Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

very slow browser, browser keeps suggesting a malicious website as home page


  • This topic is locked This topic is locked
21 replies to this topic

#1 tf777f

tf777f

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 12 February 2015 - 10:03 PM

Please help me clean my laptop. I was trying to download Odin to fix my phone that I got into this mess. Laptop runs very slow. the firefox keeps enforcing a website as a search engine. ran malwarebytes and it detected 12 items which i put in quarentin.

with advanced thanks



BC AdBot (Login to Remove)

 


#2 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 13 February 2015 - 03:42 AM

Hi & :welcome: to Bleeping Computer Forums!
My name is Jürgen and I will be assisting you with your Malware related problems. :warrior:

Before we move on, please read the following points carefully: :exclame:

  • My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
  • Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.
  • If I don't reply within 24 hours please PM me!
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

Step 1

Please run a FRST scan. This will help us diagnose your problem.

frst.pngfrstscan.png
Please download Farbar Recovery Scan Tool and save it to your Desktop.
(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)
  • Start FRST with administator privileges.
  • Make sure the option Addition.txt is checked and press the Scan button.
  • When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
  • Please copy and paste these logs in your next reply.


regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#3 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 13 February 2015 - 01:22 PM

Hello Jürgen, thanks so much for helping me.

Here are my logs pasted :

 

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2015
Ran by FM (administrator) on FM-PC on 13-02-2015 11:10:51
Running from C:\Users\FM\Desktop
Loaded Profiles: FM (Available profiles: FM)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AdminService.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Juniper Networks, Inc.) C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Livescribe) C:\Program Files\Common Files\Livescribe\PenComm\PenCommService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\FXSSVC.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Alcor Micro Corp.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AthBtTray.exe
() C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [233472 2010-03-12] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1733928 2010-03-11] (Synaptics Incorporated)
HKLM\...\Run: [ODDPwr] => C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe [186912 2010-04-22] (Acer Incorporated)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [908368 2010-04-07] (Dritek System Inc.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [206208 2010-06-01] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715296 2010-04-23] (Acer Incorporated)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [490656 2011-01-20] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files\Bluetooth Suite\AthBtTray.exe [302240 2011-01-20] (Atheros Commnucations)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [BrStsWnd] => C:\Program Files\Brownie\BrstsWnd.exe [3618104 2009-08-19] (brother)
HKU\S-1-5-21-672566934-3909434764-2333441952-1003\...\Run: [7 Taskbar Tweaker] => C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe [69632 2010-03-20] ()
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-12-16] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-672566934-3909434764-2333441952-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-672566934-3909434764-2333441952-1003 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.3.25

FireFox:
========
FF ProfilePath: C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default
FF DefaultSearchEngine: Google
FF Homepage: https://encrypted.google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @Citrix.com/npagee,version=10.1.122.1708 -> C:\Program Files\Citrix\Secure Access Client\npagee.dll (Citrix Systems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-672566934-3909434764-2333441952-1003: @talk.google.com/GoogleTalkPlugin -> C:\Users\FM\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-672566934-3909434764-2333441952-1003: @talk.google.com/O1DPlugin -> C:\Users\FMk\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-672566934-3909434764-2333441952-1003: @tools.google.com/Google Update;version=3 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-672566934-3909434764-2333441952-1003: @tools.google.com/Google Update;version=9 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\FM\AppData\Roaming\mozilla\plugins\npagee.dll (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\FM\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\FM\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF Extension: 20-20 3D Viewer - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\2020Player@2020Technologies.com [2010-10-04]
FF Extension: BlackFox V2-Blue - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\zigboom.designs@gmail.com [2015-01-09]
FF Extension: EPUBReader - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2015-02-10]
FF Extension: DownloadHelper - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-11-22]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\elemhidehelper@adblockplus.org.xpi [2011-09-28]
FF Extension: Keyword Search - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\keywordsearch@kaply.com.xpi [2013-08-11]
FF Extension: Stylish - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2011-04-17]
FF Extension: Adblock Plus - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-03-27]
FF Extension: BetterPrivacy - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-08-11]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-01-26]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-01-26]

Chrome:
=======
CHR Profile: C:\Users\FM\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\FM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-03]
CHR Extension: (Google Drive) - C:\Users\FM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\FM\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-03]
CHR Extension: (Google Wallet) - C:\Users\FM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-03]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [72864 2011-01-20] (Atheros Commnucations) [File not signed]
R2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 dsNcService; C:\Program Files\Juniper Networks\Common Files\dsNcService.exe [684144 2014-08-12] (Juniper Networks, Inc.)
R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-04-23] (Acer Incorporated)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2013-01-12] (Flexera Software, Inc.)
R2 LMS; C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe [262144 2009-09-30] (Intel Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation)
R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [129568 2010-04-22] (Acer Incorporated)
R2 PenCommService; C:\Program Files\Common Files\Livescribe\PenComm\PenCommService.exe [470528 2011-10-27] (Livescribe) [File not signed]
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2011-08-19] (Logitech Inc.)
R2 UNS; C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2314240 2009-09-30] (Intel Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AmUStor; C:\Windows\System32\drivers\AmUStor.SYS [25600 2010-03-12] (Alcor Micro, Corp.)
S3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [34976 2011-01-20] (Atheros) [File not signed]
S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [258720 2011-01-20] (Atheros)
R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2011-01-20] (Atheros)
S3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [175776 2011-01-20] (Atheros)
S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [49312 2011-01-20] (Atheros)
S3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [141088 2011-01-20] (Atheros)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [294952 2010-06-26] (Broadcom Corporation.)
R3 dsNcAdpt; C:\Windows\System32\DRIVERS\dsNcAdpt.sys [27648 2013-07-24] (Juniper Networks)
S2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [29232 2010-06-01] (EgisTec)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [35776 2013-09-23] (http://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
S3 PulseUsb; C:\Windows\System32\DRIVERS\PulseUsb.sys [20480 2011-10-27] (Windows ® Win 7 DDK provider) [File not signed]
S3 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [7168 2009-11-12] () [File not signed]
S3 tap0801co; C:\Windows\System32\DRIVERS\tap0801co.sys [25856 2006-08-30] (The OpenVPN Project) [File not signed]
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [14808 2009-11-02] ()
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed]
S3 WsAudio_Device(1); C:\Windows\System32\drivers\VirtualAudio1.sys [27496 2013-01-25] (Wondershare)
S3 WsAudio_Device(2); C:\Windows\System32\drivers\VirtualAudio2.sys [27496 2013-01-25] (Wondershare)
S3 WsAudio_Device(3); C:\Windows\System32\drivers\VirtualAudio3.sys [27496 2013-01-25] (Wondershare)
S3 WsAudio_Device(4); C:\Windows\System32\drivers\VirtualAudio4.sys [27496 2013-01-25] (Wondershare)
S3 WsAudio_Device(5); C:\Windows\System32\drivers\VirtualAudio5.sys [27496 2013-01-25] (Wondershare)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 11:10 - 2015-02-13 11:11 - 00018501 _____ () C:\Users\FM\Desktop\FRST.txt
2015-02-13 11:10 - 2015-02-13 11:10 - 01125376 _____ (Farbar) C:\Users\FM\Desktop\FRST.exe
2015-02-12 19:50 - 2015-02-13 10:31 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-12 19:49 - 2015-02-12 19:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-12 19:49 - 2015-02-12 19:49 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-02-12 19:49 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-12 19:49 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-12 19:49 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-12 19:48 - 2015-02-12 19:49 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\FM\Desktop\mbam-setup-2.0.4.1028(2).exe
2015-02-12 19:32 - 2015-02-12 19:32 - 00000088 _____ () C:\Users\FM\AppData\Local\98024bdb50f33b66087ef5a55a879aed
2015-02-12 19:27 - 2015-02-04 16:40 - 00323928 _____ (System Alerts LLC) C:\Windows\system32\ZxslE8.dll
2015-02-11 17:39 - 2015-01-22 20:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-11 17:39 - 2015-01-22 20:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-10 23:47 - 2015-01-15 00:46 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-10 23:47 - 2015-01-15 00:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-10 23:47 - 2015-01-15 00:43 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-10 23:47 - 2015-01-15 00:43 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-10 23:47 - 2015-01-15 00:42 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-10 23:47 - 2015-01-15 00:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-10 23:47 - 2015-01-15 00:42 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-10 23:47 - 2015-01-15 00:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-10 23:47 - 2015-01-15 00:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-10 23:47 - 2015-01-15 00:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-10 23:47 - 2015-01-15 00:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-10 23:47 - 2015-01-14 21:21 - 00369968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-10 23:47 - 2015-01-08 18:45 - 02380288 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-10 23:46 - 2015-01-13 22:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-02-10 23:46 - 2015-01-13 22:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-10 23:46 - 2015-01-13 22:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-10 23:46 - 2015-01-11 19:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-10 23:46 - 2015-01-11 19:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-10 23:46 - 2015-01-11 19:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-10 23:46 - 2015-01-11 19:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-10 23:46 - 2015-01-11 19:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-10 23:46 - 2015-01-11 19:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-10 23:46 - 2015-01-11 19:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-10 23:46 - 2015-01-11 19:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-10 23:46 - 2015-01-11 19:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-10 23:46 - 2015-01-11 18:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-10 23:46 - 2015-01-11 18:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-10 23:46 - 2015-01-11 18:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-10 23:46 - 2015-01-11 18:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-10 23:46 - 2015-01-11 18:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-10 23:46 - 2015-01-11 18:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-10 23:46 - 2015-01-11 18:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-10 23:46 - 2015-01-11 18:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-10 23:46 - 2015-01-11 18:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-10 23:46 - 2015-01-11 18:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-10 23:46 - 2015-01-11 18:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-10 23:46 - 2015-01-11 18:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-10 23:46 - 2015-01-11 18:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-10 23:46 - 2015-01-11 18:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-10 23:46 - 2015-01-11 18:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-10 23:46 - 2015-01-11 18:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-10 23:46 - 2015-01-11 17:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-10 23:46 - 2015-01-11 17:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-10 23:46 - 2015-01-09 23:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-10 23:46 - 2014-11-25 20:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-10 23:46 - 2014-10-03 18:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-10 23:46 - 2014-10-03 18:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2015-02-10 23:45 - 2015-01-12 19:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-10 23:45 - 2014-12-11 22:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-10 23:45 - 2014-12-07 19:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-10 23:45 - 2014-07-06 18:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-10 23:45 - 2014-07-06 18:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-10 19:21 - 2015-02-10 18:32 - 00024064 _____ () C:\Windows\zoek-delete.exe
2015-02-10 18:34 - 2015-02-10 20:33 - 00009205 _____ () C:\zoek-results.log
2015-02-10 18:32 - 2015-02-10 19:13 - 00000000 ____D () C:\zoek_backup
2015-02-09 12:48 - 2015-02-12 20:53 - 00000000 ____D () C:\AdwCleaner
2015-02-08 14:11 - 2015-02-13 11:11 - 00000000 ____D () C:\FRST
2015-02-08 12:22 - 2015-02-08 12:22 - 00023988 _____ () C:\ComboFix.txt
2015-02-08 12:01 - 2011-06-25 23:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-08 12:01 - 2010-11-07 10:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-08 12:01 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-08 12:01 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-08 12:01 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-08 12:01 - 2000-08-30 17:00 - 00098816 _____ () C:\Windows\sed.exe
2015-02-08 12:01 - 2000-08-30 17:00 - 00080412 _____ () C:\Windows\grep.exe
2015-02-08 12:01 - 2000-08-30 17:00 - 00068096 _____ () C:\Windows\zip.exe
2015-02-08 11:54 - 2015-02-08 12:22 - 00000000 ____D () C:\Qoobox
2015-02-08 11:52 - 2015-02-08 12:22 - 00000000 ____D () C:\Windows\erdnt
2015-02-07 19:04 - 2015-02-07 19:04 - 00022259 _____ () C:\Users\FM\Desktop\qrcode-5.1.tar.gz
2015-02-07 19:02 - 2015-02-07 19:02 - 00149416 _____ () C:\Users\FM\Desktop\pyqrcode-0.2.1.tar.gz
2015-02-07 18:37 - 2015-02-07 18:37 - 00000000 ____D () C:\Users\FM\PycharmProjects
2015-02-07 11:25 - 2015-02-07 11:25 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-07 11:24 - 2015-02-07 11:24 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\FM\Desktop\mbam-setup-2.0.4.1028.exe
2015-02-02 19:20 - 2015-02-07 20:05 - 00000000 ____D () C:\Users\FM\Desktop\VIdeo test
2015-01-31 18:48 - 2015-01-31 18:48 - 00000000 ____D () C:\Users\FM\AppData\Local\Citrix
2015-01-31 18:45 - 2015-01-31 18:45 - 00000000 ____D () C:\ProgramData\Citrix
2015-01-31 18:45 - 2015-01-31 18:45 - 00000000 ____D () C:\Program Files\Citrix
2015-01-27 15:33 - 2015-01-27 15:33 - 00000000 ____D () C:\Users\FM\AppData\Roaming\JetBrains
2015-01-27 15:32 - 2015-01-27 15:32 - 00000000 ____D () C:\Users\FM\.PyCharm40
2015-01-27 15:31 - 2015-01-27 15:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2015-01-27 15:31 - 2015-01-27 15:31 - 00000000 ____D () C:\Program Files\JetBrains
2015-01-26 23:35 - 2015-01-26 23:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-01-26 11:19 - 2015-01-26 11:21 - 00000000 ____D () C:\Users\FM\Desktop\Fund. of Aerodynamics
2015-01-26 11:17 - 2015-01-26 11:21 - 00000000 ____D () C:\Users\FM\Desktop\PDE
2015-01-26 11:13 - 2015-01-26 11:14 - 00000000 ____D () C:\Users\FM\Desktop\AER-ASTRO Dynamics
2015-01-26 11:07 - 2015-01-26 11:07 - 00000000 __SHD () C:\Users\FM\AppData\Local\EmieUserList
2015-01-26 11:07 - 2015-01-26 11:07 - 00000000 __SHD () C:\Users\FM\AppData\Local\EmieSiteList
2015-01-26 11:07 - 2015-01-26 11:07 - 00000000 __SHD () C:\Users\FM\AppData\Local\EmieBrowserModeList
2015-01-23 12:13 - 2015-02-01 15:06 - 00000000 ____D () C:\ProgramData\Skype
2015-01-23 12:13 - 2015-02-01 15:05 - 00000000 ____D () C:\Users\FM\AppData\Roaming\Skype
2015-01-23 12:13 - 2015-01-23 12:13 - 00000000 ____D () C:\Users\FM\AppData\Local\Skype
2015-01-21 16:48 - 2015-01-21 16:51 - 21374488 _____ () C:\Users\FM\Desktop\ACFrOgA4hGjxZwEGSiMXYwQJIXiA2jI21ulaPsH6JsBc2v1133tRD6Ha5vyvMfncxFj28pfvbTbqS7XO3550WbgIQ0u2qOrXUuHVojZ4qItkIeKaHrvL20wLCfWV91c=

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 10:54 - 2012-03-29 16:17 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-13 10:48 - 2010-06-01 23:53 - 01595152 _____ () C:\Windows\WindowsUpdate.log
2015-02-13 10:17 - 2014-01-01 18:01 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2015-02-13 10:07 - 2009-07-13 21:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-13 10:07 - 2009-07-13 21:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-13 10:00 - 2010-07-14 21:00 - 00950390 _____ () C:\Windows\setupact.log
2015-02-13 10:00 - 2009-07-13 21:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-13 09:59 - 2010-07-17 21:42 - 00191482 _____ () C:\Windows\PFRO.log
2015-02-13 09:58 - 2014-01-17 23:59 - 00000000 ____D () C:\Users\FM\AppData\Local\CrashDumps
2015-02-13 01:14 - 2009-07-13 19:37 - 00000000 ____D () C:\Windows\rescache
2015-02-12 21:31 - 2010-08-01 00:07 - 00000000 ____D () C:\Program Files\Java
2015-02-12 15:17 - 2010-05-12 14:19 - 00796094 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-11 03:35 - 2009-07-13 21:33 - 00483200 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 03:15 - 2013-08-14 04:28 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 03:06 - 2010-07-20 00:04 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 03:04 - 2012-04-27 02:01 - 00002121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-02-11 03:04 - 2012-04-15 19:49 - 00001945 _____ () C:\Windows\epplauncher.mif
2015-02-11 03:03 - 2012-04-15 19:49 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-02-10 19:19 - 2009-07-13 19:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-02-09 20:59 - 2013-10-16 14:50 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-09 18:02 - 2014-09-01 16:26 - 00000000 ____D () C:\Users\FM\AppData\Local\Apps\2.0
2015-02-08 13:28 - 2013-12-30 11:28 - 00001064 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-02-08 12:22 - 2009-07-13 19:37 - 00000000 __RHD () C:\Users\Default
2015-02-08 12:22 - 2009-07-13 19:37 - 00000000 ___RD () C:\Users\Public
2015-02-08 12:17 - 2009-07-13 19:04 - 00000215 _____ () C:\Windows\system.ini
2015-02-08 12:14 - 2009-07-13 19:03 - 65273856 _____ () C:\Windows\system32\config\SOFTWARE.bak
2015-02-08 12:14 - 2009-07-13 19:03 - 17825792 _____ () C:\Windows\system32\config\SYSTEM.bak
2015-02-08 12:14 - 2009-07-13 19:03 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2015-02-08 12:14 - 2009-07-13 19:03 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2015-02-08 12:14 - 2009-07-13 19:03 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak
2015-02-07 18:39 - 2012-03-15 00:10 - 00000000 ____D () C:\Users\FM\.matplotlib
2015-02-07 18:37 - 2010-07-14 11:09 - 00000000 ____D () C:\Users\FM
2015-02-05 07:54 - 2012-03-29 16:17 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-05 07:54 - 2011-05-20 07:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-04 20:01 - 2014-11-21 07:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bridge Building Game
2015-02-04 19:59 - 2012-11-19 20:40 - 00000000 ____D () C:\Program Files\Google
2015-02-04 12:54 - 2014-09-06 18:30 - 00000000 ____D () C:\Users\FM\AppData\Roaming\vlc
2015-02-03 18:59 - 2010-08-29 16:26 - 00000000 ____D () C:\Users\FM\AppData\Local\Google
2015-02-02 19:37 - 2010-07-30 16:24 - 00002056 ____H () C:\Users\FM\Documents\Default.rdp
2015-02-02 19:16 - 2009-07-13 21:52 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-02-02 19:14 - 2010-09-26 23:24 - 00000000 ____D () C:\Users\FM\Documents\MATLAB
2015-02-01 05:15 - 2009-07-13 19:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-02-01 01:21 - 2012-04-24 17:48 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-02-01 01:07 - 2010-07-30 16:18 - 00000000 ____D () C:\Users\FM\AppData\Roaming\Juniper Networks
2015-02-01 01:07 - 2010-07-30 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Juniper Networks
2015-02-01 01:07 - 2010-07-30 16:18 - 00000000 ____D () C:\Program Files\Juniper Networks
2015-01-31 18:33 - 2010-07-14 11:21 - 00000000 ____D () C:\Users\FM\AppData\Roaming\Mozilla
2015-01-26 13:07 - 2010-07-17 12:08 - 00000000 ____D () C:\Users\FM\AppData\Local\CutePDF Writer
2015-01-26 11:22 - 2014-11-15 22:35 - 00000000 ____D () C:\Users\FM\Desktop\Galaxy Note II
2015-01-26 11:21 - 2014-05-15 12:36 - 00000000 ____D () C:\Users\FM\Desktop\Homework
2015-01-26 06:19 - 2014-11-13 19:20 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-01-26 06:19 - 2014-11-13 19:20 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-01-26 06:19 - 2014-11-13 19:20 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-01-16 06:28 - 2010-10-04 19:30 - 00000000 ____D () C:\ProgramData\Apple

==================== Files in the root of some directories =======

2015-02-12 19:32 - 2015-02-12 19:32 - 0000088 _____ () C:\Users\FM\AppData\Local\98024bdb50f33b66087ef5a55a879aed
2012-05-30 22:40 - 2012-05-30 22:40 - 0000095 _____ () C:\Users\FM\AppData\Local\fusioncache.dat
2013-10-10 05:11 - 2013-10-10 05:11 - 0002128 _____ () C:\Users\FM\AppData\Local\recently-used.xbel
2010-07-14 17:55 - 2014-10-25 17:49 - 0000952 ___SH () C:\ProgramData\KGyGaAvL.sys
2013-01-12 14:31 - 2013-01-12 14:31 - 0000147 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

 

 

