TechSpot

Cleaned up laptop is not really clean...

Solved
By MatSeven
Oct 25, 2012
Topic Status:
Not open for further replies.
  1. Hi,

    I'm running Windows Vista on my laptop which has has a virus problem for a couple of weeks now.

    I had a malicious pop up which led to a white screen/frozen system. I took it into an IT guy who did a clean up and apparently removed several Trojans. I was relieved to be back in my system again however it is still not funtioning properly, recurring problems are:

    Odd behaviour of Hotmail (messages randomly being copied and deleted);
    'Ebay account blocked' message, asking me to input name, address, credit card details etc;
    Paypal transactions missing on the site;
    Repeated Error 404 messages on Google;
    Difficulty accessing any type of security/anti virus websites eg I had to go in a very roundabout way to get Microsoft Security Essentials and also Malwarebytes.

    AVG Free had not detected any recent threats so I removed it and installed MSE, did a detailed scan which took 4 hours and found/removed several items even after the IT guy's clean up.

    After browsing this site today I also downloaded Malwarebytes which found further items and removed them (details below).

    I also ran a GMER scan (results below). Does this software merely identify threats or would it have removed them as well?

    I tried to do a DDS scan afterwards as per instructions on the forum sticky however my computer showed an alert that the programme could be dangerous and damage my computer so I backed off in advance of asking for advice!

    This is today's Malwarebyte's log (items all removed):

    25/10/2012 10:51:49
    mbam-log-2012-10-25 (10-51-49).txt
    Scan type: Full scan (C:\|D:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 358827
    Time elapsed: 1 hour(s), 42 minute(s), 49 second(s)
    Memory Processes Detected: 0
    (No malicious items detected)
    Memory Modules Detected: 0
    (No malicious items detected)
    Registry Keys Detected: 0
    (No malicious items detected)
    Registry Values Detected: 3
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\TAMARA~1\LOCALS~1\Temp\msuihruj.scr -> Delete on reboot.
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\TAMARA~1\LOCALS~1\Temp\msuihruj.scr -> Delete on reboot.
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell (Trojan.Agent) -> Data: explorer.exe,C:\Users\Tamara Fulcher\AppData\Roaming\msconfig.dat -> Quarantined and deleted successfully.
    Registry Data Items Detected: 1
    HKCR\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InProcServer32| (Trojan.0Access) -> Bad: (C:\$Recycle.Bin\S-1-5-21-2230609155-3124472653-3679513960-1003\$a3074f9df956c8853aa9dd6dc2e1c1ba\n.) Good: (shell32.dll) -> Quarantined and repaired successfully.
    Folders Detected: 0
    (No malicious items detected)
    Files Detected: 0
    (No malicious items detected)
    (end)

    This is from the GMER notepad log (scan performed after Malwarebytes):

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-10-25 13:05:56
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS543232L9A300 rev.FB4OC4CC
    Running: iyhxyuhz.exe; Driver: C:\Users\TAMARA~1\AppData\Local\Temp\uxrdypod.sys

    ---- Devices - GMER 1.0.15 ----
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    ---- EOF - GMER 1.0.15 ----
  2. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    Sorry I meant to sign off with thanks but the website keeps 'not responding' and I have to repeatedly recover the webpage. There's clearly something still going on and I'm really worried about accessing any websites or online accounts as part of the problem (eg the ebay issue) seems to be potential identity theft.
  3. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello, and welcome to TechSpot.


    [​IMG] Please see here for the board rules and other FAQ.

    Please feel free to introduce yourself, after you follow the steps below to get started.

    Information
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.


    Please download AdwCleaner by Xplode onto your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Delete.
    • A logfile will automatically open after the scan has finished.
    • Please post the content of that logfile in your reply.
    • You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.


    ComboFix scan

    Please download ComboFix[​IMG] by sUBs
    From BleepingComputer.com

    Please save the file to your Desktop.

    Important information about ComboFix


    After the download:
    • Close any open browsers.
    • Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
    • If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.
    Running ComboFix:
    • Double click on ComboFix.exe & follow the prompts.
    • When ComboFix finishes, it will produce a report for you.
    • Please post the report, which will launch or be found at "C:\Combo-Fix.txt" in your next reply.
    Troubleshooting ComboFix

    Safe Mode:

    If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

    (To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
    logo appears. A list of options will appear, select "Safe Mode.")

