Trojan that's unaffected by Antivirus and MalwareBytes

Hello,

I was without antivirus protection for about a few weeks and a trojan got on my computer. It was redirecting all my internet pages to google search, or I would see a google error code. Then, upon starting up my computer, my computer would restart to "protect itself" several times before I was able to use it. I quickly went out and bought Defender Pro 2012 and was FINALLY able to install it on my computer. After it scanned and "removed" the malicious files from my computer, it installed and said my computer was protected.

However, it was still rebooting upon start. So I disabled all the unnecessary start up programs including my Dell Dock, and ran Malwarebytes. It found 2 Trojans and said I needed to restart to completely remove them. However, after restarting, they are still there.

The trojan that Malware bytes NOW detects is:

Trojan.Agent C\Windows\svchost.exe

Would it be okay to get help running ComboFix, to see if it truly cleans my computer?

Thanks so much!

Oh, I have:

Windows 7 Home Premium , 64 bit
Service Pack 1

Dell Studio XPS 8000
Intel Core i7 CPU 860 @ 2.8GHz 2.79GHz
6.00 Gigs Ram

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


DeFogger:

• Please download DeFogger to your desktop.
  
  Double click DeFogger to run the tool.
  
• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.


Security Check

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Download DDS:

• Please download DDS by sUBs from one of the links below and save it to your desktop:
  
  
  Download DDS and save it to your desktop
  
  Link1
  Link2
  Link3
  
  Please disable any anti-malware program that will block scripts from running before running DDS.
  
  
  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    
  • DDS.txt
  • Attach.txt
• A window will open instructing you save & post the logs
• Save the logs to a convenient place such as your desktop
• Copy the contents of both logs & post in your next reply

information and logs:

• In your next post I need the following
  
  
• .logs from DDS
• let me know of any problems you may have had

Gringo

Thanks for the reply!

I was able to download and run Defogger. However, I could not run Security Check. I saved it to my desktop, double clicked it to run, and nothing happened. I did not see a black box.

So I have not ran DDS yet.