Addition.txt

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2015
Ran by FM at 2015-02-13 11:11:57
Running from C:\Users\FM\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.15 beta (HKLM\...\7-Zip) (Version:  - )
Acer Crystal Eye webcam Ver:1.1.167.331 (HKLM\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.167.331 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3004 - Acer Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advanced Port Scanner v1.3 (HKLM\...\Advanced Port Scanner v1.3) (Version:  - )
Alcor Micro USB Card Reader (HKLM\...\InstallShield_{BC15023B-48DB-4F71-9C25-CFE1A8BB7202}) (Version: 1.7.17.06011 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (Version: 1.7.17.06011 - Alcor Micro Corp.) Hidden
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Aptana Studio 3 (HKLM\...\Aptana Studio 3) (Version: 3.3.3 - Appcelerator, Inc.)
AutoCAD 2013 - English (HKLM\...\AutoCAD 2013 - English) (Version: 19.0.55.0 - Autodesk)
AutoCAD 2013 - English (Version: 19.0.55.0 - Autodesk) Hidden
AutoCAD 2013 Language Pack - English (Version: 19.0.55.0 - Autodesk) Hidden
Autodesk Content Service (HKLM\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Inventor Fusion 2013 (HKLM\...\Autodesk Inventor Fusion 2013) (Version: 2.0.0.206 - Autodesk, Inc.)
Autodesk Inventor Fusion 2013 (Version: 2.0.0.206 - Autodesk, Inc.) Hidden
Autodesk Inventor Fusion plug-in for AutoCAD 2013 (HKLM\...\Autodesk Inventor Fusion plug-in for AutoCAD 2013) (Version: 0.2.0.230 - Autodesk)
Autodesk Inventor Fusion plug-in for AutoCAD 2013 (Version: 0.2.0.230 - Autodesk) Hidden
Autodesk Inventor Fusion plug-in language pack for AutoCAD 2013 (Version: 0.2.0.230 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
Bluetooth Win7 Suite (HKLM\...\{101A497C-7EF6-4001-834D-E5FA1C70FEFA}) (Version: 7.2.0.56 - Atheros Communications)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Gigabit Integrated Controller (HKLM\...\{F26DE123-C491-4D8C-BC86-FDF604F00226}) (Version: 14.0.2.2 - Broadcom Corporation)
Brother HL-2140 (HKLM\...\{89838D79-2A76-4BCF-BB91-E2D55719024A}) (Version: 1.00 - Brother)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.5.2256 - CDBurnerXP)
CDex - Open Source Digital Audio CD Extractor (HKLM\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Citrix Access Gateway Endpoint Analysis (HKLM\...\{28D26AB9-C282-44E3-ACD7-4013B9DD3A06}) (Version: 10.1.122.1708 - Citrix Systems, Inc.)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version:  - DownloadHelper)
CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version:  - )
EES - Engineering Equation Solver (DEMO) (HKLM\...\EES - Engineering Equation Solver (DEMO)) (Version:  - F-Chart Software)
FARO LS 1.1.406.58 (HKLM\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production)
Garmin ANT Agent (HKLM\...\{A59DAA2A-6559-4D09-925A-9CCF5526D911}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Talk Plugin (HKLM\...\{C77CC230-7417-3F01-B70D-52583DC9FEC9}) (Version: 5.40.2.0 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
HandBrake 0.9.6 (HKLM\...\HandBrake) (Version: 0.9.6 - )
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.4.63 - Conexant Systems)
HxD Hex Editor version 1.7.7.0 (HKLM\...\HxD Hex Editor_is1) (Version: 1.7.7.0 - Maël Hörz)
Intel® Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)
Intel® Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel® Turbo Boost Technology Monitor (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
InterVideo WinDVD 8 (HKLM\...\InstallShield_{5FEBF468-5AC2-4C66-AD80-DF85C085AA73}) (Version: 8.5.10.75 - InterVideo Inc.)
InterVideo WinDVD 8 (Version: 8.5.10.75 - InterVideo Inc.) Hidden
JetBrains PyCharm Community Edition 4.0.4 (HKLM\...\PyCharm Community Edition 4.0.4) (Version: 139.1001 - JetBrains s.r.o.)
Juniper Networks Network Connect 6.5.0 (HKLM\...\Juniper Network Connect 6.5.0) (Version: 6.5.0.16339 - Juniper Networks)
Juniper Networks Network Connect 7.1.0 (HKLM\...\Juniper Network Connect 7.1.0) (Version: 7.1.0.20169 - Juniper Networks)
Juniper Networks Network Connect 7.4.0 (HKLM\...\Juniper Network Connect 7.4.0) (Version: 7.4.0.30599 - Juniper Networks)
Juniper Networks Network Connect 8.0 (HKLM\...\Juniper Network Connect 8.0) (Version: 8.0.6.32195 - Juniper Networks)
Juniper Networks Setup Client (HKU\S-1-5-21-672566934-3909434764-2333441952-1003\...\Juniper_Setup_Client) (Version: 8.0.6.48695 - Juniper Networks)
Juniper Networks Setup Client Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks)
K-Lite Codec Pack 6.3.0 (Full) (HKLM\...\KLiteCodecPack_is1) (Version: 6.3.0 - )
Launch Manager (HKLM\...\LManager) (Version: 4.0.8 - Acer Inc.)
Livescribe Connect (HKLM\...\com.livescribe.LivescribeConnect) (Version: 1.2.1.58498 - Livescribe Inc)
Livescribe Connect (Version: 1.2.1 - Livescribe Inc) Hidden
Livescribe Desktop (HKLM\...\Livescribe Desktop 2.8.3) (Version: 2.8.3 - Livescribe Inc)
LyX 2.0.0-3 (HKLM\...\LyX20) (Version: 2.0.0-3 - LyX Team)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MATLAB R2010a (HKLM\...\MatlabR2010a) (Version: 7.10 - The MathWorks, Inc.)
Media Player Classic - Home Cinema v. 1.3.1249.0 (HKLM\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version:  - )
Menschen A1 Lerner-DVD-ROM zum Kursbuch (HKLM\...\de.hueber.menschena1izu) (Version: 1.0 - Hueber Verlag GmbH & Co KG)
Menschen A1 Lerner-DVD-ROM zum Kursbuch (Version: 1.0 - Hueber Verlag GmbH & Co KG) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM\...\{90A40409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Standard Edition 2003 (HKLM\...\{91120409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Music Manager (HKU\S-1-5-21-672566934-3909434764-2333441952-1003\...\MusicManager) (Version:  - Google, Inc.)
Notepad++ (HKLM\...\Notepad++) (Version: 6.3.3 - Notepad++ Team)
NVIDIA PhysX v8.10.29 (HKLM\...\{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}) (Version: 8.10.29 - NVIDIA Corporation)
Octoshape add-in for Adobe Flash Player (HKU\S-1-5-21-672566934-3909434764-2333441952-1003\...\Octoshape add-in for Adobe Flash Player) (Version:  - )
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
ooVoo (HKLM\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.5.6046 - ooVoo LLC.)
Optical Drive Power Management (HKLM\...\{AE09C972-EEB2-4DA5-8090-0FCF54576854}) (Version: 1.01.3007 - Acer Incorporated)
PyQt GPL v4.9.6 for Python v2.7 (x32) (HKLM\...\PyQt GPL v4.9.6 for Python v2.7 (x32)) (Version: 4.9.6-1 - )
Python 2.7 distribute-0.6.35 (HKLM\...\distribute-py2.7) (Version:  - )
Python 2.7 ipython-0.13.1 (HKLM\...\ipython-py2.7) (Version:  - )
Python 2.7 matplotlib-1.2.1 (HKLM\...\matplotlib-py2.7) (Version:  - )
Python 2.7 numpy-1.7.1rc1 (HKLM\...\numpy-py2.7) (Version:  - )
Python 2.7 pygame-1.9.2pre (HKLM\...\pygame-py2.7) (Version:  - )
Python 2.7 pyglet-1.2alpha1 (HKLM\...\pyglet-py2.7) (Version:  - )
Python 2.7 Pygments-1.6 (HKLM\...\Pygments-py2.7) (Version:  - )
Python 2.7 pyreadline-1.7.1 (HKLM\...\pyreadline-py2.7) (Version:  - )
Python 2.7 PyWavelets-0.2.2 (HKLM\...\PyWavelets-py2.7) (Version:  - )
Python 2.7 pyzmq-13.0.2 (HKLM\...\pyzmq-py2.7) (Version:  - )
Python 2.7 scikit-learn-0.13.1 (HKLM\...\scikit-learn-py2.7) (Version:  - )
Python 2.7 scipy-0.11.0 (HKLM\...\scipy-py2.7) (Version:  - )
Python 2.7 Spyder 2.1.13.1 (HKLM\...\spyder-py2.7) (Version:  - )
Python 2.7 tornado-2.4.1 (HKLM\...\tornado-py2.7) (Version:  - )
Python 2.7.3 (HKLM\...\{C0C31BCC-56FB-42a7-8766-D29E1BD74C7C}) (Version: 2.7.3150 - Python Software Foundation)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.14.0 - SAMSUNG Electronics Co., Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.12.0 - Synaptics Incorporated)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6000 - Broadcom Corporation)
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinPcap 4.1.2 (HKLM\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\FM\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Users\FM\AppData\Local\Google\Google Talk Plugin\googletalkax.dll (Google)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2013\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Users\FM\AppData\Local\Google\Google Talk Plugin\o1dax.dll (Google)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{BD0DEB94-63DB-4392-9420-6EEE05094B1F}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2013\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2013\en-US\acadficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-672566934-3909434764-2333441952-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\psuser.dll (Google Inc.)

==================== Restore Points  =========================

11-02-2015 03:00:28 Windows Update
12-02-2015 03:00:24 Windows Update
12-02-2015 21:30:52 Removed Java 8 Update 31
13-02-2015 10:40:19 Removed Windows Media Player Firefox Plugin

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:04 - 2015-02-08 12:17 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {07C09548-CA3B-4C6F-AC84-8DBAFCB876B2} - System32\Tasks\{6898B452-0E0C-4F2F-9A62-9474F9FED163} => Firefox.exe http://ui.skype.com/ui/0/7.0.0.102/en/abandoninstall?source=lightinstaller&page=tsPlugin
Task: {2070B0AD-E6BA-4B89-A5A8-8EC47C9BA70A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {3C357655-5328-49D0-9861-F199674923AB} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-13] (Microsoft Corporation)
Task: {4CA2868D-F6DB-4A44-B47F-C68F0C06FF81} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-672566934-3909434764-2333441952-1003Core => C:\Users\FM\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-13] (Google Inc.)
Task: {529FC23D-48E4-4461-B260-7BDF3CA1A811} - System32\Tasks\{6481027B-519D-4557-9E39-19B558DE25D5} => pcalua.exe -a C:\Users\FM\Desktop\jre-6u26-windows-i586-iftw.exe -d C:\Windows\system32
Task: {7AC61641-2D62-4B16-88DB-9AAC38117411} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-672566934-3909434764-2333441952-1003UA => C:\Users\FM\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-13] (Google Inc.)
Task: {BF748091-7766-4B91-B47C-F59C4F0D6137} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {F909D86B-9F21-418D-AE10-3B76F35F4AFA} - System32\Tasks\{A38CC1DB-2E69-4998-8975-692DD1A29334} => pcalua.exe -a "C:\Program Files\Steam\steam.exe" -c steam://uninstall/39000

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2010-07-17 12:08 - 2009-11-05 07:39 - 00087552 _____ () C:\Windows\System32\cpwmon2k.dll
2010-07-14 19:54 - 2010-03-04 22:38 - 00071096 _____ () C:\Program Files\CDBurnerXP\NMSAccessU.exe
2011-10-27 15:56 - 2011-10-27 15:56 - 00276992 _____ () C:\Program Files\Common Files\Livescribe\PenComm\PenCommSdk.dll
2015-02-13 10:00 - 2015-02-13 10:00 - 00005632 _____ () C:\Users\FM\AppData\Local\Temp\stt9EDD.tmp
2010-06-25 08:18 - 2010-06-25 08:18 - 00132384 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2010-05-12 15:05 - 2009-05-19 23:02 - 00072200 _____ () C:\Program Files\Launch Manager\CdDirIo.dll
2010-06-01 23:58 - 2010-06-01 23:58 - 00206208 _____ () C:\Windows\PLFSetI.exe
2010-07-14 19:33 - 2010-03-20 16:44 - 00069632 _____ () C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe
2015-01-26 23:35 - 2015-01-26 23:35 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2015-02-05 07:54 - 2015-02-05 07:54 - 16852144 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\21831643.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\84047096.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\21831643.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\84047096.sys => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-672566934-3909434764-2333441952-1003\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1 - 205.171.3.25

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-672566934-3909434764-2333441952-500 - Administrator - Disabled)
ASPNET (S-1-5-21-672566934-3909434764-2333441952-1005 - Limited - Enabled)
FM (S-1-5-21-672566934-3909434764-2333441952-1003 - Administrator - Enabled) => C:\Users\FM
Guest (S-1-5-21-672566934-3909434764-2333441952-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Fingerprint Reader
Description: Fingerprint Reader
Class Guid: {a8e6a1b0-bce2-11dc-95ff-0800200c9a66}
Manufacturer: EgisTec
Service: FPSensor
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/13/2015 10:17:51 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24523

Error: (02/13/2015 10:17:51 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24523

Error: (02/13/2015 10:17:51 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2015 10:17:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 23525

Error: (02/13/2015 10:17:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 23525

Error: (02/13/2015 10:17:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2015 10:17:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 22495

Error: (02/13/2015 10:17:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 22495

Error: (02/13/2015 10:17:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2015 10:17:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8252


System errors:
=============
Error: (02/13/2015 10:00:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys) service failed to start due to the following error:
%%1058

Error: (02/13/2015 09:58:00 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/13/2015 03:49:06 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.

Error: (02/13/2015 00:33:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys) service failed to start due to the following error:
%%1058

Error: (02/13/2015 00:31:59 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/13/2015 00:15:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TeamViewer9 service.

Error: (02/12/2015 09:16:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys) service failed to start due to the following error:
%%1058

Error: (02/12/2015 08:54:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys) service failed to start due to the following error:
%%1058


Microsoft Office Sessions:
=========================
Error: (02/13/2015 10:17:51 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24523

Error: (02/13/2015 10:17:51 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24523

Error: (02/13/2015 10:17:51 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2015 10:17:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 23525

Error: (02/13/2015 10:17:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 23525

Error: (02/13/2015 10:17:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2015 10:17:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 22495

Error: (02/13/2015 10:17:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 22495

Error: (02/13/2015 10:17:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/13/2015 10:17:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8252


CodeIntegrity Errors:
===================================
  Date: 2012-06-09 01:09:04.029
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CX32HP25.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-06-09 01:05:16.853
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\CX32HP25.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core™ i7 CPU M 620 @ 2.67GHz
Percentage of memory in use: 67%
Total physical RAM: 2356.49 MB
Available physical RAM: 756.85 MB
Total Pagefile: 4711.27 MB
Available Pagefile: 2482.73 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.57 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:452.66 GB) (Free:53.97 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 820131F1)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

Advanced Thanks

tfm



#4 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 13 February 2015 - 01:30 PM

Hi,

Step 1

Please download TDSStdsskiller.pngiller and save it to your Desktop.
  • Start tdsskiller.exe with administrator privileges.
  • Accept the EULA and the KSN Statement.
  • Click on Change parameters. (1)
  • Make sure that all available options (except "Loaded modules") are checked and click OK. (2)
  • Click on Start scan.
  • If any threats are found don't delete them but choose the Skip option for all of them.
  • Click on Report (3) to open the log file. (It is also saved at C:\TDSSKiller.<version_date_time>_log.txt).
    Copy and paste its contents in your next reply.
tdss.gif
regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#5 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 13 February 2015 - 01:37 PM

step 1:

 

 

