERS\usbprint.sys
20:14:31.0609 1004 usbprint - ok
20:14:31.0633 1004 usbscan (ea0bf666868964fbe8cb10e50c97b9f1) C:\Windows\system32\DRIVERS\usbscan.sys
20:14:31.0661 1004 usbscan - ok
20:14:31.0811 1004 USBSTOR (586d9876a4945779c8eea926c0d16889) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:14:31.0844 1004 USBSTOR - ok
20:14:31.0903 1004 usbuhci (d63b28cffbba74bc374b41a60543190c) C:\Windows\system32\DRIVERS\usbuhci.sys
20:14:31.0961 1004 usbuhci - ok
20:14:32.0016 1004 UxSms (9190f03c82547afa87367f1ceca88f3b) C:\Windows\System32\uxsms.dll
20:14:32.0049 1004 UxSms - ok
20:14:32.0387 1004 vds (c15a4a550cba7b9f1f68b72528e04ce1) C:\Windows\System32\vds.exe
20:14:32.0430 1004 vds - ok
20:14:32.0452 1004 vga (916b94bcf1e09873fff2d5fb11767bbc) C:\Windows\system32\DRIVERS\vgapnp.sys
20:14:32.0489 1004 vga - ok
20:14:32.0555 1004 VgaSave (b83ab16b51feda65dd81b8c59d114d63) C:\Windows\System32\drivers\vga.sys
20:14:32.0586 1004 VgaSave - ok
20:14:32.0590 1004 viaide (8294b6c3fdb6c33f24e150de647ecdaa) C:\Windows\system32\drivers\viaide.sys
20:14:32.0599 1004 viaide - ok
20:14:32.0613 1004 volmgr (793d9b32a1c462c91f6f70358283ac97) C:\Windows\system32\drivers\volmgr.sys
20:14:32.0623 1004 volmgr - ok
20:14:32.0644 1004 volmgrx (5aa217da5dc4ff5b9ac9ab86563b3223) C:\Windows\system32\drivers\volmgrx.sys
20:14:32.0661 1004 volmgrx - ok
20:14:32.0678 1004 volsnap (de4307412d98050239026e56a7dff3c0) C:\Windows\system32\drivers\volsnap.sys
20:14:32.0691 1004 volsnap - ok
20:14:32.0714 1004 vsmraid (a68f455ed2673835209318dd61bfbb0e) C:\Windows\system32\drivers\vsmraid.sys
20:14:32.0724 1004 vsmraid - ok
20:14:33.0400 1004 VSS (186bd53f8a408ad20f5a056c05678629) C:\Windows\system32\vssvc.exe
20:14:33.0464 1004 VSS - ok
20:14:33.0605 1004 W32Time (ba29f34a61cb55c0dee29e787542edf4) C:\Windows\system32\w32time.dll
20:14:33.0640 1004 W32Time - ok
20:14:33.0728 1004 WacomPen (fef8fe5923fead2cee4dfabfce3393a7) C:\Windows\system32\drivers\wacompen.sys
20:14:33.0780 1004 WacomPen - ok
20:14:33.0813 1004 Wanarp (aea75207e443c8623c36b8d03596f84f) C:\Windows\system32\DRIVERS\wanarp.sys
20:14:33.0846 1004 Wanarp - ok
20:14:33.0848 1004 Wanarpv6 (aea75207e443c8623c36b8d03596f84f) C:\Windows\system32\DRIVERS\wanarp.sys
20:14:33.0880 1004 Wanarpv6 - ok
20:14:34.0384 1004 wbengine (54d1827975afd9bc391343c357b9ea06) C:\Windows\system32\wbengine.exe
20:14:34.0426 1004 wbengine - ok
20:14:34.0481 1004 wcncsvc (055449247c490e24b968b44fe8a969eb) C:\Windows\System32\wcncsvc.dll
20:14:34.0509 1004 wcncsvc - ok
20:14:34.0514 1004 WcsPlugInService (ea4b369560e986f19d93f45a881484ac) C:\Windows\System32\WcsPlugInService.dll
20:14:34.0552 1004 WcsPlugInService - ok
20:14:34.0573 1004 Wd (0c17a0816f65b89e362e682ad5e7266e) C:\Windows\system32\drivers\wd.sys
20:14:34.0587 1004 Wd - ok
20:14:34.0643 1004 WDC_SAM (a3d04ebf5227886029b4532f20d026f7) C:\Windows\system32\DRIVERS\wdcsam64.sys
