scottch

PUM.UserWLoad and Trojan.Ransom Infected Need Help

37 posts in this topic

I ran the malwarebytes program and it shows that I have these two viruses but when I attempt to remove them, they do not get removed. I'm running windows 7.

Share this post


Link to post
Share on other sites

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs here.....DDS.txt and Attach.txt

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Quit all running programs.

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Share this post


Link to post
Share on other sites

I downloaded roguekiller to my desktop and attempted to run the can but it is stating the a problem caused the program to working correctly.

Share this post


Link to post
Share on other sites

Delete your copy and download a fresh one.

Reboot into safe mode and see if it runs now, MrC

Share this post


Link to post
Share on other sites

Below are the report that was in the RK Quarantine folder on my desktop: [00:00:0000] ***** Global Init *****

[00:00:0000] Has crashed before : Yes

[00:00:0000] Create mutex : RogueKiller

[00:00:0000] Mutex Created : 0x1c4

[00:00:0015] Fill lists

[00:00:0015] OS Language : English

[00:00:0015] Take Privileges

[00:00:0015] Modify Token

[00:00:0031] Set priority to HIGH

[00:00:0031] Getting Operating System

[00:00:0031] Os Getted : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

[00:00:0031] ***** Global Init OK *****

[00:00:0031] ***** GUI Init *****

[00:00:0031] Get build number

[00:00:0031] build number : RogueKiller (by Tigzy) -- v8.4.3 [Jan 25 2013] (x64 : No)

[00:00:0109] ***** GUI Init OK *****

[00:00:0125] ***** PreScan *****

[00:00:0125] Clear ListViews

[00:00:0125] Clear Objects : 0x0

[00:00:0125] Enum Windows

[00:00:0140] [Check Window] Eula - Please read

[00:00:0140] [Check Window] Debug log sending

[00:00:0140] [Check Window] Task Switching

[00:00:0156] [Check Window] CiceroUIWndFrame

[00:00:0156] [Check Window] Start

[00:00:0156] [Check Window] SysFader

[00:00:0156] [Check Window] Scott

[00:00:0156] [Check Window] Start menu

[00:00:0156] [Check Window] Jump List

[00:00:0156] [Check Window] View Available Networks (Tooltip)

[00:00:0171] [Check Window] View Available Networks

[00:00:0171] [Check Window] HP OSD Window

[00:00:0171] [Check Window] Network Flyout

[00:00:0171] [Check Window] HP Message Service

[00:00:0171] [Check Window] CiceroUIWndFrame

[00:00:0171] [Check Window] TF_FloatingLangBar_WndTitle

[00:00:0171] [Check Window] RogueKiller (by Tigzy) -- v8.4.3

[00:00:0187] [Check Window] PUM.UserWLoad and Trojan.Ransom Infected Need Help - Malwarebytes Forum - Windows Internet Explorer

[00:00:0187] [Check Window] View Downloads - Windows Internet Explorer

[00:00:0187] [Check Window] Trend Micro Titanium Internet Security

[00:00:0187] [Check Window] PUM.UserWLoad and Trojan.Ransom Infected Need Help - Malwarebytes Forum - Windows Internet Explorer

[00:00:0187] [Check Window] Acrobat IEHelper

[00:00:0203] [Check Window] AcroStubUnloadWClass

[00:00:0203] [Check Window] GDI+ Window

[00:00:0203] [Check Window] DDE Server Window

[00:00:0203] [Check Window] DDE Server Window

[00:00:0203] [Check Window] MCI command handling window

[00:00:0203] [Check Window] DDE Server Window

[00:00:0203] [Check Window] AMD:CCC-AEMCapturingWindow

[00:00:0218] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0

[00:00:0218] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0

[00:00:0218] [Check Window] {94F11419-869E-47aa-9563-F48591285CAD}

[00:00:0218] [Check Window] TaskEng - Task Scheduler Engine Process

[00:00:0218] [Check Window] GDI+ Window

[00:00:0218] [Check Window] IEWLOForm

[00:00:0218] [Check Window] GDI+ Window

[00:00:0234] [Check Window] MediaContextNotificationWindow

[00:00:0234] [Check Window] SystemResourceNotifyWindow

[00:00:0234] [Check Window] WinBio Client Focus Tracker

[00:00:0234] [Check Window] HiddenFaxWindow

[00:00:0234] [Check Window] BluetoothNotificationAreaIconWindowClass

[00:00:0234] [Check Window] .NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0

[00:00:0234] [Check Window] GDI+ Window

[00:00:0249] [Check Window] OfficePowerManagerWindow

[00:00:0249] [Check Window] Office Sync Process

[00:00:0249] [Check Window] ActivClient Agent

[00:00:0249] [Check Window] TouchPad object helper window

[00:00:0249] [Check Window] MS_WebcheckMonitor

[00:00:0249] [Check Window] Media Center SSO

[00:00:0265] [Check Window] Battery Meter

[00:00:0265] [Check Window] accrdsub

[00:00:0265] [Check Window] acevents

[00:00:0265] [Check Window] Touchpad driver tray icon window

[00:00:0265] [Check Window] Sigmatel-IDT-SysTray

[00:00:0265] [Check Window] TouchPad object helper window

[00:00:0281] [Check Window] Touchpad driver helper window

[00:00:0281] [Check Window] Touchpad driver backward compatibility window

[00:00:0281] [Check Window] WinBio Client Focus Tracker

[00:00:0281] [Check Window] DDE Server Window

[00:00:0281] [Check Window] MCI command handling window

[00:00:0296] [Check Window] Task Host Window

[00:00:0296] [Check Window] GDI+ Window

[00:00:0296] [Check Window] Malwarebytes Anti-Malware

[00:00:0296] [Check Window] AMD EEU Client

[00:00:0296] [Check Window] DWM Notification Window

[00:00:0296] [Check Window] Program Manager

[00:00:0312] [Check Window] Default IME

[00:00:0312] [Check Window] MSCTFIME UI

[00:00:0312] [Check Window] Default IME

[00:00:0312] [Check Window] MSCTFIME UI

[00:00:0312] [Check Window] Default IME

[00:00:0312] [Check Window] MSCTFIME UI

[00:00:0312] [Check Window] Default IME

[00:00:0327] [Check Window] MSCTFIME UI

[00:00:0327] [Check Window] Default IME

[00:00:0327] [Check Window] Default IME

[00:00:0327] [Check Window] MSCTFIME UI

[00:00:0327] [Check Window] Default IME

[00:00:0327] [Check Window] MSCTFIME UI

[00:00:0327] [Check Window] Default IME

[00:00:0343] [Check Window] MSCTFIME UI

[00:00:0343] [Check Window] Default IME

[00:00:0343] [Check Window] MSCTFIME UI

[00:00:0343] [Check Window] Default IME

[00:00:0343] [Check Window] Default IME

[00:00:0343] [Check Window] Default IME

[00:00:0359] [Check Window] MSCTFIME UI

[00:00:0359] [Check Window] Default IME

[00:00:0359] [Check Window] Default IME

[00:00:0359] [Check Window] Default IME

[00:00:0359] [Check Window] MSCTFIME UI

[00:00:0359] [Check Window] Default IME

[00:00:0359] [Check Window] Default IME

[00:00:0374] [Check Window] Default IME

[00:00:0374] [Check Window] Default IME

[00:00:0374] [Check Window] Default IME

[00:00:0374] [Check Window] MSCTFIME UI

[00:00:0374] [Check Window] Default IME

[00:00:0374] [Check Window] Default IME

[00:00:0390] [Check Window] Default IME

[00:00:0390] [Check Window] Default IME

[00:00:0390] [Check Window] Default IME

[00:00:0390] [Check Window] MSCTFIME UI

[00:00:0390] [Check Window] Default IME

[00:00:0390] [Check Window] Default IME

[00:00:0390] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0405] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0421] [Check Window] Default IME

[00:00:0437] [Check Window] Default IME

[00:00:0437] [Check Window] Default IME

[00:00:0437] [Check Window] Default IME

[00:00:0437] [Check Window] MSCTFIME UI

[00:00:0437] [Check Window] Default IME

[00:00:0452] [Check Processes] Service PID : 796

[00:08:0143] [Check Processes] [0][_0] [system Process] :

[00:08:0143] [Check Processes] [4][_0] System :

[00:08:0159] [Check Processes] [380][_4] smss.exe : C:\Windows\System32\smss.exe

[00:08:0159] [Check Processes] [620][_452] csrss.exe : C:\Windows\System32\csrss.exe

[00:08:0159] [Check Processes] [732][_452] wininit.exe : C:\Windows\System32\wininit.exe

[00:08:0174] [Check Processes] [756][_740] csrss.exe : C:\Windows\System32\csrss.exe

[00:08:0174] [Check Processes] [796][_732] services.exe : C:\Windows\System32\services.exe

[00:08:0174] [Check Processes] [812][_732] lsass.exe : C:\Windows\System32\lsass.exe

[00:08:0174] [Check Processes] [820][_732] lsm.exe : C:\Windows\System32\lsm.exe

[00:08:0190] [Check Processes] [916][_740] winlogon.exe : C:\Windows\System32\winlogon.exe

[00:08:0190] [Check Processes] [980][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0190] [Check Processes] [400][_796] TrueSuiteService.exe : C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe

[00:08:0221] [Check Processes] [840][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0221] [Check Processes] [1048][_796] atiesrxx.exe : C:\Windows\System32\atiesrxx.exe

[00:08:0237] [Check Processes] [1124][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0237] [Check Processes] [1156][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0237] [Check Processes] [1196][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0237] [Check Processes] [1232][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0237] [Check Processes] [1268][_796] stacsv64.exe : C:\Program Files\IDT\WDM\stacsv64.exe

[00:08:0252] [Check Processes] [1420][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0252] [Check Processes] [1536][_796] hpservice.exe : C:\Windows\System32\hpservice.exe

[00:08:0268] [Check Processes] [1600][_1048] atieclxx.exe : C:\Windows\System32\atieclxx.exe

[00:08:0268] [Check Processes] [1632][_1156] WUDFHost.exe : C:\Windows\System32\WUDFHost.exe

[00:08:0268] [Check Processes] [1896][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0268] [Check Processes] [1320][_796] spoolsv.exe : C:\Windows\System32\spoolsv.exe

[00:08:0283] [Check Processes] [1532][_796] ac.sharedstore.exe : C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe

[00:08:0299] [Check Processes] [1584][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0299] [Check Processes] [1780][_1532] acevents.exe : C:\Program Files\ActivIdentity\ActivClient\acevents.exe

[00:08:0330] [Check Processes] [2012][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0330] [Check Processes] [2068][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0330] [Check Processes] [2156][_796] coreServiceShell.exe : C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

[00:08:0346] [Check Processes] [2200][_2156] uiWatchDog.exe : C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe

[00:08:0346] [Check Processes] [2208][_620] conhost.exe : C:\Windows\System32\conhost.exe

[00:08:0346] [Check Processes] [2220][_796] armsvc.exe : C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

[00:08:0361] [Check Processes] [2248][_2156] coreFrameworkHost.exe : C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

[00:08:0361] [Check Processes] [2256][_620] conhost.exe : C:\Windows\System32\conhost.exe

[00:08:0361] [Check Processes] [2284][_2248] AMSP_LogServer.exe : C:\Program Files\Trend Micro\AMSP\AMSP_LogServer.exe

[00:08:0393] [Check Processes] [2344][_796] Fuel.Service.exe : C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

[00:08:0408] [Check Processes] [2368][_796] AppleMobileDeviceService.exe : C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

[00:08:0424] [Check Processes] [2444][_796] mDNSResponder.exe : C:\Program Files\Bonjour\mDNSResponder.exe