Hello Jackque2817


skip Security Check and move on to DDS


Gringo

DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Jackque at 6:16:22 on 2012-06-16
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6135.4385 [GMT -5:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Defender Pro\Defender Pro\vsserv.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\lxducoms.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Defender Pro\Defender Pro\updatesrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Defender Pro\Defender Pro\bdagent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://msn.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_Plugin.exe -update plugin
mRun: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.15.1
TCP: Interfaces\{7484D03D-E281-48A8-B53D-1E1F956A5DF4} : DhcpNameServer = 192.168.15.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
mRun-x64: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
mRun-x64: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Jackque\AppData\Roaming\Mozilla\Firefox\Profiles\nbdboseh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
FF - prefs.js: browser.search.selectedEngine - bing
FF - prefs.js: browser.startup.homepage - hxxp://g.msn.com/USCON/1
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll
FF - plugin: C:\Program Files (x86)\Download Manager\npfpdlm.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 avc3;avc3;C:\Windows\system32\DRIVERS\avc3.sys --> C:\Windows\system32\DRIVERS\avc3.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;C:\Program Files\Common Files\Defender Pro\Defender Pro Firewall\bdfndisf6.sys [2011-3-1 89680]
R1 bdfwfpf;bdfwfpf;C:\Program Files\Common Files\Defender Pro\Defender Pro Firewall\bdfwfpf.sys [2011-3-1 102992]
R1 BDVEDISK;BDVEDISK;C:\Windows\system32\DRIVERS\bdvedisk.sys --> C:\Windows\system32\DRIVERS\bdvedisk.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-1-17 92160]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
R2 lxdu_device;lxdu_device;C:\Windows\system32\lxducoms.exe -service --> C:\Windows\system32\lxducoms.exe -service [?]
R2 UPDATESRV;Defender Pro Desktop Update Service;C:\Program Files\Defender Pro\Defender Pro\updatesrv.exe [2011-8-2 62512]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 avchv;avchv Function Driver;C:\Windows\system32\DRIVERS\avchv.sys --> C:\Windows\system32\DRIVERS\avchv.sys [?]
R3 avckf;avckf;C:\Windows\system32\DRIVERS\avckf.sys --> C:\Windows\system32\DRIVERS\avckf.sys [?]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
S2 0055071339077083mcinstcleanup;McAfee Application Installer Cleanup (0055071339077083);C:\Users\Jackque\AppData\Local\Temp\005507~1.EXE -cleanup -nolog --> C:\Users\Jackque\AppData\Local\Temp\005507~1.EXE -cleanup -nolog [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 McMPFSvc;McAfee Personal Firewall Service;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc --> C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [?]
S2 SessionLauncher;SessionLauncher;c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe --> c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [?]
S3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\system32\DRIVERS\lgandbus64.sys --> C:\Windows\system32\DRIVERS\lgandbus64.sys [?]
S3 AndDiag;LGE Android Platform USB Serial Port;C:\Windows\system32\DRIVERS\lganddiag64.sys --> C:\Windows\system32\DRIVERS\lganddiag64.sys [?]
S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\Windows\system32\DRIVERS\lgandgps64.sys --> C:\Windows\system32\DRIVERS\lgandgps64.sys [?]
S3 ANDModem;LGE Android Platform USB Modem;C:\Windows\system32\DRIVERS\lgandmodem64.sys --> C:\Windows\system32\DRIVERS\lgandmodem64.sys [?]
S3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\lgandadb.sys --> C:\Windows\system32\Drivers\lgandadb.sys [?]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]
S3 bdsandbox;bdsandbox;\??\C:\Windows\system32\drivers\bdsandbox.sys --> C:\Windows\system32\drivers\bdsandbox.sys [?]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Steam\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe [2011-10-29 25832]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-6-16 129976]
S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe [2009-6-26 1124848]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 Update Server;BitDefender Update Server v2;C:\Program Files\Common Files\Defender Pro\Defender Pro Arrakis Server\bin\arrakis3.exe [2011-8-2 466736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-06-16 11:11:04 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2012-06-16 11:11:01 588728 ----a-w- C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll
2012-06-16 11:11:01 43960 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
2012-06-16 11:11:01 157352 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-06-16 11:11:01 129976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-06-16 11:11:00 626688 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr80.dll
2012-06-16 11:11:00 548864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp80.dll
2012-06-16 11:11:00 479232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcm80.dll
2012-06-15 00:31:17 -------- d-----w- C:\Users\Jackque\AppData\Local\Funcom
2012-06-15 00:31:12 -------- d-----w- C:\Program Files (x86)\Funcom
2012-06-14 23:28:09 20480 ----a-w- C:\Windows\svchost.exe
2012-06-14 22:22:51 463 ----a-w- C:\Program Files (x86)\0614201217225091.bat
2012-06-13 20:51:59 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-06-11 00:50:34 -------- d-----w- C:\ProgramData\Cateia Games
2012-06-11 00:47:19 -------- d-----w- C:\Program Files (x86)\Oberon Media
2012-06-09 14:41:40 -------- d-----w- C:\Windows\pss
2012-06-09 14:04:30 -------- d-----w- C:\Users\Jackque\AppData\Local\{F31F328F-6657-4AE1-BD54-BCE48CF7E989}
2012-06-09 06:02:42 -------- d-----w- C:\Users\Jackque\AppData\Local\{EE74F0BA-6B49-4B12-B506-D480881736E9}
2012-06-09 05:55:33 -------- d-----w- C:\Users\Jackque\AppData\Local\ElevatedDiagnostics
2012-06-09 05:43:31 -------- d-----w- C:\Users\Jackque\AppData\Local\{2D37415E-617E-4BB0-AEED-588E278A9E88}
2012-06-09 05:32:19 -------- d-----w- C:\Users\Jackque\AppData\Roaming\Malwarebytes
2012-06-09 05:32:11 -------- d-----w- C:\ProgramData\Malwarebytes
2012-06-09 05:32:10 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-06-09 05:32:10 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-06-07 14:35:40 545472 ----a-w- C:\ProgramData\1339077669.bdinstall.bin
2012-06-07 14:03:55 -------- d-----w- C:\ProgramData\Bitdefender
2012-06-07 14:03:32 -------- d-----w- C:\Users\Jackque\AppData\Roaming\Defender Pro
2012-06-07 14:03:30 -------- d-----w- C:\ProgramData\Defender Pro
2012-06-07 14:01:27 -------- d-----w- C:\Users\Jackque\AppData\Roaming\QuickScan
2012-06-07 14:01:20 288600 ----a-w- C:\Windows\System32\drivers\trufos.sys
2012-06-07 14:01:20 -------- d-----w- C:\Program Files\Defender Pro
2012-06-07 14:01:16 431176 ----a-w- C:\Windows\System32\drivers\bdfsfltr.sys
2012-06-07 14:00:18 502 ----a-w- C:\ProgramData\1339077613.bdinstall.bin
2012-06-07 13:59:50 -------- d-----w- C:\Program Files\Common Files\Defender Pro
2012-06-07 00:55:05 -------- d-----w- C:\Windows\System32\wbem\repository
2012-06-06 23:46:43 -------- d-----w- C:\ProgramData\NortonInstaller
2012-06-06 23:46:43 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2012-06-06 23:36:18 -------- d-----w- C:\ProgramData\Norton
2012-06-01 22:04:38 -------- d-----w- C:\ProgramData\Media Center Programs
2012-05-30 23:01:00 -------- d-----w- C:\Users\Jackque\AppData\Local\{B7228725-7300-4EDF-A709-7F357A18EE77}
2012-05-30 23:00:47 -------- d-----w- C:\Users\Jackque\AppData\Local\{A31D2E9D-BDFF-4D21-B6F8-FEB34B16641A}
2012-05-30 18:02:41 -------- d-----w- C:\Users\Jackque\AppData\Local\{659704BB-3D11-4820-9AD8-1FB28E573EE4}
2012-05-30 18:02:29 -------- d-----w- C:\Users\Jackque\AppData\Local\{620E4073-7B17-4630-A153-CD17510D9161}
2012-05-29 23:09:59 -------- d-----w- C:\Users\Jackque\AppData\Local\{B7183797-4A29-40DC-9230-CBE311C9B368}
2012-05-29 23:09:46 -------- d-----w- C:\Users\Jackque\AppData\Local\{6A21FD6D-5232-4E90-B8B0-FD150E95282E}
2012-05-28 03:41:22 2304 ----a-w- C:\Windows\SysWow64\HtsysmNT.sys
2012-05-27 18:25:20 -------- d-----w- C:\Down
2012-05-26 18:28:35 -------- d-----w- C:\Users\Jackque\AppData\Local\{0C766B24-611D-4278-A808-1F4DF9A1F2A6}
2012-05-26 18:28:23 -------- d-----w- C:\Users\Jackque\AppData\Local\{014577AD-2BAC-41D6-8532-1328B7DAF01A}
2012-05-26 06:50:37 -------- d-----w- C:\Users\Jackque\AppData\Local\{2B4D9F61-AA72-4EEF-B162-9262A54D0047}
2012-05-26 06:50:25 -------- d-----w- C:\Users\Jackque\AppData\Local\{043CD668-D204-4419-A2DD-2C119D7BE6AC}
2012-05-26 02:27:08 -------- d-----w- C:\Users\Jackque\AppData\Local\{A1B2A755-3D7D-4A5D-A6B8-FC13D14357DC}
2012-05-26 02:26:56 -------- d-----w- C:\Users\Jackque\AppData\Local\{6D985176-FF60-4571-A85B-D270B2396A9B}
2012-05-25 13:44:22 -------- d-----w- C:\Users\Jackque\AppData\Local\{4D6355DE-6502-4FD8-9F23-E617DD1B44C3}
2012-05-25 13:44:07 -------- d-----w- C:\Users\Jackque\AppData\Local\{F7DD198C-D898-4C5B-A91A-CBDFC648517F}
2012-05-24 22:22:25 -------- d-----w- C:\Users\Jackque\AppData\Local\{71320283-E12D-43F9-96BF-97812F8A16C8}
2012-05-24 22:22:12 -------- d-----w- C:\Users\Jackque\AppData\Local\{67B6B6BE-70DA-4F82-9D03-82FCCE5C09AA}
2012-05-23 21:02:49 -------- d-----w- C:\Users\Jackque\AppData\Local\{1561328A-AB88-435B-AD6A-2E8C8825C786}
2012-05-23 21:02:36 -------- d-----w- C:\Users\Jackque\AppData\Local\{4C3F00CA-E8B0-4D3E-83C3-86267DCBFC04}
2012-05-22 17:26:27 -------- d-----w- C:\Users\Jackque\AppData\Local\{6FE1C0DE-1A43-49F9-A05D-E5F93802E26E}
2012-05-22 17:26:14 -------- d-----w- C:\Users\Jackque\AppData\Local\{1EFE13EB-9BA8-46E9-AC6D-6AC6D0770E14}
2012-05-22 04:32:36 -------- d-----w- C:\Users\Jackque\AppData\Local\{AD170400-4A00-4E75-8C68-D26B111EDBC1}
2012-05-22 04:32:24 -------- d-----w- C:\Users\Jackque\AppData\Local\{8B0C3DD2-BFD1-4C87-A5E5-18AEFBBD4680}
2012-05-22 01:29:24 -------- d-----w- C:\Users\Jackque\AppData\Local\{0A7548E9-C8EC-4547-83EA-1EBCD4F6C4F6}
2012-05-22 01:29:11 -------- d-----w- C:\Users\Jackque\AppData\Local\{2742A8FB-4E74-43D2-AFCB-2EF75E5978E8}
2012-05-20 11:45:33 -------- d-----w- C:\Users\Jackque\AppData\Roaming\Ubisoft
2012-05-19 20:37:09 -------- d-----w- C:\Users\Jackque\AppData\Roaming\SulusGames
2012-05-19 20:37:09 -------- d-----w- C:\ProgramData\SulusGames
2012-05-19 16:43:33 -------- d-----w- C:\Program Files (x86)\Strange Cases - The Lighthouse Mystery
2012-05-19 16:41:18 -------- d-----w- C:\Program Files (x86)\Strange Cases - The Tarot Card Mystery
2012-05-19 16:41:11 -------- d-----w- C:\Program Files (x86)\bfgclient
2012-05-19 16:41:02 -------- d-----w- C:\BigFishGamesCache
2012-05-19 02:00:41 -------- d-----w- C:\Users\Jackque\AppData\Local\{443C89E4-B847-4B61-8FC7-E9448C464FFD}
2012-05-18 14:00:44 -------- d-----w- C:\Users\Jackque\AppData\Local\{A2C6017A-0B23-4B6A-834D-CC056E5B5E06}
2012-05-18 14:00:31 -------- d-----w- C:\Users\Jackque\AppData\Local\{795DE697-BB7B-4BC7-B1E3-411C2D453831}
.
==================== Find3M ====================
.
2012-05-18 02:06:48 2311680 ----a-w- C:\Windows\System32\jscript9.dll
2012-05-18 01:59:14 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-05-18 01:58:39 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-05-18 01:55:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-05-18 01:51:30 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-05-17 22:45:37 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-05-17 22:35:47 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-05-17 22:35:39 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-05-17 22:29:45 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-05-17 22:24:45 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-05-15 01:32:33 3146752 ----a-w- C:\Windows\System32\win32k.sys
2012-05-01 05:40:20 209920 ----a-w- C:\Windows\System32\profsvc.dll
2012-04-28 03:55:21 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:41:56 77312 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:41:55 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-24 05:37:37 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:37:37 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 05:37:36 1462272 ----a-w- C:\Windows\System32\crypt32.dll
2012-04-24 04:36:42 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:36:42 1158656 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-04-24 04:36:42 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2012-04-07 12:31:40 3216384 ----a-w- C:\Windows\System32\msi.dll
2012-04-07 11:26:29 2342400 ----a-w- C:\Windows\SysWow64\msi.dll
2012-03-31 06:05:57 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-03-31 04:39:37 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-31 04:39:37 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-03-30 11:35:47 1918320 ----a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 6:17:04.08 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 2/1/2010 10:10:33 PM
System Uptime: 6/14/2012 6:26:38 PM (36 hours ago)
.
Motherboard: Dell Inc. | | 0X231R
Processor: Intel® Core™ i7 CPU 860 @ 2.80GHz | CPU 1 | 2793/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 922 GiB total, 565.671 GiB free.
D: is CDROM (UDF)
E: is Removable
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: DW1525 (802.11n) WLAN PCIe Card
Device ID: PCI\VEN_168C&DEV_002A&SUBSYS_0203168C&REV_01\4&2DC1CD0F&0&00E4
Manufacturer: Atheros Communications Inc.
Name: DW1525 (802.11n) WLAN PCIe Card
PNP Device ID: PCI\VEN_168C&DEV_002A&SUBSYS_0203168C&REV_01\4&2DC1CD0F&0&00E4
Service: athr
.
==== System Restore Points ===================
.
RP267: 6/8/2012 3:00:12 AM - Windows Update
RP268: 6/9/2012 12:23:34 AM - Removed SPORE™ Creature Creator Trial Edition
RP269: 6/14/2012 3:00:23 AM - Windows Update
RP270: 6/14/2012 5:21:10 PM - Removed Apple Application Support
RP271: 6/15/2012 6:35:19 PM - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Acrobat.com
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9.5.1
Amazon MP3 Downloader 1.0.12
Application Profiles
Assassin's Creed
ATI Catalyst Control Center
ATI Catalyst Registration
Big Fish Games: Game Manager
Bing Bar
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help English
CCC Help French
CCC Help German
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Portuguese
CCC Help Spanish
CCC Help Turkish
Compatibility Pack for the 2007 Office system
D3DX10
Deus Ex: Human Revolution
DirectXInstallService
Download Manager 2.3.10
Dragon Age: Origins
EMC 10 Content
Fallen Earth
Fallout 3
Fallout: New Vegas
GIMP 2.6.8
Grand Theft Auto IV
Grand Theft Auto Vice City
Guild Wars
Internet TV for Windows Media Center
Java Auto Updater
Java™ 6 Update 26
Junk Mail filter update
Kingdoms of Amalur: Reckoning
L.A. Noire: The Complete Edition
LG SP USB Driver
LG United Mobile Driver
LG USB WML Modem Driver
Malwarebytes Anti-Malware version 1.61.0.1400
Mass Effect 2
Mesh Runtime
Messenger Companion
Microsoft Default Manager
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft UI Engine
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Microsoft WSE 3.0 Runtime
Mozilla Firefox 12.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Multimedia Card Reader
Nancy Drew - The Phantom of Venice
NVIDIA PhysX
Oblivion
Origin
PowerDVD DX
QuickTime
Realtek High Definition Audio Driver
Rhapsody
Rockstar Games Social Club
Roxio Activation Module
Roxio BackOnTrack
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio Easy CD and DVD Burning
Roxio Express Labeler 3
Roxio Update Manager
s3pe - Sims3 Package Editor (x64)
Saints Row 2
Saints Row: The Third
Samsung PC Studio 3 USB Driver Installer
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
SimCity™ Societies
SimCity™ Societies Destinations
Skins
Sonic CinePlayer Decoder Pack
Steam
The Elder Scrolls V: Skyrim
The Lord of the Rings FREE Trial
The Secret World
The Sims Medieval
The Sims™ 3
The Sims™ 3 Ambitions
The Sims™ 3 Create a Pattern Tool
The Sims™ 3 Create a World Tool - Beta
The Sims™ 3 Fast Lane Stuff
The Sims™ 3 Generations
The Sims™ 3 High-End Loft Stuff
The Sims™ 3 Late Night
The Sims™ 3 Outdoor Living Stuff
The Sims™ 3 Pets
The Sims™ 3 Town Life Stuff
The Sims™ 3 World Adventures
The Witcher 2
Tropico 3 - Steam Special Edition
Tropico 3: Absolute Power
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Venetica
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Center Add-in for Flash
.
==== Event Viewer Messages From Past Week ========
.
6/9/2012 9:31:15 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
6/9/2012 9:09:41 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
6/9/2012 9:09:41 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
6/9/2012 9:09:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/9/2012 9:09:31 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
6/9/2012 9:09:28 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000101 (0x0000000000000019, 0x0000000000000000, 0xfffff88003315180, 0x0000000000000006). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-27144-01.
6/9/2012 9:09:24 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avc3 bdfsfltr BDVEDISK discache RxFilter spldr Wanarpv6
6/9/2012 9:09:24 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
6/9/2012 9:05:37 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800032c182f, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-31824-01.
6/9/2012 9:03:40 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800032ad82f, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-26520-01.
6/9/2012 9:01:45 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff8000326c82f, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-21153-01.
6/9/2012 8:53:22 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff8000326782f, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-21434-01.
6/9/2012 12:42:29 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f7 (0xfffff88003577b30, 0x00001ba626cc2300, 0xffffe459d933dcff, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-20966-01.
6/9/2012 12:40:14 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800032c082f, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-20779-01.
6/9/2012 1:01:42 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff800032ba435). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060912-20326-01.
6/16/2012 6:12:20 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 56 time(s).
6/16/2012 6:12:20 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 55 time(s).
6/16/2012 5:58:59 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 94 time(s).
6/16/2012 5:58:59 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 54 time(s).
6/16/2012 5:44:01 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 93 time(s).
6/16/2012 4:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 92 time(s).
6/16/2012 4:44:41 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 91 time(s).
6/16/2012 4:44:41 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 53 time(s).
6/16/2012 3:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 90 time(s).