11:32:32.0104 0x0d1c  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
11:32:38.0964 0x0d1c  ============================================================
11:32:38.0964 0x0d1c  Current date / time: 2015/02/13 11:32:38.0964
11:32:38.0964 0x0d1c  SystemInfo:
11:32:38.0964 0x0d1c  
11:32:38.0964 0x0d1c  OS Version: 6.1.7601 ServicePack: 1.0
11:32:38.0964 0x0d1c  Product type: Workstation
11:32:38.0964 0x0d1c  ComputerName: FM-PC
11:32:38.0964 0x0d1c  UserName: FM
11:32:38.0964 0x0d1c  Windows directory: C:\Windows
11:32:38.0964 0x0d1c  System windows directory: C:\Windows
11:32:38.0965 0x0d1c  Processor architecture: Intel x86
11:32:38.0965 0x0d1c  Number of processors: 4
11:32:38.0965 0x0d1c  Page size: 0x1000
11:32:38.0965 0x0d1c  Boot type: Normal boot
11:32:38.0965 0x0d1c  ============================================================
11:32:40.0700 0x0d1c  KLMD registered as C:\Windows\system32\drivers\95487974.sys
11:32:41.0342 0x0d1c  System UUID: {EF986946-5EC7-7F4C-5412-D63FE546737A}
11:32:42.0100 0x0d1c  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
11:32:42.0103 0x0d1c  ============================================================
11:32:42.0103 0x0d1c  \Device\Harddisk0\DR0:
11:32:42.0103 0x0d1c  MBR partitions:
11:32:42.0103 0x0d1c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1A00800, BlocksNum 0x32000
11:32:42.0103 0x0d1c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1A32800, BlocksNum 0x38953000
11:32:42.0103 0x0d1c  ============================================================
11:32:42.0127 0x0d1c  C: <-> \Device\Harddisk0\DR0\Partition2
11:32:42.0128 0x0d1c  ============================================================
11:32:42.0128 0x0d1c  Initialize success
11:32:42.0128 0x0d1c  ============================================================
11:32:50.0010 0x14d4  ============================================================
11:32:50.0010 0x14d4  Scan started
11:32:50.0010 0x14d4  Mode: Manual; SigCheck; TDLFS;
11:32:50.0010 0x14d4  ============================================================
11:32:50.0010 0x14d4  KSN ping started
11:32:53.0388 0x14d4  KSN ping finished: true
11:32:54.0325 0x14d4  ================ Scan system memory ========================
11:32:54.0326 0x14d4  System memory - ok
11:32:54.0326 0x14d4  ================ Scan services =============================
11:32:54.0499 0x14d4  [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
11:32:54.0560 0x14d4  1394ohci - ok
11:32:54.0632 0x14d4  [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI            C:\Windows\system32\drivers\ACPI.sys
11:32:54.0652 0x14d4  ACPI - ok
11:32:54.0667 0x14d4  [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
11:32:54.0686 0x14d4  AcpiPmi - ok
11:32:54.0800 0x14d4  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
11:32:54.0813 0x14d4  AdobeARMservice - ok
11:32:54.0925 0x14d4  [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:32:54.0941 0x14d4  AdobeFlashPlayerUpdateSvc - ok
11:32:55.0019 0x14d4  [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
11:32:55.0043 0x14d4  adp94xx - ok
11:32:55.0125 0x14d4  [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
11:32:55.0144 0x14d4  adpahci - ok
11:32:55.0154 0x14d4  [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
11:32:55.0170 0x14d4  adpu320 - ok
11:32:55.0189 0x14d4  [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
11:32:55.0203 0x14d4  AeLookupSvc - ok
11:32:55.0281 0x14d4  [ D0B388DA1D111A34366E04EB4A5DD156, 60D226F027F4025CC032CAFF73A80FAFB5FA75445654FDCF80CA8C0419C6E938 ] AFD             C:\Windows\system32\drivers\afd.sys
11:32:55.0316 0x14d4  AFD - ok
11:32:55.0369 0x14d4  [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440          C:\Windows\system32\drivers\agp440.sys
11:32:55.0381 0x14d4  agp440 - ok
11:32:55.0393 0x14d4  [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx         C:\Windows\system32\DRIVERS\djsvs.sys
11:32:55.0406 0x14d4  aic78xx - ok
11:32:55.0429 0x14d4  [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG             C:\Windows\System32\alg.exe
11:32:55.0444 0x14d4  ALG - ok
11:32:55.0496 0x14d4  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide          C:\Windows\system32\drivers\aliide.sys
11:32:55.0505 0x14d4  aliide - ok
11:32:55.0521 0x14d4  [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
11:32:55.0534 0x14d4  amdagp - ok
11:32:55.0580 0x14d4  [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide          C:\Windows\system32\drivers\amdide.sys
11:32:55.0591 0x14d4  amdide - ok
11:32:55.0636 0x14d4  [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
11:32:55.0650 0x14d4  AmdK8 - ok
11:32:55.0665 0x14d4  [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
11:32:55.0678 0x14d4  AmdPPM - ok
11:32:55.0743 0x14d4  [ D320BF87125326F996D4904FE24300FC, F767D8C5C58D57202905D829F7AE1B1FF33937F407FDCE4C90E32A6638F27416 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
11:32:55.0758 0x14d4  amdsata - ok
11:32:55.0782 0x14d4  [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
11:32:55.0797 0x14d4  amdsbs - ok
11:32:55.0851 0x14d4  [ 46387FB17B086D16DEA267D5BE23A2F2, 8B8AC61B91F154B4EB5CC6DECB5FCCEBA8B42EFE94859947136AD06681EA8ED0 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
11:32:55.0865 0x14d4  amdxata - ok
11:32:55.0891 0x14d4  [ 3BB8A4DCA55F3EC1579B72EB91DA7EBA, 6E51C382CF1953C4B5E8DEFB0198AA2DDC59034EA879DBFA919670E14D34BFA3 ] AmUStor         C:\Windows\system32\drivers\AmUStor.SYS
11:32:55.0913 0x14d4  AmUStor - ok
11:32:55.0978 0x14d4  [ AEA177F783E20150ACE5383EE368DA19, 8FA9EE27AA1F22E8B8FE33A21028CA1E0062BAA95CB132C20D55B98C03B4254F ] AppID           C:\Windows\system32\drivers\appid.sys
11:32:56.0021 0x14d4  AppID - ok
11:32:56.0052 0x14d4  [ 62A9C86CB6085E20DB4823E4E97826F5, E0F840B49710022C4FB437002AD06F64B0F6B5D628B32D00F2B66765E6B97E4B ] AppIDSvc        C:\Windows\System32\appidsvc.dll
11:32:56.0080 0x14d4  AppIDSvc - ok
11:32:56.0138 0x14d4  [ EACFDF31921F51C097629F1F3C9129B4, 24138755D823E69760579ECBD672421192457CDC9941B2BC499C2D34D83E86C3 ] Appinfo         C:\Windows\System32\appinfo.dll
11:32:56.0151 0x14d4  Appinfo - ok
11:32:56.0175 0x14d4  [ A45D184DF6A8803DA13A0B329517A64A, C1D16B60A6D69689AE951DC3D6884ED2E233D144B3FC0B86BC1C50AAAAA01ED2 ] AppMgmt         C:\Windows\System32\appmgmts.dll
11:32:56.0191 0x14d4  AppMgmt - ok
11:32:56.0227 0x14d4  [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc             C:\Windows\system32\DRIVERS\arc.sys
11:32:56.0238 0x14d4  arc - ok
11:32:56.0261 0x14d4  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
11:32:56.0273 0x14d4  arcsas - ok
11:32:56.0409 0x14d4  [ 537B2948976F5D9B5767B74A63EBB395, 1A14F8B582E74AD15B612EDA5B707AA3CB0B2A107ED14572B4232EAA7383B634 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
11:32:56.0423 0x14d4  aspnet_state - ok
11:32:56.0444 0x14d4  [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
11:32:56.0470 0x14d4  AsyncMac - ok
11:32:56.0515 0x14d4  [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi           C:\Windows\system32\drivers\atapi.sys
11:32:56.0527 0x14d4  atapi - ok
11:32:56.0580 0x14d4  [ 882EDBAFCC227852C9DCA23EA48D2E78, 309E4247EC236F2488E86B38EBA2995518ECFDC5916FBB6CF5054073C3010A1B ] AthBTPort       C:\Windows\system32\DRIVERS\btath_flt.sys
11:32:56.0586 0x14d4  AthBTPort - detected UnsignedFile.Multi.Generic ( 1 )
11:33:00.0861 0x14d4  Detect skipped due to KSN trusted
11:33:00.0861 0x14d4  AthBTPort - ok
11:33:00.0972 0x14d4  [ E8AFE198280594A12765870954186936, 1B8CC0A017BA119192F3C9AB9C98F6057A61A6243567EFD949255630C1CE7604 ] AtherosSvc      C:\Program Files\Bluetooth Suite\adminservice.exe
11:33:00.0984 0x14d4  AtherosSvc - detected UnsignedFile.Multi.Generic ( 1 )
11:33:04.0601 0x14d4  Detect skipped due to KSN trusted
11:33:04.0602 0x14d4  AtherosSvc - ok
11:33:04.0682 0x14d4  [ F4157B3CECF19B1C266C83AFF051C97A, 26728B59B6003EB36BC322D189254574E94790CE23637228A669FAD6ED76ECE3 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:33:04.0719 0x14d4  AudioEndpointBuilder - ok
11:33:04.0734 0x14d4  [ F4157B3CECF19B1C266C83AFF051C97A, 26728B59B6003EB36BC322D189254574E94790CE23637228A669FAD6ED76ECE3 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
11:33:04.0766 0x14d4  Audiosrv - ok
11:33:04.0925 0x14d4  [ F431DC5D94F4B2FDBC927655D8A9B10E, FA16A95E5B83D08F0FD76FDAB03FC7CD4B6917BFE15F2F1D9F3B781F6A1888D8 ] Autodesk Content Service C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
11:33:04.0935 0x14d4  Autodesk Content Service - ok
11:33:04.0995 0x14d4  [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV        C:\Windows\System32\AxInstSV.dll
11:33:05.0013 0x14d4  AxInstSV - ok
11:33:05.0062 0x14d4  [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbdx.sys
11:33:05.0085 0x14d4  b06bdrv - ok
11:33:05.0131 0x14d4  [ 3D3F40545C81032297625655CAD40963, C33AF3DCD333EC83AFF6D7AE2C820977EF1B1EDA36996BA8B49EE465DE69D6A7 ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
11:33:05.0164 0x14d4  b57nd60x - ok
11:33:05.0302 0x14d4  [ F4D388DC3FF004AEE886762D5CEC7783, 5F667C60E083DC8565753B5AEE96F99F99B583D9A038DE4C95FA5874EFEEE9D5 ] BCM43XX         C:\Windows\system32\DRIVERS\bcmwl6.sys
11:33:05.0408 0x14d4  BCM43XX - ok
11:33:05.0449 0x14d4  [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC          C:\Windows\System32\bdesvc.dll
11:33:05.0461 0x14d4  BDESVC - ok
11:33:05.0490 0x14d4  [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep            C:\Windows\system32\drivers\Beep.sys
11:33:05.0516 0x14d4  Beep - ok
11:33:05.0590 0x14d4  [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE             C:\Windows\System32\bfe.dll
11:33:05.0620 0x14d4  BFE - ok
11:33:05.0692 0x14d4  [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS            C:\Windows\system32\qmgr.dll
11:33:05.0736 0x14d4  BITS - ok
11:33:05.0750 0x14d4  [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
11:33:05.0764 0x14d4  blbdrive - ok
11:33:05.0870 0x14d4  [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A, 10F21999FF6B1D410EBF280F7F27DEACA5289739CF12F4293B614B8FC6C88DCC ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
11:33:05.0889 0x14d4  Bonjour Service - ok
11:33:05.0942 0x14d4  [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
11:33:05.0969 0x14d4  bowser - ok
11:33:05.0989 0x14d4  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
11:33:06.0023 0x14d4  BrFiltLo - ok
11:33:06.0047 0x14d4  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
11:33:06.0065 0x14d4  BrFiltUp - ok
11:33:06.0081 0x14d4  [ 77361D72A04F18809D0EFB6CCEB74D4B, 55E7DB65BB29FF421F138CDFF05E5ECFFC7C8862FAA68F6179A3BA9D6B69AE64 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
11:33:06.0109 0x14d4  BridgeMP - ok
11:33:06.0159 0x14d4  [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser         C:\Windows\System32\browser.dll
11:33:06.0171 0x14d4  Browser - ok
11:33:06.0195 0x14d4  [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
11:33:06.0214 0x14d4  Brserid - ok
11:33:06.0231 0x14d4  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
11:33:06.0246 0x14d4  BrSerWdm - ok
11:33:06.0259 0x14d4  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
11:33:06.0271 0x14d4  BrUsbMdm - ok
11:33:06.0286 0x14d4  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
11:33:06.0300 0x14d4  BrUsbSer - ok
11:33:06.0366 0x14d4  [ D57BC943ED4EF85A51165F408E4C15A7, 095C7200E8F5EEAEB0C11396901F46C908F2CA3360F62918410E5B7F3F210B74 ] BTATH_A2DP      C:\Windows\system32\drivers\btath_a2dp.sys
11:33:06.0382 0x14d4  BTATH_A2DP - ok
11:33:06.0437 0x14d4  [ F60E0C722442EA91F0C253B7814D8192, FCD383C9DD38B57FADB8EC5F915D8040E6B116E59DC062BD3600C7BED4039F21 ] BTATH_BUS       C:\Windows\system32\DRIVERS\btath_bus.sys
11:33:06.0447 0x14d4  BTATH_BUS - ok
11:33:06.0473 0x14d4  [ F31E369DB8258B28E3DCF66705AEA9E9, 75D653846A66D082B1F2235474FA0D206E50DFA6C1537FDFB64890A3945FB740 ] BTATH_HCRP      C:\Windows\system32\DRIVERS\btath_hcrp.sys
11:33:06.0498 0x14d4  BTATH_HCRP - ok
11:33:06.0509 0x14d4  [ 6651798266FDE23159D961463A63A77D, 636E4DA3122282CC37B92AA67A3B392012B57F4BDFC91AE655CD6978B8E60D22 ] BTATH_LWFLT     C:\Windows\system32\DRIVERS\btath_lwflt.sys
11:33:06.0521 0x14d4  BTATH_LWFLT - ok
11:33:06.0580 0x14d4  [ 08EF5298DF80BC136523BCD2ED8B9C37, 0970A24DB16160F8BF30AF2FFC4A98A2676619A0ABDC36FCF16BE74291A4E206 ] BTATH_RCP       C:\Windows\system32\DRIVERS\btath_rcp.sys
11:33:06.0595 0x14d4  BTATH_RCP - ok
11:33:06.0669 0x14d4  [ 2865A5C8E98C70C605F417908CEBB3A4, B1C5AC228BD7072AF8668C009C6CDC13EE9FCB9481F57524300F37C40BF1E935 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys
11:33:06.0681 0x14d4  BthEnum - ok
11:33:06.0696 0x14d4  [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
11:33:06.0708 0x14d4  BTHMODEM - ok
11:33:06.0732 0x14d4  [ AD1872E5829E8A2C3B5B4B641C3EAB0E, 8C2DBCAC08DDB41E2B44E257C55FA2D0272959B308EFF9EAF5FF9AE1E4A0AA39 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
11:33:06.0747 0x14d4  BthPan - ok
11:33:06.0777 0x14d4  [ 1153DE2E4F5941E10C399CB5592F78A1, 2B88AF246D62F72FA9F5B921B0375AE59A0F263672472D5EC9FDB5CA5EF51C31 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
11:33:06.0800 0x14d4  BTHPORT - ok
11:33:06.0830 0x14d4  [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv         C:\Windows\system32\bthserv.dll
11:33:06.0860 0x14d4  bthserv - ok
11:33:06.0881 0x14d4  [ C81E9413A25A439F436B1D4B6A0CF9E9, A4C290163207AED22C70C7F90B28F6FC24892889643D60D915059405AC5A4A72 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
11:33:06.0894 0x14d4  BTHUSB - ok
11:33:06.0961 0x14d4  [ F8B15E764C1F6E3810BC809EAED97714, 679838C3F119A41E9D0C1624730CB5A7B7060C459E1295EDEE5933FE67128886 ] btwampfl        C:\Windows\system32\drivers\btwampfl.sys
11:33:06.0975 0x14d4  btwampfl - ok
11:33:07.0021 0x14d4  [ 772994C15198818FEE2314364CD12EE9, B08D4D7B0C4D0FEEA7D6F6D102785A23CF761A12391A4EFC320B1AEEA40F1CD7 ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys
11:33:07.0033 0x14d4  btwaudio - ok
11:33:07.0068 0x14d4  [ F6A04B6E929C4D57906C76E92025D31C, 5C530B60F8ED24F8CF20C79833AFB51669722E395B2F3D6CD7A3B0109BB28AA5 ] btwavdt         C:\Windows\system32\drivers\btwavdt.sys
11:33:07.0078 0x14d4  btwavdt - ok
11:33:07.0157 0x14d4  [ 99A2148D4B09F60A5F8854104ED2D45C, D0C17E175AAA18C03F9A24B9CDCD587F819A7BD7D39C0DF76F34F70B58A94D81 ] btwdins         C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
11:33:07.0184 0x14d4  btwdins - ok
11:33:07.0195 0x14d4  [ DE53089F0678CB5F0AFEB867ACB0FB05, 62AE8B22A96B8D22A5A843C855956423BF2281339C2D921A4650F318D6AEA783 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys
11:33:07.0204 0x14d4  btwl2cap - ok
11:33:07.0211 0x14d4  [ BCCBC07CD5CF37F53155C31C434B4A0E, BAC35F64CC10BBC50A8035217C67702BE16897CB0FAAF8474EAAB92C60CA0B50 ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys
11:33:07.0219 0x14d4  btwrchid - ok
11:33:07.0245 0x14d4  [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
11:33:07.0272 0x14d4  cdfs - ok
11:33:07.0337 0x14d4  [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom           C:\Windows\system32\drivers\cdrom.sys
11:33:07.0353 0x14d4  cdrom - ok
11:33:07.0415 0x14d4  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc     C:\Windows\System32\certprop.dll
11:33:07.0444 0x14d4  CertPropSvc - ok
11:33:07.0470 0x14d4  [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
11:33:07.0485 0x14d4  circlass - ok
11:33:07.0505 0x14d4  [ 635181E0E9BBF16871BF5380D71DB02D, 58D5150C6F3B9F1730FFDF3A8A2ABF5FF207F9785BD66C0C1E03A0F1C223A26A ] CLFS            C:\Windows\system32\CLFS.sys
11:33:07.0524 0x14d4  CLFS - ok
11:33:07.0599 0x14d4  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:33:07.0615 0x14d4  clr_optimization_v2.0.50727_32 - ok
11:33:07.0683 0x14d4  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:33:07.0704 0x14d4  clr_optimization_v4.0.30319_32 - ok
11:33:07.0713 0x14d4  [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
11:33:07.0725 0x14d4  CmBatt - ok
11:33:07.0774 0x14d4  [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
11:33:07.0785 0x14d4  cmdide - ok
11:33:07.0851 0x14d4  [ F516F1167EFBBC5ABC90687C94497869, AD650D56241533439419EA00236ABE14AB6E50B768620211D1A44047A9FA14EC ] CNG             C:\Windows\system32\Drivers\cng.sys
11:33:07.0876 0x14d4  CNG - ok
11:33:07.0899 0x14d4  [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
11:33:07.0910 0x14d4  Compbatt - ok
11:33:07.0965 0x14d4  [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
11:33:07.0979 0x14d4  CompositeBus - ok
11:33:07.0992 0x14d4  COMSysApp - ok
11:33:08.0017 0x14d4  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
11:33:08.0029 0x14d4  crcdisk - ok
11:33:08.0085 0x14d4  [ 623E143F2DF17C0106A9988F5D7DC878, 9DA30262FF22FA9F1DB247CB3B4A2892D79730EF0ECC9589D399D24B4F58E565 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
11:33:08.0102 0x14d4  CryptSvc - ok
11:33:08.0164 0x14d4  [ 3C2177A897B4CA2788C6FB0C3FD81D4B, 98575CBD0664586E6211D02E71BDD52CBAA149A1658573550E29E74E5F7B1553 ] CSC             C:\Windows\system32\drivers\csc.sys
11:33:08.0190 0x14d4  CSC - ok
11:33:08.0230 0x14d4  [ 15F93B37F6801943360D9EB42485D5D3, DD6838C6496CB15F8BB57A6596F6A64ADD9C36B09F062295699131232712B558 ] CscService      C:\Windows\System32\cscsvc.dll
11:33:08.0264 0x14d4  CscService - ok
11:33:08.0281 0x14d4  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch      C:\Windows\system32\rpcss.dll
11:33:08.0321 0x14d4  DcomLaunch - ok
11:33:08.0342 0x14d4  [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc       C:\Windows\System32\defragsvc.dll
11:33:08.0376 0x14d4  defragsvc - ok
11:33:08.0427 0x14d4  [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
11:33:08.0453 0x14d4  DfsC - ok
11:33:08.0521 0x14d4  [ EDF7F8387C2072205ABCF105F14B13B4, 602BC006AFE088FFCD0B26DF39F184AC351E62C8214036E7086C120CD41CC014 ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys
11:33:08.0532 0x14d4  dg_ssudbus - ok
11:33:08.0605 0x14d4  [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp            C:\Windows\system32\dhcpcore.dll
11:33:08.0623 0x14d4  Dhcp - ok
11:33:08.0646 0x14d4  [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache        C:\Windows\system32\drivers\discache.sys
11:33:08.0672 0x14d4  discache - ok
11:33:08.0703 0x14d4  [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
11:33:08.0715 0x14d4  Disk - ok
11:33:08.0766 0x14d4  [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache        C:\Windows\System32\dnsrslvr.dll
11:33:08.0781 0x14d4  Dnscache - ok
11:33:08.0840 0x14d4  [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc         C:\Windows\System32\dot3svc.dll
11:33:08.0873 0x14d4  dot3svc - ok
11:33:08.0902 0x14d4  [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS             C:\Windows\system32\dps.dll
11:33:08.0945 0x14d4  DPS - ok
11:33:09.0006 0x14d4  [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
11:33:09.0016 0x14d4  drmkaud - ok
11:33:09.0074 0x14d4  [ E2B2853A0210D6EDAB2261870BD80C1A, BAC20DFFCFD8C324BC5B9CDA7BAFD553BBA8E3ED9224FDCF471357A456AC0A61 ] DsiWMIService   C:\Program Files\Launch Manager\dsiwmis.exe
11:33:09.0090 0x14d4  DsiWMIService - ok
11:33:09.0146 0x14d4  [ 3338D8E7346F9E6FF1A65132E91569CD, 20D15152EE77EDF91C31F14C96BC89A5BAA0CC1476A696B5DFD899851BF0AB31 ] dsNcAdpt        C:\Windows\system32\DRIVERS\dsNcAdpt.sys
11:33:09.0159 0x14d4  dsNcAdpt - ok
11:33:09.0238 0x14d4  [ 6374AF3AD666BA6E55A96AE47E61797D, E30C8689C693872C48BB8947869AC9A58346E375A19DC58A1352E51A38067E81 ] dsNcService     C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
11:33:09.0279 0x14d4  dsNcService - ok
11:33:09.0356 0x14d4  [ 3583A5A8CC2E682BFFBD4630D0FEC08B, FD0F184B358FCECAA763444B414074BEF4E871EB7527D88385519FC158435C72 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
11:33:09.0386 0x14d4  DXGKrnl - ok
11:33:09.0427 0x14d4  [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost         C:\Windows\System32\eapsvc.dll
11:33:09.0457 0x14d4  EapHost - ok
11:33:09.0591 0x14d4  [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv           C:\Windows\system32\DRIVERS\evbdx.sys
11:33:09.0689 0x14d4  ebdrv - ok
11:33:09.0797 0x14d4  [ BF08DE8E4FA1F143D41B3241F7FCE5F6, 4140BE0ECE0D4B8FDD413DBA120F5D7EF6F94628224320EDA2A85E50BEFDA638 ] EFS             C:\Windows\System32\lsass.exe
11:33:09.0808 0x14d4  EFS - ok
11:33:09.0891 0x14d4  [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
11:33:09.0921 0x14d4  ehRecvr - ok
11:33:09.0948 0x14d4  [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched         C:\Windows\ehome\ehsched.exe
11:33:09.0975 0x14d4  ehSched - ok
11:33:10.0027 0x14d4  [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
11:33:10.0051 0x14d4  elxstor - ok
11:33:10.0121 0x14d4  [ 60B037DB7FA23A40FD6F6C0EE9844852, 3AF944469F840C36336A400EAA66F64FDEEDA48F54DFEE493E4FB75DEF80D795 ] ePowerSvc       C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
11:33:10.0149 0x14d4  ePowerSvc - ok
11:33:10.0198 0x14d4  [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