20:14:34.0711 1004 WDC_SAM - ok
20:14:34.0876 1004 WDDMService (7dedecc376b29a973a0f3384d135f2da) C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
20:14:34.0890 1004 WDDMService - ok
20:14:35.0274 1004 Wdf01000 (d02e7e4567da1e7582fbf6a91144b0df) C:\Windows\system32\drivers\Wdf01000.sys
20:14:35.0322 1004 Wdf01000 - ok
20:14:35.0460 1004 WDFMEService (8e798f577a684a5f1e464d954c6c7f1e) C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
20:14:35.0562 1004 WDFMEService - ok
20:14:35.0666 1004 WdiServiceHost (c5efda73ebfca8b02a094898de0a9276) C:\Windows\system32\wdi.dll
20:14:35.0692 1004 WdiServiceHost - ok
20:14:35.0694 1004 WdiSystemHost (c5efda73ebfca8b02a094898de0a9276) C:\Windows\system32\wdi.dll
20:14:35.0720 1004 WdiSystemHost - ok
20:14:36.0269 1004 WDRulesService (65d571576e366067c22f22b3e919ef8c) C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
20:14:36.0339 1004 WDRulesService - ok
20:14:36.0401 1004 WebClient (3d4ab55f8178fd0cd3ca45cd0ec9cf5b) C:\Windows\System32\webclnt.dll
20:14:36.0421 1004 WebClient - ok
20:14:36.0590 1004 Wecsvc (8d40bc587993f876658bf9fb0f7d3462) C:\Windows\system32\wecsvc.dll
20:14:36.0639 1004 Wecsvc - ok
20:14:36.0727 1004 wercplsupport (9c980351d7e96288ea0c23ae232bd065) C:\Windows\System32\wercplsupport.dll
20:14:36.0760 1004 wercplsupport - ok
20:14:36.0930 1004 WerSvc (fc25242b3bcaf7e84d9184082274ae08) C:\Windows\System32\WerSvc.dll
20:14:36.0983 1004 WerSvc - ok
20:14:36.0986 1004 WinHttpAutoProxySvc - ok
20:14:37.0361 1004 Winmgmt (ac98f38feab066a8f983d54ff3f4fd4c) C:\Windows\system32\wbem\WMIsvc.dll
20:14:37.0398 1004 Winmgmt - ok
20:14:37.0593 1004 WinRM (6cbb0c68f13b9c2ec1b16f5fa5e7c869) C:\Windows\system32\WsmSvc.dll
20:14:37.0711 1004 WinRM - ok
20:14:38.0377 1004 Wlansvc (0a69955261c1b54206adc9beb89517de) C:\Windows\System32\wlansvc.dll
20:14:38.0411 1004 Wlansvc - ok
20:14:38.0414 1004 wltrysvc - ok
20:14:38.0434 1004 WmiAcpi (7999dfb1c555efc0db69576f70027867) C:\Windows\system32\DRIVERS\wmiacpi.sys
20:14:38.0511 1004 WmiAcpi - ok
20:14:38.0558 1004 wmiApSrv (d303322dd577c3deda1251ed2e7a496c) C:\Windows\system32\wbem\WmiApSrv.exe
20:14:38.0610 1004 wmiApSrv - ok
20:14:38.0689 1004 WMPNetworkSvc - ok
20:14:38.0954 1004 WPCSvc (cbc156c913f099e6680d1df9307db7a8) C:\Windows\System32\wpcsvc.dll
20:14:38.0977 1004 WPCSvc - ok
20:14:39.0106 1004 WPDBusEnum (a27c8f92d84e2ddc151978e4692c978e) C:\Windows\system32\wpdbusenum.dll
20:14:39.0131 1004 WPDBusEnum - ok
20:14:39.0163 1004 WpdUsb (6329d1990db931073b86ab5946d8e317) C:\Windows\system32\DRIVERS\wpdusb.sys
20:14:39.0208 1004 WpdUsb - ok
20:14:39.0386 1004 WPFFontCache_v0400 (991e2c2cf3bc204c2bb2ee1476149e4e) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:14:39.0498 1004 WPFFontCache_v0400 - ok
20:14:39.0523 1004 ws2ifsl (8a900348370e359b6bff6a550e4649e1) C:\Windows\system32\drivers\ws2ifsl.sys
20:14:39.0553 1004 ws2ifsl - ok