6/16/2012 3:44:13 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 89 time(s).
6/16/2012 3:28:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 88 time(s).
6/16/2012 3:28:58 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 52 time(s).
6/16/2012 2:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 87 time(s).
6/16/2012 2:44:01 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 86 time(s).
6/16/2012 12:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 83 time(s).
6/16/2012 12:44:41 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 82 time(s).
6/16/2012 12:44:41 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 50 time(s).
6/16/2012 12:38:34 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 55 time(s).
6/16/2012 12:29:42 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 81 time(s).
6/16/2012 12:29:42 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 54 time(s).
6/16/2012 12:24:29 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 53 time(s).
6/16/2012 12:24:29 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 49 time(s).
6/16/2012 1:58:59 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 85 time(s).
6/16/2012 1:58:59 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 51 time(s).
6/16/2012 1:44:01 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 84 time(s).
6/15/2012 9:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 43 time(s).
6/15/2012 9:58:58 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 28 time(s).
6/15/2012 9:54:22 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 46 time(s).
6/15/2012 9:44:43 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 75 time(s).
6/15/2012 9:44:43 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 44 time(s).
6/15/2012 9:44:40 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 42 time(s).
6/15/2012 9:37:59 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 35 time(s).
6/15/2012 9:35:06 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 34 time(s).
6/15/2012 9:35:06 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 27 time(s).
6/15/2012 9:32:34 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 33 time(s).
6/15/2012 9:30:53 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 45 time(s).
6/15/2012 9:29:39 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 41 time(s).
6/15/2012 9:29:39 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 32 time(s).
6/15/2012 9:29:39 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 26 time(s).
6/15/2012 9:28:59 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 74 time(s).
6/15/2012 9:18:20 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 31 time(s).
6/15/2012 9:08:48 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 30 time(s).
6/15/2012 9:08:08 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 44 time(s).
6/15/2012 9:08:08 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 43 time(s).
6/15/2012 8:59:39 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 40 time(s).
6/15/2012 8:59:39 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 29 time(s).
6/15/2012 8:59:39 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 25 time(s).
6/15/2012 8:59:02 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 73 time(s).
6/15/2012 8:56:28 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 39 time(s).
6/15/2012 8:56:28 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 28 time(s).
6/15/2012 8:44:42 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 72 time(s).
6/15/2012 8:44:42 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 42 time(s).
6/15/2012 8:44:39 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 38 time(s).
6/15/2012 8:44:39 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 24 time(s).
6/15/2012 8:06:28 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 43 time(s).
6/15/2012 7:58:57 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 37 time(s).
6/15/2012 7:58:22 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 71 time(s).
6/15/2012 7:58:22 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 42 time(s).
6/15/2012 7:58:22 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 41 time(s).
6/15/2012 7:44:39 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 36 time(s).
6/15/2012 7:44:03 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 70 time(s).
6/15/2012 7:40:16 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 69 time(s).
6/15/2012 7:40:16 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 41 time(s).
6/15/2012 7:40:16 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 40 time(s).
6/15/2012 6:58:59 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 68 time(s).
6/15/2012 6:58:59 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 39 time(s).
6/15/2012 6:58:57 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 35 time(s).
6/15/2012 6:58:57 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 23 time(s).
6/15/2012 6:45:23 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 67 time(s).
6/15/2012 6:45:23 PM, Error: Service Control Manager [7034] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 3 time(s).
6/15/2012 6:44:00 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 34 time(s).
6/15/2012 6:42:19 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 27 time(s).
6/15/2012 6:41:09 PM, Error: Service Control Manager [7034] - The Windows Update service terminated unexpectedly. It has done this 2 time(s).
6/15/2012 6:41:09 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 66 time(s).
6/15/2012 6:41:09 PM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/15/2012 6:37:08 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 65 time(s).
6/15/2012 6:37:08 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 38 time(s).
6/15/2012 6:37:08 PM, Error: Service Control Manager [7031] - The Windows Update service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/15/2012 6:37:08 PM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/15/2012 6:36:02 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2709715).
6/15/2012 6:30:24 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 64 time(s).
6/15/2012 6:29:06 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 33 time(s).
6/15/2012 6:29:06 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 22 time(s).
6/15/2012 6:00:22 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 63 time(s).
6/15/2012 6:00:22 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 37 time(s).
6/15/2012 5:59:02 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 32 time(s).
6/15/2012 5:44:44 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 31 time(s).
6/15/2012 5:44:41 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 62 time(s).
6/15/2012 5:34:21 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 40 time(s).
6/15/2012 5:26:29 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 36 time(s).
6/15/2012 4:58:59 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 61 time(s).
6/15/2012 4:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 30 time(s).
6/15/2012 4:58:58 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 21 time(s).
6/15/2012 4:44:04 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 29 time(s).
6/15/2012 4:43:58 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 60 time(s).
6/15/2012 4:34:01 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 39 time(s).
6/15/2012 4:34:01 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 35 time(s).
6/15/2012 3:59:05 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 28 time(s).
6/15/2012 3:58:59 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 59 time(s).
6/15/2012 3:44:48 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 27 time(s).
6/15/2012 3:44:48 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 20 time(s).
6/15/2012 3:44:05 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 58 time(s).
6/15/2012 3:29:50 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 26 time(s).
6/15/2012 3:28:59 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 57 time(s).
6/15/2012 3:28:59 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 34 time(s).
6/15/2012 2:59:15 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 25 time(s).
6/15/2012 2:58:59 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 56 time(s).
6/15/2012 2:56:50 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 55 time(s).
6/15/2012 2:44:18 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 24 time(s).
6/15/2012 2:44:18 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 19 time(s).
6/15/2012 2:44:01 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 54 time(s).
6/15/2012 2:44:01 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 33 time(s).
6/15/2012 12:59:07 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 21 time(s).
6/15/2012 12:58:58 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 51 time(s).
6/15/2012 12:58:58 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 32 time(s).
6/15/2012 12:44:40 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 50 time(s).
6/15/2012 12:44:23 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 20 time(s).
6/15/2012 12:29:28 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 19 time(s).
6/15/2012 12:29:28 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 17 time(s).
6/15/2012 12:28:01 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 49 time(s).
6/15/2012 12:28:01 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 38 time(s).
6/15/2012 11:59:00 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 80 time(s).
6/15/2012 11:58:59 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 48 time(s).
6/15/2012 11:58:59 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 31 time(s).
6/15/2012 11:44:05 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 79 time(s).
6/15/2012 11:44:01 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 47 time(s).
6/15/2012 11:23:12 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 46 time(s).
6/15/2012 11:23:12 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 37 time(s).
6/15/2012 11:17:43 AM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 36 time(s).
6/15/2012 11:17:43 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 30 time(s).
6/15/2012 10:59:43 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 78 time(s).
6/15/2012 10:59:43 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 52 time(s).
6/15/2012 10:59:43 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 48 time(s).
6/15/2012 10:58:58 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 45 time(s).
6/15/2012 10:58:58 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 29 time(s).
6/15/2012 10:51:53 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 51 time(s).
6/15/2012 10:49:27 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 50 time(s).
6/15/2012 10:44:40 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 44 time(s).
6/15/2012 10:42:58 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 77 time(s).
6/15/2012 10:42:58 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 47 time(s).
6/15/2012 10:38:27 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 49 time(s).
6/15/2012 10:38:27 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 46 time(s).
6/15/2012 10:29:29 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 48 time(s).
6/15/2012 10:17:52 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 47 time(s).
6/15/2012 10:17:52 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 45 time(s).
6/15/2012 10:00:26 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 76 time(s).
6/15/2012 1:59:40 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 53 time(s).
6/15/2012 1:59:07 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 23 time(s).
6/15/2012 1:44:51 AM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 22 time(s).
6/15/2012 1:44:40 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 52 time(s).
6/15/2012 1:40:38 AM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 18 time(s).
6/14/2012 9:59:03 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 14 time(s).
6/14/2012 9:45:22 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 13 time(s).
6/14/2012 9:45:22 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 15 time(s).
6/14/2012 9:29:32 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 12 time(s).
6/14/2012 9:21:54 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 26 time(s).
6/14/2012 9:18:44 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 25 time(s).
6/14/2012 9:18:44 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 14 time(s).
6/14/2012 9:16:29 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 24 time(s).
6/14/2012 9:13:32 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 23 time(s).
6/14/2012 9:10:47 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 22 time(s).
6/14/2012 9:10:47 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 13 time(s).
6/14/2012 9:07:59 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 21 time(s).
6/14/2012 9:02:58 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 20 time(s).
6/14/2012 8:57:58 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 11 time(s).
6/14/2012 8:57:58 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 19 time(s).
6/14/2012 8:57:58 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 12 time(s).
6/14/2012 8:53:29 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 18 time(s).
6/14/2012 8:49:23 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 17 time(s).
6/14/2012 8:43:43 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 10 time(s).
6/14/2012 8:43:43 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 16 time(s).
6/14/2012 8:43:43 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 11 time(s).
6/14/2012 8:40:50 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 15 time(s).
6/14/2012 8:36:20 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 14 time(s).
6/14/2012 8:32:26 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 9 time(s).
6/14/2012 8:32:26 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 13 time(s).
6/14/2012 8:32:26 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 10 time(s).
6/14/2012 8:29:03 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 12 time(s).
6/14/2012 8:26:15 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 11 time(s).
6/14/2012 8:05:51 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 10 time(s).
6/14/2012 8:05:51 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 9 time(s).
6/14/2012 8:03:59 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 9 time(s).
6/14/2012 7:59:09 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 8 time(s).
6/14/2012 7:59:09 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 8 time(s).
6/14/2012 7:44:48 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 7 time(s).
6/14/2012 7:41:27 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 8 time(s).
6/14/2012 7:35:02 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 7 time(s).
6/14/2012 7:35:02 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 7 time(s).
6/14/2012 7:30:40 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 6 time(s).
6/14/2012 7:30:40 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 6 time(s).
6/14/2012 7:14:44 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 6 time(s).
6/14/2012 7:14:44 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 5 time(s).
6/14/2012 7:10:55 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 5 time(s).
6/14/2012 7:00:22 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 5 time(s).
6/14/2012 6:57:08 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 4 time(s).
6/14/2012 6:57:08 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 4 time(s).
6/14/2012 6:41:14 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 4 time(s).
6/14/2012 6:41:14 PM, Error: Service Control Manager [7034] - The User Profile Service service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:41:14 PM, Error: Service Control Manager [7034] - The System Event Notification Service service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:41:14 PM, Error: Service Control Manager [7034] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:41:14 PM, Error: Service Control Manager [7034] - The Group Policy Client service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Windows Update service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Themes service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Task Scheduler service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Server service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:36:22 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 3 time(s).
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The User Profile Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The System Event Notification Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Shell Hardware Detection service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:33:55 PM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:32:35 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The User Profile Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The System Event Notification Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
6/14/2012 6:30:35 PM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/14/2012 6:28:23 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
6/14/2012 6:27:28 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: RxFilter
6/14/2012 6:27:21 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
6/14/2012 6:27:20 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device service to connect.
6/14/2012 6:27:20 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed.
6/14/2012 6:27:20 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
6/14/2012 6:27:20 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
6/14/2012 6:27:20 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the file specified.
6/14/2012 6:27:20 PM, Error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/14/2012 4:47:51 PM, Error: Service Control Manager [7000] - The Windows Update service failed to start due to the following error: The pipe has been ended.
6/14/2012 11:59:16 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 18 time(s).
6/14/2012 11:45:15 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 17 time(s).
6/14/2012 10:59:55 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 16 time(s).
6/14/2012 10:59:55 PM, Error: Service Control Manager [7034] - The Application Experience service terminated unexpectedly. It has done this 16 time(s).
6/14/2012 10:44:23 PM, Error: Service Control Manager [7034] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 15 time(s).
6/13/2012 5:53:22 AM, Error: Service Control Manager [7034] - The Defender Pro Virus Shield service terminated unexpectedly. It has done this 1 time(s).
6/13/2012 3:09:42 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff8800111b64e, 0xfffff88005d9b9d8, 0xfffff88005d9b230). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 061312-23602-01.
.
==== End Of File ===========================