11:33:10.0208 0x14d4  ErrDev - ok
11:33:10.0239 0x14d4  [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem     C:\Windows\system32\es.dll
11:33:10.0269 0x14d4  EventSystem - ok
11:33:10.0290 0x14d4  [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat           C:\Windows\system32\drivers\exfat.sys
11:33:10.0322 0x14d4  exfat - ok
11:33:10.0338 0x14d4  [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
11:33:10.0373 0x14d4  fastfat - ok
11:33:10.0438 0x14d4  [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax             C:\Windows\system32\fxssvc.exe
11:33:10.0465 0x14d4  Fax - ok
11:33:10.0480 0x14d4  [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
11:33:10.0492 0x14d4  fdc - ok
11:33:10.0519 0x14d4  [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost         C:\Windows\system32\fdPHost.dll
11:33:10.0544 0x14d4  fdPHost - ok
11:33:10.0576 0x14d4  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub        C:\Windows\system32\fdrespub.dll
11:33:10.0605 0x14d4  FDResPub - ok
11:33:10.0628 0x14d4  [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
11:33:10.0639 0x14d4  FileInfo - ok
11:33:10.0652 0x14d4  [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
11:33:10.0679 0x14d4  Filetrace - ok
11:33:10.0767 0x14d4  [ ACEFEEA621DCA62EFB7A7EEA59F5E91B, 1D998E25B2C4C2DB51BF5E76BD0EFCA172CFC9BC16AFE7044BFC7A9FCF346154 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
11:33:10.0801 0x14d4  FLEXnet Licensing Service - ok
11:33:10.0817 0x14d4  [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
11:33:10.0828 0x14d4  flpydisk - ok
11:33:10.0845 0x14d4  [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
11:33:10.0861 0x14d4  FltMgr - ok
11:33:10.0954 0x14d4  [ E12C4928B32ACE04610259647F072635, B71B9C2DF45F33C4DAC88435129B08B0BCDBBE82E8C3AD0A95F00137CC8B619F ] FontCache       C:\Windows\system32\FntCache.dll
11:33:10.0994 0x14d4  FontCache - ok
11:33:11.0045 0x14d4  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
11:33:11.0054 0x14d4  FontCache3.0.0.0 - ok
11:33:11.0088 0x14d4  [ 041033F5DED5E58F8198CE31CFD09562, 18660379F8071904A7034F5DEC82B5F481CFB2B05D5DE60F76CFF9DD98AFA3FA ] FPSensor        C:\Windows\system32\Drivers\FPSensor.sys
11:33:11.0099 0x14d4  FPSensor - ok
11:33:11.0107 0x14d4  [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
11:33:11.0119 0x14d4  FsDepends - ok
11:33:11.0166 0x14d4  [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
11:33:11.0177 0x14d4  Fs_Rec - ok
11:33:11.0223 0x14d4  [ E306A24D9694C724FA2491278BF50FDB, 1D246B9C28550640EACBF8CF9DC980FD75106B92832D392FEBEF0C7012353091 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
11:33:11.0240 0x14d4  fvevol - ok
11:33:11.0273 0x14d4  [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
11:33:11.0285 0x14d4  gagp30kx - ok
11:33:11.0357 0x14d4  [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc           C:\Windows\System32\gpsvc.dll
11:33:11.0406 0x14d4  gpsvc - ok
11:33:11.0420 0x14d4  [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
11:33:11.0433 0x14d4  hcw85cir - ok
11:33:11.0493 0x14d4  [ A5EF29D5315111C80A5C1ABAD14C8972, A181DA72E946F121C3F4A19438C547B0BFD15138AB1DB5465945EC89DF1F6B0A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
11:33:11.0523 0x14d4  HdAudAddService - ok
11:33:11.0582 0x14d4  [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
11:33:11.0601 0x14d4  HDAudBus - ok
11:33:11.0640 0x14d4  [ A88485DC6A7136C10D9A6C7E38FDFE3C, B651823E5F6D13B086B00440AD17C7C2756F079DD9290E0FEB1A3A48D0104F8C ] HECI            C:\Windows\system32\DRIVERS\HECI.sys
11:33:11.0661 0x14d4  HECI - ok
11:33:11.0689 0x14d4  [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
11:33:11.0701 0x14d4  HidBatt - ok
11:33:11.0713 0x14d4  [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
11:33:11.0732 0x14d4  HidBth - ok
11:33:11.0754 0x14d4  [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
11:33:11.0766 0x14d4  HidIr - ok
11:33:11.0785 0x14d4  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv         C:\Windows\System32\hidserv.dll
11:33:11.0814 0x14d4  hidserv - ok
11:33:11.0860 0x14d4  [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
11:33:11.0882 0x14d4  HidUsb - ok
11:33:11.0930 0x14d4  [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc          C:\Windows\system32\kmsvc.dll
11:33:11.0954 0x14d4  hkmsvc - ok
11:33:12.0007 0x14d4  [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
11:33:12.0027 0x14d4  HomeGroupListener - ok
11:33:12.0078 0x14d4  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
11:33:12.0095 0x14d4  HomeGroupProvider - ok
11:33:12.0152 0x14d4  [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
11:33:12.0163 0x14d4  HpSAMD - ok
11:33:12.0215 0x14d4  [ 83106F9E39CE6F635ACFFE4099AEA9AB, 3F29A3A4680EF637782EF129209B89E1329080E0C234B5A59EF716612A533830 ] HsfXAudioService C:\Windows\system32\XAudio32.dll
11:33:12.0240 0x14d4  HsfXAudioService - ok
11:33:12.0280 0x14d4  [ A437B370F97B160C66F0847ED5099E3B, 983A007833E2EC364D8E0E890AA670B2C611156B450DF27F98D11575771B5566 ] HSF_DPV         C:\Windows\system32\DRIVERS\HSX_DPV.sys
11:33:12.0314 0x14d4  HSF_DPV - ok
11:33:12.0334 0x14d4  [ F20B9BE5F3AE257B6358597DA323260E, 0C88391A1E7AC563DA55D17FE19EAAB4F1082B10C2B78142E9F82C4BF9FA0929 ] HSXHWAZL        C:\Windows\system32\DRIVERS\HSXHWAZL.sys
11:33:12.0348 0x14d4  HSXHWAZL - ok
11:33:12.0427 0x14d4  [ 871917B07A141BFF43D76D8844D48106, 30C702008D0EE57D63F74864967DD19A55A268E77E42B5B3CC73037AD51D2987 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
11:33:12.0466 0x14d4  HTTP - ok
11:33:12.0516 0x14d4  [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
11:33:12.0528 0x14d4  hwpolicy - ok
11:33:12.0595 0x14d4  [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
11:33:12.0607 0x14d4  i8042prt - ok
11:33:12.0668 0x14d4  [ 26541A068572F650A2FA490726FE81BE, 9D6EF745731D45C4482274BE9C56300BBE8843D6C182F0E5C621AB121DBE371E ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
11:33:12.0687 0x14d4  iaStor - ok
11:33:12.0715 0x14d4  [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E, 72870092A80C6DAE0105025B0ED8B607E98BA81E59298364A7FE4C9C56C68FF0 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
11:33:12.0736 0x14d4  iaStorV - ok
11:33:12.0825 0x14d4  [ 3E9213A2A050BF429E91898C90F8B4E3, D80ABE5691087661B19F01927B631CB8C5291120B814B6F863F046E0D643E9E4 ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:33:12.0860 0x14d4  idsvc - ok
11:33:12.0879 0x14d4  IEEtwCollectorService - ok
11:33:13.0166 0x14d4  [ 0DAB2D553BE272359BCCE55C3449937E, FA539CF0DAA084C56BE22D14E857BD2E753C4B24FEA0C6168EC41B5788D9E7F8 ] igfx            C:\Windows\system32\DRIVERS\igdkmd32.sys
11:33:13.0425 0x14d4  igfx - ok
11:33:13.0480 0x14d4  [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
11:33:13.0494 0x14d4  iirsp - ok
11:33:13.0570 0x14d4  [ B9C54120F46392100478F58F374E5709, A28EE8B0988F580D5984E815FC78DF41B169260814234AA0E453375542D0957B ] IKEEXT          C:\Windows\System32\ikeext.dll
11:33:13.0601 0x14d4  IKEEXT - ok
11:33:13.0644 0x14d4  [ E3C36AC5AE87EC970AE8EA2A93D59AE1, 8403A5243DF38EFC35A0200760EC081E42467744AF25A1F2168D5A8198AF6A5B ] Impcd           C:\Windows\system32\DRIVERS\Impcd.sys
11:33:13.0665 0x14d4  Impcd - ok
11:33:13.0715 0x14d4  [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide        C:\Windows\system32\drivers\intelide.sys
11:33:13.0727 0x14d4  intelide - ok
11:33:13.0749 0x14d4  [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
11:33:13.0762 0x14d4  intelppm - ok
11:33:13.0790 0x14d4  [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
11:33:13.0822 0x14d4  IPBusEnum - ok
11:33:13.0838 0x14d4  [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:33:13.0869 0x14d4  IpFilterDriver - ok
11:33:13.0938 0x14d4  [ 58F67245D041FBE7AF88F4EAF79DF0FA, 67468D6A46FF4D87AD321BFEA42F2FC843D09AA292A119C76D4D795D06028F96 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
11:33:13.0979 0x14d4  iphlpsvc - ok
11:33:14.0026 0x14d4  [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
11:33:14.0037 0x14d4  IPMIDRV - ok
11:33:14.0065 0x14d4  [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
11:33:14.0100 0x14d4  IPNAT - ok
11:33:14.0124 0x14d4  [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM          C:\Windows\system32\drivers\irenum.sys
11:33:14.0138 0x14d4  IRENUM - ok
11:33:14.0189 0x14d4  [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp          C:\Windows\system32\drivers\isapnp.sys
11:33:14.0205 0x14d4  isapnp - ok
11:33:14.0252 0x14d4  [ EB34CE31FABD4DC4343FD2AD16D2CAF9, D21C91227A15DA89ECF522345D0AB80B3B7FC24A230596DABDB8BD3B7554CE8C ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
11:33:14.0275 0x14d4  iScsiPrt - ok
11:33:14.0306 0x14d4  [ 213822072085B5BBAD9AF30AB577D817, 2C373B804D840933EC3A5F3ABFC43E47C2636CDB2431AB51846C565077B7C468 ] IviRegMgr       C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
11:33:14.0319 0x14d4  IviRegMgr - ok
11:33:14.0346 0x14d4  [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
11:33:14.0356 0x14d4  kbdclass - ok
11:33:14.0418 0x14d4  [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
11:33:14.0432 0x14d4  kbdhid - ok
11:33:14.0438 0x14d4  [ BF08DE8E4FA1F143D41B3241F7FCE5F6, 4140BE0ECE0D4B8FDD413DBA120F5D7EF6F94628224320EDA2A85E50BEFDA638 ] KeyIso          C:\Windows\system32\lsass.exe
11:33:14.0451 0x14d4  KeyIso - ok
11:33:14.0505 0x14d4  [ EF88BAC2B489D9C46F4E41ACF0219CD0, BF0FAF51BB6D0E588E53E483EF48D8D96B33544113892CC723CDEFAE7E5FB97A ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
11:33:14.0515 0x14d4  KSecDD - ok
11:33:14.0533 0x14d4  [ 49D70660EE8266988C1F99A0297A1430, D17B7A3118DB42358DEA80D8A21C5F1B0CC33BF74F6570676D4708B36BB91FD4 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
11:33:14.0547 0x14d4  KSecPkg - ok
11:33:14.0580 0x14d4  [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm           C:\Windows\system32\msdtckrm.dll
11:33:14.0615 0x14d4  KtmRm - ok
11:33:14.0687 0x14d4  [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer    C:\Windows\System32\srvsvc.dll
11:33:14.0723 0x14d4  LanmanServer - ok
11:33:14.0775 0x14d4  [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:33:14.0802 0x14d4  LanmanWorkstation - ok
11:33:14.0866 0x14d4  [ CB5D13966F74D7F000724A907F614193, 720374DE3C3E930B3C679DEF41A7073477F0C9C3156A0400F2F23672CCFCC981 ] libusb0         C:\Windows\system32\DRIVERS\libusb0.sys
11:33:14.0882 0x14d4  libusb0 - ok
11:33:14.0915 0x14d4  [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
11:33:14.0997 0x14d4  lltdio - ok
11:33:15.0035 0x14d4  [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
11:33:15.0082 0x14d4  lltdsvc - ok
11:33:15.0132 0x14d4  [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts         C:\Windows\System32\lmhsvc.dll
11:33:15.0156 0x14d4  lmhosts - ok
11:33:15.0249 0x14d4  [ A1C148801B4AF64847AEB9F3AD9594EF, FF6ED89EA47DF74C33CD8BFAC48FAED1B979348ABA6B6D94EE07CBD21810F37B ] LMS             C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
11:33:15.0260 0x14d4  LMS - detected UnsignedFile.Multi.Generic ( 1 )
11:33:19.0327 0x14d4  Detect skipped due to KSN trusted
11:33:19.0327 0x14d4  LMS - ok
11:33:19.0371 0x14d4  [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
11:33:19.0387 0x14d4  LSI_FC - ok
11:33:19.0406 0x14d4  [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
11:33:19.0417 0x14d4  LSI_SAS - ok
11:33:19.0433 0x14d4  [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
11:33:19.0445 0x14d4  LSI_SAS2 - ok
11:33:19.0462 0x14d4  [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
11:33:19.0476 0x14d4  LSI_SCSI - ok
11:33:19.0494 0x14d4  [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv           C:\Windows\system32\drivers\luafv.sys
11:33:19.0526 0x14d4  luafv - ok
11:33:19.0719 0x14d4  [ 37E57C48AF530DF01CDD4E8A2AD77B51, D1D66F11C28E8362D493ECFF4F1F6FB7E593BDE62446F86D3761809F01B0AF9F ] LVUVC           C:\Windows\system32\DRIVERS\lvuvc.sys
11:33:19.0837 0x14d4  LVUVC - ok
11:33:19.0887 0x14d4  [ A3F4391DFDF2F9E9FE4EAD193265A5AD, A60A1A345622F4758181FB0B6EE784B0B718105FEE7B0F6FEDE5AD59FE448EE1 ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys
11:33:19.0896 0x14d4  MBAMProtector - ok
11:33:20.0077 0x14d4  [ 0BB29DE40C9D9529793DCDB59A43CF5B, 251001A407D32EF22F64915EEFFAAEC229073C4549BF7D9D1D4209B7D15B4681 ] MBAMScheduler   C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
11:33:20.0138 0x14d4  MBAMScheduler - ok
11:33:20.0220 0x14d4  [ 5F82D8188B370B0CF185D4AE2B9B4A0E, 549B53DD989A069E1C38347C4CEF5283DF9B428CE102799B06A20D3D8F23825F ] MBAMService     C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
11:33:20.0253 0x14d4  MBAMService - ok
11:33:20.0313 0x14d4  [ 8E2E9CCD873ABF180F48BCAEEEBE347D, 35DBBB8E63B480151EA5701D9DB7C90642FA2391D044DB400D3644F3E21BB0C1 ] MBAMSwissArmy   C:\Windows\system32\drivers\MBAMSwissArmy.sys
11:33:20.0325 0x14d4  MBAMSwissArmy - ok
11:33:20.0374 0x14d4  [ 312CD3307F600E7CD340B79B3DCB3A01, 861A6DFC53C69743129DAAFE73DECDE8D842475503E8D713E7CE5D22AC8D1370 ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
11:33:20.0387 0x14d4  MBAMWebAccessControl - ok
11:33:20.0440 0x14d4  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
11:33:20.0455 0x14d4  Mcx2Svc - ok
11:33:20.0488 0x14d4  [ 0A6A9A9407626BDD89A7CFE87A973A87, 6A509909F6A37A4AD5AB4A28DE3CA7C06AC7C1B2C87C98A8A69A01DE2FF19843 ] mdmxsdk         C:\Windows\system32\DRIVERS\mdmxsdk.sys
11:33:20.0496 0x14d4  mdmxsdk - ok
11:33:20.0520 0x14d4  [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
11:33:20.0530 0x14d4  megasas - ok
11:33:20.0581 0x14d4  [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
11:33:20.0602 0x14d4  MegaSR - ok
11:33:20.0620 0x14d4  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS           C:\Windows\system32\mmcss.dll
11:33:20.0652 0x14d4  MMCSS - ok
11:33:20.0665 0x14d4  [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem           C:\Windows\system32\drivers\modem.sys
11:33:20.0693 0x14d4  Modem - ok
11:33:20.0713 0x14d4  [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
11:33:20.0725 0x14d4  monitor - ok
11:33:20.0780 0x14d4  [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass        C:\Windows\system32\drivers\mouclass.sys
11:33:20.0790 0x14d4  mouclass - ok
11:33:20.0803 0x14d4  [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
11:33:20.0816 0x14d4  mouhid - ok
11:33:20.0868 0x14d4  [ FC8771F45ECCCFD89684E38842539B9B, 806DDF2B4830CA866582FE74A521BB7DF26CA0E19013DAF584D3677FB48CC77A ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
11:33:20.0882 0x14d4  mountmgr - ok
11:33:20.0932 0x14d4  [ 345477F02C308B7480702767218C86A2, 98AFB5CF35BD82BA44B8F52CBC5FA3760506ADD7892C2AA1A77E8DF71FC8523F ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
11:33:20.0948 0x14d4  MozillaMaintenance - ok
11:33:21.0047 0x14d4  [ 7D2484C4995A3DB47345EFED2A0B579E, 55B3CDE0BEF743874793679692A6C744B2771C85A0FEE1904F28A51EEE9C0CEB ] MpFilter        C:\Windows\system32\DRIVERS\MpFilter.sys
11:33:21.0065 0x14d4  MpFilter - ok
11:33:21.0115 0x14d4  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio            C:\Windows\system32\drivers\mpio.sys
11:33:21.0128 0x14d4  mpio - ok
11:33:21.0171 0x14d4  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
11:33:21.0196 0x14d4  mpsdrv - ok
11:33:21.0262 0x14d4  [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc          C:\Windows\system32\mpssvc.dll
11:33:21.0301 0x14d4  MpsSvc - ok
11:33:21.0349 0x14d4  [ 03F899F521D2AAED1C55008F734DF252, 4E56A51476A13F5630719018037B1F63DF9ACEA1CFE782AF04E669BD696954C5 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
11:33:21.0365 0x14d4  MRxDAV - ok
11:33:21.0414 0x14d4  [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
11:33:21.0428 0x14d4  mrxsmb - ok
11:33:21.0483 0x14d4  [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:33:21.0498 0x14d4  mrxsmb10 - ok
11:33:21.0515 0x14d4  [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:33:21.0527 0x14d4  mrxsmb20 - ok
11:33:21.0577 0x14d4  [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci          C:\Windows\system32\drivers\msahci.sys
11:33:21.0587 0x14d4  msahci - ok
11:33:21.0651 0x14d4  [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
11:33:21.0663 0x14d4  msdsm - ok
11:33:21.0677 0x14d4  [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC           C:\Windows\System32\msdtc.exe
11:33:21.0691 0x14d4  MSDTC - ok
11:33:21.0719 0x14d4  [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs            C:\Windows\system32\drivers\Msfs.sys
11:33:21.0766 0x14d4  Msfs - ok
11:33:21.0778 0x14d4  [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
11:33:21.0804 0x14d4  mshidkmdf - ok
11:33:21.0860 0x14d4  [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
11:33:21.0871 0x14d4  msisadrv - ok
11:33:21.0904 0x14d4  [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
11:33:21.0934 0x14d4  MSiSCSI - ok
11:33:21.0937 0x14d4  msiserver - ok
11:33:21.0952 0x14d4  [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
11:33:21.0980 0x14d4  MSKSSRV - ok
11:33:22.0102 0x14d4  [ F26F7A5B18C717E57E3B6B306ABEC00B, 4C49C67A48F6B77E38A7FD28C960C92DFF371ACF0722C6EE4DF5F4B382937870 ] MsMpSvc         c:\Program Files\Microsoft Security Client\MsMpEng.exe
11:33:22.0117 0x14d4  MsMpSvc - ok
11:33:22.0127 0x14d4  [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
11:33:22.0156 0x14d4  MSPCLOCK - ok
11:33:22.0179 0x14d4  [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
11:33:22.0208 0x14d4  MSPQM - ok
11:33:22.0217 0x14d4  [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
11:33:22.0231 0x14d4  MsRPC - ok
11:33:22.0245 0x14d4  [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
11:33:22.0255 0x14d4  mssmbios - ok
11:33:22.0263 0x14d4  [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
11:33:22.0292 0x14d4  MSTEE - ok
11:33:22.0303 0x14d4  [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
11:33:22.0314 0x14d4  MTConfig - ok
11:33:22.0332 0x14d4  [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup             C:\Windows\system32\Drivers\mup.sys
11:33:22.0343 0x14d4  Mup - ok
11:33:22.0410 0x14d4  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent        C:\Windows\system32\qagentRT.dll
11:33:22.0445 0x14d4  napagent - ok
11:33:22.0472 0x14d4  [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
11:33:22.0493 0x14d4  NativeWifiP - ok
11:33:22.0570 0x14d4  [ 8C9C922D71F1CD4DEF73F186416B7896, 15FF43CD90C7913F83B35F2E7986561584588E8A45196EBD965C3A355836A9C7 ] NDIS            C:\Windows\system32\drivers\ndis.sys
11:33:22.0596 0x14d4  NDIS - ok
11:33:22.0623 0x14d4  [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
11:33:22.0653 0x14d4  NdisCap - ok
11:33:22.0680 0x14d4  [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
11:33:22.0706 0x14d4  NdisTapi - ok
11:33:22.0765 0x14d4  [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
11:33:22.0792 0x14d4  Ndisuio - ok
11:33:22.0849 0x14d4  [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
11:33:22.0882 0x14d4  NdisWan - ok
11:33:22.0931 0x14d4  [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
11:33:22.0958 0x14d4  NDProxy - ok
11:33:22.0967 0x14d4  [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
11:33:22.0997 0x14d4  NetBIOS - ok
11:33:23.0057 0x14d4  [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
11:33:23.0086 0x14d4  NetBT - ok
11:33:23.0091 0x14d4  [ BF08DE8E4FA1F143D41B3241F7FCE5F6, 4140BE0ECE0D4B8FDD413DBA120F5D7EF6F94628224320EDA2A85E50BEFDA638 ] Netlogon        C:\Windows\system32\lsass.exe
11:33:23.0105 0x14d4  Netlogon - ok
11:33:23.0129 0x14d4  [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman          C:\Windows\System32\netman.dll
11:33:23.0166 0x14d4  Netman - ok
11:33:23.0225 0x14d4  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:33:23.0242 0x14d4  NetMsmqActivator - ok
11:33:23.0265 0x14d4  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:33:23.0283 0x14d4  NetPipeActivator - ok
11:33:23.0302 0x14d4  [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm        C:\Windows\System32\netprofm.dll
11:33:23.0338 0x14d4  netprofm - ok
11:33:23.0347 0x14d4  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:33:23.0361 0x14d4  NetTcpActivator - ok
11:33:23.0367 0x14d4  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:33:23.0384 0x14d4  NetTcpPortSharing - ok
11:33:23.0411 0x14d4  [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
11:33:23.0423 0x14d4  nfrd960 - ok
11:33:23.0497 0x14d4  [ 94B8279FC0E27A8253944DFA47FC4A83, D799003BD163200F7DE0EC882756EF08AA70C45BF0518E3BC6DB8B8FB74BF663 ] NisDrv          C:\Windows\system32\DRIVERS\NisDrvWFP.sys
11:33:23.0511 0x14d4  NisDrv - ok
11:33:23.0557 0x14d4  [ 1452F52471F2DC1515DD6C35B42FF06E, 57A2858B24D0C9C229A4C76F85DB453E867921C2B4E41835211C4EB5EBE99DE8 ] NisSrv          c:\Program Files\Microsoft Security Client\NisSrv.exe
11:33:23.0577 0x14d4  NisSrv - ok