20:14:39.0572 1004 wscsvc (cb8ea6d95949384925ccfca21cc6dfd8) C:\Windows\System32\wscsvc.dll
20:14:39.0586 1004 wscsvc - ok
20:14:39.0588 1004 WSearch - ok
20:14:40.0382 1004 wuauserv (fb3796754fe00f0bdc87a36f164a5f4d) C:\Windows\system32\wuaueng.dll
20:14:40.0448 1004 wuauserv - ok
20:14:40.0555 1004 WUDFRd (501a65252617b495c0f1832f908d54d8) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:14:40.0589 1004 WUDFRd - ok
20:14:40.0600 1004 wudfsvc (6cbd51ff913c851d56ed9dc7f2a27dde) C:\Windows\System32\WUDFSvc.dll
20:14:40.0631 1004 wudfsvc - ok
20:14:40.0667 1004 MBR (0x1B8) (cdb4de4bbd714f152979da2dcbef57eb) \Device\Harddisk0\DR0
20:14:41.0083 1004 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
20:14:41.0083 1004 \Device\Harddisk0\DR0 - detected TDSS File System (1)
20:14:41.0145 1004 Boot (0x1200) (134c0e012363c4c6516d3f27647f52a0) \Device\Harddisk0\DR0\Partition0
20:14:41.0146 1004 \Device\Harddisk0\DR0\Partition0 - ok
20:14:41.0149 1004 Boot (0x1200) (0726bb1600c3352fe643ffb8a5ac30c4) \Device\Harddisk0\DR0\Partition1
20:14:41.0150 1004 \Device\Harddisk0\DR0\Partition1 - ok
20:14:41.0150 1004 ============================================================
20:14:41.0150 1004 Scan finished
20:14:41.0151 1004 ============================================================
20:14:41.0158 3940 Detected object count: 10
20:14:41.0158 3940 Actual detected object count: 10
20:15:08.0524 3940 Creative ALchemy AL6 Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0524 3940 Creative ALchemy AL6 Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0525 3940 Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0525 3940 Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0527 3940 CTAudSvcService ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0527 3940 CTAudSvcService ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0528 3940 DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0528 3940 DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0529 3940 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0529 3940 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0530 3940 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0530 3940 FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0532 3940 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0532 3940 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0533 3940 Kodak AiO Status Monitor Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0533 3940 Kodak AiO Status Monitor Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0534 3940 UPnPService ( UnsignedFile.Multi.Generic ) - skipped by user
20:15:08.0534 3940 UPnPService ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:15:08.0535 3940 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
20:15:08.0535 3940 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
20:15:10.0962 6932 Deinitialize success