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Hello,

I did not have any problems running combofix. Here is the log. As of right now, the computer seems to be doing okay. I did not have any problems starting my computer up or anything. Yesterday, however, I went online, and a few of my searches from ask.com were redirected. I then quickly closed the new tab, selected the search link again, and then it took me to the right page. But that was before I ran combofix. Right now the computer seems to be behaving normally. I still have blocked some programs from automatically starting, though.

ComboFix 12-06-15.06 - Jackque 06/16/2012 15:20:29.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6135.4634 [GMT -5:00]
Running from: c:\users\Jackque\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\programdata\1339077613.bdinstall.bin
c:\programdata\1339077669.bdinstall.bin
c:\programdata\SPL272B.tmp
c:\programdata\SPL4B18.tmp
c:\programdata\SPLDC55.tmp
c:\windows\svchost.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-05-17 to 2012-06-17 )))))))))))))))))))))))))))))))
.
.
2012-06-16 20:26 . 2012-06-16 20:26 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-06-16 20:26 . 2012-06-16 20:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-16 11:11 . 2012-06-16 11:11 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-06-16 11:11 . 2012-06-16 11:11 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-06-16 11:11 . 2012-06-16 11:11 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-06-16 11:11 . 2012-06-16 11:11 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-06-16 11:11 . 2012-06-16 11:11 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-06-16 11:11 . 2012-06-16 11:11 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-06-16 11:11 . 2012-06-16 11:11 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-06-16 11:11 . 2012-06-16 11:11 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-06-15 00:31 . 2012-06-15 00:31 -------- d-----w- c:\users\Jackque\AppData\Local\Funcom
2012-06-15 00:31 . 2012-06-15 00:31 -------- d-----w- c:\program files (x86)\Funcom
2012-06-14 22:22 . 2012-06-14 22:22 463 ----a-w- c:\program files (x86)\0614201217225091.bat
2012-06-14 21:43 . 2012-06-14 21:43 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Defender Pro
2012-06-14 21:42 . 2012-06-14 21:42 -------- d-----w- c:\users\Default\AppData\Roaming\Defender Pro
2012-06-13 20:51 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 10:53 . 2012-06-13 10:53 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\bdch
2012-06-11 00:50 . 2012-06-11 00:50 -------- d-----w- c:\programdata\Cateia Games
2012-06-11 00:47 . 2012-06-11 00:49 -------- d-----w- c:\program files (x86)\Oberon Media
2012-06-09 05:55 . 2012-06-09 05:55 -------- d-----w- c:\users\Jackque\AppData\Local\ElevatedDiagnostics
2012-06-09 05:32 . 2012-06-09 05:32 -------- d-----w- c:\users\Jackque\AppData\Roaming\Malwarebytes
2012-06-09 05:32 . 2012-06-09 05:32 -------- d-----w- c:\programdata\Malwarebytes
2012-06-09 05:32 . 2012-06-09 05:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-09 05:32 . 2012-04-04 20:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-07 15:37 . 2012-06-07 15:37 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\QuickScan
2012-06-07 14:03 . 2012-06-07 14:03 -------- d-----w- c:\programdata\Bitdefender
2012-06-07 14:03 . 2012-06-07 14:03 -------- d-----w- c:\users\Jackque\AppData\Roaming\Defender Pro
2012-06-07 14:03 . 2012-06-07 14:03 -------- d-----w- c:\programdata\Defender Pro
2012-06-07 14:01 . 2012-06-07 14:01 -------- d-----w- c:\users\Jackque\AppData\Roaming\QuickScan
2012-06-07 14:01 . 2012-06-07 14:01 -------- d-----w- c:\program files\Defender Pro
2012-06-07 14:01 . 2011-07-23 01:20 288600 ----a-w- c:\windows\system32\drivers\trufos.sys
2012-06-07 14:01 . 2011-03-24 20:36 431176 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2012-06-07 13:59 . 2012-06-07 14:01 -------- d-----w- c:\program files\Common Files\Defender Pro
2012-06-07 00:55 . 2012-06-16 20:28 -------- d-----w- c:\windows\system32\wbem\repository
2012-06-06 23:46 . 2012-06-07 00:30 -------- d-----w- c:\program files (x86)\NortonInstaller
2012-06-06 23:36 . 2012-06-07 00:51 -------- d-----w- c:\programdata\Norton
2012-06-01 22:04 . 2012-06-15 00:31 -------- d-----w- c:\programdata\Media Center Programs
2012-05-28 03:41 . 2012-05-28 01:53 2304 ----a-w- c:\windows\SysWow64\HtsysmNT.sys
2012-05-27 18:25 . 2012-05-27 18:25 -------- d-----w- C:\Down
2012-05-20 11:45 . 2012-05-20 11:45 -------- d-----w- c:\users\Jackque\AppData\Roaming\Ubisoft
2012-05-20 11:44 . 2012-05-20 11:44 -------- d-----w- c:\programdata\Ubisoft
2012-05-19 20:37 . 2012-05-22 03:30 -------- d-----w- c:\users\Jackque\AppData\Roaming\SulusGames
2012-05-19 20:37 . 2012-05-22 03:30 -------- d-----w- c:\programdata\SulusGames
2012-05-19 16:43 . 2012-05-19 16:44 -------- d-----w- c:\program files (x86)\Strange Cases - The Lighthouse Mystery
2012-05-19 16:41 . 2012-06-07 14:17 -------- d-----w- c:\program files (x86)\Strange Cases - The Tarot Card Mystery
2012-05-19 16:41 . 2012-05-19 16:41 -------- d-----w- c:\program files (x86)\bfgclient
2012-05-19 16:41 . 2012-05-20 05:36 -------- d-----w- C:\BigFishGamesCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-31 06:05 . 2012-05-11 18:58 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-31 04:39 . 2012-05-11 18:58 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-31 04:39 . 2012-05-11 18:58 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-30 11:35 . 2012-05-11 18:53 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2009-07-17 237568]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 0055071339077083mcinstcleanup;McAfee Application Installer Cleanup (0055071339077083);c:\users\Jackque\AppData\Local\Temp\005507~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 SessionLauncher;SessionLauncher;c:\users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [x]
R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [x]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [2011-10-29 25832]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 129976]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Defender Pro\Defender Pro Arrakis Server\bin\arrakis3.exe [2011-08-02 466736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\defender pro\defender pro firewall\bdfndisf6.sys [2011-03-01 89680]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Defender Pro\Defender Pro Firewall\bdfwfpf.sys [2011-03-01 102992]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe [2009-10-16 1039360]
S2 UPDATESRV;Defender Pro Desktop Update Service;c:\program files\Defender Pro\Defender Pro\updatesrv.exe [2011-08-02 62512]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [x]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-05-23 7833120]
"BDAgent"="c:\program files\Defender Pro\Defender Pro\bdagent.exe" [2011-08-02 924080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://msn.com/
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
TCP: DhcpNameServer = 192.168.15.1
FF - ProfilePath - c:\users\Jackque\AppData\Roaming\Mozilla\Firefox\Profiles\nbdboseh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
FF - prefs.js: browser.search.selectedEngine - bing
FF - prefs.js: browser.startup.homepage - hxxp://g.msn.com/USCON/1
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1651834869-554549910-2406132148-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1651834869-554549910-2406132148-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-1651834869-554549910-2406132148-1000\Software\SecuROM\License information*]
"datasecu"=hex:41,26,55,be,30,4a,c0,4b,ab,61,f5,76,66,72,ab,34,d9,e9,15,39,51,
3a,ab,7f,0a,be,6f,61,55,b0,43,ce,ce,22,67,0a,da,cc,6d,d3,10,6a,b9,42,59,4a,\
"rkeysecu"=hex:8c,2a,20,fc,a0,be,34,8f,b4,58,28,b1,96,19,e4,b8
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\\.\globalroot\systemroot\svchost.exe
.
**************************************************************************
.
Completion time: 2012-06-17 00:05:41 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-17 05:05
.
Pre-Run: 607,040,983,040 bytes free
Post-Run: 605,129,355,264 bytes free
.
- - End Of File - - C98F1D11614F22F406D6AADAC87BF07A