11:33:23.0631 0x14d4  [ F115C5CD29E512F18BD7138A094B77E5, 90C2CE8B256EE9AABF674ADDE7F85E91DAF48EA368452D03C187A4AE027D4E39 ] NlaSvc          C:\Windows\System32\nlasvc.dll
11:33:23.0651 0x14d4  NlaSvc - ok
11:33:23.0671 0x14d4  [ 7AEA4DF1CA68FD45DD4BBE1F0243CE7F, 4CCE820F455512C41E4F98109FA6F048907DD3452D5A00D5F885C77F93C9C105 ] NMSAccess       C:\Program Files\CDBurnerXP\NMSAccessU.exe
11:33:23.0680 0x14d4  NMSAccess - ok
11:33:23.0738 0x14d4  [ B48DC6ABCD3AEFF8618350CCBDC6B09A, 824D8B03E061DDD0D33EF9F03C669B13E7B6E339684009BD44D69178C45E2DE1 ] NPF             C:\Windows\system32\drivers\npf.sys
11:33:23.0749 0x14d4  NPF - ok
11:33:23.0765 0x14d4  [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
11:33:23.0798 0x14d4  Npfs - ok
11:33:23.0818 0x14d4  [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi             C:\Windows\system32\nsisvc.dll
11:33:23.0848 0x14d4  nsi - ok
11:33:23.0862 0x14d4  [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
11:33:23.0890 0x14d4  nsiproxy - ok
11:33:23.0971 0x14d4  [ C8DFF8D07755A66C7A4A738930F0FEAC, A2CC58312CE57988ABD976155BE91F558DCEC4C23481C6FBE64B361D511A36EA ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
11:33:24.0026 0x14d4  Ntfs - ok
11:33:24.0040 0x14d4  [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null            C:\Windows\system32\drivers\Null.sys
11:33:24.0069 0x14d4  Null - ok
11:33:24.0134 0x14d4  [ B3E25EE28883877076E0E1FF877D02E0, 402B6FED6FBBF645190396DC141141EF52DD059DABD01F8AC9CF01D23664070C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
11:33:24.0147 0x14d4  nvraid - ok
11:33:24.0166 0x14d4  [ 4380E59A170D88C4F1022EFF6719A8A4, 93EDB3F4CDBF53C9C1970DD29AB146E390695C568180847BA8903F5FBEABCFF2 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
11:33:24.0179 0x14d4  nvstor - ok
11:33:24.0234 0x14d4  [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
11:33:24.0247 0x14d4  nv_agp - ok
11:33:24.0325 0x14d4  [ FDDC452BE513D00E1B4DA18000F279EE, F3F1929B86947347D1441ED9B3635DACF415DFE182DC2196839EF11E25DCC473 ] ODDPwrSvc       C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
11:33:24.0341 0x14d4  ODDPwrSvc - ok
11:33:24.0394 0x14d4  [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
11:33:24.0408 0x14d4  ohci1394 - ok
11:33:24.0441 0x14d4  [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose             C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:33:24.0455 0x14d4  ose - ok
11:33:24.0496 0x14d4  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
11:33:24.0521 0x14d4  p2pimsvc - ok
11:33:24.0542 0x14d4  [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc          C:\Windows\system32\p2psvc.dll
11:33:24.0561 0x14d4  p2psvc - ok
11:33:24.0577 0x14d4  [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport         C:\Windows\system32\DRIVERS\parport.sys
11:33:24.0592 0x14d4  Parport - ok
11:33:24.0644 0x14d4  [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr         C:\Windows\system32\drivers\partmgr.sys
11:33:24.0656 0x14d4  partmgr - ok
11:33:24.0671 0x14d4  [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
11:33:24.0682 0x14d4  Parvdm - ok
11:33:24.0698 0x14d4  [ 358AB7956D3160000726574083DFC8A6, 6CAFD4D1B8AB8C1D167ADC018985DDAB5AC2CBFFB3434FE6390F14AF50C19025 ] PcaSvc          C:\Windows\System32\pcasvc.dll
11:33:24.0720 0x14d4  PcaSvc - ok
11:33:24.0780 0x14d4  [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci             C:\Windows\system32\drivers\pci.sys
11:33:24.0796 0x14d4  pci - ok
11:33:24.0839 0x14d4  [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide          C:\Windows\system32\drivers\pciide.sys
11:33:24.0850 0x14d4  pciide - ok
11:33:24.0873 0x14d4  [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
11:33:24.0887 0x14d4  pcmcia - ok
11:33:24.0906 0x14d4  [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw             C:\Windows\system32\drivers\pcw.sys
11:33:24.0924 0x14d4  pcw - ok
11:33:24.0954 0x14d4  [ 9E0104BA49F4E6973749A02BF41344ED, B32F39F38DB48D77FBA884DEE34112BAB81CCEF5DD2EAAA12D9589D73D2BB116 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
11:33:24.0996 0x14d4  PEAUTH - ok
11:33:25.0071 0x14d4  [ AF4D64D2A57B9772CF3801950B8058A6, C9C493A3775E6E1660CE5DF75DA574D0C04245FB88CF41B96217A725359C350D ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
11:33:25.0114 0x14d4  PeerDistSvc - ok
11:33:25.0212 0x14d4  [ EDFFBC067C9321D2076B3D6F33E0D4C6, BB1ED48E5D0C06A774CFC7D891E46E419D83BDDFD6DEEEE8C19CC0AB0F51BACB ] PenCommService  C:\Program Files\Common Files\Livescribe\PenComm\PenCommService.exe
11:33:25.0228 0x14d4  PenCommService - detected UnsignedFile.Multi.Generic ( 1 )
11:33:29.0224 0x14d4  Detect skipped due to KSN trusted
11:33:29.0224 0x14d4  PenCommService - ok
11:33:29.0328 0x14d4  [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla             C:\Windows\system32\pla.dll
11:33:29.0404 0x14d4  pla - ok
11:33:29.0473 0x14d4  [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
11:33:29.0497 0x14d4  PlugPlay - ok
11:33:29.0506 0x14d4  [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
11:33:29.0518 0x14d4  PNRPAutoReg - ok
11:33:29.0538 0x14d4  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
11:33:29.0561 0x14d4  PNRPsvc - ok
11:33:29.0631 0x14d4  [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
11:33:29.0668 0x14d4  PolicyAgent - ok
11:33:29.0726 0x14d4  [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power           C:\Windows\system32\umpo.dll
11:33:29.0760 0x14d4  Power - ok
11:33:29.0787 0x14d4  [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
11:33:29.0823 0x14d4  PptpMiniport - ok
11:33:29.0836 0x14d4  [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
11:33:29.0847 0x14d4  Processor - ok
11:33:29.0896 0x14d4  [ FD9692A3D31E021207D3C2A9DDDC2BE3, 5295EFAD9BD4B59996935A41825392C12A4C968D161BEEA37797F90AF8E54229 ] ProfSvc         C:\Windows\system32\profsvc.dll
11:33:29.0910 0x14d4  ProfSvc - ok
11:33:29.0922 0x14d4  [ BF08DE8E4FA1F143D41B3241F7FCE5F6, 4140BE0ECE0D4B8FDD413DBA120F5D7EF6F94628224320EDA2A85E50BEFDA638 ] ProtectedStorage C:\Windows\system32\lsass.exe
11:33:29.0933 0x14d4  ProtectedStorage - ok
11:33:29.0955 0x14d4  [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
11:33:29.0987 0x14d4  Psched - ok
11:33:30.0009 0x14d4  [ A6A7AD767BF5141665F5C675F671B3E1, 11D43F732C3B82679E53516F83E675B60B0EFEDE3F4EE3C42AC752AD8D5155AF ] PSI_SVC_2       C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
11:33:30.0022 0x14d4  PSI_SVC_2 - ok
11:33:30.0077 0x14d4  [ 82749A87E49FDC46E6D1B9627507DD75, 0B09F4F05069F52F5D0EF0C7FA6DB24690DF8F981C0734F19941639BD892AF7F ] PulseUsb        C:\Windows\system32\DRIVERS\PulseUsb.sys
11:33:30.0082 0x14d4  PulseUsb - detected UnsignedFile.Multi.Generic ( 1 )
11:33:33.0730 0x14d4  Detect skipped due to KSN trusted
11:33:33.0730 0x14d4  PulseUsb - ok
11:33:33.0800 0x14d4  [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
11:33:33.0855 0x14d4  ql2300 - ok
11:33:33.0897 0x14d4  [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
11:33:33.0907 0x14d4  ql40xx - ok
11:33:33.0942 0x14d4  [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE           C:\Windows\system32\qwave.dll
11:33:33.0963 0x14d4  QWAVE - ok
11:33:33.0972 0x14d4  [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
11:33:33.0987 0x14d4  QWAVEdrv - ok
11:33:33.0997 0x14d4  [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
11:33:34.0023 0x14d4  RasAcd - ok
11:33:34.0054 0x14d4  [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
11:33:34.0080 0x14d4  RasAgileVpn - ok
11:33:34.0094 0x14d4  [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto         C:\Windows\System32\rasauto.dll
11:33:34.0126 0x14d4  RasAuto - ok
11:33:34.0140 0x14d4  [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
11:33:34.0171 0x14d4  Rasl2tp - ok
11:33:34.0229 0x14d4  [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan          C:\Windows\System32\rasmans.dll
11:33:34.0261 0x14d4  RasMan - ok
11:33:34.0272 0x14d4  [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
11:33:34.0304 0x14d4  RasPppoe - ok
11:33:34.0319 0x14d4  [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
11:33:34.0349 0x14d4  RasSstp - ok
11:33:34.0410 0x14d4  [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
11:33:34.0445 0x14d4  rdbss - ok
11:33:34.0459 0x14d4  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
11:33:34.0473 0x14d4  rdpbus - ok
11:33:34.0522 0x14d4  [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
11:33:34.0546 0x14d4  RDPCDD - ok
11:33:34.0560 0x14d4  [ B973FCFC50DC1434E1970A146F7E3885, BE797E5F5AE34D37F8DA1134CE94DD14DBE36D2BC405B97E992E2257848B7CA9 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
11:33:34.0574 0x14d4  RDPDR - ok
11:33:34.0590 0x14d4  [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
11:33:34.0615 0x14d4  RDPENCDD - ok
11:33:34.0637 0x14d4  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
11:33:34.0665 0x14d4  RDPREFMP - ok
11:33:34.0732 0x14d4  [ CD9214A6AE17D188D17C3CF8CB9CC693, 2E16FF1F7446F0600D6519010FD05A30B94D97167C16B3E7FC396A97D8139D60 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
11:33:34.0759 0x14d4  RDPWD - ok
11:33:34.0827 0x14d4  [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
11:33:34.0844 0x14d4  rdyboost - ok
11:33:34.0861 0x14d4  [ 001B4278407F4303EFC902A2B16F2453, 92A95B0EFAAE7ADC6380D5207C86CB45BEEAE6974417A13669484A9D179E69AC ] regi            C:\Windows\system32\drivers\regi.sys
11:33:34.0869 0x14d4  regi - ok
11:33:34.0888 0x14d4  [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess    C:\Windows\System32\mprdim.dll
11:33:34.0913 0x14d4  RemoteAccess - ok
11:33:34.0944 0x14d4  [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry  C:\Windows\system32\regsvc.dll
11:33:34.0983 0x14d4  RemoteRegistry - ok
11:33:35.0017 0x14d4  [ CB928D9E6DAF51879DD6BA8D02F01321, DFD263B67DDF98AE09AF6D6986CBC7BE3206BCE8403AAC51BCF9459E78233D12 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
11:33:35.0034 0x14d4  RFCOMM - ok
11:33:35.0094 0x14d4  [ B60F58F175DE20A6739194E85B035178, 6E66D6041AF0B69896E4556F9FF3A3AA70CF4B09FFBE68E14E60313C5E3FFDDB ] rpcapd          C:\Program Files\WinPcap\rpcapd.exe
11:33:35.0109 0x14d4  rpcapd - ok
11:33:35.0128 0x14d4  [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
11:33:35.0160 0x14d4  RpcEptMapper - ok
11:33:35.0171 0x14d4  [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator      C:\Windows\system32\locator.exe
11:33:35.0183 0x14d4  RpcLocator - ok
11:33:35.0244 0x14d4  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs           C:\Windows\system32\rpcss.dll
11:33:35.0282 0x14d4  RpcSs - ok
11:33:35.0313 0x14d4  [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
11:33:35.0345 0x14d4  rspndr - ok
11:33:35.0392 0x14d4  [ 7FA7F2E249A5DCBB7970630E15E1F482, 9633B193F3FDA67BC551C6DCA4788AB83E9F45F77763EE579D02FE5D6B80DEDF ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
11:33:35.0403 0x14d4  s3cap - ok
11:33:35.0414 0x14d4  [ BF08DE8E4FA1F143D41B3241F7FCE5F6, 4140BE0ECE0D4B8FDD413DBA120F5D7EF6F94628224320EDA2A85E50BEFDA638 ] SamSs           C:\Windows\system32\lsass.exe
11:33:35.0427 0x14d4  SamSs - ok
11:33:35.0482 0x14d4  [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
11:33:35.0495 0x14d4  sbp2port - ok
11:33:35.0517 0x14d4  [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
11:33:35.0546 0x14d4  SCardSvr - ok
11:33:35.0595 0x14d4  [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
11:33:35.0623 0x14d4  scfilter - ok
11:33:35.0703 0x14d4  [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule        C:\Windows\system32\schedsvc.dll
11:33:35.0749 0x14d4  Schedule - ok
11:33:35.0799 0x14d4  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc     C:\Windows\System32\certprop.dll
11:33:35.0829 0x14d4  SCPolicySvc - ok
11:33:35.0846 0x14d4  [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
11:33:35.0863 0x14d4  SDRSVC - ok
11:33:35.0890 0x14d4  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
11:33:35.0921 0x14d4  secdrv - ok
11:33:35.0944 0x14d4  [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon        C:\Windows\system32\seclogon.dll
11:33:35.0977 0x14d4  seclogon - ok
11:33:35.0986 0x14d4  [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS            C:\Windows\system32\sens.dll
11:33:36.0017 0x14d4  SENS - ok
11:33:36.0030 0x14d4  [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
11:33:36.0045 0x14d4  SensrSvc - ok
11:33:36.0059 0x14d4  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
11:33:36.0070 0x14d4  Serenum - ok
11:33:36.0087 0x14d4  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial          C:\Windows\system32\DRIVERS\serial.sys
11:33:36.0104 0x14d4  Serial - ok
11:33:36.0121 0x14d4  [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
11:33:36.0134 0x14d4  sermouse - ok
11:33:36.0196 0x14d4  [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv      C:\Windows\system32\sessenv.dll
11:33:36.0225 0x14d4  SessionEnv - ok
11:33:36.0271 0x14d4  [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
11:33:36.0282 0x14d4  sffdisk - ok
11:33:36.0329 0x14d4  [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
11:33:36.0342 0x14d4  sffp_mmc - ok
11:33:36.0355 0x14d4  [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
11:33:36.0369 0x14d4  sffp_sd - ok
11:33:36.0378 0x14d4  [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
11:33:36.0389 0x14d4  sfloppy - ok
11:33:36.0424 0x14d4  [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess    C:\Windows\System32\ipnathlp.dll
11:33:36.0460 0x14d4  SharedAccess - ok
11:33:36.0481 0x14d4  [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:33:36.0521 0x14d4  ShellHWDetection - ok
11:33:36.0540 0x14d4  [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp          C:\Windows\system32\drivers\sisagp.sys
11:33:36.0551 0x14d4  sisagp - ok
11:33:36.0590 0x14d4  [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
11:33:36.0603 0x14d4  SiSRaid2 - ok
11:33:36.0619 0x14d4  [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
11:33:36.0631 0x14d4  SiSRaid4 - ok
11:33:36.0656 0x14d4  [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
11:33:36.0684 0x14d4  Smb - ok
11:33:36.0728 0x14d4  [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
11:33:36.0742 0x14d4  SNMPTRAP - ok
11:33:36.0772 0x14d4  [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr           C:\Windows\system32\drivers\spldr.sys
11:33:36.0783 0x14d4  spldr - ok
11:33:36.0854 0x14d4  [ 9AEA093B8F9C37CF45538382CABA2475, CC63239C412067AA72318ADB8BB80BCDF2CA60DA05D814D32753C92508BC16A8 ] Spooler         C:\Windows\System32\spoolsv.exe
11:33:36.0876 0x14d4  Spooler - ok
11:33:36.0990 0x14d4  [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc          C:\Windows\system32\sppsvc.exe
11:33:37.0098 0x14d4  sppsvc - ok
11:33:37.0204 0x14d4  [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify     C:\Windows\system32\sppuinotify.dll
11:33:37.0235 0x14d4  sppuinotify - ok
11:33:37.0290 0x14d4  [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv             C:\Windows\system32\DRIVERS\srv.sys
11:33:37.0308 0x14d4  srv - ok
11:33:37.0327 0x14d4  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
11:33:37.0345 0x14d4  srv2 - ok
11:33:37.0370 0x14d4  [ E00FDFAFF025E94F9821153750C35A6D, 6ECDC5F314A29B859B0DCB7FF114CACE0718612556299B16412C21F9539DC9B5 ] SrvHsfHDA       C:\Windows\system32\DRIVERS\VSTAZL3.SYS
11:33:37.0387 0x14d4  SrvHsfHDA - ok
11:33:37.0504 0x14d4  [ CEB4E3B6890E1E42DCA6694D9E59E1A0, 00D841690A88F1051A238F67AACCE905E8A59C86070F215A8D31FA3E68C6BF35 ] SrvHsfV92       C:\Windows\system32\DRIVERS\VSTDPV3.SYS
11:33:37.0542 0x14d4  SrvHsfV92 - ok
11:33:37.0607 0x14d4  [ BC0C7EA89194C299F051C24119000E17, F5FB21F7AD7370F3D5DF7C23F33118ECF19865B995AF12E9A8A8D893E7E6264F ] SrvHsfWinac     C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
11:33:37.0638 0x14d4  SrvHsfWinac - ok
11:33:37.0659 0x14d4  [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
11:33:37.0673 0x14d4  srvnet - ok
11:33:37.0692 0x14d4  [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
11:33:37.0722 0x14d4  SSDPSRV - ok
11:33:37.0746 0x14d4  [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
11:33:37.0787 0x14d4  SstpSvc - ok
11:33:37.0847 0x14d4  [ 24F5F92263E3B461A1105FE370D53D1C, FEF552ADACEF37137AAF9142218165954CBCBB9D107AF307CA6C53E09DDDA61A ] ssudmdm         C:\Windows\system32\DRIVERS\ssudmdm.sys
11:33:37.0861 0x14d4  ssudmdm - ok
11:33:37.0901 0x14d4  [ F92254B0BCFCD10CAAC7BCCC7CB7F467, A44B569F658BED53502C9155947759EE67FABEE306DA2A9ABE87141F99B251A3 ] StarOpen        C:\Windows\system32\drivers\StarOpen.sys
11:33:37.0906 0x14d4  StarOpen - detected UnsignedFile.Multi.Generic ( 1 )
11:33:41.0442 0x14d4  Detect skipped due to KSN trusted
11:33:41.0442 0x14d4  StarOpen - ok
11:33:41.0482 0x14d4  [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
11:33:41.0492 0x14d4  stexstor - ok
11:33:41.0556 0x14d4  [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc          C:\Windows\System32\wiaservc.dll
11:33:41.0586 0x14d4  StiSvc - ok
11:33:41.0634 0x14d4  [ 472AF0311073DCECEAA8FA18BA2BDF89, 089414057EB2047E42C96C1ACE79D509967461DC5A4D2836F63C04268637A3FC ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
11:33:41.0646 0x14d4  storflt - ok
11:33:41.0663 0x14d4  [ 0BF669F0A910BEDA4A32258D363AF2A5, 83EEBACDE4F69A2866B69CAA633F5C8B3CB01D88CEDB01B6EA5988E0A25CEE47 ] StorSvc         C:\Windows\system32\storsvc.dll
11:33:41.0677 0x14d4  StorSvc - ok
11:33:41.0740 0x14d4  [ DCAFFD62259E0BDB433DD67B5BB37619, CBD12FF9BBF33D18B0F3D322B12EC62E7DF3BF45C6AD43D2E91FF4C4762E05D0 ] storvsc         C:\Windows\system32\drivers\storvsc.sys
11:33:41.0750 0x14d4  storvsc - ok
11:33:41.0807 0x14d4  [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum          C:\Windows\system32\drivers\swenum.sys
11:33:41.0818 0x14d4  swenum - ok
11:33:41.0836 0x14d4  [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv           C:\Windows\System32\swprv.dll
11:33:41.0874 0x14d4  swprv - ok
11:33:41.0913 0x14d4  [ 138436636E21592091406C27F3D49EE5, 33B7C8575747C45F64A776AA52728505CC7C9809AC5518AFC4878F79D9737E4F ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
11:33:41.0929 0x14d4  SynTP - ok
11:33:42.0010 0x14d4  [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain         C:\Windows\system32\sysmain.dll
11:33:42.0060 0x14d4  SysMain - ok
11:33:42.0114 0x14d4  [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
11:33:42.0133 0x14d4  TabletInputService - ok
11:33:42.0182 0x14d4  [ 68F0454007DF488EC7AF04060C6131C3, C108D0280792FDC75F1E4429B55C598BFBDCEEF3317001CCCDB3E6B4BFC471CB ] tap0801co       C:\Windows\system32\DRIVERS\tap0801co.sys
11:33:42.0186 0x14d4  tap0801co - detected UnsignedFile.Multi.Generic ( 1 )
11:33:45.0567 0x14d4  Detect skipped due to KSN trusted
11:33:45.0567 0x14d4  tap0801co - ok
11:33:45.0620 0x14d4  [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv         C:\Windows\System32\tapisrv.dll
11:33:45.0658 0x14d4  TapiSrv - ok
11:33:45.0673 0x14d4  [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS             C:\Windows\System32\tbssvc.dll
11:33:45.0702 0x14d4  TBS - ok
11:33:45.0789 0x14d4  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
11:33:45.0831 0x14d4  Tcpip - ok
11:33:45.0880 0x14d4  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
11:33:45.0926 0x14d4  TCPIP6 - ok
11:33:45.0982 0x14d4  [ 3EEBD3BD93DA46A26E89893C7AB2FF3B, 2C7204DCD2BCBC6A250FF0F6477616F327AF41FDB7CABE69E5C357361009FB4E ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
11:33:46.0008 0x14d4  tcpipreg - ok
11:33:46.0063 0x14d4  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
11:33:46.0077 0x14d4  TDPIPE - ok
11:33:46.0083 0x14d4  [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
11:33:46.0094 0x14d4  TDTCP - ok
11:33:46.0145 0x14d4  [ 7FE680A3DFA421C4A8E4879AE4C5AAB0, A4C64E155AB2843823CD3586756BA7681CFDEA50812095468221503BBAD30DCD ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
11:33:46.0172 0x14d4  tdx - ok
11:33:46.0436 0x14d4  [ 4ACFC5853A3F0C6C2F54E537C23EE90F, 47D81F471A250696A1A0D19294FC553EB88D813612A8351C89F65D7BF99C8532 ] TeamViewer9     C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
11:33:46.0572 0x14d4  TeamViewer9 - ok
11:33:46.0593 0x14d4  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD          C:\Windows\system32\drivers\termdd.sys
11:33:46.0604 0x14d4  TermDD - ok
11:33:46.0667 0x14d4  [ FCFD4F50419B4BC72E80066DA10D2E54, 7C2314A57A404525F0444986332DBAE0964A3359374671598387051D7AAE72AE ] TermService     C:\Windows\System32\termsrv.dll
11:33:46.0696 0x14d4  TermService - ok
11:33:46.0721 0x14d4  [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes          C:\Windows\system32\themeservice.dll
11:33:46.0739 0x14d4  Themes - ok
11:33:46.0756 0x14d4  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER     C:\Windows\system32\mmcss.dll
11:33:46.0787 0x14d4  THREADORDER - ok