[00:08:0424] [Check Processes] [2508][_796] HPWMISVC.exe : C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

[00:08:0439] [Check Processes] [2560][_796] mbamscheduler.exe : C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

[00:08:0502] [Check Processes] [2580][_796] mbamservice.exe : C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

[00:08:0580] [Check Processes] [2632][_796] c2c_service.exe : C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

[00:08:0580] [Check Processes] [2776][_796] WLIDSVC.EXE : C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[00:08:0627] [Check Processes] [3148][_2776] WLIDSVCM.EXE : C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

[00:08:0627] [Check Processes] [1908][_796] HPSA_Service.exe : C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

[00:08:0658] [Check Processes] [3896][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:08:0658] [Check Processes] [4064][_796] wmpnetwk.exe : C:\Program Files\Windows Media Player\wmpnetwk.exe

[00:08:0689] [Check Processes] [2784][_796] SearchIndexer.exe : C:\Windows\System32\SearchIndexer.exe

[00:08:0705] [Check Processes] [1464][_796] SeaPort.EXE : C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\SeaPort.EXE

[00:08:0705] [Check Processes] [2044][_796] taskhost.exe : C:\Windows\System32\taskhost.exe

[00:08:0705] [Check Processes] [1824][_2580] mbamgui.exe : C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

[00:08:0798] [Check Processes] [1952][_1156] dwm.exe : C:\Windows\System32\dwm.exe

[00:08:0798] [Check Processes] [2100][_400] TouchControl.exe : C:\Program Files (x86)\HP SimplePass\TouchControl.exe

[00:08:0861] [Check Processes] [3012][_876] explorer.exe : C:\Windows\explorer.exe

[00:08:0861] [Check Processes] [4300][_980] WmiPrvSE.exe : C:\Windows\System32\wbem\WmiPrvSE.exe

[00:08:0876] [Check Processes] [4800][_980] unsecapp.exe : C:\Windows\System32\wbem\unsecapp.exe

[00:08:0876] [Check Processes] [4728][_3012] SynTPEnh.exe : C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[00:08:0939] [Check Processes] [4980][_3012] sttray64.exe : C:\Program Files\IDT\WDM\sttray64.exe

[00:08:0970] [Check Processes] [5072][_2100] IEWebSiteLogon.exe : C:\Program Files (x86)\HP SimplePass\IEWebSiteLogon.exe

[00:09:0032] [Check Processes] [4148][_3012] acevents.exe : C:\Program Files\ActivIdentity\ActivClient\acevents.exe

[00:09:0048] [Check Processes] [4228][_3012] accrdsub.exe : C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe

[00:09:0063] [Check Processes] [2980][_3012] MSOSYNC.EXE : C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE

[00:09:0079] [Check Processes] [4652][_3012] acsagent.exe : C:\Program Files\ActivIdentity\ActivClient\acsagent.exe

[00:09:0110] [Check Processes] [4576][_2200] uiSeAgnt.exe : C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe

[00:09:0141] [Check Processes] [4924][_796] TrueService.exe : C:\Program Files\Common Files\AuthenTec\TrueService.exe

[00:09:0141] [Check Processes] [4332][_4144] HPMSGSVC.exe : C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

[00:09:0157] [Check Processes] [4188][_4144] HPOSD.exe : C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

[00:09:0173] [Check Processes] [4536][_4924] TrueService.exe : C:\Program Files\Common Files\AuthenTec\TrueService.exe

[00:09:0188] [Check Processes] [4964][_4452] SynTPHelper.exe : C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

[00:09:0188] [Check Processes] [4700][_796] hpqWmiEx.exe : C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

[00:09:0204] [Check Processes] [5148][_4144] jusched.exe : C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

[00:09:0219] [Check Processes] [5288][_4748] HPConnectionManager.exe : C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe

[00:09:0266] [Check Processes] [4508][_796] hpCMSrv.exe : C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe

[00:09:0297] [Check Processes] [4428][_1232] taskeng.exe : C:\Windows\System32\taskeng.exe

[00:09:0297] [Check Processes] [5612][_4428] YCMMirage.exe : C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

[00:09:0313] [Check Processes] [4944][_5636] MOM.exe : C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

[00:09:0329] [Check Processes] [2432][_4944] CCC.exe : C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

[00:09:0360] [Check Processes] [5776][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:09:0360] [Check Processes] [2088][_796] PresentationFontCache.exe : C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

[00:09:0360] [Check Processes] [1516][_3940] ielowutil.exe : C:\Program Files (x86)\Internet Explorer\IELowutil.exe

[00:09:0375] [Check Processes] [7428][_3012] iexplore.exe : C:\Program Files\Internet Explorer\iexplore.exe

[00:09:0391] [Check Processes] [7288][_980] BingApp.exe : C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingApp.exe

[00:09:0391] [Check Processes] [6612][_980] BingBar.exe : C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingBar.exe

[00:09:0407] [Check Processes] [8860][_980] bingsurrogate.exe : C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingSurrogate.exe

[00:09:0407] [Check Processes] [8312][_980] bingsurrogate.exe : C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingSurrogate.exe

[00:09:0422] [Check Processes] [8888][_980] bingsurrogate.exe : C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingSurrogate.exe

[00:09:0422] [Check Processes] [6052][_980] dllhost.exe : C:\Windows\System32\dllhost.exe

[00:09:0422] [Check Processes] [7160][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:09:0438] [Check Processes] [8812][_7428] iexplore.exe : C:\Program Files (x86)\Internet Explorer\iexplore.exe

[00:09:0453] [Check Processes] [6684][_980] FlashUtil64_11_5_502_146_ActiveX.exe : C:\Windows\System32\Macromed\Flash\FlashUtil64_11_5_502_146_ActiveX.exe

[00:09:0453] [Check Processes] [2884][_980] MsSpellCheckingFacility.exe : C:\Windows\System32\MsSpellCheckingFacility.exe

[00:09:0453] [Check Processes] [8832][_1124] audiodg.exe :

[00:09:0453] [Check Processes] [4464][_796] svchost.exe : C:\Windows\System32\svchost.exe

[00:09:0469] [Check Processes] [3968][_2784] SearchProtocolHost.exe : C:\Windows\System32\SearchProtocolHost.exe

[00:09:0469] [Check Processes] [5844][_2784] SearchFilterHost.exe : C:\Windows\System32\SearchFilterHost.exe

[00:09:0469] [Check Processes] [7024][_7428] iexplore.exe : C:\Program Files (x86)\Internet Explorer\iexplore.exe

[00:09:0485] [Check Processes] [8684][_2784] SearchProtocolHost.exe : C:\Windows\System32\SearchProtocolHost.exe

[00:09:0485] [Check Processes] [3276][_980] dllhost.exe :

[00:09:0485] [Check Processes] [8316][_980] dllhost.exe :

[00:09:0485] [Check Processes] [9104][_980] dllhost.exe :

[00:09:0563] [Check Services] [1/451] 1394ohci

[00:09:0563] [Check Services] C:\Windows\system32\drivers\1394ohci.sys

[00:09:0578] [Check Services] [2/451] ac.sharedstore

[00:09:0578] [Check Services] C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe

[00:09:0578] [Check Services] [3/451] Accelerometer

[00:09:0578] [Check Services] C:\Windows\system32\drivers\Accelerometer.sys

[00:09:0578] [Check Services] [4/451] ACPI

[00:09:0578] [Check Services] C:\Windows\system32\drivers\ACPI.sys

[00:09:0578] [Check Services] [5/451] AcpiPmi

[00:09:0578] [Check Services] C:\Windows\system32\drivers\acpipmi.sys

[00:09:0578] [Check Services] [6/451] AdobeARMservice

[00:09:0594] [Check Services] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

[00:09:0594] [Check Services] [7/451] AdobeFlashPlayerUpdateSvc

[00:09:0594] [Check Services] C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[00:09:0594] [Check Services] [8/451] adp94xx

[00:09:0594] [Check Services] C:\Windows\system32\drivers\adp94xx.sys

[00:09:0594] [Check Services] [9/451] adpahci

[00:09:0594] [Check Services] C:\Windows\system32\drivers\adpahci.sys

[00:09:0594] [Check Services] [10/451] adpu320

[00:09:0609] [Check Services] C:\Windows\system32\drivers\adpu320.sys

[00:09:0609] [Check Services] [11/451] AeLookupSvc

[00:09:0609] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:09:0609] [Check Services] [12/451] AFD

[00:09:0609] [Check Services] C:\Windows\system32\drivers\afd.sys

[00:09:0609] [Check Services] [13/451] agp440

[00:09:0609] [Check Services] C:\Windows\system32\drivers\agp440.sys

[00:09:0609] [Check Services] [14/451] ALG

[00:09:0625] [Check Services] C:\Windows\System32\alg.exe

[00:09:0625] [Check Services] [15/451] aliide

[00:09:0625] [Check Services] C:\Windows\system32\drivers\aliide.sys

[00:09:0625] [Check Services] [16/451] AMD External Events Utility

[00:09:0625] [Check Services] C:\Windows\system32\atiesrxx.exe

[00:09:0625] [Check Services] [17/451] AMD FUEL Service

[00:09:0625] [Check Services] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService

[00:09:0641] [Check Services] [18/451] amdhub30

[00:09:0641] [Check Services] C:\Windows\system32\drivers\amdhub30.sys

[00:09:0641] [Check Services] [19/451] amdide

[00:09:0641] [Check Services] C:\Windows\system32\drivers\amdide.sys

[00:09:0641] [Check Services] [20/451] amdiox64

[00:09:0641] [Check Services] C:\Windows\system32\drivers\amdiox64.sys

[00:09:0641] [Check Services] [21/451] AmdK8

[00:09:0641] [Check Services] C:\Windows\system32\drivers\amdk8.sys

[00:09:0656] [Check Services] [22/451] amdkmdag

[00:09:0656] [Check Services] C:\Windows\system32\DRIVERS\atikmdag.sys

[00:09:0656] [Check Services] [23/451] amdkmdap

[00:09:0656] [Check Services] C:\Windows\system32\DRIVERS\atikmpag.sys

[00:09:0656] [Check Services] [24/451] amdkmpfd

[00:09:0656] [Check Services] C:\Windows\system32\drivers\amdkmpfd.sys

[00:09:0656] [Check Services] [25/451] AmdPPM

[00:09:0672] [Check Services] C:\Windows\system32\drivers\amdppm.sys

[00:09:0672] [Check Services] [26/451] amdsata

[00:09:0672] [Check Services] C:\Windows\system32\drivers\amdsata.sys

[00:09:0672] [Check Services] [27/451] amdsbs

[00:09:0672] [Check Services] C:\Windows\system32\drivers\amdsbs.sys

[00:09:0672] [Check Services] [28/451] amdxata

[00:09:0672] [Check Services] C:\Windows\system32\drivers\amdxata.sys

[00:09:0672] [Check Services] [29/451] amdxhc

[00:09:0687] [Check Services] C:\Windows\system32\drivers\amdxhc.sys

[00:09:0687] [Check Services] [30/451] amd_sata

[00:09:0687] [Check Services] C:\Windows\system32\drivers\amd_sata.sys

[00:09:0687] [Check Services] [31/451] amd_xata

[00:09:0687] [Check Services] C:\Windows\system32\drivers\amd_xata.sys

[00:09:0687] [Check Services] [32/451] Amsp

[00:09:0687] [Check Services] "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad

[00:09:0687] [Check Services] [33/451] AppID

[00:09:0703] [Check Services] C:\Windows\system32\drivers\appid.sys

[00:09:0703] [Check Services] [34/451] AppIDSvc

[00:09:0703] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:09:0703] [Check Services] [35/451] Appinfo