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
• If an infected file is detected, the default action will be Cure, click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

• Double click the aswMBR.exe icon to run it
• it will ask to download extra definitions - ALLOW IT
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

Hello,

I had turned my antivirus software back on after the combofix run was completed. Should I have waited? Here are the logs.

00:41:50.0679 4396 TDSS rootkit removing tool 2.7.40.0 Jun 15 2012 15:13:31
00:41:51.0106 4396 ============================================================
00:41:51.0106 4396 Current date / time: 2012/06/17 00:41:51.0106
00:41:51.0106 4396 SystemInfo:
00:41:51.0106 4396
00:41:51.0106 4396 OS Version: 6.1.7601 ServicePack: 1.0
00:41:51.0106 4396 Product type: Workstation
00:41:51.0106 4396 ComputerName: JOSEPHINE
00:41:51.0106 4396 UserName: Jackque
00:41:51.0106 4396 Windows directory: C:\Windows
00:41:51.0106 4396 System windows directory: C:\Windows
00:41:51.0106 4396 Running under WOW64
00:41:51.0106 4396 Processor architecture: Intel x64
00:41:51.0107 4396 Number of processors: 8
00:41:51.0107 4396 Page size: 0x1000
00:41:51.0107 4396 Boot type: Normal boot
00:41:51.0107 4396 ============================================================
00:41:53.0033 4396 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
00:41:53.0050 4396 ============================================================
00:41:53.0050 4396 \Device\Harddisk0\DR0:
00:41:53.0050 4396 MBR partitions:
00:41:53.0050 4396 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x23800, BlocksNum 0x12D5000
00:41:53.0050 4396 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x12F8800, BlocksNum 0x7340D800
00:41:53.0050 4396 ============================================================
00:41:53.0080 4396 C: <-> \Device\Harddisk0\DR0\Partition1
00:41:53.0080 4396 ============================================================
00:41:53.0080 4396 Initialize success
00:41:53.0080 4396 ============================================================
00:42:22.0009 3180 ============================================================
00:42:22.0009 3180 Scan started
00:42:22.0009 3180 Mode: Manual;
00:42:22.0009 3180 ============================================================
00:42:23.0080 3180 0055071339077083mcinstcleanup - ok
00:42:23.0538 3180 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
00:42:23.0558 3180 1394ohci - ok
00:42:23.0619 3180 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
00:42:23.0624 3180 ACPI - ok
00:42:23.0645 3180 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
00:42:23.0648 3180 AcpiPmi - ok
00:42:23.0690 3180 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
00:42:23.0696 3180 adp94xx - ok
00:42:23.0730 3180 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
00:42:23.0735 3180 adpahci - ok
00:42:23.0745 3180 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
00:42:23.0748 3180 adpu320 - ok
00:42:23.0771 3180 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
00:42:23.0772 3180 AeLookupSvc - ok
00:42:23.0817 3180 AERTFilters (3ac22a3dfa8a050e35f0e3cd99d0cdf2) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
00:42:23.0820 3180 AERTFilters - ok
00:42:23.0867 3180 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
00:42:23.0872 3180 AFD - ok
00:42:23.0887 3180 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
00:42:23.0889 3180 agp440 - ok
00:42:23.0914 3180 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
00:42:23.0917 3180 ALG - ok
00:42:23.0919 3180 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
00:42:23.0920 3180 aliide - ok
00:42:23.0956 3180 AMD External Events Utility (812349d328eb406815183a5d17b49e7c) C:\Windows\system32\atiesrxx.exe
00:42:23.0960 3180 AMD External Events Utility - ok
00:42:23.0975 3180 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
00:42:23.0976 3180 amdide - ok
00:42:23.0989 3180 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
00:42:23.0991 3180 AmdK8 - ok
00:42:24.0208 3180 amdkmdag (0415ffe1b6a6ea141feafca57567f57f) C:\Windows\system32\DRIVERS\atikmdag.sys
00:42:24.0373 3180 amdkmdag - ok
00:42:24.0433 3180 amdkmdap (dc24d6f38f17c0d643d9aa8a6852f8d0) C:\Windows\system32\DRIVERS\atikmpag.sys
00:42:24.0436 3180 amdkmdap - ok
00:42:24.0447 3180 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
00:42:24.0449 3180 AmdPPM - ok
00:42:24.0474 3180 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
00:42:24.0479 3180 amdsata - ok
00:42:24.0498 3180 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
00:42:24.0501 3180 amdsbs - ok
00:42:24.0514 3180 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
00:42:24.0517 3180 amdxata - ok
00:42:24.0544 3180 Andbus (48cd7e6520d47d62eab0e6ce3ec30c65) C:\Windows\system32\DRIVERS\lgandbus64.sys
00:42:24.0546 3180 Andbus - ok
00:42:24.0577 3180 AndDiag (08cbacc00d15dcdbbaae1a7c8f231c61) C:\Windows\system32\DRIVERS\lganddiag64.sys
00:42:24.0580 3180 AndDiag - ok
00:42:24.0633 3180 AndGps (cea9a4cd6b3a83428ce8501240833668) C:\Windows\system32\DRIVERS\lgandgps64.sys
00:42:24.0635 3180 AndGps - ok
00:42:24.0657 3180 ANDModem (e2b5663e547fa5e756b253efa8ec8286) C:\Windows\system32\DRIVERS\lgandmodem64.sys
00:42:24.0660 3180 ANDModem - ok
00:42:24.0686 3180 androidusb (9c1751b2e733471ae07561028b7d2a9b) C:\Windows\system32\Drivers\lgandadb.sys
00:42:24.0689 3180 androidusb - ok
00:42:24.0744 3180 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
00:42:24.0746 3180 AppID - ok
00:42:24.0769 3180 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
00:42:24.0771 3180 AppIDSvc - ok
00:42:24.0798 3180 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
00:42:24.0801 3180 Appinfo - ok
00:42:24.0866 3180 Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
00:42:24.0874 3180 Apple Mobile Device - ok
00:42:24.0890 3180 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
00:42:24.0894 3180 arc - ok
00:42:24.0944 3180 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
00:42:24.0976 3180 arcsas - ok
00:42:25.0367 3180 aspnet_state (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
00:42:25.0379 3180 aspnet_state - ok
00:42:25.0416 3180 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
00:42:25.0436 3180 AsyncMac - ok
00:42:25.0482 3180 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
00:42:25.0483 3180 atapi - ok
00:42:26.0146 3180 athr (e0fabc10635c670bd7d89fd214a405d7) C:\Windows\system32\DRIVERS\athrx.sys
00:42:26.0214 3180 athr - ok
00:42:26.0572 3180 atikmdag (0415ffe1b6a6ea141feafca57567f57f) C:\Windows\system32\DRIVERS\atikmdag.sys
00:42:26.0613 3180 atikmdag - ok
00:42:26.0695 3180 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
00:42:26.0702 3180 AudioEndpointBuilder - ok
00:42:26.0707 3180 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
00:42:26.0710 3180 AudioSrv - ok
00:42:26.0785 3180 avc3 (1a57afa8e17f578dfb1507e93b52749f) C:\Windows\system32\DRIVERS\avc3.sys
00:42:26.0796 3180 avc3 - ok
00:42:26.0806 3180 avchv (9bb5c4987545c77c27a7e5471f635f88) C:\Windows\system32\DRIVERS\avchv.sys
00:42:26.0809 3180 avchv - ok
00:42:26.0832 3180 avckf (014816ea77a3dd50fe82629395b28645) C:\Windows\system32\DRIVERS\avckf.sys
00:42:26.0834 3180 avckf - ok
00:42:26.0912 3180 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
00:42:26.0914 3180 AxInstSV - ok
00:42:26.0940 3180 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
00:42:26.0946 3180 b06bdrv - ok
00:42:26.0962 3180 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
00:42:26.0966 3180 b57nd60a - ok
00:42:27.0058 3180 BBSvc (825f81a6f7dd073509db101f0ba6dc59) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
00:42:27.0071 3180 BBSvc - ok
00:42:27.0095 3180 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
00:42:27.0098 3180 BDESVC - ok
00:42:27.0162 3180 BdfNdisf (5d70a5a4eb6bf57a8679f93a8bfb9480) c:\program files\common files\defender pro\defender pro firewall\bdfndisf6.sys
00:42:27.0164 3180 BdfNdisf - ok
00:42:27.0201 3180 bdfsfltr (66116e0a4da8407ff7f2aaace52b8b54) C:\Windows\system32\DRIVERS\bdfsfltr.sys
00:42:27.0208 3180 bdfsfltr - ok
00:42:27.0245 3180 bdfwfpf (1cf6429ceea44619adb5484398cb5776) C:\Program Files\Common Files\Defender Pro\Defender Pro Firewall\bdfwfpf.sys
00:42:27.0248 3180 bdfwfpf - ok
00:42:27.0277 3180 bdsandbox (e847521115c2c95ab13abac33365b0a2) C:\Windows\system32\drivers\bdsandbox.sys
00:42:27.0279 3180 bdsandbox - ok
00:42:27.0308 3180 BDVEDISK (b89deff4817b4cc6fc2bcd8f83b4e75d) C:\Windows\system32\DRIVERS\bdvedisk.sys
00:42:27.0311 3180 BDVEDISK - ok
00:42:27.0317 3180 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
00:42:27.0318 3180 Beep - ok
00:42:27.0373 3180 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
00:42:27.0381 3180 BFE - ok
00:42:27.0402 3180 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\system32\qmgr.dll
00:42:27.0407 3180 BITS - ok
00:42:27.0436 3180 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
00:42:27.0438 3180 blbdrive - ok
00:42:27.0534 3180 Bonjour Service (1c87705ccb2f60172b0fc86b5d82f00d) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
00:42:27.0552 3180 Bonjour Service - ok
00:42:27.0589 3180 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
00:42:27.0592 3180 bowser - ok
00:42:27.0600 3180 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
00:42:27.0601 3180 BrFiltLo - ok
00:42:27.0612 3180 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
00:42:27.0613 3180 BrFiltUp - ok
00:42:27.0632 3180 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
00:42:27.0635 3180 BridgeMP - ok
00:42:27.0666 3180 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
00:42:27.0668 3180 Browser - ok
00:42:27.0686 3180 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
00:42:27.0690 3180 Brserid - ok
00:42:27.0701 3180 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
00:42:27.0704 3180 BrSerWdm - ok
00:42:27.0707 3180 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
00:42:27.0708 3180 BrUsbMdm - ok
00:42:27.0719 3180 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
00:42:27.0721 3180 BrUsbSer - ok
00:42:27.0727 3180 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
00:42:27.0729 3180 BTHMODEM - ok
00:42:27.0776 3180 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
00:42:27.0779 3180 bthserv - ok
00:42:27.0781 3180 catchme - ok
00:42:27.0796 3180 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
00:42:27.0800 3180 cdfs - ok
00:42:27.0843 3180 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
00:42:27.0848 3180 cdrom - ok
00:42:27.0876 3180 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
00:42:27.0878 3180 CertPropSvc - ok
00:42:27.0890 3180 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
00:42:27.0891 3180 circlass - ok
00:42:27.0909 3180 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
00:42:27.0913 3180 CLFS - ok
00:42:27.0967 3180 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
00:42:27.0969 3180 clr_optimization_v2.0.50727_32 - ok
00:42:28.0007 3180 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
00:42:28.0010 3180 clr_optimization_v2.0.50727_64 - ok
00:42:28.0140 3180 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
00:42:28.0175 3180 clr_optimization_v4.0.30319_32 - ok
00:42:28.0286 3180 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
00:42:28.0327 3180 clr_optimization_v4.0.30319_64 - ok
00:42:28.0355 3180 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
00:42:28.0367 3180 CmBatt - ok
00:42:28.0411 3180 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
00:42:28.0413 3180 cmdide - ok
00:42:28.0458 3180 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
00:42:28.0465 3180 CNG - ok
00:42:28.0474 3180 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
00:42:28.0475 3180 Compbatt - ok
00:42:28.0513 3180 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
00:42:28.0516 3180 CompositeBus - ok
00:42:28.0518 3180 COMSysApp - ok
00:42:28.0530 3180 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
00:42:28.0531 3180 crcdisk - ok
00:42:28.0558 3180 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
00:42:28.0560 3180 CryptSvc - ok
00:42:28.0734 3180 DAUpdaterSvc (914a7156b0c0f10be645a02e13f576b2) c:\program files (x86)\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe
00:42:28.0739 3180 DAUpdaterSvc - ok
00:42:28.0774 3180 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
00:42:28.0777 3180 DcomLaunch - ok
00:42:28.0810 3180 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
00:42:28.0814 3180 defragsvc - ok
00:42:28.0847 3180 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
00:42:28.0848 3180 DfsC - ok
00:42:28.0885 3180 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
00:42:28.0889 3180 Dhcp - ok
00:42:28.0897 3180 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
00:42:28.0898 3180 discache - ok
00:42:28.0916 3180 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
00:42:28.0918 3180 Disk - ok
00:42:28.0960 3180 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
00:42:28.0963 3180 Dnscache - ok
00:42:29.0011 3180 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe
00:42:29.0026 3180 DockLoginService - ok
00:42:29.0057 3180 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
00:42:29.0063 3180 dot3svc - ok
00:42:29.0072 3180 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
00:42:29.0075 3180 DPS - ok
00:42:29.0105 3180 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
00:42:29.0107 3180 drmkaud - ok
00:42:29.0152 3180 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
00:42:29.0158 3180 DXGKrnl - ok
00:42:29.0171 3180 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
00:42:29.0174 3180 EapHost - ok
00:42:29.0242 3180 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
00:42:29.0284 3180 ebdrv - ok
00:42:29.0348 3180 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
00:42:29.0351 3180 EFS - ok
00:42:29.0403 3180 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
00:42:29.0413 3180 ehRecvr - ok
00:42:29.0436 3180 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
00:42:29.0439 3180 ehSched - ok
00:42:29.0472 3180 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
00:42:29.0478 3180 elxstor - ok
00:42:29.0504 3180 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
00:42:29.0505 3180 ErrDev - ok
00:42:29.0528 3180 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
00:42:29.0531 3180 EventSystem - ok
00:42:29.0544 3180 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
00:42:29.0548 3180 exfat - ok
00:42:29.0567 3180 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
00:42:29.0569 3180 fastfat - ok
00:42:29.0607 3180 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
00:42:29.0617 3180 Fax - ok
00:42:29.0629 3180 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
00:42:29.0631 3180 fdc - ok
00:42:29.0652 3180 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
00:42:29.0653 3180 fdPHost - ok
00:42:29.0662 3180 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
00:42:29.0663 3180 FDResPub - ok
00:42:29.0677 3180 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
00:42:29.0679 3180 FileInfo - ok
00:42:29.0691 3180 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
00:42:29.0693 3180 Filetrace - ok
00:42:29.0705 3180 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
00:42:29.0707 3180 flpydisk - ok
00:42:29.0738 3180 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
00:42:29.0740 3180 FltMgr - ok
00:42:29.0782 3180 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
00:42:29.0815 3180 FontCache - ok
00:42:29.0877 3180 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
00:42:29.0879 3180 FontCache3.0.0.0 - ok
00:42:29.0897 3180 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
00:42:29.0900 3180 FsDepends - ok
00:42:29.0942 3180 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys
00:42:29.0946 3180 fssfltr - ok
00:42:30.0061 3180 fsssvc (40cdfad174b3d5e80f95dda003c0b97f) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
00:42:30.0117 3180 fsssvc - ok
00:42:30.0182 3180 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
00:42:30.0185 3180 Fs_Rec - ok
00:42:30.0217 3180 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
00:42:30.0219 3180 fvevol - ok
00:42:30.0234 3180 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
00:42:30.0237 3180 gagp30kx - ok
00:42:30.0279 3180 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
00:42:30.0287 3180 gpsvc - ok
00:42:30.0297 3180 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
00:42:30.0298 3180 hcw85cir - ok
00:42:30.0746 3180 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
00:42:30.0763 3180 HdAudAddService - ok
00:42:30.0833 3180 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
00:42:30.0837 3180 HDAudBus - ok
00:42:30.0846 3180 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
00:42:30.0848 3180 HidBatt - ok
00:42:30.0860 3180 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
00:42:30.0862 3180 HidBth - ok
00:42:30.0876 3180 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
00:42:30.0878 3180 HidIr - ok
00:42:30.0898 3180 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll
00:42:30.0900 3180 hidserv - ok
00:42:30.0918 3180 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
00:42:30.0921 3180 HidUsb - ok
00:42:30.0947 3180 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
00:42:30.0951 3180 hkmsvc - ok
00:42:30.0983 3180 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
00:42:30.0986 3180 HomeGroupListener - ok
00:42:31.0034 3180 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
00:42:31.0038 3180 HomeGroupProvider - ok
00:42:31.0061 3180 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
00:42:31.0065 3180 HpSAMD - ok
00:42:31.0102 3180 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
00:42:31.0108 3180 HTTP - ok
00:42:31.0132 3180 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
00:42:31.0133 3180 hwpolicy - ok
00:42:31.0163 3180 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
00:42:31.0165 3180 i8042prt - ok
00:42:31.0190 3180 iaStor (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys
00:42:31.0198 3180 iaStor - ok
00:42:31.0214 3180 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
00:42:31.0222 3180 iaStorV - ok
00:42:31.0279 3180 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
00:42:31.0291 3180 idsvc - ok
00:42:31.0300 3180 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
00:42:31.0302 3180 iirsp - ok
00:42:31.0337 3180 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
00:42:31.0346 3180 IKEEXT - ok
00:42:31.0398 3180 IntcAzAudAddService (d42d651676883181400e22957a7e0b1e) C:\Windows\system32\drivers\RTKVHD64.sys
00:42:31.0407 3180 IntcAzAudAddService - ok
00:42:31.0451 3180 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
00:42:31.0453 3180 intelide - ok
00:42:31.0469 3180 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
00:42:31.0470 3180 intelppm - ok
00:42:31.0489 3180 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
00:42:31.0492 3180 IPBusEnum - ok
00:42:31.0524 3180 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
00:42:31.0528 3180 IpFilterDriver - ok
00:42:31.0568 3180 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
00:42:31.0574 3180 iphlpsvc - ok
00:42:31.0586 3180 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
00:42:31.0590 3180 IPMIDRV - ok
00:42:31.0602 3180 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
00:42:31.0604 3180 IPNAT - ok
00:42:31.0614 3180 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
00:42:31.0616 3180 IRENUM - ok
00:42:31.0629 3180 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
00:42:31.0630 3180 isapnp - ok
00:42:31.0644 3180 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
00:42:31.0650 3180 iScsiPrt - ok
00:42:31.0668 3180 k57nd60a (249ee2d26cb1530f3bede0ac8b9e3099) C:\Windows\system32\DRIVERS\k57nd60a.sys
00:42:31.0672 3180 k57nd60a - ok
00:42:31.0682 3180 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
00:42:31.0683 3180 kbdclass - ok
00:42:31.0692 3180 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
00:42:31.0694 3180 kbdhid - ok
00:42:31.0721 3180 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
00:42:31.0722 3180 KeyIso - ok
00:42:31.0751 3180 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
00:42:31.0755 3180 KSecDD - ok
00:42:31.0784 3180 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
00:42:31.0789 3180 KSecPkg - ok
00:42:31.0800 3180 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
00:42:31.0802 3180 ksthunk - ok
00:42:31.0844 3180 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
00:42:31.0852 3180 KtmRm - ok
00:42:31.0882 3180 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\System32\srvsvc.dll
00:42:31.0888 3180 LanmanServer - ok
00:42:31.0926 3180 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
00:42:31.0929 3180 LanmanWorkstation - ok
00:42:31.0944 3180 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
00:42:31.0946 3180 lltdio - ok
00:42:31.0973 3180 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
00:42:31.0978 3180 lltdsvc - ok
00:42:31.0986 3180 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
00:42:31.0988 3180 lmhosts - ok
00:42:32.0007 3180 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
00:42:32.0011 3180 LSI_FC - ok
00:42:32.0025 3180 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
00:42:32.0027 3180 LSI_SAS - ok
00:42:32.0040 3180 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
00:42:32.0042 3180 LSI_SAS2 - ok
00:42:32.0056 3180 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
00:42:32.0060 3180 LSI_SCSI - ok
00:42:32.0072 3180 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
00:42:32.0073 3180 luafv - ok
00:42:32.0094 3180 lxdu_device - ok
00:42:32.0131 3180 McMPFSvc - ok
00:42:32.0164 3180 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
00:42:32.0167 3180 Mcx2Svc - ok
00:42:32.0180 3180 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
00:42:32.0183 3180 megasas - ok
00:42:32.0195 3180 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
00:42:32.0199 3180 MegaSR - ok
00:42:32.0214 3180 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
00:42:32.0215 3180 MMCSS - ok
00:42:32.0229 3180 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
00:42:32.0231 3180 Modem - ok
00:42:32.0245 3180 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
00:42:32.0246 3180 monitor - ok
00:42:32.0279 3180 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
00:42:32.0280 3180 mouclass - ok
00:42:32.0298 3180 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
00:42:32.0300 3180 mouhid - ok
00:42:32.0324 3180 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
00:42:32.0325 3180 mountmgr - ok
00:42:32.0365 3180 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
00:42:32.0378 3180 MozillaMaintenance - ok
00:42:32.0390 3180 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
00:42:32.0395 3180 mpio - ok
00:42:32.0409 3180 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
00:42:32.0411 3180 mpsdrv - ok
00:42:32.0457 3180 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
00:42:32.0466 3180 MpsSvc - ok
00:42:32.0496 3180 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
00:42:32.0500 3180 MRxDAV - ok
00:42:32.0534 3180 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
00:42:32.0538 3180 mrxsmb - ok
00:42:32.0572 3180 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
00:42:32.0577 3180 mrxsmb10 - ok
00:42:32.0587 3180 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
00:42:32.0590 3180 mrxsmb20 - ok
00:42:32.0602 3180 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
00:42:32.0604 3180 msahci - ok
00:42:32.0619 3180 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
00:42:32.0622 3180 msdsm - ok
00:42:32.0659 3180 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
00:42:32.0662 3180 MSDTC - ok
00:42:32.0686 3180 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
00:42:32.0687 3180 Msfs - ok
00:42:32.0699 3180 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
00:42:32.0701 3180 mshidkmdf - ok
00:42:32.0707 3180 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
00:42:32.0709 3180 msisadrv - ok
00:42:32.0733 3180 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
00:42:32.0737 3180 MSiSCSI - ok
00:42:32.0739 3180 msiserver - ok
00:42:32.0756 3180 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
00:42:32.0757 3180 MSKSSRV - ok
00:42:32.0766 3180 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
00:42:32.0767 3180 MSPCLOCK - ok
00:42:32.0772 3180 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
00:42:32.0773 3180 MSPQM - ok
00:42:32.0804 3180 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
00:42:32.0811 3180 MsRPC - ok
00:42:32.0820 3180 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