11:33:46.0800 0x14d4  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks          C:\Windows\System32\trkwks.dll
11:33:46.0831 0x14d4  TrkWks - ok
11:33:46.0910 0x14d4  [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:33:46.0941 0x14d4  TrustedInstaller - ok
11:33:47.0010 0x14d4  [ 6C5139E4283249518F7743D7043775B3, 58684E8C90EBAC65459A97C905CDCFE3A915CFF7E8E96071DE1AC3489F85E67F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
11:33:47.0023 0x14d4  tssecsrv - ok
11:33:47.0117 0x14d4  [ FD1D6C73E6333BE727CBCC6054247654, 6F7B9AE1A5986204DB3348D13B303F30FC17624939DA74D6BD114FAEED0FB30E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
11:33:47.0130 0x14d4  TsUsbFlt - ok
11:33:47.0183 0x14d4  [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
11:33:47.0212 0x14d4  tunnel - ok
11:33:47.0277 0x14d4  [ 08D15ADE5701ACADBBB2B59AB349F74F, 47564F21FE4894E3B5C4DBF3575D779CEE1971EF6F68AC59C7AA6CADDC3EF04F ] TurboB          C:\Windows\system32\DRIVERS\TurboB.sys
11:33:47.0287 0x14d4  TurboB - ok
11:33:47.0351 0x14d4  [ 825CE9CC06689F9C8210BF9BB1D8FD02, 069A613FE1D255D99C06620741D6D5BA09DD43E5B72CB254C7D0C4CDDCED812F ] TurboBoost      C:\Program Files\Intel\TurboBoost\TurboBoost.exe
11:33:47.0365 0x14d4  TurboBoost - ok
11:33:47.0397 0x14d4  [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
11:33:47.0409 0x14d4  uagp35 - ok
11:33:47.0431 0x14d4  [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
11:33:47.0461 0x14d4  udfs - ok
11:33:47.0484 0x14d4  [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect       C:\Windows\system32\UI0Detect.exe
11:33:47.0496 0x14d4  UI0Detect - ok
11:33:47.0549 0x14d4  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
11:33:47.0561 0x14d4  uliagpkx - ok
11:33:47.0615 0x14d4  [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus           C:\Windows\system32\drivers\umbus.sys
11:33:47.0628 0x14d4  umbus - ok
11:33:47.0641 0x14d4  [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
11:33:47.0652 0x14d4  UmPass - ok
11:33:47.0711 0x14d4  [ 409994A8EACEEE4E328749C0353527A0, FFC57B647147DE2957A7DE4B330CC534DE7AC892A2FCE3BB164F7A516CAB1B56 ] UmRdpService    C:\Windows\System32\umrdp.dll
11:33:47.0727 0x14d4  UmRdpService - ok
11:33:47.0794 0x14d4  [ 927754ABF077AEB5504BE4E0F2C60C1B, 14DBDB8DAD85432D310C4F3DDF99C07AA5E23DC3D92280CB8B9ECC7456B9F6E1 ] UMVPFSrv        C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
11:33:47.0813 0x14d4  UMVPFSrv - ok
11:33:47.0911 0x14d4  [ 41118D920B2B268C0ADC36421248CDCF, 4F99C4913DCFE02B0783FD97F02558E4DD4D7C98553D95A8E26FAAA0C0D67616 ] UNS             C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
11:33:47.0976 0x14d4  UNS - detected UnsignedFile.Multi.Generic ( 1 )
11:33:51.0794 0x14d4  Detect skipped due to KSN trusted
11:33:51.0795 0x14d4  UNS - ok
11:33:51.0842 0x14d4  [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost        C:\Windows\System32\upnphost.dll
11:33:51.0890 0x14d4  upnphost - ok
11:33:51.0935 0x14d4  [ 6E421CCC57059B0186C6259CA3B6DFC9, E348BF23CCD6C14FD10C1689BBDC77E125245331F97BFE60D4C8FD9A8711CB59 ] USBAAPL         C:\Windows\system32\Drivers\usbaapl.sys
11:33:51.0939 0x14d4  USBAAPL - detected UnsignedFile.Multi.Generic ( 1 )
11:33:55.0513 0x14d4  Detect skipped due to KSN trusted
11:33:55.0513 0x14d4  USBAAPL - ok
11:33:55.0578 0x14d4  [ A1977C315BF5691DA99235AA4A6907AF, 34B52FBA83F0E1C6B001D0AD1808B00152F731D18AAECC3C53B9918AA89BACEC ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
11:33:55.0591 0x14d4  usbaudio - ok
11:33:55.0607 0x14d4  [ 0803FBA9FE829D61AE26EC0BCC910C46, 30D00E2C7DFC630C99C1599587D4F9C272BC30D444E07C961AA05BF84587806B ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
11:33:55.0621 0x14d4  usbccgp - ok
11:33:55.0671 0x14d4  [ 2352AB5F9F8F097BF9D41D5A4718A041, 25BC7828C625B9B2A5110C25B230C5828CEC18EC97ECF9EC4745E8930CBF472C ] usbcir          C:\Windows\system32\drivers\usbcir.sys
11:33:55.0682 0x14d4  usbcir - ok
11:33:55.0733 0x14d4  [ D40855F89B69305140BBD7E9A3BA2DA6, 745DC6D770666F6B19C2B6AA89C21D1A314732E291453BFA2367F9AF86F97C3C ] usbehci         C:\Windows\system32\drivers\usbehci.sys
11:33:55.0744 0x14d4  usbehci - ok
11:33:55.0773 0x14d4  [ EDF2DF71C4F1E13A6AC75F5224DE655A, 1764D155C6B99201774B57195349304259232A12868ECFC2069CA49443EBDC2C ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
11:33:55.0790 0x14d4  usbhub - ok
11:33:55.0815 0x14d4  [ 9828C8D14CC2676421778F0DE638CF97, 479A28211FFB85190A01FAB0283B927588805D2C0CDB03F85F8F814B88E4F453 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
11:33:55.0826 0x14d4  usbohci - ok
11:33:55.0850 0x14d4  [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
11:33:55.0865 0x14d4  usbprint - ok
11:33:55.0916 0x14d4  [ F991AB9CC6B908DB552166768176896A, AD8E7A16B23B244B7F834622D4E38B5844193C6E31EF96F61E0E2EA16C945026 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:33:55.0929 0x14d4  USBSTOR - ok
11:33:55.0940 0x14d4  [ 800AABFD625EEFF899F7E5496BDE37AB, 3EB7ED07760CB348FCA9A06C2B838EF79B51A83C5F70A9C9EAAEAE54480067E2 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
11:33:55.0950 0x14d4  usbuhci - ok
11:33:55.0976 0x14d4  [ DE014425522610BEDCA3821BB8C0F1D5, D6FEA0DF07F89834AEEE8C02CC7FD41068D758B6CCECE2EEE5CF4B9DB646FA1E ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
11:33:55.0987 0x14d4  usbvideo - ok
11:33:56.0012 0x14d4  [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms           C:\Windows\System32\uxsms.dll
11:33:56.0035 0x14d4  UxSms - ok
11:33:56.0048 0x14d4  [ BF08DE8E4FA1F143D41B3241F7FCE5F6, 4140BE0ECE0D4B8FDD413DBA120F5D7EF6F94628224320EDA2A85E50BEFDA638 ] VaultSvc        C:\Windows\system32\lsass.exe
11:33:56.0058 0x14d4  VaultSvc - ok
11:33:56.0115 0x14d4  [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
11:33:56.0135 0x14d4  vdrvroot - ok
11:33:56.0208 0x14d4  [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds             C:\Windows\System32\vds.exe
11:33:56.0256 0x14d4  vds - ok
11:33:56.0279 0x14d4  [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
11:33:56.0290 0x14d4  vga - ok
11:33:56.0311 0x14d4  [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave         C:\Windows\System32\drivers\vga.sys
11:33:56.0333 0x14d4  VgaSave - ok
11:33:56.0382 0x14d4  [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
11:33:56.0407 0x14d4  vhdmp - ok
11:33:56.0436 0x14d4  [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
11:33:56.0451 0x14d4  viaagp - ok
11:33:56.0462 0x14d4  [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7           C:\Windows\system32\DRIVERS\viac7.sys
11:33:56.0473 0x14d4  ViaC7 - ok
11:33:56.0517 0x14d4  [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide          C:\Windows\system32\drivers\viaide.sys
11:33:56.0536 0x14d4  viaide - ok
11:33:56.0590 0x14d4  [ C2F2911156FDC7817C52829C86DA494E, FE499F189B5016FCE0018AA3DE3970B72275B7B15F3D4D608117F6DDEC6B90DC ] vmbus           C:\Windows\system32\drivers\vmbus.sys
11:33:56.0615 0x14d4  vmbus - ok
11:33:56.0626 0x14d4  [ D4D77455211E204F370D08F4963063CE, 2018B2A84C73E0834200A594C02A9D28C74906F126DAD3CCDDFC9CD9A61669E2 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
11:33:56.0639 0x14d4  VMBusHID - ok
11:33:56.0652 0x14d4  [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
11:33:56.0662 0x14d4  volmgr - ok
11:33:56.0679 0x14d4  [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
11:33:56.0693 0x14d4  volmgrx - ok
11:33:56.0748 0x14d4  [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
11:33:56.0782 0x14d4  volsnap - ok
11:33:56.0818 0x14d4  [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
11:33:56.0836 0x14d4  vsmraid - ok
11:33:56.0921 0x14d4  [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS             C:\Windows\system32\vssvc.exe
11:33:56.0969 0x14d4  VSS - ok
11:33:56.0984 0x14d4  [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
11:33:56.0996 0x14d4  vwifibus - ok
11:33:57.0015 0x14d4  [ 7090D3436EEB4E7DA3373090A23448F7, 3A130B28F2BFA7DCEC8596C4CE4E187B019F5ECF1AAC8DD1BBDE9CBD2428FEC2 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
11:33:57.0029 0x14d4  vwififlt - ok
11:33:57.0051 0x14d4  [ A3F04CBEA6C2A10E6CB01F8B47611882, 32AFE18B07FECA30BC95831A5DC94C784E543784DF16165334A777DC84E91EF3 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
11:33:57.0065 0x14d4  vwifimp - ok
11:33:57.0093 0x14d4  [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time         C:\Windows\system32\w32time.dll
11:33:57.0127 0x14d4  W32Time - ok
11:33:57.0150 0x14d4  [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
11:33:57.0162 0x14d4  WacomPen - ok
11:33:57.0223 0x14d4  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
11:33:57.0250 0x14d4  WANARP - ok
11:33:57.0254 0x14d4  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
11:33:57.0276 0x14d4  Wanarpv6 - ok
11:33:57.0336 0x14d4  [ 353A04C273EC58475D8633E75CCD5604, FFAE53B6B53AEFC9E8A10BF27480E072D74430276BEB532FE1D473E9616D8CE0 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
11:33:57.0376 0x14d4  WatAdminSvc - ok
11:33:57.0436 0x14d4  [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine        C:\Windows\system32\wbengine.exe
11:33:57.0473 0x14d4  wbengine - ok
11:33:57.0507 0x14d4  [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
11:33:57.0523 0x14d4  WbioSrvc - ok
11:33:57.0583 0x14d4  [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc         C:\Windows\System32\wcncsvc.dll
11:33:57.0617 0x14d4  wcncsvc - ok
11:33:57.0632 0x14d4  [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:33:57.0645 0x14d4  WcsPlugInService - ok
11:33:57.0663 0x14d4  [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
11:33:57.0673 0x14d4  Wd - ok
11:33:57.0749 0x14d4  [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
11:33:57.0770 0x14d4  Wdf01000 - ok
11:33:57.0781 0x14d4  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiServiceHost  C:\Windows\system32\wdi.dll
11:33:57.0806 0x14d4  WdiServiceHost - ok
11:33:57.0809 0x14d4  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiSystemHost   C:\Windows\system32\wdi.dll
11:33:57.0823 0x14d4  WdiSystemHost - ok
11:33:57.0884 0x14d4  [ 75E8EBD7040CE238684333F97014762A, 2CA0B267FBAEB303D1F8B639D733DC0DE17BA1276CC9096035B4F2BBBED3EF7F ] WebClient       C:\Windows\System32\webclnt.dll
11:33:57.0921 0x14d4  WebClient - ok
11:33:57.0948 0x14d4  [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc          C:\Windows\system32\wecsvc.dll
11:33:57.0982 0x14d4  Wecsvc - ok
11:33:57.0999 0x14d4  [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
11:33:58.0030 0x14d4  wercplsupport - ok
11:33:58.0056 0x14d4  [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc          C:\Windows\System32\WerSvc.dll
11:33:58.0086 0x14d4  WerSvc - ok
11:33:58.0111 0x14d4  [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
11:33:58.0134 0x14d4  WfpLwf - ok
11:33:58.0146 0x14d4  [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
11:33:58.0156 0x14d4  WIMMount - ok
11:33:58.0192 0x14d4  [ 383C6394D018D5012DE356F71DB15284, 317F01438F318BEC406321C58F40187D585D5C788551A175AA3F50B2E55A4A95 ] winachsf        C:\Windows\system32\DRIVERS\HSX_CNXT.sys
11:33:58.0213 0x14d4  winachsf - ok
11:33:58.0323 0x14d4  [ 082CF481F659FAE0DE51AD060881EB47, BB67D2AF0BB9192D4CCF66C23D80CE5A1B38715556D94E2561DBF8F805FA30A5 ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
11:33:58.0355 0x14d4  WinDefend - ok
11:33:58.0372 0x14d4  WinHttpAutoProxySvc - ok
11:33:58.0416 0x14d4  [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
11:33:58.0440 0x14d4  Winmgmt - ok
11:33:58.0523 0x14d4  [ 1DE9BD23AFA36150586C732D876D9B74, 32CF2C8EC18CFDA677AB72A182EB4B839DCC72BFCD6CA309BE2F434991CAE973 ] WinRM           C:\Windows\system32\WsmSvc.dll
11:33:58.0566 0x14d4  WinRM - ok
11:33:58.0646 0x14d4  [ A67E5F9A400F3BD1BE3D80613B45F708, E170A8BD31A779403DC9C43ED6483DA8E186512D3EE700B87F6BA292E284E367 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
11:33:58.0672 0x14d4  WinUsb - ok
11:33:58.0717 0x14d4  [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc         C:\Windows\System32\wlansvc.dll
11:33:58.0754 0x14d4  Wlansvc - ok
11:33:58.0810 0x14d4  [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
11:33:58.0833 0x14d4  WmiAcpi - ok
11:33:58.0861 0x14d4  [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
11:33:58.0889 0x14d4  wmiApSrv - ok
11:33:59.0015 0x14d4  [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
11:33:59.0057 0x14d4  WMPNetworkSvc - ok
11:33:59.0081 0x14d4  [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
11:33:59.0091 0x14d4  WPCSvc - ok
11:33:59.0144 0x14d4  [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
11:33:59.0179 0x14d4  WPDBusEnum - ok
11:33:59.0195 0x14d4  [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
11:33:59.0224 0x14d4  ws2ifsl - ok
11:33:59.0274 0x14d4  [ F67C4950E3B07684AC483CB718C2A3C1, DF0B2358E46DE4B795994A21483BA702BE1A958F3DE60E419595F2CD37D01F7C ] WsAudio_Device(1) C:\Windows\system32\drivers\VirtualAudio1.sys
11:33:59.0284 0x14d4  WsAudio_Device(1) - ok
11:33:59.0295 0x14d4  [ F67C4950E3B07684AC483CB718C2A3C1, DF0B2358E46DE4B795994A21483BA702BE1A958F3DE60E419595F2CD37D01F7C ] WsAudio_Device(2) C:\Windows\system32\drivers\VirtualAudio2.sys
11:33:59.0305 0x14d4  WsAudio_Device(2) - ok
11:33:59.0359 0x14d4  [ F67C4950E3B07684AC483CB718C2A3C1, DF0B2358E46DE4B795994A21483BA702BE1A958F3DE60E419595F2CD37D01F7C ] WsAudio_Device(3) C:\Windows\system32\drivers\VirtualAudio3.sys
11:33:59.0378 0x14d4  WsAudio_Device(3) - ok
11:33:59.0412 0x14d4  [ F67C4950E3B07684AC483CB718C2A3C1, DF0B2358E46DE4B795994A21483BA702BE1A958F3DE60E419595F2CD37D01F7C ] WsAudio_Device(4) C:\Windows\system32\drivers\VirtualAudio4.sys
11:33:59.0429 0x14d4  WsAudio_Device(4) - ok
11:33:59.0434 0x14d4  [ F67C4950E3B07684AC483CB718C2A3C1, DF0B2358E46DE4B795994A21483BA702BE1A958F3DE60E419595F2CD37D01F7C ] WsAudio_Device(5) C:\Windows\system32\drivers\VirtualAudio5.sys
11:33:59.0447 0x14d4  WsAudio_Device(5) - ok
11:33:59.0466 0x14d4  [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc          C:\Windows\system32\wscsvc.dll
11:33:59.0480 0x14d4  wscsvc - ok
11:33:59.0483 0x14d4  WSearch - ok
11:33:59.0601 0x14d4  [ D9B0134913E5EF007AF82A418C503322, 7418DD28C8E968674382F8352AAFFC4DE77887E2B71B8844D615F19432B4C55A ] wuauserv        C:\Windows\system32\wuaueng.dll
11:33:59.0655 0x14d4  wuauserv - ok
11:33:59.0709 0x14d4  [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
11:33:59.0731 0x14d4  WudfPf - ok
11:33:59.0756 0x14d4  [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
11:33:59.0767 0x14d4  WUDFRd - ok
11:33:59.0813 0x14d4  [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
11:33:59.0825 0x14d4  wudfsvc - ok
11:33:59.0876 0x14d4  [ 7CC38741B8F68F1E0D5D79DA6123666A, F90D2DA1C9AFB506C381CD386E1430931B5F81813FEDFD720F87FBC54E7A00DA ] WwanSvc         C:\Windows\System32\wwansvc.dll
11:33:59.0904 0x14d4  WwanSvc - ok
11:33:59.0938 0x14d4  [ 0D287628AB896448597B9701FD5603D2, E18AC4BC153625EFCA406C3A916F209B74B81C15E9911034864FB075F9F6F518 ] XAudio          C:\Windows\system32\DRIVERS\XAudio32.sys
11:33:59.0948 0x14d4  XAudio - ok
11:33:59.0981 0x14d4  ================ Scan global ===============================
11:34:00.0040 0x14d4  [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
11:34:00.0099 0x14d4  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
11:34:00.0118 0x14d4  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
11:34:00.0146 0x14d4  [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
11:34:00.0161 0x14d4  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6, D7BC4ED605B32274B45328FD9914FB0E7B90D869A38F0E6F94FB1BF4E9E2B407 ] C:\Windows\system32\services.exe
11:34:00.0167 0x14d4  [ Global ] - ok
11:34:00.0168 0x14d4  ================ Scan MBR ==================================
11:34:00.0179 0x14d4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
11:34:00.0792 0x14d4  \Device\Harddisk0\DR0 - ok
11:34:00.0792 0x14d4  ================ Scan VBR ==================================
11:34:00.0796 0x14d4  [ C5C58C7EBE963D70F88F87AEA0D8D304 ] \Device\Harddisk0\DR0\Partition1
11:34:00.0837 0x14d4  \Device\Harddisk0\DR0\Partition1 - ok
11:34:00.0842 0x14d4  [ 72C6ABC5959E8334EF8E8443A72BABF8 ] \Device\Harddisk0\DR0\Partition2
11:34:00.0872 0x14d4  \Device\Harddisk0\DR0\Partition2 - ok
11:34:00.0873 0x14d4  ================ Scan generic autorun ======================
11:34:00.0919 0x14d4  [ 4532C81637954F7D62E2AF7082763430, F8925CA0A2643A1F6BBF5A76185C9D2F8F2517BB349C17BD4E25BC995B856C99 ] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
11:34:00.0933 0x14d4  AmIcoSinglun - detected UnsignedFile.Multi.Generic ( 1 )
11:34:04.0582 0x14d4  Detect skipped due to KSN trusted
11:34:04.0582 0x14d4  AmIcoSinglun - ok
11:34:04.0682 0x14d4  [ DC20169949B56A7E16FE151490A78B07, FDF3B7814F754019063820DE5918F3CDFE19E980E9B5FBDD24587B10515D4D04 ] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
11:34:04.0736 0x14d4  SynTPEnh - ok
11:34:04.0754 0x14d4  [ EBB324585DC09191806392C0FE926DC6, 8796270F0EA4D9C900AA4DD1C2772C8967C5AAEA0150D7A0E41F66FF4D0F3C4D ] C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe
11:34:04.0765 0x14d4  ODDPwr - ok
11:34:04.0785 0x14d4  [ 788B21F757937A4464A8CF51EE31A4D8, 65AF087EE9DD31EB5C7FBD406B159812F44461973DD271C032C9C272A61CA491 ] C:\Windows\system32\igfxtray.exe
11:34:04.0797 0x14d4  IgfxTray - ok
11:34:04.0804 0x14d4  [ 48D406E77B7CB520108C7BD5A662D8A0, 444CA2C9238C44B14E43A53D607C63288A384D2F7EA54EFBE46FCE4CFEAEBEDA ] C:\Windows\system32\hkcmd.exe
11:34:04.0816 0x14d4  HotKeysCmds - ok
11:34:04.0825 0x14d4  [ 5FE25182F2D0D8A2F864303BF13647DE, CDBAFC11B58AC9020E2443969087A76469AA0FF8B71ECC8548252E4989E7BA60 ] C:\Windows\system32\igfxpers.exe
11:34:04.0837 0x14d4  Persistence - ok
11:34:04.0890 0x14d4  [ B283F9A1DEABD43ACC7481F893CF21E9, D3DE06E20C64917917541F31E132161F4CF9FB26BCB0214B1CEADB0CF7D3FB81 ] C:\Program Files\Launch Manager\LManager.exe
11:34:04.0921 0x14d4  LManager - ok
11:34:04.0937 0x14d4  [ 30CCA31D938B70FB98343EB857F02945, 28F7FD49C8C0BFE83AA067A1FC7710280CD60800A79A833E7E635A89E557A00D ] C:\Windows\PLFSetI.exe
11:34:04.0949 0x14d4  PLFSetI - ok
11:34:04.0995 0x14d4  [ C2681AD62555D80BC0566943FBF79DAE, 61C9A6A26F9E57ACC0D3241B2F8C667F8FC6E0B5B5B8006B31D3C527F6628A78 ] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
11:34:05.0021 0x14d4  Acer ePower Management - ok
11:34:05.0034 0x14d4  [ 51138BEEA3E2C21EC44D0932C71762A8, 5AD3C37E6F2B9DB3EE8B5AEEDC474645DE90C66E3D95F8620C48102F1EBA4124 ] C:\Windows\system32\rundll32.exe
11:34:05.0056 0x14d4  Logitech Download Assistant - ok
11:34:05.0132 0x14d4  [ BBD1BA710A00842064BA038570C13CB2, 155FABD8323C95932C9F552E8827A87356E9FCED471B8F5E06466F920EEB56A4 ] c:\Program Files\Microsoft Security Client\msseces.exe
11:34:05.0175 0x14d4  MSC - ok
11:34:05.0289 0x14d4  [ 514240B60373AF886E0B6EBB885349E6, 0981562F1EBAE35F9F9E947746356973D9DB3AA78848E9651C36203BB1EF0421 ] C:\Program Files\Bluetooth Suite\BtvStack.exe
11:34:05.0318 0x14d4  AtherosBtStack - detected UnsignedFile.Multi.Generic ( 1 )
11:34:09.0288 0x14d4  Detect skipped due to KSN trusted
11:34:09.0288 0x14d4  AtherosBtStack - ok
11:34:09.0324 0x14d4  [ 1F9681D830FE51DAD74966009448E298, B04A6E5338966C380DA406460B235E687C5A54715F20E418DB06964B2815A292 ] C:\Program Files\Bluetooth Suite\AthBtTray.exe
11:34:09.0373 0x14d4  AthBtTray - detected UnsignedFile.Multi.Generic ( 1 )
11:34:12.0706 0x14d4  Detect skipped due to KSN trusted
11:34:12.0706 0x14d4  AthBtTray - ok
11:34:12.0803 0x14d4  [ 08E7173D1B74095335052459200CB1EA, 5B6EB8A65B5F451BF6115EB7CD1355E5870E6D764F22D767D13216BF17C5668F ] C:\Program Files\QuickTime\QTTask.exe
11:34:12.0841 0x14d4  QuickTime Task - detected UnsignedFile.Multi.Generic ( 1 )
11:34:16.0340 0x14d4  Detect skipped due to KSN trusted
11:34:16.0340 0x14d4  QuickTime Task - ok
11:34:16.0554 0x14d4  [ 090956557CC68D25C1BCA9A2703A9ABA, 950C403CF1960C492F66AF499A75666DB5A18812E340281F44C13648F4447BC6 ] C:\Program Files\Brownie\BrstsWnd.exe
11:34:16.0650 0x14d4  BrStsWnd - ok
11:34:16.0694 0x14d4  [ 5D4961959249EA722AD93B9A59B75642, D174807CDCAB7C00654A30CCD691C814834D4180A34BEF4B990AD9DEFF98A541 ] C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe
11:34:16.0710 0x14d4  7 Taskbar Tweaker - detected UnsignedFile.Multi.Generic ( 1 )
11:34:20.0267 0x14d4  7 Taskbar Tweaker ( UnsignedFile.Multi.Generic ) - warning
11:34:23.0641 0x14d4  AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.7.205.0 ), 0x60000 ( disabled : updated )
11:34:23.0807 0x14d4  Win FW state via NFP2: enabled
11:34:26.0615 0x14d4  ============================================================
11:34:26.0615 0x14d4  Scan finished
11:34:26.0615 0x14d4  ============================================================
11:34:26.0628 0x10a8  Detected object count: 1
11:34:26.0628 0x10a8  Actual detected object count: 1
11:34:43.0218 0x10a8  7 Taskbar Tweaker ( UnsignedFile.Multi.Generic ) - skipped by user
11:34:43.0218 0x10a8  7 Taskbar Tweaker ( UnsignedFile.Multi.Generic ) - User select action: Skip