[00:09:0703] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:09:0703] [Check Services] [36/451] Apple Mobile Device

[00:09:0719] [Check Services] "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"

[00:09:0719] [Check Services] [37/451] APXACC

[00:09:0719] [Check Services] C:\Windows\system32\DRIVERS\appexDrv.sys

[00:09:0719] [Check Services] [38/451] arc

[00:09:0719] [Check Services] C:\Windows\system32\drivers\arc.sys

[00:09:0719] [Check Services] [39/451] arcsas

[00:09:0719] [Check Services] C:\Windows\system32\drivers\arcsas.sys

[00:09:0719] [Check Services] [40/451] aspnet_state

[00:09:0734] [Check Services] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

[00:09:0734] [Check Services] [41/451] AsyncMac

[00:09:0734] [Check Services] C:\Windows\system32\DRIVERS\asyncmac.sys

[00:09:0734] [Check Services] [42/451] atapi

[00:09:0734] [Check Services] C:\Windows\system32\drivers\atapi.sys

[00:09:0734] [Check Services] [43/451] athr

[00:09:0734] [Check Services] C:\Windows\system32\DRIVERS\athrx.sys

[00:09:0750] [Check Services] [44/451] AtiHDAudioService

[00:09:0750] [Check Services] C:\Windows\system32\drivers\AtihdW76.sys

[00:09:0750] [Check Services] [45/451] AudioEndpointBuilder

[00:09:0750] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:09:0750] [Check Services] [46/451] AudioSrv

[00:09:0750] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

[00:09:0750] [Check Services] [47/451] AxInstSV

[00:09:0765] [Check Services] C:\Windows\system32\svchost.exe -k AxInstSVGroup

[00:09:0765] [Check Services] [48/451] b06bdrv

[00:09:0765] [Check Services] C:\Windows\system32\drivers\bxvbda.sys

[00:09:0765] [Check Services] [49/451] b57nd60a

[00:09:0765] [Check Services] C:\Windows\system32\DRIVERS\b57nd60a.sys

[00:09:0765] [Check Services] [50/451] BBSvc

[00:09:0765] [Check Services] C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BBSvc.EXE

[00:09:0781] [Check Services] [51/451] BBUpdate

[00:09:0781] [Check Services] C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\SeaPort.EXE

[00:09:0781] [Check Services] [52/451] BCM43XX

[00:09:0781] [Check Services] C:\Windows\system32\DRIVERS\bcmwl664.sys

[00:09:0781] [Check Services] [53/451] BDESVC

[00:09:0781] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:09:0781] [Check Services] [54/451] Beep

[00:09:0797] [Check Services] Path not found

[00:09:0797] [Check Services] [55/451] BFE

[00:09:0797] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

[00:09:0797] [Check Services] [56/451] BITS

[00:09:0797] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:09:0797] [Check Services] [57/451] blbdrive

[00:09:0812] [Check Services] C:\Windows\system32\drivers\blbdrive.sys

[00:09:0812] [Check Services] [58/451] Bonjour Service

[00:09:0812] [Check Services] "C:\Program Files\Bonjour\mDNSResponder.exe"

[00:09:0812] [Check Services] [59/451] bowser

[00:09:0812] [Check Services] C:\Windows\system32\DRIVERS\bowser.sys

[00:09:0812] [Check Services] [60/451] BrFiltLo

[00:09:0812] [Check Services] C:\Windows\system32\drivers\BrFiltLo.sys

[00:09:0812] [Check Services] [61/451] BrFiltUp

[00:09:0828] [Check Services] C:\Windows\system32\drivers\BrFiltUp.sys

[00:09:0828] [Check Services] [62/451] Browser

[00:09:0828] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:09:0828] [Check Services] [63/451] Brserid

[00:09:0828] [Check Services] C:\Windows\System32\Drivers\Brserid.sys

[00:09:0828] [Check Services] [64/451] BrSerWdm

[00:09:0828] [Check Services] C:\Windows\System32\Drivers\BrSerWdm.sys

[00:09:0843] [Check Services] [65/451] BrUsbMdm

[00:09:0843] [Check Services] C:\Windows\System32\Drivers\BrUsbMdm.sys

[00:09:0906] [Check Services] [66/451] BrUsbSer

[00:09:0921] [Check Services] C:\Windows\System32\Drivers\BrUsbSer.sys

[00:09:0921] [Check Services] [67/451] BTHMODEM

[00:09:0921] [Check Services] C:\Windows\system32\drivers\bthmodem.sys

[00:09:0921] [Check Services] [68/451] bthserv

[00:09:0937] [Check Services] C:\Windows\system32\svchost.exe -k bthsvcs

[00:09:0937] [Check Services] [69/451] cdfs

[00:09:0937] [Check Services] C:\Windows\system32\DRIVERS\cdfs.sys

[00:09:0937] [Check Services] [70/451] cdrom

[00:09:0937] [Check Services] C:\Windows\system32\drivers\cdrom.sys

[00:09:0953] [Check Services] [71/451] CertPropSvc

[00:09:0953] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:09:0953] [Check Services] [72/451] circlass

[00:09:0953] [Check Services] C:\Windows\system32\drivers\circlass.sys

[00:09:0968] [Check Services] [73/451] CLFS

[00:09:0968] [Check Services] C:\Windows\System32\CLFS.sys

[00:09:0968] [Check Services] [74/451] clr_optimization_v2.0.50727_32

[00:09:0968] [Check Services] C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

[00:09:0984] [Check Services] [75/451] clr_optimization_v2.0.50727_64

[00:09:0984] [Check Services] C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

[00:09:0984] [Check Services] [76/451] clr_optimization_v4.0.30319_32

[00:09:0984] [Check Services] C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

[00:09:0984] [Check Services] [77/451] clr_optimization_v4.0.30319_64

[00:09:0984] [Check Services] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

[00:09:0999] [Check Services] [78/451] clwvd

[00:09:0999] [Check Services] C:\Windows\system32\DRIVERS\clwvd.sys

[00:09:0999] [Check Services] [79/451] CmBatt

[00:09:0999] [Check Services] C:\Windows\system32\drivers\CmBatt.sys

[00:09:0999] [Check Services] [80/451] cmdide

[00:09:0999] [Check Services] C:\Windows\system32\drivers\cmdide.sys

[00:09:0999] [Check Services] [81/451] CNG

[00:10:0015] [Check Services] C:\Windows\System32\Drivers\cng.sys

[00:10:0015] [Check Services] [82/451] Compbatt

[00:10:0015] [Check Services] C:\Windows\system32\drivers\compbatt.sys

[00:10:0015] [Check Services] [83/451] CompositeBus

[00:10:0015] [Check Services] C:\Windows\system32\drivers\CompositeBus.sys

[00:10:0015] [Check Services] [84/451] COMSysApp

[00:10:0031] [Check Services] C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

[00:10:0031] [Check Services] [85/451] crcdisk

[00:10:0031] [Check Services] C:\Windows\system32\drivers\crcdisk.sys

[00:10:0031] [Check Services] [86/451] CryptSvc

[00:10:0031] [Check Services] C:\Windows\system32\svchost.exe -k NetworkService

[00:10:0031] [Check Services] [87/451] DcomLaunch

[00:10:0046] [Check Services] C:\Windows\system32\svchost.exe -k DcomLaunch

[00:10:0046] [Check Services] [88/451] defragsvc

[00:10:0046] [Check Services] C:\Windows\system32\svchost.exe -k defragsvc

[00:10:0046] [Check Services] [89/451] DfsC

[00:10:0046] [Check Services] C:\Windows\System32\Drivers\dfsc.sys

[00:10:0046] [Check Services] [90/451] Dhcp

[00:10:0062] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

[00:10:0062] [Check Services] [91/451] discache

[00:10:0062] [Check Services] C:\Windows\System32\drivers\discache.sys

[00:10:0062] [Check Services] [92/451] Disk

[00:10:0062] [Check Services] C:\Windows\system32\drivers\disk.sys

[00:10:0062] [Check Services] [93/451] Dnscache

[00:10:0077] [Check Services] C:\Windows\system32\svchost.exe -k NetworkService

[00:10:0077] [Check Services] [94/451] dot3svc

[00:10:0077] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:10:0077] [Check Services] [95/451] DPS

[00:10:0077] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

[00:10:0077] [Check Services] [96/451] drmkaud

[00:10:0093] [Check Services] C:\Windows\system32\drivers\drmkaud.sys

[00:10:0093] [Check Services] [97/451] DXGKrnl

[00:10:0093] [Check Services] C:\Windows\System32\drivers\dxgkrnl.sys

[00:10:0093] [Check Services] [98/451] EapHost

[00:10:0093] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:10:0093] [Check Services] [99/451] ebdrv

[00:10:0093] [Check Services] C:\Windows\system32\drivers\evbda.sys

[00:10:0109] [Check Services] [100/451] EFS

[00:10:0109] [Check Services] C:\Windows\System32\lsass.exe

[00:10:0109] [Check Services] [101/451] ehRecvr

[00:10:0109] [Check Services] C:\Windows\ehome\ehrecvr.exe

[00:10:0109] [Check Services] [102/451] ehSched

[00:10:0109] [Check Services] C:\Windows\ehome\ehsched.exe

[00:10:0124] [Check Services] [103/451] elxstor

[00:10:0124] [Check Services] C:\Windows\system32\drivers\elxstor.sys

[00:10:0124] [Check Services] [104/451] ErrDev

[00:10:0124] [Check Services] C:\Windows\system32\drivers\errdev.sys

[00:10:0124] [Check Services] [105/451] eventlog

[00:10:0124] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

[00:10:0140] [Check Services] [106/451] EventSystem

[00:10:0140] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:10:0140] [Check Services] [107/451] exfat

[00:10:0140] [Check Services] Path not found

[00:10:0140] [Check Services] [108/451] fastfat

[00:10:0140] [Check Services] Path not found

[00:10:0155] [Check Services] [109/451] Fax

[00:10:0155] [Check Services] C:\Windows\system32\fxssvc.exe

[00:10:0155] [Check Services] [110/451] fdc

[00:10:0155] [Check Services] C:\Windows\system32\drivers\fdc.sys

[00:10:0155] [Check Services] [111/451] fdPHost

[00:10:0155] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:10:0155] [Check Services] [112/451] FDResPub

[00:10:0171] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:10:0171] [Check Services] [113/451] FileInfo

[00:10:0171] [Check Services] C:\Windows\system32\drivers\fileinfo.sys

[00:10:0171] [Check Services] [114/451] Filetrace

[00:10:0171] [Check Services] C:\Windows\system32\drivers\filetrace.sys

[00:10:0187] [Check Services] [115/451] flpydisk

[00:10:0187] [Check Services] C:\Windows\system32\drivers\flpydisk.sys

[00:10:0187] [Check Services] [116/451] FltMgr

[00:10:0187] [Check Services] C:\Windows\system32\drivers\fltmgr.sys

[00:10:0187] [Check Services] [117/451] FontCache

[00:10:0187] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:10:0187] [Check Services] [118/451] FontCache3.0.0.0

[00:10:0202] [Check Services] C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

[00:10:0202] [Check Services] [119/451] FPLService

[00:10:0202] [Check Services] "C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe"

[00:10:0202] [Check Services] [120/451] FsDepends

[00:10:0202] [Check Services] C:\Windows\System32\drivers\FsDepends.sys

[00:10:0202] [Check Services] [121/451] fvevol

[00:10:0218] [Check Services] C:\Windows\System32\DRIVERS\fvevol.sys

[00:10:0218] [Check Services] [122/451] gagp30kx

[00:10:0218] [Check Services] C:\Windows\system32\drivers\gagp30kx.sys

[00:10:0218] [Check Services] [123/451] GamesAppService

[00:10:0218] [Check Services] "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe"