00:42:32.0821 3180 mssmbios - ok
00:42:32.0844 3180 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
00:42:32.0852 3180 MSTEE - ok
00:42:32.0862 3180 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
00:42:32.0863 3180 MTConfig - ok
00:42:32.0877 3180 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
00:42:32.0879 3180 Mup - ok
00:42:32.0917 3180 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
00:42:32.0926 3180 napagent - ok
00:42:32.0947 3180 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
00:42:32.0952 3180 NativeWifiP - ok
00:42:32.0982 3180 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
00:42:32.0990 3180 NDIS - ok
00:42:33.0008 3180 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
00:42:33.0010 3180 NdisCap - ok
00:42:33.0023 3180 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
00:42:33.0025 3180 NdisTapi - ok
00:42:33.0060 3180 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
00:42:33.0064 3180 Ndisuio - ok
00:42:33.0077 3180 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
00:42:33.0081 3180 NdisWan - ok
00:42:33.0105 3180 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
00:42:33.0108 3180 NDProxy - ok
00:42:33.0114 3180 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
00:42:33.0115 3180 NetBIOS - ok
00:42:33.0135 3180 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
00:42:33.0138 3180 NetBT - ok
00:42:33.0170 3180 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
00:42:33.0171 3180 Netlogon - ok
00:42:33.0194 3180 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
00:42:33.0198 3180 Netman - ok
00:42:33.0284 3180 NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:42:33.0291 3180 NetMsmqActivator - ok
00:42:33.0293 3180 NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:42:33.0294 3180 NetPipeActivator - ok
00:42:33.0310 3180 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
00:42:33.0316 3180 netprofm - ok
00:42:33.0319 3180 NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:42:33.0319 3180 NetTcpActivator - ok
00:42:33.0321 3180 NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:42:33.0322 3180 NetTcpPortSharing - ok
00:42:33.0343 3180 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
00:42:33.0345 3180 nfrd960 - ok
00:42:33.0361 3180 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
00:42:33.0366 3180 NlaSvc - ok
00:42:33.0372 3180 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
00:42:33.0373 3180 Npfs - ok
00:42:33.0390 3180 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
00:42:33.0392 3180 nsi - ok
00:42:33.0402 3180 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
00:42:33.0403 3180 nsiproxy - ok
00:42:33.0468 3180 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
00:42:33.0491 3180 Ntfs - ok
00:42:33.0532 3180 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
00:42:33.0533 3180 Null - ok
00:42:33.0569 3180 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
00:42:33.0574 3180 nvraid - ok
00:42:33.0589 3180 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
00:42:33.0595 3180 nvstor - ok
00:42:33.0608 3180 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
00:42:33.0611 3180 nv_agp - ok
00:42:33.0705 3180 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
00:42:33.0734 3180 odserv - ok
00:42:33.0751 3180 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
00:42:33.0754 3180 ohci1394 - ok
00:42:33.0791 3180 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
00:42:33.0793 3180 ose - ok
00:42:33.0817 3180 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
00:42:33.0822 3180 p2pimsvc - ok
00:42:33.0843 3180 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
00:42:33.0856 3180 p2psvc - ok
00:42:33.0870 3180 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
00:42:33.0872 3180 Parport - ok
00:42:33.0891 3180 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
00:42:33.0895 3180 partmgr - ok
00:42:33.0908 3180 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
00:42:33.0911 3180 PcaSvc - ok
00:42:33.0925 3180 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
00:42:33.0929 3180 pci - ok
00:42:33.0934 3180 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
00:42:33.0935 3180 pciide - ok
00:42:33.0950 3180 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
00:42:33.0954 3180 pcmcia - ok
00:42:33.0966 3180 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
00:42:33.0969 3180 pcw - ok
00:42:33.0989 3180 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
00:42:33.0996 3180 PEAUTH - ok
00:42:34.0038 3180 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
00:42:34.0044 3180 PerfHost - ok
00:42:34.0098 3180 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
00:42:34.0122 3180 pla - ok
00:42:34.0167 3180 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
00:42:34.0175 3180 PlugPlay - ok
00:42:34.0185 3180 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
00:42:34.0187 3180 PNRPAutoReg - ok
00:42:34.0200 3180 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
00:42:34.0202 3180 PNRPsvc - ok
00:42:34.0238 3180 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
00:42:34.0244 3180 PolicyAgent - ok
00:42:34.0266 3180 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
00:42:34.0269 3180 Power - ok
00:42:34.0304 3180 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
00:42:34.0309 3180 PptpMiniport - ok
00:42:34.0322 3180 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
00:42:34.0324 3180 Processor - ok
00:42:34.0353 3180 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
00:42:34.0359 3180 ProfSvc - ok
00:42:34.0385 3180 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
00:42:34.0386 3180 ProtectedStorage - ok
00:42:34.0416 3180 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
00:42:34.0417 3180 Psched - ok
00:42:34.0448 3180 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
00:42:34.0451 3180 PxHlpa64 - ok
00:42:34.0490 3180 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
00:42:34.0514 3180 ql2300 - ok
00:42:34.0564 3180 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
00:42:34.0566 3180 ql40xx - ok
00:42:34.0579 3180 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
00:42:34.0584 3180 QWAVE - ok
00:42:34.0591 3180 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
00:42:34.0593 3180 QWAVEdrv - ok
00:42:34.0605 3180 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
00:42:34.0607 3180 RasAcd - ok
00:42:34.0621 3180 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
00:42:34.0623 3180 RasAgileVpn - ok
00:42:34.0633 3180 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
00:42:34.0637 3180 RasAuto - ok
00:42:34.0649 3180 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
00:42:34.0651 3180 Rasl2tp - ok
00:42:34.0666 3180 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
00:42:34.0671 3180 RasMan - ok
00:42:34.0690 3180 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
00:42:34.0693 3180 RasPppoe - ok
00:42:34.0697 3180 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
00:42:34.0699 3180 RasSstp - ok
00:42:34.0714 3180 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
00:42:34.0718 3180 rdbss - ok
00:42:34.0725 3180 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
00:42:34.0726 3180 rdpbus - ok
00:42:34.0733 3180 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
00:42:34.0734 3180 RDPCDD - ok
00:42:34.0748 3180 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
00:42:34.0748 3180 RDPENCDD - ok
00:42:34.0751 3180 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
00:42:34.0752 3180 RDPREFMP - ok
00:42:34.0778 3180 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
00:42:34.0782 3180 RDPWD - ok
00:42:34.0829 3180 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
00:42:34.0833 3180 rdyboost - ok
00:42:34.0879 3180 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
00:42:34.0881 3180 RemoteAccess - ok
00:42:34.0889 3180 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
00:42:34.0893 3180 RemoteRegistry - ok
00:42:35.0023 3180 RoxMediaDB10 (05fc44d32a144925eae45570029fd6e1) c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
00:42:35.0065 3180 RoxMediaDB10 - ok
00:42:35.0083 3180 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
00:42:35.0085 3180 RpcEptMapper - ok
00:42:35.0104 3180 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
00:42:35.0106 3180 RpcLocator - ok
00:42:35.0143 3180 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
00:42:35.0146 3180 RpcSs - ok
00:42:35.0176 3180 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
00:42:35.0180 3180 rspndr - ok
00:42:35.0181 3180 RxFilter - ok
00:42:35.0210 3180 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
00:42:35.0211 3180 SamSs - ok
00:42:35.0246 3180 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
00:42:35.0250 3180 sbp2port - ok
00:42:35.0263 3180 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
00:42:35.0267 3180 SCardSvr - ok
00:42:35.0297 3180 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
00:42:35.0300 3180 scfilter - ok
00:42:35.0349 3180 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
00:42:35.0355 3180 Schedule - ok
00:42:35.0386 3180 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
00:42:35.0387 3180 SCPolicySvc - ok
00:42:35.0394 3180 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
00:42:35.0398 3180 SDRSVC - ok
00:42:35.0495 3180 SeaPort (cc781378e7eda615d2cdca3b17829fa4) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
00:42:35.0516 3180 SeaPort - ok
00:42:35.0540 3180 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
00:42:35.0541 3180 secdrv - ok
00:42:35.0574 3180 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
00:42:35.0577 3180 seclogon - ok
00:42:35.0591 3180 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll
00:42:35.0593 3180 SENS - ok
00:42:35.0603 3180 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
00:42:35.0606 3180 SensrSvc - ok
00:42:35.0619 3180 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
00:42:35.0620 3180 Serenum - ok
00:42:35.0631 3180 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
00:42:35.0634 3180 Serial - ok
00:42:35.0671 3180 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
00:42:35.0673 3180 sermouse - ok
00:42:35.0709 3180 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
00:42:35.0713 3180 SessionEnv - ok
00:42:35.0728 3180 SessionLauncher - ok
00:42:35.0787 3180 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
00:42:35.0789 3180 sffdisk - ok
00:42:35.0800 3180 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
00:42:35.0801 3180 sffp_mmc - ok
00:42:35.0809 3180 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
00:42:35.0811 3180 sffp_sd - ok
00:42:35.0818 3180 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
00:42:35.0820 3180 sfloppy - ok
00:42:35.0883 3180 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
00:42:35.0891 3180 SharedAccess - ok
00:42:35.0905 3180 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
00:42:35.0908 3180 ShellHWDetection - ok
00:42:35.0918 3180 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
00:42:35.0919 3180 SiSRaid2 - ok
00:42:35.0932 3180 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
00:42:35.0934 3180 SiSRaid4 - ok
00:42:35.0948 3180 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
00:42:35.0950 3180 Smb - ok
00:42:35.0972 3180 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
00:42:35.0973 3180 SNMPTRAP - ok
00:42:35.0984 3180 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
00:42:35.0986 3180 spldr - ok
00:42:36.0007 3180 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
00:42:36.0010 3180 Spooler - ok
00:42:36.0100 3180 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
00:42:36.0153 3180 sppsvc - ok
00:42:36.0213 3180 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
00:42:36.0216 3180 sppuinotify - ok
00:42:36.0255 3180 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
00:42:36.0261 3180 srv - ok
00:42:36.0278 3180 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
00:42:36.0284 3180 srv2 - ok
00:42:36.0299 3180 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
00:42:36.0302 3180 srvnet - ok
00:42:36.0325 3180 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
00:42:36.0328 3180 SSDPSRV - ok
00:42:36.0341 3180 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
00:42:36.0344 3180 SstpSvc - ok
00:42:36.0392 3180 Steam Client Service - ok
00:42:36.0409 3180 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
00:42:36.0411 3180 stexstor - ok
00:42:36.0448 3180 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
00:42:36.0455 3180 stisvc - ok
00:42:36.0502 3180 stllssvr (ff5eb78af7dfb68c2fb363537aaf753e) c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
00:42:36.0511 3180 stllssvr - ok
00:42:36.0543 3180 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
00:42:36.0544 3180 swenum - ok
00:42:36.0565 3180 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
00:42:36.0572 3180 swprv - ok
00:42:36.0653 3180 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
00:42:36.0693 3180 SysMain - ok
00:42:36.0738 3180 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
00:42:36.0741 3180 TabletInputService - ok
00:42:36.0749 3180 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
00:42:36.0751 3180 TapiSrv - ok
00:42:36.0762 3180 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
00:42:36.0765 3180 TBS - ok
00:42:36.0830 3180 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
00:42:36.0858 3180 Tcpip - ok
00:42:36.0938 3180 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
00:42:36.0945 3180 TCPIP6 - ok
00:42:36.0993 3180 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
00:42:36.0995 3180 tcpipreg - ok
00:42:37.0011 3180 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
00:42:37.0013 3180 TDPIPE - ok
00:42:37.0041 3180 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
00:42:37.0043 3180 TDTCP - ok
00:42:37.0085 3180 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
00:42:37.0087 3180 tdx - ok
00:42:37.0095 3180 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
00:42:37.0096 3180 TermDD - ok
00:42:37.0117 3180 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
00:42:37.0121 3180 TermService - ok
00:42:37.0133 3180 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
00:42:37.0135 3180 Themes - ok
00:42:37.0150 3180 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
00:42:37.0151 3180 THREADORDER - ok
00:42:37.0166 3180 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
00:42:37.0169 3180 TrkWks - ok
00:42:37.0206 3180 trufos (d1c1f105fcfe218112d21fd3d83062dd) C:\Windows\system32\DRIVERS\trufos.sys
00:42:37.0209 3180 trufos - ok
00:42:37.0248 3180 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
00:42:37.0250 3180 TrustedInstaller - ok
00:42:37.0275 3180 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
00:42:37.0277 3180 tssecsrv - ok
00:42:37.0329 3180 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
00:42:37.0332 3180 TsUsbFlt - ok
00:42:37.0425 3180 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
00:42:37.0464 3180 tunnel - ok
00:42:37.0519 3180 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
00:42:37.0546 3180 uagp35 - ok
00:42:37.0662 3180 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
00:42:37.0688 3180 udfs - ok
00:42:37.0738 3180 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
00:42:37.0754 3180 UI0Detect - ok
00:42:37.0807 3180 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
00:42:37.0809 3180 uliagpkx - ok
00:42:37.0826 3180 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
00:42:37.0829 3180 umbus - ok
00:42:37.0837 3180 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
00:42:37.0838 3180 UmPass - ok
00:42:37.0924 3180 Update Server (1a8699bc39dd601eca24b72abd710bbf) C:\Program Files\Common Files\Defender Pro\Defender Pro Arrakis Server\bin\arrakis3.exe
00:42:37.0931 3180 Update Server - ok
00:42:37.0986 3180 UPDATESRV (5511e7ebb439c697966bc5cc7510f348) C:\Program Files\Defender Pro\Defender Pro\updatesrv.exe
00:42:37.0989 3180 UPDATESRV - ok
00:42:38.0008 3180 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
00:42:38.0013 3180 upnphost - ok
00:42:38.0022 3180 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
00:42:38.0025 3180 usbccgp - ok
00:42:38.0040 3180 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
00:42:38.0043 3180 usbcir - ok
00:42:38.0047 3180 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
00:42:38.0050 3180 usbehci - ok
00:42:38.0065 3180 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
00:42:38.0072 3180 usbhub - ok
00:42:38.0081 3180 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
00:42:38.0084 3180 usbohci - ok
00:42:38.0103 3180 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
00:42:38.0104 3180 usbprint - ok
00:42:38.0131 3180 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
00:42:38.0133 3180 usbscan - ok
00:42:38.0138 3180 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
00:42:38.0142 3180 USBSTOR - ok
00:42:38.0153 3180 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
00:42:38.0155 3180 usbuhci - ok
00:42:38.0167 3180 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
00:42:38.0169 3180 UxSms - ok
00:42:38.0198 3180 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
00:42:38.0199 3180 VaultSvc - ok
00:42:38.0208 3180 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
00:42:38.0210 3180 vdrvroot - ok
00:42:38.0249 3180 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
00:42:38.0257 3180 vds - ok
00:42:38.0269 3180 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
00:42:38.0270 3180 vga - ok
00:42:38.0280 3180 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
00:42:38.0282 3180 VgaSave - ok
00:42:38.0298 3180 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
00:42:38.0303 3180 vhdmp - ok
00:42:38.0310 3180 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
00:42:38.0311 3180 viaide - ok
00:42:38.0320 3180 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
00:42:38.0324 3180 volmgr - ok
00:42:38.0362 3180 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
00:42:38.0366 3180 volmgrx - ok
00:42:38.0382 3180 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
00:42:38.0387 3180 volsnap - ok
00:42:38.0406 3180 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
00:42:38.0409 3180 vsmraid - ok
00:42:38.0466 3180 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
00:42:38.0498 3180 VSS - ok
00:42:38.0544 3180 VSSERV - ok
00:42:38.0596 3180 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
00:42:38.0598 3180 vwifibus - ok
00:42:38.0632 3180 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
00:42:38.0634 3180 vwififlt - ok
00:42:38.0741 3180 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
00:42:38.0746 3180 W32Time - ok
00:42:38.0769 3180 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
00:42:38.0786 3180 WacomPen - ok
00:42:38.0917 3180 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
00:42:38.0919 3180 WANARP - ok
00:42:38.0921 3180 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
00:42:38.0922 3180 Wanarpv6 - ok
00:42:38.0975 3180 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
00:42:39.0000 3180 WatAdminSvc - ok
00:42:39.0054 3180 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
00:42:39.0077 3180 wbengine - ok
00:42:39.0116 3180 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
00:42:39.0120 3180 WbioSrvc - ok
00:42:39.0136 3180 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
00:42:39.0142 3180 wcncsvc - ok
00:42:39.0151 3180 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
00:42:39.0154 3180 WcsPlugInService - ok
00:42:39.0177 3180 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
00:42:39.0179 3180 Wd - ok
00:42:39.0205 3180 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
00:42:39.0212 3180 Wdf01000 - ok
00:42:39.0220 3180 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
00:42:39.0223 3180 WdiServiceHost - ok
00:42:39.0225 3180 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
00:42:39.0226 3180 WdiSystemHost - ok
00:42:39.0243 3180 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
00:42:39.0247 3180 WebClient - ok
00:42:39.0263 3180 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
00:42:39.0267 3180 Wecsvc - ok
00:42:39.0274 3180 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
00:42:39.0276 3180 wercplsupport - ok
00:42:39.0293 3180 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
00:42:39.0296 3180 WerSvc - ok
00:42:39.0310 3180 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
00:42:39.0311 3180 WfpLwf - ok
00:42:39.0318 3180 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
00:42:39.0320 3180 WIMMount - ok
00:42:39.0351 3180 WinDefend - ok
00:42:39.0365 3180 WinHttpAutoProxySvc - ok
00:42:39.0399 3180 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
00:42:39.0403 3180 Winmgmt - ok
00:42:39.0471 3180 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
00:42:39.0499 3180 WinRM - ok
00:42:39.0563 3180 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
00:42:39.0566 3180 WinUsb - ok
00:42:39.0595 3180 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
00:42:39.0605 3180 Wlansvc - ok
00:42:39.0643 3180 wlcrasvc (06c8fa1cf39de6a735b54d906ba791c6) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
00:42:39.0647 3180 wlcrasvc - ok
00:42:39.0732 3180 wlidsvc (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
00:42:39.0763 3180 wlidsvc - ok
00:42:39.0895 3180 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
00:42:39.0904 3180 WmiAcpi - ok
00:42:39.0945 3180 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
00:42:39.0949 3180 wmiApSrv - ok
00:42:39.0969 3180 WMPNetworkSvc - ok
00:42:39.0986 3180 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
00:42:39.0988 3180 WPCSvc - ok
00:42:40.0017 3180 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
00:42:40.0020 3180 WPDBusEnum - ok
00:42:40.0032 3180 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
00:42:40.0032 3180 ws2ifsl - ok
00:42:40.0060 3180 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll
00:42:40.0063 3180 wscsvc - ok
00:42:40.0065 3180 WSearch - ok
00:42:40.0136 3180 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
00:42:40.0170 3180 wuauserv - ok
00:42:40.0236 3180 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
00:42:40.0240 3180 WudfPf - ok
00:42:40.0257 3180 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
00:42:40.0261 3180 WUDFRd - ok
00:42:40.0272 3180 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
00:42:40.0275 3180 wudfsvc - ok
00:42:40.0297 3180 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
00:42:40.0302 3180 WwanSvc - ok
00:42:40.0311 3180 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
00:42:40.0338 3180 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected
00:42:40.0338 3180 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)
00:42:40.0370 3180 Boot (0x1200) (40bc0cd6465d86930abe46f054021f65) \Device\Harddisk0\DR0\Partition0
00:42:40.0371 3180 \Device\Harddisk0\DR0\Partition0 - ok
00:42:40.0372 3180 Boot (0x1200) (80dd4b6ef039966c64efd41cf64c3256) \Device\Harddisk0\DR0\Partition1
00:42:40.0373 3180 \Device\Harddisk0\DR0\Partition1 - ok
00:42:40.0374 3180 ============================================================
00:42:40.0374 3180 Scan finished
00:42:40.0374 3180 ============================================================
00:42:40.0380 4476 Detected object count: 1
00:42:40.0380 4476 Actual detected object count: 1
00:43:02.0641 4476 \Device\Harddisk0\DR0\# - copied to quarantine
00:43:02.0641 4476 \Device\Harddisk0\DR0 - copied to quarantine
00:43:02.0674 4476 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine
00:43:02.0676 4476 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine
00:43:02.0777 4476 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine
00:43:02.0821 4476 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine
00:43:02.0825 4476 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine
00:43:02.0836 4476 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine
00:43:02.0840 4476 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine
00:43:02.0853 4476 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine
00:43:02.0873 4476 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine
00:43:02.0878 4476 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine
00:43:02.0887 4476 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine
00:43:02.0890 4476 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine
00:43:02.0952 4476 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot
00:43:02.0953 4476 \Device\Harddisk0\DR0 - ok
00:43:02.0963 4476 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure
00:43:09.0258 4180 Deinitialize success