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[dmw18045]

Will do.

Thanks!

[dmw18045]

MBAM Log:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.28.07

Windows Vista Service Pack 1 x64 NTFS
Internet Explorer 7.0.6001.18000
dmweiss :: DMWEISS2 [administrator]

7/28/2012 3:47:45 PM
mbam-log-2012-07-28 (16-30-28).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 231014
Time elapsed: 12 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> No action taken.

(end)


DDS.txt

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_31
Run by dmweiss at 16:32:48 on 2012-07-28
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.6134.1643 [GMT -4:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
C:\Program Files (x86)\iWin Games\iWinTrusted.exe
C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files (x86)\Nortel\Nortel VPN Client\NvcSvcMgr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskeng.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\WLTRAY.EXE
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\RealPlayerPlus\Update\realsched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wuauclt.exe
c:\PROGRA~1\mcafee\msc\mcupdmgr.exe
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
C:\Windows\splwow64.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\vssvc.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.isp.netscape.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120627090239.dll
BHO: Video Download Toolbar Helper: {83bd144c-5e53-4e12-8e99-5a7f1bbf3ea0} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
BHO: IEHlprObj Class: {8ca5ed52-f3fb-4414-a105-2e3491156990} - C:\Program Files (x86)\iWin Games\iWinGamesHookIE.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO: Video Download Toolbar IE Browser Helper Object: {b29002a0-87a1-4dc4-ac55-5982034eb61e} - C:\PROGRA~2\VIDEOD~1\V330~1.3\RESOUR~1\VIDEOD~1.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB: Video Download Toolbar: {e52be12d-a44a-4f51-9dc1-34f37a488cc7} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [OpAgent] "OpAgent.exe" /agent
uRun: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
uRun: [Google Update] "C:\Users\dmweiss\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
mRun: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
mRun: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [NVC] "C:\Program Files (x86)\Nortel\Nortel VPN Client\Nvc.exe" -autostart
mRun: [Conime] %windir%\system32\conime.exe
mRun: [Nuance OmniPage 17-reminder] "C:\Program Files (x86)\Nuance\OmniPage17\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 17\Ereg\Ereg.ini"
mRun: [TrayServer] C:\PROGRA~2\MAGIX\MOVIES~1\TrayServer.exe
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [TkBellExe] "c:\program files (x86)\realplayerplus\Update\realsched.exe" -osboot
dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
StartupFolder: C:\Users\dmweiss\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe
uPolicies-explorer: HideSCAHealth = 1 (0x1)
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
Trusted Zone: affinityfcu.org\www
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxps://support.dell.com/systemprofiler/SysProExe.CAB
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://njremote.telcordia.com/dana-cached/sc/JuniperSetupClient.cab
TCP: DhcpNameServer = 208.59.247.45 208.59.247.46
TCP: Interfaces\{1BD5BB80-513A-4E0A-BA8D-C72F933A13AC} : DhcpNameServer = 208.59.247.45 208.59.247.46
TCP: Interfaces\{B6D14AEB-A6BE-46F6-8515-37918B521032} : NameServer = 128.96.20.33,128.96.20.43
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120627090239.dll
BHO-X64: scriptproxy - No File
BHO-X64: Video Download Toolbar Helper: {83BD144C-5E53-4E12-8E99-5A7F1BBF3EA0} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
BHO-X64: IEHlprObj Class: {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\Program Files (x86)\iWin Games\iWinGamesHookIE.dll
BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO-X64: Video Download Toolbar IE Browser Helper Object: {B29002A0-87A1-4DC4-AC55-5982034EB61E} - C:\PROGRA~2\VIDEOD~1\V330~1.3\RESOUR~1\VIDEOD~1.DLL
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB-X64: Video Download Toolbar: {E52BE12D-A44A-4F51-9DC1-34F37A488CC7} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB-X64: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
mRun-x64: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun-x64: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun-x64: [NVC] "C:\Program Files (x86)\Nortel\Nortel VPN Client\Nvc.exe" -autostart
mRun-x64: [Conime] %windir%\system32\conime.exe
mRun-x64: [Nuance OmniPage 17-reminder] "C:\Program Files (x86)\Nuance\OmniPage17\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 17\Ereg\Ereg.ini"