[00:10:0218] [Check Services] [124/451] GEARAspiWDM

[00:10:0218] [Check Services] C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

[00:10:0233] [Check Services] [125/451] gpsvc

[00:10:0233] [Check Services] C:\Windows\system32\svchost.exe -k GPSvcGroup

[00:10:0233] [Check Services] [126/451] gupdate

[00:10:0233] [Check Services] "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc

[00:10:0233] [Check Services] [127/451] gupdatem

[00:10:0233] [Check Services] "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc

[00:10:0233] [Check Services] [128/451] gusvc

[00:10:0233] [Check Services] "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"

[00:10:0249] [Check Services] [129/451] hcw85cir

[00:10:0249] [Check Services] C:\Windows\system32\drivers\hcw85cir.sys

[00:10:0249] [Check Services] [130/451] HdAudAddService

[00:10:0249] [Check Services] C:\Windows\system32\drivers\HdAudio.sys

[00:10:0249] [Check Services] [131/451] HDAudBus

[00:10:0249] [Check Services] C:\Windows\system32\drivers\HDAudBus.sys

[00:10:0249] [Check Services] [132/451] HidBatt

[00:10:0249] [Check Services] C:\Windows\system32\drivers\HidBatt.sys

[00:10:0265] [Check Services] [133/451] HidBth

[00:10:0265] [Check Services] C:\Windows\system32\drivers\hidbth.sys

[00:10:0265] [Check Services] [134/451] HidIr

[00:10:0265] [Check Services] C:\Windows\system32\drivers\hidir.sys

[00:10:0265] [Check Services] [135/451] hidserv

[00:10:0265] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:10:0265] [Check Services] [136/451] HidUsb

[00:10:0280] [Check Services] C:\Windows\system32\DRIVERS\hidusb.sys

[00:10:0280] [Check Services] [137/451] hkmsvc

[00:10:0280] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:10:0280] [Check Services] [138/451] HomeGroupListener

[00:10:0280] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:10:0280] [Check Services] [139/451] HomeGroupProvider

[00:10:0280] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

[00:10:0280] [Check Services] [140/451] HP Support Assistant Service

[00:10:0296] [Check Services] "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"

[00:10:0296] [Check Services] [141/451] hpCMSrv

[00:10:0296] [Check Services] "C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe"

[00:10:0296] [Check Services] [142/451] hpdskflt

[00:10:0296] [Check Services] C:\Windows\system32\drivers\hpdskflt.sys

[00:10:0296] [Check Services] [143/451] hpqwmiex

[00:10:0296] [Check Services] "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe"

[00:10:0311] [Check Services] [144/451] HpSAMD

[00:10:0311] [Check Services] C:\Windows\system32\drivers\HpSAMD.sys

[00:10:0311] [Check Services] [145/451] hpsrv

[00:10:0311] [Check Services] C:\Windows\system32\Hpservice.exe

[00:10:0311] [Check Services] [146/451] HPWMISVC

[00:10:0311] [Check Services] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

[00:10:0311] [Check Services] [147/451] HTTP

[00:10:0311] [Check Services] C:\Windows\system32\drivers\HTTP.sys

[00:10:0327] [Check Services] [148/451] hwpolicy

[00:10:0327] [Check Services] C:\Windows\System32\drivers\hwpolicy.sys

[00:10:0327] [Check Services] [149/451] i8042prt

[00:10:0327] [Check Services] C:\Windows\system32\DRIVERS\i8042prt.sys

[00:10:0327] [Check Services] [150/451] iaStor

[00:10:0327] [Check Services] C:\Windows\system32\drivers\iaStor.sys

[00:10:0327] [Check Services] [151/451] iaStorV

[00:10:0343] [Check Services] C:\Windows\system32\drivers\iaStorV.sys

[00:10:0343] [Check Services] [152/451] idsvc

[00:10:0343] [Check Services] "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe"

[00:10:0343] [Check Services] [153/451] iirsp

[00:10:0343] [Check Services] C:\Windows\system32\drivers\iirsp.sys

[00:10:0343] [Check Services] [154/451] IKEEXT

[00:10:0343] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:10:0358] [Check Services] [155/451] intelide

[00:10:0358] [Check Services] C:\Windows\system32\drivers\intelide.sys

[00:10:0358] [Check Services] [156/451] intelppm

[00:10:0358] [Check Services] C:\Windows\system32\drivers\intelppm.sys

[00:10:0358] [Check Services] [157/451] IPBusEnum

[00:10:0358] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:10:0358] [Check Services] [158/451] IpFilterDriver

[00:10:0374] [Check Services] C:\Windows\system32\DRIVERS\ipfltdrv.sys

[00:10:0374] [Check Services] [159/451] iphlpsvc

[00:10:0374] [Check Services] C:\Windows\System32\svchost.exe -k NetSvcs

[00:10:0374] [Check Services] [160/451] IPMIDRV

[00:10:0374] [Check Services] C:\Windows\system32\drivers\IPMIDrv.sys

[00:10:0374] [Check Services] [161/451] IPNAT

[00:10:0374] [Check Services] C:\Windows\System32\drivers\ipnat.sys

[00:10:0374] [Check Services] [162/451] iPod Service

[00:10:0389] [Check Services] "C:\Program Files\iPod\bin\iPodService.exe"

[00:10:0389] [Check Services] [163/451] IRENUM

[00:10:0389] [Check Services] C:\Windows\system32\drivers\irenum.sys

[00:10:0389] [Check Services] [164/451] isapnp

[00:10:0389] [Check Services] C:\Windows\system32\drivers\isapnp.sys

[00:10:0389] [Check Services] [165/451] iScsiPrt

[00:10:0389] [Check Services] C:\Windows\system32\drivers\msiscsi.sys

[00:10:0389] [Check Services] [166/451] kbdclass

[00:10:0405] [Check Services] C:\Windows\system32\drivers\kbdclass.sys

[00:10:0405] [Check Services] [167/451] kbdhid

[00:10:0405] [Check Services] C:\Windows\system32\drivers\kbdhid.sys

[00:10:0405] [Check Services] [168/451] KeyIso

[00:10:0405] [Check Services] C:\Windows\system32\lsass.exe

[00:10:0405] [Check Services] [169/451] KSecDD

[00:10:0405] [Check Services] C:\Windows\System32\Drivers\ksecdd.sys

[00:10:0421] [Check Services] [170/451] KSecPkg

[00:10:0421] [Check Services] C:\Windows\System32\Drivers\ksecpkg.sys

[00:10:0421] [Check Services] [171/451] ksthunk

[00:10:0421] [Check Services] C:\Windows\system32\drivers\ksthunk.sys

[00:10:0421] [Check Services] [172/451] KtmRm

[00:10:0421] [Check Services] C:\Windows\System32\svchost.exe -k NetworkServiceAndNoImpersonation

[00:10:0421] [Check Services] [173/451] LanmanServer

[00:10:0436] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:10:0436] [Check Services] [174/451] LanmanWorkstation

[00:10:0436] [Check Services] C:\Windows\System32\svchost.exe -k NetworkService

[00:10:0436] [Check Services] [175/451] lltdio

[00:10:0436] [Check Services] C:\Windows\system32\DRIVERS\lltdio.sys

[00:10:0436] [Check Services] [176/451] lltdsvc

[00:10:0452] [Check Services] C:\Windows\System32\svchost.exe -k LocalService

[00:10:0452] [Check Services] [177/451] lmhosts

[00:10:0452] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

[00:10:0452] [Check Services] [178/451] LSI_FC

[00:10:0452] [Check Services] C:\Windows\system32\drivers\lsi_fc.sys

[00:10:0452] [Check Services] [179/451] LSI_SAS

[00:10:0452] [Check Services] C:\Windows\system32\drivers\lsi_sas.sys

[00:10:0452] [Check Services] [180/451] LSI_SAS2

[00:10:0467] [Check Services] C:\Windows\system32\drivers\lsi_sas2.sys

[00:10:0467] [Check Services] [181/451] LSI_SCSI

[00:10:0467] [Check Services] C:\Windows\system32\drivers\lsi_scsi.sys

[00:10:0467] [Check Services] [182/451] luafv

[00:10:0467] [Check Services] C:\Windows\system32\drivers\luafv.sys

[00:10:0467] [Check Services] [183/451] MBAMProtector

[00:10:0483] [Check Services] C:\Windows\system32\drivers\mbam.sys

[00:10:0483] [Check Services] [184/451] MBAMScheduler

[00:10:0483] [Check Services] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"

[00:10:0483] [Check Services] [185/451] MBAMService

[00:10:0483] [Check Services] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"

[00:10:0483] [Check Services] [186/451] Mcx2Svc

[00:10:0483] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:10:0483] [Check Services] [187/451] megasas

[00:10:0499] [Check Services] C:\Windows\system32\drivers\megasas.sys

[00:10:0499] [Check Services] [188/451] MegaSR

[00:10:0499] [Check Services] C:\Windows\system32\drivers\MegaSR.sys

[00:10:0499] [Check Services] [189/451] Microsoft SharePoint Workspace Audit Service

[00:10:0499] [Check Services] "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

[00:10:0499] [Check Services] [190/451] MMCSS

[00:10:0499] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:10:0499] [Check Services] [191/451] Modem

[00:10:0514] [Check Services] C:\Windows\system32\drivers\modem.sys

[00:10:0514] [Check Services] [192/451] monitor

[00:10:0514] [Check Services] C:\Windows\system32\DRIVERS\monitor.sys

[00:10:0514] [Check Services] [193/451] mouclass

[00:10:0514] [Check Services] C:\Windows\system32\DRIVERS\mouclass.sys

[00:10:0514] [Check Services] [194/451] mouhid

[00:10:0514] [Check Services] C:\Windows\system32\DRIVERS\mouhid.sys

[00:10:0530] [Check Services] [195/451] mountmgr

[00:10:0530] [Check Services] C:\Windows\System32\drivers\mountmgr.sys

[00:10:0530] [Check Services] [196/451] mpio

[00:10:0530] [Check Services] C:\Windows\system32\drivers\mpio.sys

[00:10:0530] [Check Services] [197/451] mpsdrv

[00:10:0530] [Check Services] C:\Windows\System32\drivers\mpsdrv.sys

[00:10:0530] [Check Services] [198/451] MpsSvc

[00:10:0545] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

[00:10:0545] [Check Services] [199/451] MRxDAV

[00:10:0545] [Check Services] C:\Windows\system32\drivers\mrxdav.sys

[00:10:0545] [Check Services] [200/451] mrxsmb

[00:10:0545] [Check Services] C:\Windows\system32\DRIVERS\mrxsmb.sys

[00:10:0545] [Check Services] [201/451] mrxsmb10

[00:10:0561] [Check Services] C:\Windows\system32\DRIVERS\mrxsmb10.sys

[00:10:0561] [Check Services] [202/451] mrxsmb20

[00:10:0561] [Check Services] C:\Windows\system32\DRIVERS\mrxsmb20.sys

[00:10:0561] [Check Services] [203/451] msahci

[00:10:0561] [Check Services] C:\Windows\system32\drivers\msahci.sys

[00:10:0561] [Check Services] [204/451] msdsm

[00:10:0561] [Check Services] C:\Windows\system32\drivers\msdsm.sys

[00:10:0577] [Check Services] [205/451] MSDTC

[00:10:0577] [Check Services] C:\Windows\System32\msdtc.exe

[00:10:0577] [Check Services] [206/451] Msfs

[00:10:0577] [Check Services] Path not found

[00:10:0577] [Check Services] [207/451] mshidkmdf

[00:10:0577] [Check Services] C:\Windows\System32\drivers\mshidkmdf.sys

[00:10:0577] [Check Services] [208/451] msisadrv

[00:10:0592] [Check Services] C:\Windows\system32\drivers\msisadrv.sys

[00:10:0592] [Check Services] [209/451] MSiSCSI

[00:10:0592] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:10:0592] [Check Services] [210/451] msiserver