 



#6 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 13 February 2015 - 02:01 PM

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Step 1

zoek.jpg

  • Right-click on ZOEK 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    process;
    services-list;
    systemspecs;
    startupall;
    filesrcm;
    autoclean;
    
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.


Edited by deeprybka, 13 February 2015 - 02:02 PM.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#7 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 13 February 2015 - 02:41 PM

step 1:

 

Zoek.exe v5.0.0.0 Updated 13-February-2015
Tool run by FM on Fri 02/13/2015 at 12:07:10.47.
Microsoft Windows 7 Professional  6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\FM\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-02-11-033310.log    9205 bytes

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Running Processes ======================

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Bluetooth Suite\adminservice.exe
C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Launch Manager\dsiwmis.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
C:\Program Files\Common Files\Livescribe\PenComm\PenCommService.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
C:\Windows\system32\fxssvc.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Bluetooth Suite\BtvStack.exe
C:\Program Files\Bluetooth Suite\AthBtTray.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Launch Manager\LMworker.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\FM\Desktop\zoek.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k HsfXAudioService
C:\Windows\system32\svchost.exe -k imgsvc

==== Services(whitelist) ======================
Powered by E Dev

R2 - [AdobeARMservice] - Adobe Acrobat Update Service - c:\program files\common files\adobe\arm\1.0\armsvc.exe
R2 - [AtherosSvc] - AtherosSvc - c:\program files\bluetooth suite\adminservice.exe
R2 - [Autodesk Content Service] - Autodesk Content Service - c:\program files\autodesk\content service\connect.service.contentservice.exe
R2 - [Bonjour Service] - Bonjour Service - c:\program files\bonjour\mdnsresponder.exe
R2 - [btwdins] - Bluetooth Service - c:\program files\widcomm\bluetooth software\btwdins.exe
R2 - [DsiWMIService] - Dritek WMI Service - c:\program files\launch manager\dsiwmis.exe
R2 - [dsNcService] - Juniper Network Connect Service - c:\program files\juniper networks\common files\dsncservice.exe
R2 - [ePowerSvc] - Acer ePower Service - c:\program files\acer\acer epower management\epowersvc.exe
R2 - [Fax] - Fax - c:\windows\system32\fxssvc.exe
R2 - [IviRegMgr] - IviRegMgr - c:\program files\common files\intervideo\regmgr\iviregmgr.exe
R2 - [LMS] - Intel® Management and Security Application Local Management Service - c:\program files\intel\intel® management engine components\lms\lms.exe
R2 - [MBAMScheduler] - MBAMScheduler - c:\program files\malwarebytes anti-malware\mbamscheduler.exe
R2 - [MBAMService] - MBAMService - c:\program files\malwarebytes anti-malware\mbamservice.exe
R2 - [MsMpSvc] - Microsoft Antimalware Service - c:\program files\microsoft security client\msmpeng.exe
R2 - [NMSAccess] - NMSAccess - c:\program files\cdburnerxp\nmsaccessu.exe
R2 - [ODDPwrSvc] - Acer ODD Power Service - c:\program files\acer\optical drive power management\oddpwrsvc.exe
R2 - [PenCommService] - Livescribe Pulse Smartpen Service - c:\program files\common files\livescribe\pencomm\pencommservice.exe
R2 - [PSI_SVC_2] - Protexis Licensing V2 - c:\program files\common files\protexis\license service\psiservice_2.exe
R2 - [TeamViewer9] - TeamViewer 9 - c:\program files\teamviewer\version9\teamviewer_service.exe
R2 - [UMVPFSrv] - UMVPFSrv - c:\program files\common files\logishrd\lvmvfm\umvpfsrv.exe
R2 - [UNS] - Intel® Management & Security Application User Notification Service - c:\program files\intel\intel® management engine components\uns\uns.exe
R2 - [WSearch] - Windows Search - c:\windows\system32\searchindexer.exe
S2 - [clr_optimization_v4.0.30319_32] - Microsoft .NET Framework NGEN v4.0.30319_X86 - c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe
S2 - [sppsvc] - Software Protection - c:\windows\system32\sppsvc.exe
S3 - [AdobeFlashPlayerUpdateSvc] - Adobe Flash Player Update Service - c:\windows\system32\macromed\flash\flashplayerupdateservice.exe
S3 - [ALG] - Application Layer Gateway Service - c:\windows\system32\alg.exe
S3 - [aspnet_state] - ASP.NET State Service - c:\windows\microsoft.net\framework\v4.0.30319\aspnet_state.exe
S3 - [clr_optimization_v2.0.50727_32] - Microsoft .NET Framework NGEN v2.0.50727_X86 - c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe
S3 - [COMSysApp] - COM+ System Application - c:\windows\system32\dllhost.exe
S3 - [ehRecvr] - Windows Media Center Receiver Service - c:\windows\ehome\ehrecvr.exe
S3 - [ehSched] - Windows Media Center Scheduler Service - c:\windows\ehome\ehsched.exe
S3 - [FLEXnet Licensing Service] - FLEXnet Licensing Service - c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe
S3 - [FontCache3.0.0.0] - Windows Presentation Foundation Font Cache 3.0.0.0 - c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe
S3 - [IEEtwCollectorService] - Internet Explorer ETW Collector Service - c:\windows\system32\ieetwcollector.exe
S3 - [MozillaMaintenance] - Mozilla Maintenance Service - c:\program files\mozilla maintenance service\maintenanceservice.exe
S3 - [MSDTC] - Distributed Transaction Coordinator - c:\windows\system32\msdtc.exe
S3 - [msiserver] - Windows Installer - c:\windows\system32\msiexec.exe
S3 - [NisSrv] - Microsoft Network Inspection - c:\program files\microsoft security client\nissrv.exe
S3 - [ose] - Office Source Engine - c:\program files\common files\microsoft shared\source engine\ose.exe
S3 - [rpcapd] - Remote Packet Capture Protocol v.0 (experimental) - c:\program files\winpcap\rpcapd.exe
S3 - [RpcLocator] - Remote Procedure Call (RPC) Locator - c:\windows\system32\locator.exe
S3 - [SNMPTRAP] - SNMP Trap - c:\windows\system32\snmptrap.exe
S3 - [TrustedInstaller] - Windows Modules Installer - c:\windows\servicing\trustedinstaller.exe
S3 - [TurboBoost] - TurboBoost - c:\program files\intel\turboboost\turboboost.exe
S3 - [vds] - Virtual Disk - c:\windows\system32\vds.exe
S3 - [VSS] - Volume Shadow Copy - c:\windows\system32\vssvc.exe
S3 - [WatAdminSvc] - Windows Activation Technologies Service - c:\windows\system32\wat\watadminsvc.exe
S3 - [wbengine] - Block Level Backup Engine Service - c:\windows\system32\wbengine.exe
S3 - [wmiApSrv] - WMI Performance Adapter - c:\windows\system32\wbem\wmiapsrv.exe
S3 - [WMPNetworkSvc] - Windows Media Player Network Sharing Service - c:\program files\windows media player\wmpnetwk.exe

==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\Users\FM\AppData\Roaming\Yahoo! deleted
C:\Users\FM\AppData\LocalLow\Company deleted
C:\Users\FM\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A} deleted
"C:\Users\FM\AppData\Local\98024bdb50f33b66087ef5a55a879aed" deleted

==== System Specs ======================

Windows: Windows 7 Professional Edition Service Pack 1 (Build 7601)
Memory (RAM): 2357 MB
CPU Info: Intel® Core™ i7 CPU       M 620  @ 2.67GHz
CPU Speed: 2657.2 MHz
Sound Card: Speakers (High Definition Audio |
Display Adapters: Intel® HD Graphics | Intel® HD Graphics | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver
Monitors: 1x; Generic PnP Monitor |
Screen Resolution: 1366 X 768 - 32 bit
Network: Network Present
Network Adapters: Juniper Network Connect Virtual Adapter | Microsoft Virtual WiFi Miniport Adapter | Broadcom NetXtreme Gigabit Ethernet | Broadcom 802.11n Network Adapter
CD / DVD Drives: 1x (E: | ) E: HL-DT-STDVDRAM GT31N
Ports: COM3 LPT Port NOT Present.
Mouse: 16 Button Wheel Mouse Present
Hard Disks: C:  452.7GB
Hard Disks - Free: C:  53.6GB
Manufacturer *: Phoenix
BIOS Info: AT/AT COMPATIBLE | 05/11/10 | ACRSYS - 6040000
Time Zone: Mountain Standard Time
Motherboard *: Acer             BAP50-CP
Country: United States
Language: ENU

==== System Specs (Software) ======================

Anti-Virus: Microsoft Security Essentials On-access scanning disabled (Outdated)
Anti-Spyware: Microsoft Security Essentials disabled (Outdated)
Anti-Spyware: Windows Defender disabled (Outdated)
Default Browser: Firefox    35.0.1
Internet Explorer Version: 11.0.9600.17633
Mozilla Firefox version: 35.0.1 (x86 en-US)
Adobe Reader version: 11.0.10.32
Flash Player version: 16.0.0.305

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2015-02-08 19:01:47    F042EE4C8D66248D9B86DCF52ABAE416    256000    ----a-w-    C:\Windows\PEV.exe
2015-02-08 19:01:47    9E05A9C264C8A908A8E79450FCBFF047    80412    ----a-w-    C:\Windows\grep.exe
2015-02-08 19:01:47    5E832F4FAF5F481F2EAF3B3A48F603B8    68096    ----a-w-    C:\Windows\zip.exe
2015-02-08 19:01:47    0297C72529807322B152F517FDB0A9FC    406528    ----a-w-    C:\Windows\SWSC.exe
2015-02-08 19:01:47    0277C027A26428DB64EF4F64F52BB4FD    208896    ----a-w-    C:\Windows\MBR.exe
====== C:\Users\FM\AppData\Local\Temp ====
====== Java Cache =====
====== C:\Windows\system32 =====
2015-02-13 02:27:52    B0F7307619E2BFDEA58E28D330485B7F    323928    ----a-w-    C:\Windows\System32\ZxslE8.dll
2015-02-12 00:39:32    01BD2653F2185218837CF4A175617F8A    620032    ----a-w-    C:\Windows\System32\jscript9diag.dll
2015-02-12 00:39:31    4FD3763F3917201856B0CBCE310003EA    4300800    ----a-w-    C:\Windows\System32\jscript9.dll
2015-02-11 06:47:18    15E13FB1C22A47A128965287194D1906    2380288    ----a-w-    C:\Windows\System32\win32k.sys
2015-02-11 06:47:16    F2A743912D404A8866362836CFE7A648    686080    ----a-w-    C:\Windows\System32\adtschema.dll
2015-02-11 06:47:16    F29BC66CE4A5507A49FB20744A056E61    22016    ----a-w-    C:\Windows\System32\secur32.dll
2015-02-11 06:47:16    CEFE50761B7681715C66AE3488363985    100352    ----a-w-    C:\Windows\System32\sspicli.dll
2015-02-11 06:47:16    BF08DE8E4FA1F143D41B3241F7FCE5F6    22528    ----a-w-    C:\Windows\System32\lsass.exe
2015-02-11 06:47:16    ACF312F6CCFC9249F739BF439DD4B80C    15872    ----a-w-    C:\Windows\System32\sspisrv.dll
2015-02-11 06:47:16    4E6934926B4C923CC0FF61C6D77814EF    50176    ----a-w-    C:\Windows\System32\auditpol.exe
2015-02-11 06:47:16    4775E1A0E15BF148098C35A19135F881    1061376    ----a-w-    C:\Windows\System32\lsasrv.dll
2015-02-11 06:47:16    43791D2F736C4E9BE9FE0B33A1E92A5D    60416    ----a-w-    C:\Windows\System32\msobjs.dll
2015-02-11 06:47:16    36F152AE2F64B12771A44EA77124332B    146432    ----a-w-    C:\Windows\System32\msaudite.dll
2015-02-11 06:46:51    6D227897A458DA8A9518DACDC88F1947    3917760    ----a-w-    C:\Windows\System32\ntoskrnl.exe
2015-02-11 06:46:51    62C93E47A424A8EC79F3CF1719A2DCC6    3972544    ----a-w-    C:\Windows\System32\ntkrnlpa.exe
2015-02-11 06:46:45    F5142E9A99F44F9CC19A8AF31761F7F9    3221504    ----a-w-    C:\Windows\System32\mstscax.dll
2015-02-11 06:46:44    B3AC14EA18DD0EE517703A86963AED18    131584    ----a-w-    C:\Windows\System32\aaclient.dll
2015-02-11 06:46:42    A208DAC2932649CFF82A6A684D8BB1F6    571904    ----a-w-    C:\Windows\System32\oleaut32.dll
2015-02-11 06:46:38    F3F6BE20A03215209B61CA85B4A83E1F    65536    ----a-w-    C:\Windows\System32\TSpkg.dll
2015-02-11 06:46:38    C256EFD3655EC782F8094E96094E8F9E    17408    ----a-w-    C:\Windows\System32\credssp.dll
2015-02-11 06:46:38    B63A6FF4339C9B701A93D3973C7FB6D2    550912    ----a-w-    C:\Windows\System32\kerberos.dll
2015-02-11 06:46:38    A12D64A94EC57079C2D96A741CB4FF53    172032    ----a-w-    C:\Windows\System32\wdigest.dll
2015-02-11 06:46:38    7D94A9161E8432B8521E60E064B1D737    259584    ----a-w-    C:\Windows\System32\msv1_0.dll
2015-02-11 06:46:38    7C893DBA0A58855A99DA68B751FD223B    248832    ----a-w-    C:\Windows\System32\schannel.dll
2015-02-11 06:46:38    3BB446DE24501FEA5FDB9A9DB23A22AE    221184    ----a-w-    C:\Windows\System32\ncrypt.dll
2015-02-11 06:46:32    B0F7BD3492C2D60A70F15AEADCE1E2A6    47616    ----a-w-    C:\Windows\System32\ieetwproxystub.dll
2015-02-11 06:46:32    94B1F7CE1AAA5542923E0AD63C4D0050    60416    ----a-w-    C:\Windows\System32\JavaScriptCollectionAgent.dll
2015-02-11 06:46:32    71189E2787179666BDCD1374AE92BF62    102912    ----a-w-    C:\Windows\System32\ieetwcollector.exe
2015-02-11 06:46:31    FD6AF61AF029B9BC2CF4EFF57CDD5821    710144    ----a-w-    C:\Windows\System32\ieapfltr.dll
2015-02-11 06:46:31    EF05E63ACC834470A07A2E73D519B5FA    418304    ----a-w-    C:\Windows\System32\dxtmsft.dll
2015-02-11 06:46:31    E1A4D24281526DDFEA418F729CDA9DC6    30720    ----a-w-    C:\Windows\System32\iernonce.dll
2015-02-11 06:46:31    C4F2424A0671907FD3AC44EBE43C3C66    667648    ----a-w-    C:\Windows\System32\MsSpellCheckingFacility.exe
2015-02-11 06:46:31    8E8137569741D3693F88DDF94CC38C20    1307136    ----a-w-    C:\Windows\System32\urlmon.dll
2015-02-11 06:46:31    74EA6C792F57E453261DA210C1BCEB53    342712    ----a-w-    C:\Windows\System32\iedkcs32.dll
2015-02-11 06:46:31    73AFBF165241EB4502CD15107AA12CBA    684544    ----a-w-    C:\Windows\System32\ie4uinit.exe
2015-02-11 06:46:31    55A84600EAAF8F1D3F0E6206E2EF6D48    47104    ----a-w-    C:\Windows\System32\jsproxy.dll
2015-02-11 06:46:31    28B2D3CB1B4306D476200D80AF7D87AD    115712    ----a-w-    C:\Windows\System32\ieUnatt.exe
2015-02-11 06:46:30    8FBC9680719ACDA9351B67D906C682F4    688640    ----a-w-    C:\Windows\System32\msfeeds.dll
2015-02-11 06:46:30    47B26D89EF9973E2DD586D0C827F61A9    2724864    ----a-w-    C:\Windows\System32\mshtml.tlb
2015-02-11 06:46:29    F285D499EC42969D963CA49EADA63218    1888256    ----a-w-    C:\Windows\System32\wininet.dll
2015-02-11 06:46:29    AD3F5926EC2C1F21FB45D1CDED6E2A47    2052608    ----a-w-    C:\Windows\System32\inetcpl.cpl
2015-02-11 06:46:29    6F10743069DFFC56DEE079204960844E    168960    ----a-w-    C:\Windows\System32\msrating.dll
2015-02-11 06:46:29    5FB7E9786F70F4072663746072C9E6CE    62464    ----a-w-    C:\Windows\System32\iesetup.dll
2015-02-11 06:46:29    44791AA90DF93DD79E63ED3A38657964    4096    ----a-w-    C:\Windows\System32\ieetwcollectorres.dll
2015-02-11 06:46:28    994E7459260D315573DD72783D1B78A7    478208    ----a-w-    C:\Windows\System32\ieui.dll
2015-02-11 06:46:28    6FA05244FD2E40A3DC08337146B3C425    285696    ----a-w-    C:\Windows\System32\dxtrans.dll
2015-02-11 06:46:27    D87759889FE7BCAE4461439139E62BAA    76288    ----a-w-    C:\Windows\System32\mshtmled.dll
2015-02-11 06:46:27    78A1A938D51D4F83A772123B93EE1612    12829184    ----a-w-    C:\Windows\System32\ieframe.dll
2015-02-11 06:46:26    9A91F9B5035F54C2D0BA92CF9B16EE34    2277888    ----a-w-    C:\Windows\System32\iertutil.dll
2015-02-11 06:46:26    3B9EF1B8E154D202D32A7765E2F33554    64000    ----a-w-    C:\Windows\System32\MshtmlDac.dll
2015-02-11 06:46:26    180168942E4A133C55E7BBF17DA3C142    1155072    ----a-w-    C:\Windows\System32\mshtmlmedia.dll
2015-02-11 06:46:25    61C74D794C14E9FC94D93F5F0F72A3F9    19740160    ----a-w-    C:\Windows\System32\mshtml.dll
2015-02-11 06:46:24    9DEE691C8FDBC2DE6957F1AE873C78FC    503296    ----a-w-    C:\Windows\System32\vbscript.dll
2015-02-11 06:45:18    E365C7B3EBB96451D3C9DF6B6B6900C2    179200    ----a-w-    C:\Windows\System32\wintrust.dll
2015-02-11 06:45:18    623E143F2DF17C0106A9988F5D7DC878    143872    ----a-w-    C:\Windows\System32\cryptsvc.dll
2015-02-11 06:45:18    0C96A745A76C7DD75C5503E86D968E49    1174528    ----a-w-    C:\Windows\System32\crypt32.dll
2015-02-11 06:45:15    B3BC38B886CA53C92D52EF724A9F0D45    308224    ----a-w-    C:\Windows\System32\scesrv.dll
2015-02-11 06:45:15    793F6658ED65839FDB2957A4884CB63C    1230336    ----a-w-    C:\Windows\System32\WindowsCodecs.dll
====== C:\Windows\system32\drivers =====
2015-02-13 02:50:04    8E2E9CCD873ABF180F48BCAEEEBE347D    114904    ----a-w-    C:\Windows\System32\drivers\MBAMSwissArmy.sys
2015-02-13 02:49:44    A3F4391DFDF2F9E9FE4EAD193265A5AD    23256    ----a-w-    C:\Windows\System32\drivers\mbam.sys
2015-02-13 02:49:44    9BD41E40039098BF5F8FE878A9A6989E    75480    ----a-w-    C:\Windows\System32\drivers\mbamchameleon.sys
2015-02-13 02:49:44    312CD3307F600E7CD340B79B3DCB3A01    51928    ----a-w-    C:\Windows\System32\drivers\mwac.sys
2015-02-11 06:47:16    F516F1167EFBBC5ABC90687C94497869    369968    ----a-w-    C:\Windows\System32\drivers\cng.sys
2015-02-11 06:47:16    EF88BAC2B489D9C46F4E41ACF0219CD0    67520    ----a-w-    C:\Windows\System32\drivers\ksecdd.sys
2015-02-11 06:47:16    49D70660EE8266988C1F99A0297A1430    136640    ----a-w-    C:\Windows\System32\drivers\ksecpkg.sys
====== C:\Windows\Tasks ======
2015-01-23 19:11:42    6DC6AFD03B152562D188229B29A40477    3126    ----a-w-    C:\Windows\system32\Tasks\{6898B452-0E0C-4F2F-9A62-9474F9FED163}
====== C:\Windows\Temp ======
======= C:\Program Files =====
2015-02-01 01:45:17    --------    d-----w-    C:\Program Files\Citrix
2015-01-27 22:31:14    --------    d-----w-    C:\Program Files\JetBrains
======= C: =====
====== C:\Users\FM\AppData\Roaming ======
2015-02-13 02:28:20    --------    d-----w-    C:\Windows\system32\config\systemprofile\AppData\Roaming\DTM
2015-02-11 02:21:34    --------    d-----w-    C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp
2015-02-11 02:21:34    --------    d-----w-    C:\Users\Public\AppData\Local\temp
2015-02-11 02:21:34    --------    d-----w-    C:\Users\FM\AppData\Local\Temp
2015-02-11 02:21:34    --------    d-----w-    C:\Users\Default\AppData\Local\temp
2015-02-11 02:21:34    --------    d-----w-    C:\Users\Default User\AppData\Local\temp
2015-02-01 01:48:11    --------    d-----w-    C:\Users\FM\AppData\Local\Citrix
2015-01-27 22:33:05    --------    d-----w-    C:\Users\FM\AppData\Roaming\JetBrains
2015-01-26 18:07:35    --------    d-sh--w-    C:\Users\FM\AppData\Locallow\EmieUserList
2015-01-26 18:07:35    --------    d-sh--w-    C:\Users\FM\AppData\Locallow\EmieBrowserModeList
2015-01-26 18:07:32    --------    d-sh--w-    C:\Users\FM\AppData\Local\EmieUserList
2015-01-26 18:07:32    --------    d-sh--w-    C:\Users\FM\AppData\Local\EmieSiteList
2015-01-26 18:07:32    --------    d-sh--w-    C:\Users\FM\AppData\Local\EmieBrowserModeList
2015-01-23 19:13:42    --------    d-----w-    C:\Users\FM\AppData\Local\Skype
2015-01-23 19:13:33    --------    d-----w-    C:\Users\FM\AppData\Roaming\Skype
====== C:\Users\FM ======
2015-02-13 18:31:50    9C5DAAED3B3C06DBC95228CC407B8B70    4197016    ----a-w-    C:\Users\FM\Desktop\tdsskiller.exe
2015-02-13 18:10:08    F50F482C9BA0BBD41DD11779095A8E5E    1125376    ----a-w-    C:\Users\FM\Desktop\FRST.exe
2015-02-13 02:48:14    3BD59D6C407AB1F6DDD7C5D9BD727469    20447072    ----a-w-    C:\Users\FM\Desktop\mbam-setup-2.0.4.1028(2).exe
2015-02-08 19:22:54    --------    d-----w-    C:\Users\Public\AppData
2015-02-08 01:37:16    --------    d-----w-    C:\Users\FM\PycharmProjects
2015-02-07 18:24:13    3BD59D6C407AB1F6DDD7C5D9BD727469    20447072    ----a-w-    C:\Users\FM\Desktop\mbam-setup-2.0.4.1028.exe
2015-02-01 01:45:17    --------    d-----w-    C:\ProgramData\Citrix
2015-01-27 22:32:33    --------    d-----w-    C:\Users\FM\.PyCharm40
2015-01-27 22:31:14    --------    d-----w-    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2015-01-23 19:13:13    --------    d-----w-    C:\ProgramData\Skype