mRun-x64: [TrayServer] C:\PROGRA~2\MAGIX\MOVIES~1\TrayServer.exe
mRun-x64: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [TkBellExe] "c:\program files (x86)\realplayerplus\Update\realsched.exe" -osboot
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\dmweiss\AppData\Roaming\Mozilla\Firefox\Profiles\hck38xsh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.isp.netscape.com/
FF - plugin: c:\progra~2\mcafee\msc\npMcSnFFPl.dll
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files (x86)\realplayerplus\Netscape6\nppl3260.dll
FF - plugin: c:\program files (x86)\realplayerplus\Netscape6\nprjplug.dll
FF - plugin: C:\Program Files (x86)\RealPlayerPlus\Netscape6\nprpjplug.dll
FF - plugin: c:\program files (x86)\realplayerplus\Netscape6\nprpplugin.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Users\dmweiss\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
R1 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-9-6 169408]
R2 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [2009-6-23 127352]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
R2 iWinTrusted;iWinTrusted;C:\Program Files (x86)\iWin Games\iWinTrusted.exe [2011-4-8 176848]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-6-18 394712]
R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-6-19 777728]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-11-10 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-11-10 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-11-10 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2010-11-10 199272]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2010-11-10 210584]
R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
R2 NvcSvcMgr;Nortel VPN Client;C:\Program Files (x86)\Nortel\Nortel VPN Client\NvcSvcMgr.exe [2009-5-4 615704]
R2 nvcwfpco;nvcwfpco;C:\Windows\system32\DRIVERS\nvcwfpco.sys --> C:\Windows\system32\DRIVERS\nvcwfpco.sys [?]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-10-30 648432]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-6-19 3048136]
R2 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-5-29 2666880]
R2 WDDMService;WDDMService;C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe [2011-12-15 319384]
R2 WDFMEService;WDFME;C:\Program Files\Western Digital\WD SmartWare\WDFME.exe [2011-12-15 1977224]
R2 WDRulesService;WDRules;C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe [2011-12-15 1338264]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
R3 NT_NvcA;Nortel VPN Adapter;C:\Windows\system32\DRIVERS\ntnvca.sys --> C:\Windows\system32\DRIVERS\ntnvca.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 t3;Sound Blaster X-Fi Xtreme Audio;C:\Windows\system32\drivers\t3.sys --> C:\Windows\system32\drivers\t3.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-14 136176]
S2 SessionLauncher;SessionLauncher;C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe --> C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [?]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-10-30 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-10-30 79360]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [2010-6-19 1527900]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-14 136176]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-6-15 129976]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe [2009-6-26 1124848]
S3 UPnPService;UPnPService;C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2010-6-19 544768]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys --> C:\Windows\system32\DRIVERS\wdcsam64.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-4-24 93184]
S4 RoxLiveShare10;LiveShare P2P Server 10;"C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" --> C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [?]
.
=============== Created Last 30 ================
.
2012-07-26 23:55:20 -------- d-----w- C:\TDSSKiller_Quarantine
2012-07-26 23:41:47 20480 ----a-w- C:\Windows\svchost.exe
2012-07-07 17:38:42 24416 ----a-r- C:\Windows\System32\AdobePDFUI.dll
2012-07-07 17:36:36 103864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2012-07-06 18:11:18 -------- d-----w- C:\WP Themes
2012-07-05 20:57:31 -------- d-----w- C:\Program Files (x86)\GetFLV9103
2012-07-04 18:53:54 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-07-04 03:21:12 -------- d-----w- C:\Ext 320 GB
.
==================== Find3M ====================
.
2012-07-04 19:01:51 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-03 17:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-06-01 17:24:20 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2012-06-01 17:24:19 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll
2012-06-01 14:35:52 952 --sha-w- C:\ProgramData\KGyGaAvL.sys
.
============= FINISH: 16:37:46.03 ===============