[00:10:0592] [Check Services] C:\Windows\system32\msiexec.exe /V

[00:10:0592] [Check Services] [211/451] MSKSSRV

[00:10:0608] [Check Services] C:\Windows\system32\drivers\MSKSSRV.sys

[00:10:0608] [Check Services] [212/451] MSPCLOCK

[00:10:0608] [Check Services] C:\Windows\system32\drivers\MSPCLOCK.sys

[00:10:0608] [Check Services] [213/451] MSPQM

[00:10:0608] [Check Services] C:\Windows\system32\drivers\MSPQM.sys

[00:10:0608] [Check Services] [214/451] MsRPC

[00:10:0608] [Check Services] Path not found

[00:10:0608] [Check Services] [215/451] mssmbios

[00:10:0623] [Check Services] C:\Windows\system32\drivers\mssmbios.sys

[00:10:0623] [Check Services] [216/451] MSTEE

[00:10:0623] [Check Services] C:\Windows\system32\drivers\MSTEE.sys

[00:10:0623] [Check Services] [217/451] MTConfig

[00:10:0623] [Check Services] C:\Windows\system32\drivers\MTConfig.sys

[00:10:0623] [Check Services] [218/451] Mup

[00:10:0623] [Check Services] C:\Windows\System32\Drivers\mup.sys

[00:10:0623] [Check Services] [219/451] napagent

[00:10:0639] [Check Services] C:\Windows\System32\svchost.exe -k NetworkService

[00:10:0639] [Check Services] [220/451] NativeWifiP

[00:10:0639] [Check Services] C:\Windows\system32\DRIVERS\nwifi.sys

[00:10:0639] [Check Services] [221/451] NDIS

[00:10:0639] [Check Services] C:\Windows\system32\drivers\ndis.sys

[00:10:0639] [Check Services] [222/451] NdisCap

[00:10:0655] [Check Services] C:\Windows\system32\DRIVERS\ndiscap.sys

[00:10:0655] [Check Services] [223/451] NdisTapi

[00:10:0655] [Check Services] C:\Windows\system32\DRIVERS\ndistapi.sys

[00:10:0655] [Check Services] [224/451] Ndisuio

[00:10:0655] [Check Services] C:\Windows\system32\DRIVERS\ndisuio.sys

[00:10:0655] [Check Services] [225/451] NdisWan

[00:10:0655] [Check Services] C:\Windows\system32\DRIVERS\ndiswan.sys

[00:10:0655] [Check Services] [226/451] NDProxy

[00:10:0670] [Check Services] Path not found

[00:10:0670] [Check Services] [227/451] NetBIOS

[00:10:0670] [Check Services] C:\Windows\system32\DRIVERS\netbios.sys

[00:10:0670] [Check Services] [228/451] NetBT

[00:10:0670] [Check Services] C:\Windows\System32\DRIVERS\netbt.sys

[00:10:0670] [Check Services] [229/451] Netlogon

[00:10:0670] [Check Services] C:\Windows\system32\lsass.exe

[00:10:0686] [Check Services] [230/451] Netman

[00:10:0686] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:10:0686] [Check Services] [231/451] NetMsmqActivator

[00:10:0686] [Check Services] "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator

[00:10:0686] [Check Services] [232/451] NetPipeActivator

[00:10:0686] [Check Services] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

[00:10:0686] [Check Services] [233/451] netprofm

[00:10:0701] [Check Services] C:\Windows\System32\svchost.exe -k LocalService

[00:10:0701] [Check Services] [234/451] NetTcpActivator

[00:10:0701] [Check Services] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

[00:10:0701] [Check Services] [235/451] NetTcpPortSharing

[00:10:0701] [Check Services] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

[00:10:0701] [Check Services] [236/451] nfrd960

[00:10:0701] [Check Services] C:\Windows\system32\drivers\nfrd960.sys

[00:10:0717] [Check Services] [237/451] NlaSvc

[00:10:0717] [Check Services] C:\Windows\System32\svchost.exe -k NetworkService

[00:10:0717] [Check Services] [238/451] Npfs

[00:10:0717] [Check Services] Path not found

[00:10:0717] [Check Services] [239/451] nsi

[00:10:0717] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:10:0717] [Check Services] [240/451] nsiproxy

[00:10:0733] [Check Services] C:\Windows\system32\drivers\nsiproxy.sys

[00:10:0733] [Check Services] [241/451] Ntfs

[00:10:0733] [Check Services] Path not found

[00:10:0733] [Check Services] [242/451] Null

[00:10:0733] [Check Services] Path not found

[00:10:0733] [Check Services] [243/451] NVENETFD

[00:10:0733] [Check Services] C:\Windows\system32\DRIVERS\nvm62x64.sys

[00:10:0733] [Check Services] [244/451] nvraid

[00:10:0748] [Check Services] C:\Windows\system32\drivers\nvraid.sys

[00:10:0748] [Check Services] [245/451] nvstor

[00:10:0748] [Check Services] C:\Windows\system32\drivers\nvstor.sys

[00:10:0748] [Check Services] [246/451] nv_agp

[00:10:0748] [Check Services] C:\Windows\system32\drivers\nv_agp.sys

[00:10:0748] [Check Services] [247/451] odserv

[00:10:0748] [Check Services] "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"

[00:10:0748] [Check Services] [248/451] ohci1394

[00:10:0764] [Check Services] C:\Windows\system32\drivers\ohci1394.sys

[00:10:0764] [Check Services] [249/451] ose

[00:10:0764] [Check Services] "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

[00:10:0764] [Check Services] [250/451] osppsvc

[00:10:0764] [Check Services] "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

[00:10:0764] [Check Services] [251/451] p2pimsvc

[00:10:0764] [Check Services] C:\Windows\System32\svchost.exe -k LocalServicePeerNet

[00:10:0764] [Check Services] [252/451] p2psvc

[00:10:0779] [Check Services] C:\Windows\System32\svchost.exe -k LocalServicePeerNet

[00:10:0779] [Check Services] [253/451] Parport

[00:10:0779] [Check Services] C:\Windows\system32\drivers\parport.sys

[00:10:0779] [Check Services] [254/451] partmgr

[00:10:0779] [Check Services] C:\Windows\System32\drivers\partmgr.sys

[00:10:0779] [Check Services] [255/451] PcaSvc

[00:10:0779] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:10:0795] [Check Services] [256/451] pci

[00:10:0795] [Check Services] C:\Windows\system32\drivers\pci.sys

[00:10:0795] [Check Services] [257/451] pciide

[00:10:0795] [Check Services] C:\Windows\system32\drivers\pciide.sys

[00:10:0795] [Check Services] [258/451] pcmcia

[00:10:0795] [Check Services] C:\Windows\system32\drivers\pcmcia.sys

[00:10:0795] [Check Services] [259/451] pcw

[00:10:0795] [Check Services] C:\Windows\System32\drivers\pcw.sys

[00:10:0811] [Check Services] [260/451] PEAUTH

[00:10:0811] [Check Services] C:\Windows\system32\drivers\peauth.sys

[00:10:0811] [Check Services] [261/451] PerfHost

[00:10:0811] [Check Services] C:\Windows\SysWOW64\perfhost.exe

[00:10:0811] [Check Services] [262/451] pla

[00:10:0811] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

[00:10:0811] [Check Services] [263/451] PlugPlay

[00:10:0826] [Check Services] C:\Windows\system32\svchost.exe -k DcomLaunch

[00:10:0826] [Check Services] [264/451] PNRPAutoReg

[00:10:0826] [Check Services] C:\Windows\System32\svchost.exe -k LocalServicePeerNet

[00:10:0826] [Check Services] [265/451] PNRPsvc

[00:10:0826] [Check Services] C:\Windows\System32\svchost.exe -k LocalServicePeerNet

[00:10:0826] [Check Services] [266/451] PolicyAgent

[00:10:0842] [Check Services] C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

[00:10:0842] [Check Services] [267/451] Power

[00:10:0842] [Check Services] C:\Windows\system32\svchost.exe -k DcomLaunch

[00:10:0842] [Check Services] [268/451] PptpMiniport

[00:10:0842] [Check Services] C:\Windows\system32\DRIVERS\raspptp.sys

[00:10:0842] [Check Services] [269/451] Processor

[00:10:0842] [Check Services] C:\Windows\system32\drivers\processr.sys

[00:10:0842] [Check Services] [270/451] ProfSvc

[00:10:0857] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:10:0857] [Check Services] [271/451] ProtectedStorage

[00:10:0857] [Check Services] C:\Windows\system32\lsass.exe

[00:10:0857] [Check Services] [272/451] Psched

[00:10:0857] [Check Services] C:\Windows\system32\DRIVERS\pacer.sys

[00:10:0857] [Check Services] [273/451] ql2300

[00:10:0873] [Check Services] C:\Windows\system32\drivers\ql2300.sys

[00:10:0873] [Check Services] [274/451] ql40xx

[00:10:0873] [Check Services] C:\Windows\system32\drivers\ql40xx.sys

[00:10:0873] [Check Services] [275/451] QWAVE

[00:10:0873] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:10:0873] [Check Services] [276/451] QWAVEdrv

[00:10:0873] [Check Services] C:\Windows\system32\drivers\qwavedrv.sys

[00:10:0873] [Check Services] [277/451] RasAcd

[00:10:0889] [Check Services] C:\Windows\System32\DRIVERS\rasacd.sys

[00:10:0889] [Check Services] [278/451] RasAgileVpn

[00:10:0889] [Check Services] C:\Windows\system32\DRIVERS\AgileVpn.sys

[00:10:0889] [Check Services] [279/451] RasAuto

[00:10:0889] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:10:0889] [Check Services] [280/451] Rasl2tp

[00:10:0889] [Check Services] C:\Windows\system32\DRIVERS\rasl2tp.sys

[00:10:0904] [Check Services] [281/451] RasMan

[00:10:0904] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:10:0904] [Check Services] [282/451] RasPppoe

[00:10:0904] [Check Services] C:\Windows\system32\DRIVERS\raspppoe.sys

[00:10:0904] [Check Services] [283/451] RasSstp

[00:10:0904] [Check Services] C:\Windows\system32\DRIVERS\rassstp.sys

[00:10:0904] [Check Services] [284/451] rdbss

[00:10:0920] [Check Services] C:\Windows\system32\DRIVERS\rdbss.sys

[00:10:0920] [Check Services] [285/451] rdpbus

[00:10:0920] [Check Services] C:\Windows\system32\drivers\rdpbus.sys

[00:10:0920] [Check Services] [286/451] RDPCDD

[00:10:0920] [Check Services] C:\Windows\System32\DRIVERS\RDPCDD.sys

[00:10:0920] [Check Services] [287/451] RDPENCDD

[00:10:0920] [Check Services] C:\Windows\system32\drivers\rdpencdd.sys

[00:10:0935] [Check Services] [288/451] RDPREFMP

[00:10:0935] [Check Services] C:\Windows\system32\drivers\rdprefmp.sys

[00:10:0935] [Check Services] [289/451] RdpVideoMiniport

[00:10:0935] [Check Services] C:\Windows\System32\drivers\rdpvideominiport.sys

[00:10:0935] [Check Services] [290/451] RDPWD

[00:10:0935] [Check Services] Path not found

[00:10:0951] [Check Services] [291/451] rdyboost

[00:10:0951] [Check Services] C:\Windows\System32\drivers\rdyboost.sys

[00:10:0951] [Check Services] [292/451] RemoteAccess

[00:10:0951] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:10:0951] [Check Services] [293/451] RemoteRegistry