====== C: exe-files ==
2015-02-13 18:31:50    9C5DAAED3B3C06DBC95228CC407B8B70    4197016    ----a-w-    C:\Users\FM\Desktop\tdsskiller.exe
2015-02-13 18:10:08    F50F482C9BA0BBD41DD11779095A8E5E    1125376    ----a-w-    C:\Users\FM\Desktop\FRST.exe
2015-02-13 02:48:14    3BD59D6C407AB1F6DDD7C5D9BD727469    20447072    ----a-w-    C:\Users\FM\Desktop\mbam-setup-2.0.4.1028(2).exe
2015-02-13 02:34:00    5442F47302C8A16D8E0CF65CAA394671    544    ----a-w-    C:\$RECYCLE.BIN\S-1-5-21-672566934-3909434764-2333441952-1003\$IOSSXVM.exe
2015-02-11 06:46:31    D674809F9EC7D6A409F553C0DF91E825    221184    ----a-w-    C:\Program Files\Internet Explorer\ielowutil.exe
2015-02-11 06:46:29    8111C559DAD3A40200AE916874E7E62A    468992    ----a-w-    C:\Program Files\Internet Explorer\ieinstal.exe
2015-02-11 06:46:29    363BC25BACB34E9D40441968B1B3D5BE    815288    ----a-w-    C:\Program Files\Internet Explorer\iexplore.exe
2015-02-07 18:24:13    3BD59D6C407AB1F6DDD7C5D9BD727469    20447072    ----a-w-    C:\Users\FM\Desktop\mbam-setup-2.0.4.1028.exe
2015-02-07 02:42:54    FD98434B6A06FE31A35E4BFBC827B290    52040    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
2015-02-07 02:42:54    5F0A3AA68785C49454F56C9F2DDA0237    52040    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
2015-02-07 02:42:54    4C02536F4CA35911FB3EA5715F300C57    52040    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
2015-02-07 02:42:53    7CA00A58AA808F4B9844C91845910377    880208    ----a-w-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
2015-02-07 02:42:49    F3B6470DA7CE34E559D3BA7365CC909C    115528    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
2015-02-07 02:42:49    83BB030C71C9727DCFB2737005772C4E    232264    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleCrashHandler.exe
2015-02-07 02:42:49    323CFFFDAF253AC65CD194A101BE6231    287048    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
2015-02-07 02:42:48    E1B44A75947137F4143308D566889837    107848    ----atw-    C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\GoogleUpdate.exe
2015-02-07 02:42:44    7CA00A58AA808F4B9844C91845910377    880208    ----a-w-    C:\Users\FM\AppData\Local\Google\Update\Install\{3CAE37F6-2143-41E7-AB7D-0C7B76E8F178}\GoogleUpdateSetup.exe
2015-02-07 02:42:44    7CA00A58AA808F4B9844C91845910377    880208    ----a-w-    C:\Users\FM\AppData\Local\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.26.9\GoogleUpdateSetup.exe
=== C: other files ==
2015-02-13 02:50:04    8E2E9CCD873ABF180F48BCAEEEBE347D    114904    ----a-w-    C:\Windows\System32\drivers\MBAMSwissArmy.sys
2015-02-13 02:49:44    A3F4391DFDF2F9E9FE4EAD193265A5AD    23256    ----a-w-    C:\Windows\System32\drivers\mbam.sys
2015-02-13 02:49:44    9BD41E40039098BF5F8FE878A9A6989E    75480    ----a-w-    C:\Windows\System32\drivers\mbamchameleon.sys
2015-02-13 02:49:44    312CD3307F600E7CD340B79B3DCB3A01    51928    ----a-w-    C:\Windows\System32\drivers\mwac.sys
2015-02-11 06:47:18    15E13FB1C22A47A128965287194D1906    2380288    ----a-w-    C:\Windows\System32\win32k.sys
2015-02-11 06:47:16    F516F1167EFBBC5ABC90687C94497869    369968    ----a-w-    C:\Windows\System32\drivers\cng.sys
2015-02-11 06:47:16    EF88BAC2B489D9C46F4E41ACF0219CD0    67520    ----a-w-    C:\Windows\System32\drivers\ksecdd.sys
2015-02-11 06:47:16    49D70660EE8266988C1F99A0297A1430    136640    ----a-w-    C:\Windows\System32\drivers\ksecpkg.sys
2015-02-08 01:37:22    1F317B7E2430A08D3D0E89F111221834    139    ----a-w-    C:\Users\FM\.PyCharm40\config\tasks\untitled.tasks.zip
2015-02-08 01:37:22    1F317B7E2430A08D3D0E89F111221834    139    ----a-w-    C:\Users\FM\.PyCharm40\config\tasks\untitled.contexts.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-672566934-3909434764-2333441952-1003\Software\Microsoft\Windows\CurrentVersion\Run]
"7 Taskbar Tweaker"="C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe -hidewnd"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun"="C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe"
"ODDPwr"="C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe"
"IgfxTray"="C:\Windows\system32\igfxtray.exe"
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"
"Persistence"="C:\Windows\system32\igfxpers.exe"
"LManager"="C:\Program Files\Launch Manager\LManager.exe"
"PLFSetI"="C:\Windows\PLFSetI.exe"
"Acer ePower Management"="C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe"
"Logitech Download Assistant"="C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch"
"MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey"
"AtherosBtStack"="C:\Program Files\Bluetooth Suite\BtvStack.exe"
"AthBtTray"="C:\Program Files\Bluetooth Suite\AthBtTray.exe"
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe -atboottime"
"BrStsWnd"="C:\Program Files\Brownie\BrstsWnd.exe Autorun"
"Autodesk Sync"="C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe"
"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe "

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"7 Taskbar Tweaker"="C:\Applications\Win7Taskbar\7 Taskbar Tweaker.exe -hidewnd"

==== Startup Folders ======================

2010-06-02 07:01:53    834    ----a-w-    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [02/05/2015 07:54 AM]

==== Other Scheduled Tasks ======================

"C:\Windows\system32\tasks\Adobe Acrobat Update Task" [C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe]
"C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe]
"C:\Windows\system32\tasks\GoogleUpdateTaskUserS-1-5-21-672566934-3909434764-2333441952-1003Core" [C:\Users\FM\AppData\Local\Google\Update\GoogleUpdate.exe]
"C:\Windows\system32\tasks\GoogleUpdateTaskUserS-1-5-21-672566934-3909434764-2333441952-1003UA" [C:\Users\FM\AppData\Local\Google\Update\GoogleUpdate.exe]
"C:\Windows\system32\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe]
"C:\Windows\system32\tasks\User_Feed_Synchronization-{79DB7ED3-B330-4CE6-88AB-AF7013EA8469}" [C:\Windows\system32\msfeedssync.exe]
"C:\Windows\system32\tasks\{6898B452-0E0C-4F2F-9A62-9474F9FED163}" ["c:\program files\mozilla firefox\firefox.exe"]

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default
user_pref("browser.startup.homepage", "https://encrypted.google.com/");
user_pref("browser.search.defaultenginename", "Google");

==== Firefox Extensions ======================

ProfilePath: C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default
- Undetermined - 2020Player@2020Technologies.com
- Undetermined - {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
- Undetermined - {b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- Undetermined - {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
- Visualisateur 3D de 20-20 - %ProfilePath%\extensions\2020Player@2020Technologies.com
- BlackFox V2-Blue - %ProfilePath%\extensions\zigboom.designs@gmail.com
- EPUBReader - %ProfilePath%\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
- DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- Element Hiding Helper for Adblock Plus - %ProfilePath%\extensions\elemhidehelper@adblockplus.org.xpi
- Keyword Search - %ProfilePath%\extensions\keywordsearch@kaply.com.xpi
- Stylish - %ProfilePath%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
- BetterPrivacy - %ProfilePath%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi

AppDir: C:\Program Files\Mozilla Firefox
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default
98137411B9C632095F919E2CE70B288A    - C:\Users\FM\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll -    Google Update
C62322C77D1AAB77B1CF1130FCC3673A    - C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll -    Shockwave Flash
2D684F0DDF782C73847BED9503250991    - C:\Users\FM\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll -    Google Talk Plugin
6C3E34E303DBDCB9F7EC1F7A7F6B1629    - C:\Users\FM\AppData\Roaming\Mozilla\plugins\npo1d.dll -    Google Talk Plugin Video Renderer
0806948270D853B709CCBBF38AF167E4    - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll -    Adobe Acrobat
9DF0C4F0CEF60158614EDD1B3AB441EE    - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll -    Adobe Acrobat
6B34823748BD3C10EB2816858025AFE9    - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll -    QuickTime Plug-in 7.7.5
233F187A5425045011A0DD51F8B48E0F    - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll -    QuickTime Plug-in 7.7.5
81CB790A6AD230090086C644DC871FC3    - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll -    QuickTime Plug-in 7.7.5
4AD1613FEDB87B4B18CADE745235A625    - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll -    QuickTime Plug-in 7.7.5
1FBB6E454767A5B43DD980C7DE5D89F6    - C:\Program Files\QuickTime\Plugins\npqtplugin.dll -    QuickTime Plug-in 7.7.5
0CA4180B21C6B728578F3B0433BB740E    - C:\Program Files\VideoLAN\VLC\npvlc.dll -    VLC Web Plugin
893BF7D2261C56C24F813405D9D018E0    - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll -    Silverlight Plug-In
7AA31903C74E82D039F150DA2FE8AF72    - C:\Program Files\Citrix\Secure Access Client\npagee.dll -    Citrix Access Gateway
7AA31903C74E82D039F150DA2FE8AF72    - C:\Users\FM\AppData\Roaming\Mozilla\plugins\npagee.dll -    Citrix Access Gateway
031992BC140364D2269349669A6979CB    - C:\Users\FM\AppData\Roaming\Mozilla\Firefox\Profiles\xk1fsn62.default\extensions\2020Player@2020Technologies.com\plugins\NP2020Player.dll -    20-20 3D Viewer
8DA2ED6B04EA33F2EAE8BA883F903729    - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrlui.dll -    Microsoft® Silverlight


==== Chromium Look ======================

Google Voice Search Hotword (Beta) - FM\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

==== Empty IE Cache ======================

C:\Users\FM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\FM\AppData\Local\Mozilla\Firefox\Profiles\xk1fsn62.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\FM\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=139750 folders=12291 4552236995 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\FM\AppData\Local\Temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\FM\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\FXSSVCDebugLogFile.txt" not deleted
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\FXSTIFFDebugLogFile.txt" not deleted

==== EOF on Fri 02/13/2015 at 12:36:41.57 ======================
 



#8 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 13 February 2015 - 03:02 PM


Step 1


Please downloadesetlogo.pngOnline Scanner and save it to your Desktop.
  • Disable the realtime-protection of your antivirus and anti-malware programs because they might interfere with the scan.
  • Start installer.pngwith administartor privileges.
  • Select the option Yes, I accept the Terms of Use and click on Start.
  • Choose the following settings:
settings.png
  • Click on Start. The virus signature database will begin to download. This may take some time.
  • When completed the Online Scan will begin automatically.
    Note: This scan might take a long time! Please be patient.
  • When completed select Uninstall application on close if you so wish, but make sure you copy the logfile first!
  • Now click on Finish
  • A log filelog.pngis created at logpath.png
    Copy and paste the content of this log file in your next reply.
esetlog.png
Note: Do not forget to re-enable your antivirus application after running the above scan!
eset.gif
regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#9 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 13 February 2015 - 06:13 PM

It took a long time here :

 

C:\Program Files\Advanced Port Scanner\Advanced Port Scanner.exe        Win32/NetTool.Portscan.AC potentially unsafe application

C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\Desktop.zip        probably unknown NewHeur_PE virus

C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\vulcan_crack.rar probably unknown NewHeur_PE virus

C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\_release.rar          probably unknown NewHeur_PE virus

C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\!release\vfxexe.exe         probably unknown NewHeur_PE virus



#10 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 13 February 2015 - 06:18 PM

Can you please try to post the eset log as instructed?


regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#11 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 13 February 2015 - 07:07 PM

I think I have to run it again - another 3 hours I guess-becasue I forgot to get the log file. my bad. so sorry

 

 

Sorry

TFM



#12 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 14 February 2015 - 12:39 AM

Finally: here is teh log.txt

 

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=66c28bc918f0ba4aadb97f74053c839a

# engine=22467

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2015-02-14 05:11:00

# local_time=2015-02-13 10:11:00 (-0700, Mountain Standard Time)

# country="United States"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Microsoft Security Essentials'

# compatibility_mode=5895 16777213 100 100 0 117956664 0 0

# scanned=448000

# found=5

# cleaned=0

# scan_time=17922

sh=A56FF8B2399D43DF8268CF943291FC7263C2F888 ft=1 fh=714d56fd7dd51d9e vn="Win32/NetTool.Portscan.AC potentially unsafe application" ac=I fn="C:\Program Files\Advanced Port Scanner\Advanced Port Scanner.exe"

sh=B8E20832CC8C9E7F67B6CBC416D3653136B828B6 ft=0 fh=0000000000000000 vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\Desktop.zip"

sh=B83092C6117A6336B8C36FB778CAC297D4EE534B ft=0 fh=0000000000000000 vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\vulcan_crack.rar"

sh=B83092C6117A6336B8C36FB778CAC297D4EE534B ft=0 fh=0000000000000000 vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\_release.rar"

sh=63E672A1D3E69DBA389DD64317342EEDF7261D71 ft=1 fh=bbeb4acd324b6dcb vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\!release\vfxexe.exe"



#13 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 14 February 2015 - 04:37 AM

goGMWSt.gifCRACKED SOFTWARE WARNING

Participating in the use of cracked/pirated/keygen software is not only illegal but also a security risk. Were you aware your machine has cracked software installed? I do not approve of nor support illegal software.

Malware authors promote and release cracked software to spread their infections. I strongly recommend you refrain from participating in this activity; your computer will be repeatedly infected otherwise. Simply visiting a cracked software site can result in infection via drive-by exploits of vulnerable software.

Cracked software will make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. In some instances an infection may cause so much damage to your system that recovery is not possible and the only option is to reformat your Hard Drive and reinstall your Operating System. Please read the following articles for more information.

Step 1

Upload File(s) to
virustotal.png
I want you to upload the following file(s) to an online virus-scanner to scan.

  • Click the Choose File button.
  • Please copy/paste the following text into the 'File name:' box:
    C:\Users\FM\Desktop\Books and Articles\Books and articles2\VULCAN 7.5\V\!release\vfxexe.exe
    
  • Click Open then click the Scan it! button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File already analyzed: click Reanalyse
  • Copy and Paste the link of the result page in your reply.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#14 tf777f

tf777f
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 14 February 2015 - 09:17 AM

hi,

per your request here is the link:

https://www.virustotal.com/en/file/5fee66ead8726d93fbd26462d80ccb9c19fdcf0f027a3cdddc02654a63986c1d/analysis/1423923301/

 

thanks for the advice on the cracked SW. I am still reading the information links. but i learned my leasson. thanks for the great advice.

 

tfm



#15 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:04:28 AM

Posted 14 February 2015 - 09:25 AM

Step 1

frst.pngfrstscan.png

Start FRST with administator privileges.
  • Make sure the following option is checked: addition.png
  • Press the Scan button.
  • When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
    Please copy and paste these logs in your next reply.
lesestoff.png

Can you please tell me which problems still persist now?
How is the computer running?

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users