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-17 00:51:56
-----------------------------
00:51:56.505 OS Version: Windows x64 6.1.7601 Service Pack 1
00:51:56.505 Number of processors: 8 586 0x1E05
00:51:56.505 ComputerName: JOSEPHINE UserName: Jackque
00:52:19.671 Initialize success
00:58:11.566 AVAST engine defs: 12061601
00:59:08.651 The log file has been saved successfully to "C:\Users\Jackque\Desktop\aswMBR.txt"
01:00:51.874 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
01:00:51.876 Disk 0 Vendor: ST31000528AS CC45 Size: 953869MB BusType: 3
01:00:51.893 Disk 0 MBR read successfully
01:00:51.895 Disk 0 MBR scan
01:00:51.962 Disk 0 Windows 7 default MBR code
01:00:51.971 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 70 MB offset 63
01:00:52.018 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 9642 MB offset 145408
01:00:52.036 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 944155 MB offset 19892224
01:00:52.080 Disk 0 scanning C:\Windows\system32\drivers
01:01:00.571 Service scanning
01:01:17.247 Modules scanning
01:01:17.252 Disk 0 trace - called modules:
01:01:17.591 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys
01:01:17.595 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800659f790]
01:01:17.598 3 CLASSPNP.SYS[fffff88001b4c43f] -> nt!IofCallDriver -> [0xfffffa80062d1670]
01:01:17.601 5 ACPI.sys[fffff88000ed17a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80062e5060]
01:01:30.871 Disk 0 MBR has been saved successfully to "C:\Users\Jackque\Desktop\MBR.dat"
01:01:30.875 The log file has been saved successfully to "C:\Users\Jackque\Desktop\aswMBR.txt"
01:01:32.054 AVAST engine scan C:\Windows
01:01:34.784 AVAST engine scan C:\Windows\system32
01:04:20.635 AVAST engine scan C:\Windows\system32\drivers
01:04:33.015 AVAST engine scan C:\Users\Jackque
01:19:45.640 AVAST engine scan C:\ProgramData
01:21:31.713 Scan finished successfully
01:34:12.645 Disk 0 MBR has been saved successfully to "C:\Users\Jackque\Desktop\MBR.dat"
01:34:12.649 The log file has been saved successfully to "C:\Users\Jackque\Desktop\aswMBR.txt"