Let me know if you need the "attach.txt" file.

Thanks!
Denise

[screen317]

Hi,

Please visit this webpage for instructions for running ComboFix:
http://www.bleepingc...to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[dmw18045]

Combofix.txt

ComboFix 12-07-30.01 - dmweiss 07/30/2012 21:01:24.1.8 - x64
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.6134.4258 [GMT -4:00]
Running from: c:\users\dmweiss\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\iWin Games\iWINgameshookie.dll
c:\users\Default\AppData\Roaming\DPInst.exe
c:\users\Default\AppData\Roaming\gacutil.exe
c:\users\Default\AppData\Roaming\PnPutil.exe
c:\users\dmweiss\AppData\Roaming\DataSafeDotNet.exe
c:\users\dmweiss\GoToAssistDownloadHelper.exe
c:\windows\svchost.exe
D:\AUTORUN.INF
.
.
((((((((((((((((((((((((( Files Created from 2012-06-28 to 2012-07-31 )))))))))))))))))))))))))))))))
.
.
2012-07-31 01:12 . 2012-07-31 01:12 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2012-07-31 01:12 . 2012-07-31 01:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-26 23:55 . 2012-07-26 23:55 -------- d-----w- C:\TDSSKiller_Quarantine
2012-07-21 01:37 . 2012-07-21 01:37 -------- d-----w- c:\users\Default\AppData\Roaming\KODAK AiO Home Center265472881
2012-07-07 19:12 . 2012-07-07 19:12 -------- d-----w- c:\program files (x86)\PuTTY
2012-07-07 17:38 . 2009-08-20 04:50 24416 ----a-r- c:\windows\system32\AdobePDFUI.dll
2012-07-07 17:36 . 2012-03-26 12:41 103864 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2012-07-06 18:11 . 2012-07-21 17:53 -------- d-----w- C:\WP Themes
2012-07-05 22:45 . 2012-07-05 22:45 5030088 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-07-05 20:57 . 2012-07-05 21:06 -------- d-----w- c:\program files (x86)\GetFLV9103
2012-07-04 18:53 . 2012-07-04 19:01 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-04 03:21 . 2012-07-04 03:25 -------- d-----w- C:\Ext 320 GB
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-04 19:01 . 2012-02-18 23:37 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-03 17:46 . 2010-01-27 15:59 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 07:19 . 2006-11-02 12:35 59701280 ----a-w- c:\windows\system32\mrt.exe
2012-06-01 17:24 . 2012-06-01 17:24 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-06-01 17:24 . 2012-06-01 17:24 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-06-01 14:35 . 2010-02-25 23:28 952 --sha-w- c:\programdata\KGyGaAvL.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83BD144C-5E53-4E12-8E99-5A7F1BBF3EA0}]
2010-09-05 15:24 815104 ----a-w- c:\program files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{B29002A0-87A1-4DC4-AC55-5982034EB61E}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{E52BE12D-A44A-4F51-9DC1-34F37A488CC7}"= "c:\program files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll" [2010-09-05 815104]
.
[HKEY_CLASSES_ROOT\clsid\{e52be12d-a44a-4f51-9dc1-34f37a488cc7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1555968]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2009-02-03 237693]
"SPIRunE"="SPIRunE.dll" [2009-07-27 18432]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-04-24 250192]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"NVC"="c:\program files (x86)\Nortel\Nortel VPN Client\Nvc.exe" [2009-05-04 1762576]
"Conime"="c:\windows\system32\conime.exe" [2008-01-21 69120]
"Nuance OmniPage 17-reminder"="c:\program files (x86)\Nuance\OmniPage17\Ereg\Ereg.exe" [2008-11-03 54560]
"TrayServer"="c:\progra~2\MAGIX\MOVIES~1\TrayServer.exe" [2008-04-09 90112]
"EEventManager"="c:\progra~2\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-03-22 1675160]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TkBellExe"="c:\program files (x86)\realplayerplus\Update\realsched.exe" [2012-06-01 296056]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-06-19 2234840]
.
c:\users\dmweiss\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Remote Access.lnk - c:\windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe [2009-10-30 53248]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-06 169408]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-20 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2006-11-02 09:45]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-14 05:21]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-14 05:21]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3173775808-2847193470-3151665814-1003Core.job
- c:\users\dmweiss\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-30 03:08]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3173775808-2847193470-3151665814-1003UA.job
- c:\users\dmweiss\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-30 03:08]
.
2012-07-08 c:\windows\Tasks\Roxio PhotoShow Updater.job
- c:\program files (x86)\Roxio\PhotoShow\auto_updater_shim.exe [2010-10-29 01:37]
.
2012-07-30 c:\windows\Tasks\User_Feed_Synchronization-{A51E060E-EACA-4351-B856-6A85826347A8}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:49]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-17 16308768]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-01-19 4119552]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2011-06-16 2922496]
"WD Quick View"="c:\program files\Western Digital\WD SmartWare\WDDMStatus.exe" [2011-12-15 4244888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.isp.netscape.com/
mLocal Page = %SystemRoot%\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: affinityfcu.org\www
TCP: DhcpNameServer = 208.59.247.45 208.59.247.46
TCP: Interfaces\{B6D14AEB-A6BE-46F6-8515-37918B521032}: NameServer = 128.96.20.33,128.96.20.43
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\dmweiss\AppData\Roaming\Mozilla\Firefox\Profiles\hck38xsh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.isp.netscape.com/
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-OpAgent - OpAgent.exe
Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe
WebBrowser-{E52BE12D-A44A-4F51-9DC1-34F37A488CC7} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-RealPlayer 15.0 - c:\program files (x86)\realplayerplus\Update\r1puninst.exe
.
.
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files\Dell\DellDock\DockLogin.exe
c:\program files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
c:\program files (x86)\Juniper Networks\Common Files\dsNcService.exe
c:\program files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
c:\program files (x86)\iWin Games\iWinTrusted.exe
c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
c:\program files (x86)\Nortel\Nortel VPN Client\NvcSvcMgr.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Dell DataSafe Local Backup\SftService.exe
c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Dell Remote Access\ezi_ra.exe
c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe
.
**************************************************************************
.
Completion time: 2012-07-30 21:22:02 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-31 01:22
.
Pre-Run: 383,706,099,712 bytes free
Post-Run: 390,577,254,400 bytes free
.
- - End Of File - - 378AC1A6AC685E6B14C98DA972F1A485