[00:10:0951] [Check Services] C:\Windows\system32\svchost.exe -k regsvc

[00:10:0967] [Check Services] [294/451] RpcEptMapper

[00:10:0967] [Check Services] C:\Windows\system32\svchost.exe -k RPCSS

[00:10:0967] [Check Services] [295/451] RpcLocator

[00:10:0967] [Check Services] C:\Windows\system32\locator.exe

[00:10:0967] [Check Services] [296/451] RpcSs

[00:10:0967] [Check Services] C:\Windows\system32\svchost.exe -k rpcss

[00:10:0967] [Check Services] [297/451] RSBASTOR

[00:10:0982] [Check Services] C:\Windows\system32\DRIVERS\RtsBaStor.sys

[00:10:0982] [Check Services] [298/451] rspndr

[00:10:0982] [Check Services] C:\Windows\system32\DRIVERS\rspndr.sys

[00:10:0982] [Check Services] [299/451] RTL8167

[00:10:0982] [Check Services] C:\Windows\system32\DRIVERS\Rt64win7.sys

[00:10:0982] [Check Services] [300/451] S3XXx64

[00:10:0998] [Check Services] C:\Windows\system32\DRIVERS\S3XXx64.sys

[00:10:0998] [Check Services] [301/451] SamSs

[00:10:0998] [Check Services] C:\Windows\system32\lsass.exe

[00:10:0998] [Check Services] [302/451] sbp2port

[00:10:0998] [Check Services] C:\Windows\system32\drivers\sbp2port.sys

[00:10:0998] [Check Services] [303/451] SCardSvr

[00:11:0013] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:11:0013] [Check Services] [304/451] scfilter

[00:11:0013] [Check Services] C:\Windows\System32\DRIVERS\scfilter.sys

[00:11:0013] [Check Services] [305/451] Schedule

[00:11:0013] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:11:0013] [Check Services] [306/451] SCPolicySvc

[00:11:0013] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:11:0029] [Check Services] [307/451] sdbus

[00:11:0029] [Check Services] C:\Windows\system32\DRIVERS\sdbus.sys

[00:11:0029] [Check Services] [308/451] SDRSVC

[00:11:0029] [Check Services] C:\Windows\system32\svchost.exe -k SDRSVC

[00:11:0029] [Check Services] [309/451] secdrv

[00:11:0029] [Check Services] Path not found

[00:11:0045] [Check Services] [310/451] seclogon

[00:11:0045] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:11:0045] [Check Services] [311/451] SENS

[00:11:0045] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:11:0045] [Check Services] [312/451] SensrSvc

[00:11:0045] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:11:0045] [Check Services] [313/451] Serenum

[00:11:0060] [Check Services] C:\Windows\system32\drivers\serenum.sys

[00:11:0060] [Check Services] [314/451] Serial

[00:11:0060] [Check Services] C:\Windows\system32\drivers\serial.sys

[00:11:0060] [Check Services] [315/451] sermouse

[00:11:0060] [Check Services] C:\Windows\system32\drivers\sermouse.sys

[00:11:0060] [Check Services] [316/451] SessionEnv

[00:11:0076] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:11:0076] [Check Services] [317/451] sffdisk

[00:11:0076] [Check Services] C:\Windows\system32\drivers\sffdisk.sys

[00:11:0076] [Check Services] [318/451] sffp_mmc

[00:11:0076] [Check Services] C:\Windows\system32\drivers\sffp_mmc.sys

[00:11:0076] [Check Services] [319/451] sffp_sd

[00:11:0091] [Check Services] C:\Windows\system32\drivers\sffp_sd.sys

[00:11:0091] [Check Services] [320/451] sfloppy

[00:11:0091] [Check Services] C:\Windows\system32\drivers\sfloppy.sys

[00:11:0091] [Check Services] [321/451] SharedAccess

[00:11:0091] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:11:0091] [Check Services] [322/451] ShellHWDetection

[00:11:0107] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:11:0107] [Check Services] [323/451] SiSRaid2

[00:11:0107] [Check Services] C:\Windows\system32\drivers\SiSRaid2.sys

[00:11:0107] [Check Services] [324/451] SiSRaid4

[00:11:0107] [Check Services] C:\Windows\system32\drivers\sisraid4.sys

[00:11:0107] [Check Services] [325/451] Skype C2C Service

[00:11:0107] [Check Services] "C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe"

[00:11:0123] [Check Services] [326/451] SkypeUpdate

[00:11:0123] [Check Services] "C:\Program Files (x86)\Skype\Updater\Updater.exe"

[00:11:0123] [Check Services] [327/451] Smb

[00:11:0123] [Check Services] C:\Windows\system32\DRIVERS\smb.sys

[00:11:0123] [Check Services] [328/451] SmbDrv

[00:11:0123] [Check Services] C:\Windows\system32\drivers\Smb_driver.sys

[00:11:0138] [Check Services] [329/451] SNMPTRAP

[00:11:0138] [Check Services] C:\Windows\System32\snmptrap.exe

[00:11:0138] [Check Services] [330/451] spldr

[00:11:0138] [Check Services] Path not found

[00:11:0138] [Check Services] [331/451] Spooler

[00:11:0138] [Check Services] C:\Windows\System32\spoolsv.exe

[00:11:0138] [Check Services] [332/451] sppsvc

[00:11:0154] [Check Services] C:\Windows\system32\sppsvc.exe

[00:11:0154] [Check Services] [333/451] sppuinotify

[00:11:0154] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:11:0154] [Check Services] [334/451] srv

[00:11:0154] [Check Services] C:\Windows\System32\DRIVERS\srv.sys

[00:11:0154] [Check Services] [335/451] srv2

[00:11:0169] [Check Services] C:\Windows\System32\DRIVERS\srv2.sys

[00:11:0169] [Check Services] [336/451] SrvHsfHDA

[00:11:0169] [Check Services] C:\Windows\system32\DRIVERS\VSTAZL6.SYS

[00:11:0169] [Check Services] [337/451] SrvHsfV92

[00:11:0169] [Check Services] C:\Windows\system32\DRIVERS\VSTDPV6.SYS

[00:11:0169] [Check Services] [338/451] SrvHsfWinac

[00:11:0185] [Check Services] C:\Windows\system32\DRIVERS\VSTCNXT6.SYS

[00:11:0185] [Check Services] [339/451] srvnet

[00:11:0185] [Check Services] C:\Windows\System32\DRIVERS\srvnet.sys

[00:11:0185] [Check Services] [340/451] SSDPSRV

[00:11:0185] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:11:0185] [Check Services] [341/451] SstpSvc

[00:11:0201] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:11:0201] [Check Services] [342/451] STacSV

[00:11:0201] [Check Services] C:\Program Files\IDT\WDM\stacsv64.exe

[00:11:0201] [Check Services] [343/451] stexstor

[00:11:0201] [Check Services] C:\Windows\system32\drivers\stexstor.sys

[00:11:0201] [Check Services] [344/451] STHDA

[00:11:0201] [Check Services] C:\Windows\system32\DRIVERS\stwrt64.sys

[00:11:0216] [Check Services] [345/451] stisvc

[00:11:0216] [Check Services] C:\Windows\system32\svchost.exe -k imgsvc

[00:11:0216] [Check Services] [346/451] swenum

[00:11:0216] [Check Services] C:\Windows\system32\drivers\swenum.sys

[00:11:0216] [Check Services] [347/451] swprv

[00:11:0216] [Check Services] C:\Windows\System32\svchost.exe -k swprv

[00:11:0232] [Check Services] [348/451] SynTP

[00:11:0232] [Check Services] C:\Windows\system32\DRIVERS\SynTP.sys

[00:11:0232] [Check Services] [349/451] SysMain

[00:11:0232] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0232] [Check Services] [350/451] TabletInputService

[00:11:0232] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0232] [Check Services] [351/451] TapiSrv

[00:11:0247] [Check Services] C:\Windows\System32\svchost.exe -k NetworkService

[00:11:0247] [Check Services] [352/451] TBS

[00:11:0247] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation

[00:11:0247] [Check Services] [353/451] Tcpip

[00:11:0247] [Check Services] C:\Windows\System32\drivers\tcpip.sys

[00:11:0247] [Check Services] [354/451] TCPIP6

[00:11:0247] [Check Services] C:\Windows\system32\DRIVERS\tcpip.sys

[00:11:0247] [Check Services] [355/451] tcpipreg

[00:11:0263] [Check Services] C:\Windows\System32\drivers\tcpipreg.sys

[00:11:0263] [Check Services] [356/451] TDPIPE

[00:11:0263] [Check Services] C:\Windows\system32\drivers\tdpipe.sys

[00:11:0263] [Check Services] [357/451] TDTCP

[00:11:0263] [Check Services] C:\Windows\system32\drivers\tdtcp.sys

[00:11:0263] [Check Services] [358/451] tdx

[00:11:0263] [Check Services] C:\Windows\system32\DRIVERS\tdx.sys

[00:11:0279] [Check Services] [359/451] TermDD

[00:11:0279] [Check Services] C:\Windows\system32\drivers\termdd.sys

[00:11:0279] [Check Services] [360/451] TermService

[00:11:0279] [Check Services] C:\Windows\System32\svchost.exe -k NetworkService

[00:11:0279] [Check Services] [361/451] Themes

[00:11:0279] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:11:0279] [Check Services] [362/451] THREADORDER

[00:11:0294] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:11:0294] [Check Services] [363/451] tmactmon

[00:11:0294] [Check Services] C:\Windows\system32\DRIVERS\tmactmon.sys

[00:11:0294] [Check Services] [364/451] tmcomm

[00:11:0294] [Check Services] C:\Windows\system32\DRIVERS\tmcomm.sys

[00:11:0294] [Check Services] [365/451] TMEBC

[00:11:0294] [Check Services] C:\Windows\system32\DRIVERS\TMEBC64.sys

[00:11:0294] [Check Services] [366/451] tmeevw

[00:11:0310] [Check Services] C:\Windows\system32\DRIVERS\tmeevw.sys

[00:11:0310] [Check Services] [367/451] tmevtmgr

[00:11:0310] [Check Services] C:\Windows\system32\DRIVERS\tmevtmgr.sys

[00:11:0310] [Check Services] [368/451] tmnciesc

[00:11:0310] [Check Services] C:\Windows\system32\DRIVERS\tmnciesc.sys

[00:11:0310] [Check Services] [369/451] tmtdi

[00:11:0310] [Check Services] C:\Windows\system32\DRIVERS\tmtdi.sys

[00:11:0310] [Check Services] [370/451] TrkWks

[00:11:0325] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0325] [Check Services] [371/451] TrueService

[00:11:0325] [Check Services] "C:\Program Files\Common Files\AuthenTec\TrueService.exe"