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
  
• report from Combofix
• let me know of any problems you may have had
• How is the computer doing now after running the script?

Gringo

Do I need to turn off my antivirus software again before I run combofix?

yes please do


gringo

Hello Gringo,

My computer restarted during the process, and my antivirus software started up again before combofix was finished. Is that okay?
Also, my mouse pointer will sometimes stall, and then catch up, on the screen. It started doing this around the same time my computer got infected. It is still doing that this morning. It isnt a big problem, but I just wanted you to know it is still there.

Here is the log:

ComboFix 12-06-19.01 - Jackque 06/19/2012 5:24.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6135.4950 [GMT -5:00]
Running from: c:\users\Jackque\Desktop\ComboFix.exe
Command switches used :: c:\users\Jackque\Desktop\CFScript.txt
AV: Defender Pro Antivirus *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: Defender Pro Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: Defender Pro Antispyware *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
.
.
((((((((((((((((((((((((( Files Created from 2012-05-19 to 2012-06-19 )))))))))))))))))))))))))))))))
.
.
2012-06-19 10:29 . 2012-06-19 10:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-06-19 10:29 . 2012-06-19 10:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-19 00:33 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-19 00:33 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-19 00:33 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-19 00:33 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-19 00:33 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-19 00:33 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-19 00:33 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-19 00:32 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-19 00:32 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-17 05:43 . 2012-06-17 05:43 -------- d-----w- C:\TDSSKiller_Quarantine
2012-06-16 11:11 . 2012-06-16 11:11 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-06-16 11:11 . 2012-06-16 11:11 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-06-16 11:11 . 2012-06-16 11:11 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-06-16 11:11 . 2012-06-16 11:11 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-06-16 11:11 . 2012-06-16 11:11 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-06-16 11:11 . 2012-06-16 11:11 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-06-16 11:11 . 2012-06-16 11:11 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-06-16 11:11 . 2012-06-16 11:11 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-06-15 00:31 . 2012-06-15 00:31 -------- d-----w- c:\users\Jackque\AppData\Local\Funcom
2012-06-15 00:31 . 2012-06-15 00:31 -------- d-----w- c:\program files (x86)\Funcom
2012-06-14 22:22 . 2012-06-14 22:22 463 ----a-w- c:\program files (x86)\0614201217225091.bat
2012-06-14 21:43 . 2012-06-14 21:43 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Defender Pro
2012-06-14 21:42 . 2012-06-14 21:42 -------- d-----w- c:\users\Default\AppData\Roaming\Defender Pro
2012-06-13 20:51 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 10:53 . 2012-06-13 10:53 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\bdch
2012-06-11 00:50 . 2012-06-11 00:50 -------- d-----w- c:\programdata\Cateia Games
2012-06-11 00:47 . 2012-06-11 00:49 -------- d-----w- c:\program files (x86)\Oberon Media
2012-06-09 05:55 . 2012-06-09 05:55 -------- d-----w- c:\users\Jackque\AppData\Local\ElevatedDiagnostics
2012-06-09 05:32 . 2012-06-09 05:32 -------- d-----w- c:\users\Jackque\AppData\Roaming\Malwarebytes
2012-06-09 05:32 . 2012-06-09 05:32 -------- d-----w- c:\programdata\Malwarebytes
2012-06-09 05:32 . 2012-06-09 05:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-09 05:32 . 2012-04-04 20:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-07 15:37 . 2012-06-07 15:37 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\QuickScan
2012-06-07 14:03 . 2012-06-07 14:03 -------- d-----w- c:\programdata\Bitdefender
2012-06-07 14:03 . 2012-06-07 14:03 -------- d-----w- c:\users\Jackque\AppData\Roaming\Defender Pro
2012-06-07 14:03 . 2012-06-07 14:03 -------- d-----w- c:\programdata\Defender Pro
2012-06-07 14:01 . 2012-06-07 14:01 -------- d-----w- c:\users\Jackque\AppData\Roaming\QuickScan
2012-06-07 14:01 . 2012-06-07 14:01 -------- d-----w- c:\program files\Defender Pro
2012-06-07 14:01 . 2011-07-23 01:20 288600 ----a-w- c:\windows\system32\drivers\trufos.sys
2012-06-07 14:01 . 2011-03-24 20:36 431176 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2012-06-07 13:59 . 2012-06-07 14:01 -------- d-----w- c:\program files\Common Files\Defender Pro
2012-06-07 00:55 . 2012-06-19 10:30 -------- d-----w- c:\windows\system32\wbem\repository
2012-06-06 23:46 . 2012-06-07 00:30 -------- d-----w- c:\program files (x86)\NortonInstaller
2012-06-06 23:36 . 2012-06-07 00:51 -------- d-----w- c:\programdata\Norton
2012-06-01 22:04 . 2012-06-15 00:31 -------- d-----w- c:\programdata\Media Center Programs
2012-05-28 03:41 . 2012-05-28 01:53 2304 ----a-w- c:\windows\SysWow64\HtsysmNT.sys
2012-05-27 18:25 . 2012-05-27 18:25 -------- d-----w- C:\Down
2012-05-20 11:45 . 2012-05-20 11:45 -------- d-----w- c:\users\Jackque\AppData\Roaming\Ubisoft
2012-05-20 11:44 . 2012-05-20 11:44 -------- d-----w- c:\programdata\Ubisoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-30 11:35 . 2012-05-11 18:53 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-17_05.02.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-06-07 01:37 . 2012-06-17 05:07 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
- 2012-06-07 01:37 . 2012-06-08 04:16 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2010-01-17 04:59 . 2012-06-18 23:33 54080 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-06-18 23:33 31642 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2010-02-02 06:42 . 2012-06-14 23:29 20292 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1651834869-554549910-2406132148-1000_UserData.bin
+ 2010-02-02 06:42 . 2012-06-18 23:33 20292 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1651834869-554549910-2406132148-1000_UserData.bin
+ 2010-02-02 04:03 . 2012-06-17 08:16 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-02-02 04:03 . 2012-06-16 20:59 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-06-16 20:59 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-06-17 08:16 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-06-02 20:19 . 2012-06-02 20:19 79232 c:\windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe
+ 2009-07-14 04:46 . 2012-06-18 23:38 91888 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2012-06-19 10:30 . 2012-06-19 10:30 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-06-16 20:28 . 2012-06-16 20:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-06-16 20:28 . 2012-06-16 20:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-06-19 10:30 . 2012-06-19 10:30 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-06-07 01:34 . 2012-06-08 04:16 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-06-07 01:34 . 2012-06-17 05:07 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-02-07 21:31 . 2012-06-19 10:16 273396 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2009-07-14 05:01 . 2012-06-16 20:27 343424 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-06-19 10:29 343424 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-06-06 23:49 . 2012-06-17 05:43 344192 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
- 2012-06-06 23:49 . 2012-06-08 08:16 344192 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
+ 2012-06-13 20:51 . 2012-05-04 10:03 3913072 c:\windows\SysWOW64\ntoskrnl.exe
- 2012-05-11 18:58 . 2012-03-31 04:39 3913072 c:\windows\SysWOW64\ntoskrnl.exe
- 2012-05-11 18:58 . 2012-03-31 04:39 3968368 c:\windows\SysWOW64\ntkrnlpa.exe
+ 2012-06-13 20:51 . 2012-05-04 10:03 3968368 c:\windows\SysWOW64\ntkrnlpa.exe
- 2012-05-11 18:58 . 2012-03-31 06:05 5559664 c:\windows\system32\ntoskrnl.exe
+ 2012-06-13 20:51 . 2012-05-04 11:06 5559664 c:\windows\system32\ntoskrnl.exe
- 2009-07-14 04:45 . 2012-06-14 10:16 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:45 . 2012-06-17 08:19 7114300 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 02:34 . 2012-06-19 00:46 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
- 2009-07-14 02:34 . 2012-06-14 08:24 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2011-06-19 05:37 . 2012-06-19 10:29 22812284 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1651834869-554549910-2406132148-1000-12288.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2009-07-17 237568]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 0055071339077083mcinstcleanup;McAfee Application Installer Cleanup (0055071339077083);c:\users\Jackque\AppData\Local\Temp\005507~1.EXE [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 SessionLauncher;SessionLauncher;c:\users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [x]
R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [x]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [2011-10-29 25832]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 129976]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Defender Pro\Defender Pro Arrakis Server\bin\arrakis3.exe [2011-08-02 466736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\defender pro\defender pro firewall\bdfndisf6.sys [2011-03-01 89680]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Defender Pro\Defender Pro Firewall\bdfwfpf.sys [2011-03-01 102992]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe [2009-10-16 1039360]
S2 UPDATESRV;Defender Pro Desktop Update Service;c:\program files\Defender Pro\Defender Pro\updatesrv.exe [2011-08-02 62512]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [x]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-05-23 7833120]
"BDAgent"="c:\program files\Defender Pro\Defender Pro\bdagent.exe" [2011-08-02 924080]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://msn.com/
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
TCP: DhcpNameServer = 192.168.15.1
FF - ProfilePath - c:\users\Jackque\AppData\Roaming\Mozilla\Firefox\Profiles\nbdboseh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
FF - prefs.js: browser.search.selectedEngine - bing
FF - prefs.js: browser.startup.homepage - hxxp://g.msn.com/USCON/1
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1651834869-554549910-2406132148-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1651834869-554549910-2406132148-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-1651834869-554549910-2406132148-1000\Software\SecuROM\License information*]
"datasecu"=hex:41,26,55,be,30,4a,c0,4b,ab,61,f5,76,66,72,ab,34,d9,e9,15,39,51,
3a,ab,7f,0a,be,6f,61,55,b0,43,ce,ce,22,67,0a,da,cc,6d,d3,10,6a,b9,42,59,4a,\
"rkeysecu"=hex:8c,2a,20,fc,a0,be,34,8f,b4,58,28,b1,96,19,e4,b8
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Completion time: 2012-06-19 05:36:08 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-19 10:36
ComboFix2.txt 2012-06-17 05:05
.
Pre-Run: 606,290,485,248 bytes free
Post-Run: 606,115,155,968 bytes free
.
- - End Of File - - 074B2DE0A46189F2AE9FC9CE9233EE10

Greetings


The mouse may have nothing to do with what is going on - is it a wireless mouse?



Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)

Programs to remove

Adobe Reader 9.5.1
Bing Bar
Java™ 6 Update 26
[/list]

• Please download and install Revo Uninstaller Free
• Double click Revo Uninstaller to run it.
• From the list of programs double click on The Program to remove
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next.
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

.

Update Adobe Reader

Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.

Note: When installing FoxitReader, be careful not to install anything to do with AskBar.
[/list]

Install Java:

Please go here to install Java

• click on the Free Java Download Button
• click on Agree and start Free download
• click on Run
• click on run again
• click on install
• when install is complete click on close

Clean Out Temp Files

• This small application you may want to keep and use once a week to keep the computer clean.
  
  Download CCleaner from here http://www.ccleaner.com/
  
  
• Run the installer to install the application.
• When it gives you the option to install Yahoo toolbar uncheck the box next to it.
• Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
• Click Run Cleaner.
• Close CCleaner.

: Malwarebytes' Anti-Malware :

• I would like you to rerun MBAM
  
• Double-click mbam icon
• go to the update tab at the top
• click on check for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  
• If you accidentally close it, the log file is saved here and will be named like this:
• C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

If you have any problems running Hijackthis see NOTE** below (Host file not read, blank notepad ...)

• Go Here to download HijackThis Installer
• Save HijackThis Installer to your desktop.
• Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed it will launch Hijackthis.
• Click on the Do a system scan and save a log file button. It will scan and the log should open in notepad.
• Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT use the Analyze This button its findings are dangerous if misinterpreted.
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

NOTE**
sometimes we have to run it like this To run HijackThis as an administrator, right-click HijackThis.exe
(located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)<--32bit
(located: C:\Program Files(86)\Trend Micro\HiJackThis\HiJackThis.exe)<--64bit
and select to run as administrator

"information and logs"

• In your next post I need the following
  
  
• Log From MBAM
• report from Hijackthis
• let me know of any problems you may have had
• How is the computer doing now?

Gringo

Hello,

I just have a regular mouse, not a wireless.

When trying to install Java, I got this error message:

C:\Users\Jackque\AppData\Local\Temp\\fx-runtime.exe is corrupt.



Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.09.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jackque :: JOSEPHINE [administrator]

6/19/2012 2:14:02 PM
mbam-log-2012-06-19 (14-14-02).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | PUP | PUM
Scan options disabled: Heuristics/Shuriken | P2P
Objects scanned: 216278
Time elapsed: 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Report from HiJackThis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:24:13 PM, on 6/19/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16446)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O4 - HKLM\..\Run: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: McAfee Application Installer Cleanup (0055071339077083) (0055071339077083mcinstcleanup) - Unknown owner - C:\Users\Jackque\AppData\Local\Temp\005507~1.EXE (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - c:\program files (x86)\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: lxdu_device - - C:\Windows\system32\lxducoms.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RoxMediaDB10 - Sonic Solutions - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SessionLauncher - Unknown owner - c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: BitDefender Update Server v2 (Update Server) - Defender Pro - C:\Program Files\Common Files\Defender Pro\Defender Pro Arrakis Server\bin\arrakis3.exe
O23 - Service: Defender Pro Desktop Update Service (UPDATESRV) - Defender Pro - C:\Program Files\Defender Pro\Defender Pro\updatesrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Defender Pro Virus Shield (VSSERV) - Defender Pro - C:\Program Files\Defender Pro\Defender Pro\vsserv.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8906 bytes

The only problem I ran into was the error message when trying to download Java.