DDS.txt

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_31
Run by dmweiss at 21:25:07 on 2012-07-30
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.6134.4062 [GMT -4:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
c:\Program Files (x86)\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
C:\Program Files (x86)\iWin Games\iWinTrusted.exe
C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files (x86)\Nortel\Nortel VPN Client\NvcSvcMgr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
C:\Windows\system32\nvvsvc.exe
c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\WLTRAY.EXE
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Dell Remote Access\ezi_ra.exe
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\RealPlayerPlus\Update\realsched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\notepad.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.isp.netscape.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120627090239.dll
BHO: Video Download Toolbar Helper: {83bd144c-5e53-4e12-8e99-5a7f1bbf3ea0} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO: Video Download Toolbar IE Browser Helper Object: {b29002a0-87a1-4dc4-ac55-5982034eb61e} - C:\PROGRA~2\VIDEOD~1\V330~1.3\RESOUR~1\VIDEOD~1.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB: Video Download Toolbar: {e52be12d-a44a-4f51-9dc1-34f37a488cc7} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
mRun: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [NVC] "C:\Program Files (x86)\Nortel\Nortel VPN Client\Nvc.exe" -autostart
mRun: [Conime] %windir%\system32\conime.exe
mRun: [Nuance OmniPage 17-reminder] "C:\Program Files (x86)\Nuance\OmniPage17\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 17\Ereg\Ereg.ini"
mRun: [TrayServer] C:\PROGRA~2\MAGIX\MOVIES~1\TrayServer.exe
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [TkBellExe] "c:\program files (x86)\realplayerplus\Update\realsched.exe" -osboot
dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
StartupFolder: C:\Users\dmweiss\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLRE~1.LNK - c:\Windows\Installer\{F66A31D9-7831-4FBA-BA02-C411C0047CC5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
Trusted Zone: affinityfcu.org\www
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxps://support.dell.com/systemprofiler/SysProExe.CAB
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://njremote.telcordia.com/dana-cached/sc/JuniperSetupClient.cab
TCP: DhcpNameServer = 208.59.247.45 208.59.247.46
TCP: Interfaces\{1BD5BB80-513A-4E0A-BA8D-C72F933A13AC} : DhcpNameServer = 208.59.247.45 208.59.247.46
TCP: Interfaces\{B6D14AEB-A6BE-46F6-8515-37918B521032} : NameServer = 128.96.20.33,128.96.20.43
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120627090239.dll
BHO-X64: scriptproxy - No File
BHO-X64: Video Download Toolbar Helper: {83BD144C-5E53-4E12-8E99-5A7F1BBF3EA0} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO-X64: Video Download Toolbar IE Browser Helper Object: {B29002A0-87A1-4DC4-AC55-5982034EB61E} - C:\PROGRA~2\VIDEOD~1\V330~1.3\RESOUR~1\VIDEOD~1.DLL
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB-X64: Video Download Toolbar: {E52BE12D-A44A-4F51-9DC1-34F37A488CC7} - C:\Program Files (x86)\Video Download Toolbar\v3.3.0.3\Video_Download_Toolbar.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB-X64: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
mRun-x64: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry
mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun-x64: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun-x64: [NVC] "C:\Program Files (x86)\Nortel\Nortel VPN Client\Nvc.exe" -autostart
mRun-x64: [Conime] %windir%\system32\conime.exe
mRun-x64: [Nuance OmniPage 17-reminder] "C:\Program Files (x86)\Nuance\OmniPage17\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 17\Ereg\Ereg.ini"
mRun-x64: [TrayServer] C:\PROGRA~2\MAGIX\MOVIES~1\TrayServer.exe
mRun-x64: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [TkBellExe] "c:\program files (x86)\realplayerplus\Update\realsched.exe" -osboot
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\dmweiss\AppData\Roaming\Mozilla\Firefox\Profiles\hck38xsh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.isp.netscape.com/
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
R1 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-9-6 169408]
R2 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [2009-6-23 127352]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
R2 iWinTrusted;iWinTrusted;C:\Program Files (x86)\iWin Games\iWinTrusted.exe [2011-4-8 176848]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-6-18 394712]
R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-6-19 777728]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-11-10 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-11-10 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-11-10 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2010-11-10 199272]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2010-11-10 210584]