[00:11:0325] [Check Services] [372/451] TrustedInstaller

[00:11:0325] [Check Services] C:\Windows\servicing\TrustedInstaller.exe

[00:11:0325] [Check Services] [373/451] tssecsrv

[00:11:0325] [Check Services] C:\Windows\System32\DRIVERS\tssecsrv.sys

[00:11:0341] [Check Services] [374/451] TsUsbFlt

[00:11:0341] [Check Services] C:\Windows\system32\drivers\tsusbflt.sys

[00:11:0341] [Check Services] [375/451] TsUsbGD

[00:11:0341] [Check Services] C:\Windows\system32\drivers\TsUsbGD.sys

[00:11:0341] [Check Services] [376/451] tunnel

[00:11:0341] [Check Services] C:\Windows\system32\DRIVERS\tunnel.sys

[00:11:0341] [Check Services] [377/451] uagp35

[00:11:0341] [Check Services] C:\Windows\system32\drivers\uagp35.sys

[00:11:0357] [Check Services] [378/451] udfs

[00:11:0357] [Check Services] C:\Windows\system32\DRIVERS\udfs.sys

[00:11:0357] [Check Services] [379/451] UI0Detect

[00:11:0357] [Check Services] C:\Windows\system32\UI0Detect.exe

[00:11:0357] [Check Services] [380/451] uliagpkx

[00:11:0357] [Check Services] C:\Windows\system32\drivers\uliagpkx.sys

[00:11:0357] [Check Services] [381/451] umbus

[00:11:0357] [Check Services] C:\Windows\system32\DRIVERS\umbus.sys

[00:11:0372] [Check Services] [382/451] UmPass

[00:11:0372] [Check Services] C:\Windows\system32\DRIVERS\umpass.sys

[00:11:0372] [Check Services] [383/451] upnphost

[00:11:0372] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

[00:11:0372] [Check Services] [384/451] USBAAPL64

[00:11:0372] [Check Services] C:\Windows\System32\Drivers\usbaapl64.sys

[00:11:0372] [Check Services] [385/451] usbccgp

[00:11:0372] [Check Services] C:\Windows\system32\DRIVERS\usbccgp.sys

[00:11:0388] [Check Services] [386/451] usbcir

[00:11:0388] [Check Services] C:\Windows\system32\drivers\usbcir.sys

[00:11:0388] [Check Services] [387/451] usbehci

[00:11:0388] [Check Services] C:\Windows\system32\drivers\usbehci.sys

[00:11:0388] [Check Services] [388/451] usbfilter

[00:11:0388] [Check Services] C:\Windows\system32\DRIVERS\usbfilter.sys

[00:11:0388] [Check Services] [389/451] usbhub

[00:11:0388] [Check Services] C:\Windows\system32\drivers\usbhub.sys

[00:11:0403] [Check Services] [390/451] usbohci

[00:11:0403] [Check Services] C:\Windows\system32\drivers\usbohci.sys

[00:11:0403] [Check Services] [391/451] usbprint

[00:11:0403] [Check Services] C:\Windows\system32\DRIVERS\usbprint.sys

[00:11:0403] [Check Services] [392/451] usbscan

[00:11:0403] [Check Services] C:\Windows\system32\DRIVERS\usbscan.sys

[00:11:0403] [Check Services] [393/451] USBSTOR

[00:11:0403] [Check Services] C:\Windows\system32\DRIVERS\USBSTOR.SYS

[00:11:0419] [Check Services] [394/451] usbuhci

[00:11:0419] [Check Services] C:\Windows\system32\drivers\usbuhci.sys

[00:11:0419] [Check Services] [395/451] usbvideo

[00:11:0419] [Check Services] C:\Windows\System32\Drivers\usbvideo.sys

[00:11:0419] [Check Services] [396/451] UxSms

[00:11:0419] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0419] [Check Services] [397/451] VaultSvc

[00:11:0435] [Check Services] C:\Windows\system32\lsass.exe

[00:11:0435] [Check Services] [398/451] vdrvroot

[00:11:0435] [Check Services] C:\Windows\system32\drivers\vdrvroot.sys

[00:11:0435] [Check Services] [399/451] vds

[00:11:0435] [Check Services] C:\Windows\System32\vds.exe

[00:11:0435] [Check Services] [400/451] vga

[00:11:0435] [Check Services] C:\Windows\system32\DRIVERS\vgapnp.sys

[00:11:0435] [Check Services] [401/451] VgaSave

[00:11:0450] [Check Services] C:\Windows\System32\drivers\vga.sys

[00:11:0450] [Check Services] [402/451] vhdmp

[00:11:0450] [Check Services] C:\Windows\system32\drivers\vhdmp.sys

[00:11:0450] [Check Services] [403/451] viaide

[00:11:0450] [Check Services] C:\Windows\system32\drivers\viaide.sys

[00:11:0450] [Check Services] [404/451] volmgr

[00:11:0450] [Check Services] C:\Windows\system32\drivers\volmgr.sys

[00:11:0450] [Check Services] [405/451] volmgrx

[00:11:0466] [Check Services] C:\Windows\System32\drivers\volmgrx.sys

[00:11:0466] [Check Services] [406/451] volsnap

[00:11:0466] [Check Services] C:\Windows\system32\drivers\volsnap.sys

[00:11:0466] [Check Services] [407/451] vsmraid

[00:11:0466] [Check Services] C:\Windows\system32\drivers\vsmraid.sys

[00:11:0466] [Check Services] [408/451] VSS

[00:11:0466] [Check Services] C:\Windows\system32\vssvc.exe

[00:11:0466] [Check Services] [409/451] vwifibus

[00:11:0481] [Check Services] C:\Windows\system32\DRIVERS\vwifibus.sys

[00:11:0481] [Check Services] [410/451] vwififlt

[00:11:0481] [Check Services] C:\Windows\system32\DRIVERS\vwififlt.sys

[00:11:0481] [Check Services] [411/451] vwifimp

[00:11:0481] [Check Services] C:\Windows\system32\DRIVERS\vwifimp.sys

[00:11:0481] [Check Services] [412/451] W32Time

[00:11:0481] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:11:0497] [Check Services] [413/451] WacomPen

[00:11:0497] [Check Services] C:\Windows\system32\drivers\wacompen.sys

[00:11:0497] [Check Services] [414/451] WANARP

[00:11:0497] [Check Services] C:\Windows\system32\DRIVERS\wanarp.sys

[00:11:0497] [Check Services] [415/451] Wanarpv6

[00:11:0497] [Check Services] C:\Windows\system32\DRIVERS\wanarp.sys

[00:11:0497] [Check Services] [416/451] WatAdminSvc

[00:11:0513] [Check Services] C:\Windows\system32\Wat\WatAdminSvc.exe

[00:11:0513] [Check Services] [417/451] wbengine

[00:11:0513] [Check Services] "C:\Windows\system32\wbengine.exe"

[00:11:0513] [Check Services] [418/451] WbioSrvc

[00:11:0513] [Check Services] C:\Windows\system32\svchost.exe -k WbioSvcGroup

[00:11:0513] [Check Services] [419/451] wcncsvc

[00:11:0528] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation

[00:11:0528] [Check Services] [420/451] WcsPlugInService

[00:11:0528] [Check Services] C:\Windows\system32\svchost.exe -k wcssvc

[00:11:0528] [Check Services] [421/451] Wd

[00:11:0528] [Check Services] C:\Windows\system32\drivers\wd.sys

[00:11:0528] [Check Services] [422/451] Wdf01000

[00:11:0544] [Check Services] C:\Windows\system32\drivers\Wdf01000.sys

[00:11:0544] [Check Services] [423/451] WdiServiceHost

[00:11:0544] [Check Services] C:\Windows\System32\svchost.exe -k LocalService

[00:11:0544] [Check Services] [424/451] WdiSystemHost

[00:11:0544] [Check Services] C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0544] [Check Services] [425/451] WebClient

[00:11:0544] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:11:0559] [Check Services] [426/451] Wecsvc

[00:11:0559] [Check Services] C:\Windows\system32\svchost.exe -k NetworkService

[00:11:0559] [Check Services] [427/451] wercplsupport

[00:11:0559] [Check Services] C:\Windows\System32\svchost.exe -k netsvcs

[00:11:0559] [Check Services] [428/451] WerSvc

[00:11:0559] [Check Services] C:\Windows\System32\svchost.exe -k WerSvcGroup

[00:11:0575] [Check Services] [429/451] WfpLwf

[00:11:0575] [Check Services] C:\Windows\system32\DRIVERS\wfplwf.sys

[00:11:0575] [Check Services] [430/451] WIMMount

[00:11:0575] [Check Services] C:\Windows\system32\drivers\wimmount.sys

[00:11:0575] [Check Services] [431/451] WinDefend

[00:11:0575] [Check Services] C:\Windows\System32\svchost.exe -k secsvcs

[00:11:0575] [Check Services] [432/451] WinHttpAutoProxySvc

[00:11:0591] [Check Services] C:\Windows\system32\svchost.exe -k LocalService

[00:11:0591] [Check Services] [433/451] Winmgmt

[00:11:0591] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:11:0591] [Check Services] [434/451] WinRM

[00:11:0591] [Check Services] C:\Windows\System32\svchost.exe -k NetworkService

[00:11:0591] [Check Services] [435/451] WinUsb

[00:11:0606] [Check Services] C:\Windows\system32\DRIVERS\WinUSB.sys

[00:11:0606] [Check Services] [436/451] Wlansvc

[00:11:0606] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0606] [Check Services] [437/451] wlcrasvc

[00:11:0606] [Check Services] "C:\Program Files\Windows Live\Mesh\wlcrasvc.exe"

[00:11:0606] [Check Services] [438/451] wlidsvc

[00:11:0606] [Check Services] "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

[00:11:0622] [Check Services] [439/451] WmiAcpi

[00:11:0622] [Check Services] C:\Windows\system32\drivers\wmiacpi.sys

[00:11:0622] [Check Services] [440/451] wmiApSrv

[00:11:0622] [Check Services] C:\Windows\system32\wbem\WmiApSrv.exe

[00:11:0622] [Check Services] [441/451] WMPNetworkSvc

[00:11:0622] [Check Services] "C:\Program Files\Windows Media Player\wmpnetwk.exe"

[00:11:0622] [Check Services] [442/451] WPCSvc

[00:11:0637] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted

[00:11:0637] [Check Services] [443/451] WPDBusEnum

[00:11:0637] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0637] [Check Services] [444/451] ws2ifsl

[00:11:0637] [Check Services] C:\Windows\system32\drivers\ws2ifsl.sys

[00:11:0637] [Check Services] [445/451] wscsvc

[00:11:0653] [Check Services] C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

[00:11:0653] [Check Services] [446/451] WSearch

[00:11:0653] [Check Services] C:\Windows\system32\SearchIndexer.exe /Embedding

[00:11:0653] [Check Services] [447/451] wuauserv

[00:11:0653] [Check Services] C:\Windows\system32\svchost.exe -k netsvcs

[00:11:0653] [Check Services] [448/451] WudfPf

[00:11:0669] [Check Services] C:\Windows\system32\drivers\WudfPf.sys

[00:11:0669] [Check Services] [449/451] WUDFRd

[00:11:0669] [Check Services] C:\Windows\system32\DRIVERS\WUDFRd.sys

[00:11:0669] [Check Services] [450/451] wudfsvc

[00:11:0669] [Check Services] C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

[00:11:0669] [Check Services] [451/451] WwanSvc

[00:11:0669] [Check Services] C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

[00:11:0684] Getting current build number

[00:12:0480] Current build number : 8.4.3

[00:12:0480] Getting previous runs informations

[00:12:0480] Drop Eula : C:\Users\Scott\Desktop\RK_Quarantine\Eula.txt

[00:16:0005] ***** PreScan OK *****

[00:19:0703] ********* Scan Mode *********

[00:19:0718] Clear ListViews

[00:19:0718] Clear Objects

[00:19:0781] [GUID] HKCR\CLSID

[00:20:0124] [RUN][0x100] HKCU\Software\Microsoft\Windows\CurrentVersion\Run

[00:20:0124] [RUN] OfficeSyncProcess

[00:20:0140] -> OfficeSyncProcess : [MSOSYNC.EXE] C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE

Share this post


Link to post
Share on other sites

Just downloaded a fresh copy and I'm rebooting now unless the information I posted above will suffice.

Share this post


Link to post
Share on other sites

No, that's not the log I need, try it again, MrC

Share this post


Link to post
Share on other sites

I attempted to run RK in safe mode and got the following message: The exception unknown software exception (0xc0000417) occurred in the application at location 0x004e62c7

Share this post


Link to post
Share on other sites

OK, please run this scan............

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

Share this post


Link to post
Share on other sites

Well Done, lets run ComboFix to clear up any leftovers.

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Share this post


Link to post
Share on other sites

Good morning. I started CF and it has been stuck on stage 4 for the last 15 mins. Is this normal?

Share this post


Link to post
Share on other sites

Yes, let it run for at least 1/2 hour...MrC

Share this post


Link to post
Share on other sites

The power went out and just came back on. I ran CF but can't connect to the Internet.

Share this post


Link to post
Share on other sites

Mr. C, please disregard the IE issue. I had to go into the security settings and change it from custom to default. Thanks.

Share this post


Link to post
Share on other sites

Mr. C, do you need me to post the text of the Combo Fix results or will the attachment above suffice? Thanks.

Share this post


Link to post
Share on other sites

ComboFix 13-01-26.02 - Scott 01/26/2013 8:20.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5609.3886 [GMT -6:00]

Running from: c:\users\Scott\Desktop\ComboFix.exe

AV: Trend Micro Titanium Internet Security *Disabled/Updated* {B7599298-8445-728A-A5C7-A26A082C8BDA}

SP: Trend Micro Titanium Internet Security *Disabled/Updated* {0C38737C-A27F-7D04-9F77-991873ABC167}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\wininit.ini

.

.

((((((((((((((((((((((((( Files Created from 2012-12-26 to 2013-01-26 )))))))))))))))))))))))))))))))

.

.

2013-01-26 15:53 . 2013-01-26 15:53 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-01-26 14:20 . 2013-01-26 14:20 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{675B6DB7-FD19-4494-8897-61A1CE1A075E}\offreg.dll

2013-01-25 23:04 . 2013-01-25 23:04 -------- d-----w- c:\program files (x86)\HP

2013-01-25 19:18 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{675B6DB7-FD19-4494-8897-61A1CE1A075E}\mpengine.dll

2013-01-24 04:42 . 2013-01-24 04:42 -------- d-----w- c:\users\Scott\AppData\Roaming\Malwarebytes

2013-01-24 04:42 . 2013-01-24 04:42 -------- d-----w- c:\programdata\Malwarebytes

2013-01-24 04:42 . 2013-01-24 04:42 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-01-24 04:42 . 2012-12-14 22:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-01-24 04:41 . 2013-01-24 04:41 -------- d-----w- c:\users\Scott\AppData\Local\Programs

2013-01-24 03:29 . 2013-01-12 09:30 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-01-22 13:30 . 2012-08-23 15:09 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui

2013-01-22 13:30 . 2012-08-23 13:41 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2013-01-22 13:30 . 2012-08-23 13:40 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2013-01-22 13:30 . 2012-08-23 13:24 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll

2013-01-22 13:28 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2013-01-22 13:28 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys

2013-01-22 13:28 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll

2013-01-22 13:28 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll

2013-01-22 13:28 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll

2013-01-22 13:28 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2013-01-22 13:28 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2013-01-22 13:28 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll

2013-01-22 13:28 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

2013-01-16 13:36 . 2013-01-25 21:32 -------- d-----w- c:\users\Scott\AppData\Local\ElevatedDiagnostics

2013-01-14 03:18 . 2012-11-14 03:51 19450880 ----a-w- c:\windows\system32\mshtml.dll

2013-01-14 03:18 . 2012-11-14 03:25 2706432 ----a-w- c:\windows\system32\mshtml.tlb

2013-01-14 03:18 . 2012-11-14 01:14 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb

2013-01-13 04:20 . 2012-11-09 06:46 28672 ----a-w- c:\windows\system32\IEUDINIT.EXE

2013-01-13 04:16 . 2013-01-13 04:16 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-01-13 04:12 . 2013-01-13 04:12 -------- d-----w- c:\programdata\HitmanPro

2013-01-12 23:53 . 2012-08-25 05:16 98104 ----a-w- c:\windows\system32\drivers\tmeevw.sys

2013-01-12 23:53 . 2012-07-06 03:35 210232 ----a-w- c:\windows\system32\drivers\tmnciesc.sys

2013-01-09 23:40 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll

2013-01-09 23:40 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll

2013-01-09 23:40 . 2012-11-01 05:43 2002432 ----a-w- c:\windows\system32\msxml6.dll

2013-01-09 23:40 . 2012-11-01 05:43 1882624 ----a-w- c:\windows\system32\msxml3.dll

2013-01-09 23:40 . 2012-11-01 04:47 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll

2013-01-09 23:40 . 2012-11-01 04:47 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll

2013-01-09 23:40 . 2012-11-20 05:48 307200 ----a-w- c:\windows\system32\ncrypt.dll

2013-01-09 23:40 . 2012-11-20 04:51 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

2013-01-09 23:40 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll

2013-01-09 23:40 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll

2013-01-09 23:38 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe

2013-01-09 23:38 . 2012-11-23 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys

2013-01-07 11:04 . 2013-01-07 11:04 74112 ----a-w- c:\windows\system32\drivers\S3XXx64.sys

2013-01-03 04:01 . 2013-01-03 04:01 -------- d-----w- c:\program files\iPod

2013-01-03 04:01 . 2013-01-03 04:01 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-01-03 04:01 . 2013-01-03 04:01 -------- d-----w- c:\program files\iTunes

2013-01-03 04:01 . 2013-01-03 04:01 -------- d-----w- c:\program files (x86)\iTunes

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-01-08 21:11 . 2012-04-20 01:00 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-01-08 21:11 . 2012-04-20 01:00 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-16 23:31 . 2012-07-05 00:29 67599240 ----a-w- c:\windows\system32\MRT.exe

2012-12-16 17:11 . 2012-12-26 20:20 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-16 14:45 . 2012-12-26 20:20 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-16 14:13 . 2012-12-26 20:20 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-12-16 14:13 . 2012-12-26 20:20 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-11-30 04:45 . 2013-01-09 23:39 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-11-09 05:45 . 2012-12-12 00:27 2048 ----a-w- c:\windows\system32\tzres.dll

2012-11-09 04:42 . 2012-12-12 00:27 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-11-09 03:00 . 2012-11-09 03:00 59 ----a-w- c:\windows\system32\SupportTool.exe.bat

2012-11-02 05:59 . 2012-12-12 00:27 478208 ----a-w- c:\windows\system32\dpnet.dll

2012-11-02 05:11 . 2012-12-12 00:27 376832 ----a-w- c:\windows\SysWow64\dpnet.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-21 719672]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AprvRemoveLegacyExcelKeys"="c:\program files (x86)\ApproveIt\Support\Tools\AprvClean.exe -k HKCU SOFTWARE\Microsoft\Office\Excel\Addins\OfficeAddIn.OfficeAddIn" [X]

"AprvRemoveLegacyWordKeys"="c:\program files (x86)\ApproveIt\Support\Tools\AprvClean.exe -k HKCU SOFTWARE\Microsoft\Office\Word\Addins\OfficeAddIn.OfficeAddIn" [X]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]

"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]

"HP CoolSense"="c:\program files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe" [2012-11-05 1343904]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]

"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-09-13 103992]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-12 642216]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"Z1"="c:\users\Scott\Desktop\mbar-1.01.0.1016\mbar\mbar.exe" [2013-01-26 1356360]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

ActivClient Agent.lnk - c:\program files\ActivIdentity\ActivClient\acsagent.exe [2009-6-3 164904]

ApproveIt StartUp.lnk - c:\windows\Installer\{4E01B649-0023-4EB5-9263-57DE317C3418}\Icon9557F1BC1.ico [2012-7-3 9216]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 APXACC;AppEx Networks Accelerator LWF;c:\windows\system32\DRIVERS\appexDrv.sys [x]

R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.362.0\BBSvc.exe [2012-02-14 193816]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-12-13 3290896]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]

R3 amdiox64;AMD IO Driver;c:\windows\system32\drivers\amdiox64.sys [2010-02-18 46136]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 S3XXx64;SCR3xx USB SmartCardReader64;c:\windows\system32\DRIVERS\S3XXx64.sys [2013-01-07 74112]

R3 SmbDrv;SmbDrv;c:\windows\system32\drivers\Smb_driver.sys [2012-03-02 21264]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-05 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys [2011-12-13 82048]

S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys [2011-12-13 42624]

S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\drivers\amdkmpfd.sys [2012-02-02 31872]

S0 TMEBC;TMEBC;c:\windows\system32\DRIVERS\TMEBC64.sys [2012-08-24 46392]

S1 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2012-07-12 76672]

S2 ac.sharedstore;ActivIdentity Shared Store Service;c:\program files\Common Files\ActivIdentity\ac.sharedstore.exe [2009-06-03 277032]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-04-07 235520]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-09-12 361984]

S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]

S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass\TrueSuiteService.exe [2012-08-10 1641320]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2012-02-22 31000]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-03-05 35200]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\drivers\amdhub30.sys [2011-10-26 102528]

S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\drivers\amdxhc.sys [2011-10-26 219776]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-12-06 95248]

S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.362.0\SeaPort.exe [2012-02-14 240408]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]

S3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-09-13 1098296]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 RSBASTOR;Realtek PCIE CardReader Driver - BA;c:\windows\system32\DRIVERS\RtsBaStor.sys [2012-03-08 293480]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-03-10 685160]

S3 tmeevw;tmeevw;c:\windows\system32\DRIVERS\tmeevw.sys [2012-08-25 98104]

S3 tmnciesc;tmnciesc;c:\windows\system32\DRIVERS\tmnciesc.sys [2012-07-06 210232]

S3 TrueService;TrueAPI Service component;c:\program files\Common Files\AuthenTec\TrueService.exe [2012-07-16 401256]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2012-01-14 56448]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-01-25 19:07 1607120 ----a-w- c:\program files (x86)\Google\Chrome\Application\24.0.1312.56\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-01-26 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-20 21:11]

.

2013-01-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-04 00:57]

.

2013-01-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-04 00:57]

.

2013-01-18 c:\windows\Tasks\HPCeeScheduleForScott.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 11:43]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 162552 ----a-w- c:\users\Scott\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-03-06 1425408]

"acevents"="c:\program files\ActivIdentity\ActivClient\acevents.exe" [2009-06-03 196648]

"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2009-06-03 483880]

"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-12-20 44880]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2012-07-25 1374864]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2012-10-08 213856]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

HKLM_Wow6432Node-ActiveSetup-{438363A8-F486-4C37-834C-4955773CB3D3} - msiexec

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-01-26 09:57:32

ComboFix-quarantined-files.txt 2013-01-26 15:57

.

Pre-Run: 281,283,026,944 bytes free

Post-Run: 280,757,297,152 bytes free

.

- - End Of File - - 1845B901B176854A296672BFDE74F76F

Share this post


Link to post
Share on other sites

Looks Good, how's it running??

----------------------------------

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Please look over what was found, we're going to delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

MrC

Share this post


Link to post
Share on other sites

# AdwCleaner v2.108 - Logfile created 01/26/2013 at 16:37:47

# Updated 24/01/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Scott - SCOTT-HP

# Boot Mode : Normal

# Running from : C:\Users\Scott\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Found : HKU\S-1-5-21-3371478201-2237100362-2187333285-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16438

[OK] Registry is clean.

-\\ Google Chrome v24.0.1312.56

File : C:\Users\Scott\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1243 octets] - [26/01/2013 16:37:47]

########## EOF - C:\AdwCleaner[R1].txt - [1303 octets] ##########

Share this post


Link to post
Share on other sites

Everything seems to be running just fine. Thanks again for the continued assistance.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.