R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
R2 NvcSvcMgr;Nortel VPN Client;C:\Program Files (x86)\Nortel\Nortel VPN Client\NvcSvcMgr.exe [2009-5-4 615704]
R2 nvcwfpco;nvcwfpco;C:\Windows\system32\DRIVERS\nvcwfpco.sys --> C:\Windows\system32\DRIVERS\nvcwfpco.sys [?]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-10-30 648432]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-7-5 3048136]
R2 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-5-29 2666880]
R2 WDDMService;WDDMService;C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe [2011-12-15 319384]
R2 WDFMEService;WDFME;C:\Program Files\Western Digital\WD SmartWare\WDFME.exe [2011-12-15 1977224]
R2 WDRulesService;WDRules;C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe [2011-12-15 1338264]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
R3 NT_NvcA;Nortel VPN Adapter;C:\Windows\system32\DRIVERS\ntnvca.sys --> C:\Windows\system32\DRIVERS\ntnvca.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 t3;Sound Blaster X-Fi Xtreme Audio;C:\Windows\system32\drivers\t3.sys --> C:\Windows\system32\drivers\t3.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-14 136176]
S2 SessionLauncher;SessionLauncher;C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe --> C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [?]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-10-30 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-10-30 79360]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [2010-6-19 1527900]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-14 136176]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-6-15 129976]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe [2009-6-26 1124848]
S3 UPnPService;UPnPService;C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2010-6-19 544768]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys --> C:\Windows\system32\DRIVERS\wdcsam64.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-4-24 93184]
S4 RoxLiveShare10;LiveShare P2P Server 10;"C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" --> C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [?]
.
=============== Created Last 30 ================
.
2012-07-31 01:15:52 -------- d-sh--w- C:\$RECYCLE.BIN
2012-07-31 00:56:06 98816 ----a-w- C:\Windows\sed.exe
2012-07-31 00:56:06 518144 ----a-w- C:\Windows\SWREG.exe
2012-07-31 00:56:06 256000 ----a-w- C:\Windows\PEV.exe
2012-07-31 00:56:06 208896 ----a-w- C:\Windows\MBR.exe
2012-07-26 23:55:20 -------- d-----w- C:\TDSSKiller_Quarantine
2012-07-07 17:38:42 24416 ----a-r- C:\Windows\System32\AdobePDFUI.dll
2012-07-07 17:36:36 103864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2012-07-06 18:11:18 -------- d-----w- C:\WP Themes
2012-07-05 22:45:34 5030088 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-07-05 20:57:31 -------- d-----w- C:\Program Files (x86)\GetFLV9103
2012-07-04 18:53:54 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-07-04 03:21:12 -------- d-----w- C:\Ext 320 GB
.
==================== Find3M ====================
.
2012-07-04 19:01:51 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-03 17:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-06-01 17:24:20 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2012-06-01 17:24:19 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll
2012-06-01 14:35:52 952 --sha-w- C:\ProgramData\KGyGaAvL.sys
.
============= FINISH: 21:29:00.45 ===============

[screen317]

Hi,

I recommend uninstalling this:

iWin Games

Reboot.


Run TFC by OldTimer to clear temporary files:

• Please download TFC from here and save it to your desktop.
  
• Close any open programs and Internet browsers.
  
• Double click TFC.exe to run it and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  
• Please be patient as clearing out temp files may take a while.
  
• Once it completes you may be prompted to restart your computer, please do so.
  
• Once it's finished you may delete TFC.exe from your Desktop or save it for later use for the cleaning of temporary files.

Next, please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan
  Wait for the scan to finish
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

[dmw18045]

Hi...

Here is the log.txt file from the Eset Online Scanner. There wasn't much there.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

The scan results stated, if found and cleaned 5 items. When I looked at the quarantine list, 3 of them were quarantined items from my TDSKiller scan. 2 were files from an old external disk I had.

Now.... I didn't run or download your Security Check software as of yet. What will this software do? I need to be careful that no configuration changes are made since this is the PC that I also log into work with.

Thanks!
Denise

[screen317]

Hi,

My program doesn't change anything.. It only reports what is there.. Please proceed with it.

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!