    Re-downloading:

    If this doesn't work either, try the same method (above method), but try to download it again, except name
    ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

    Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

    NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
  4. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    # AdwCleaner v2.005 - Logfile created 10/26/2012 at 11:35:50
    # Updated 14/10/2012 by Xplode
    # Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
    # User : Tamara Fulcher - NEWLAPTOP
    # Boot Mode : Normal
    # Running from : C:\Users\Tamara Fulcher\Downloads\adwcleaner.exe
    # Option [Delete]

    ***** [Services] *****

    ***** [Files / Folders] *****
    Deleted on reboot : C:\Users\TAMARA~1\AppData\Local\Temp\Zynga
    Folder Deleted : C:\Program Files\Ask.com
    Folder Deleted : C:\Program Files\AVG Secure Search
    Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
    Folder Deleted : C:\ProgramData\AVG Secure Search
    Folder Deleted : C:\Users\Tamara Fulcher\AppData\LocalLow\AskToolbar
    Folder Deleted : C:\Users\Tamara Fulcher\AppData\LocalLow\AVG Secure Search
    Folder Deleted : C:\Users\TAMARA~1\AppData\Local\Temp\AskSearch
    Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
    ***** [Registry] *****
    Key Deleted : HKCU\Software\AppDataLow\AskToolbarInfo
    Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
    Key Deleted : HKCU\Software\Ask.com
    Key Deleted : HKCU\Software\AVG Secure Search
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\Software\AVG Secure Search
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
    Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
    Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
    Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
    Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
    Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
    ***** [Internet Browsers] *****
    -\\ Internet Explorer v9.0.8112.16421
    [OK] Registry is clean.
    -\\ Google Chrome v [Unable to get version]
    File : C:\Users\Tamara Fulcher\AppData\Local\Google\Chrome\User Data\Default\Preferences
    [OK] File is clean.
    File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences
    [OK] File is clean.
    *************************
    AdwCleaner[R1].txt - [7885 octets] - [26/10/2012 11:33:24]
    AdwCleaner[S1].txt - [7382 octets] - [26/10/2012 11:35:50]
    ########## EOF - C:\AdwCleaner[S1].txt - [7442 octets] ##########

    Above is the AdwCleaner log. I will have to do ComboFix later when I have a bit more time to focus, will post again when I'm done. Thanks again for your help it's so much appreciated that people volunteer their expertise like this.
  5. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    Hi. Didn't take me as long as I expected to run ComboFix. Log report as follows:

    ComboFix 12-10-26.01 - Tamara Fulcher 26/10/2012 13:41:33.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2941.1843 [GMT 1:00]
    Running from: c:\users\Tamara Fulcher\Downloads\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\windows
    c:\programdata\Windows\dsdd.dat
    c:\programdata\windows\nudr.dat
    c:\users\Tamara Fulcher\AppData\Roaming\Pyamo
    c:\users\Tamara Fulcher\AppData\Roaming\Pyamo\ehnag.sop
    c:\users\Tamara Fulcher\AppData\Roaming\Zyuvym
    c:\users\Tamara Fulcher\AppData\Roaming\Zyuvym\yphow.exe
    d:\tam\~WRD0000.tmp
    d:\tam\~WRL0003.tmp
    d:\tam\~WRL3414.tmp
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-09-26 to 2012-10-26 )))))))))))))))))))))))))))))))
    .
    .
    2012-10-26 12:49 . 2012-10-26 12:49 -------- d-----w- c:\users\Tamara Fulcher\AppData\Local\temp
    2012-10-26 12:49 . 2012-10-26 12:49 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-10-26 10:24 . 2012-10-26 10:24 -------- d-----w- c:\program files\Common Files\Java
    2012-10-26 10:23 . 2012-10-26 10:23 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
    2012-10-25 14:38 . 2012-10-25 14:38 -------- d-----w- c:\users\Tamara Fulcher\AppData\Roaming\SUPERAntiSpyware.com
    2012-10-25 14:38 . 2012-10-25 14:38 -------- d-----w- c:\program files\SUPERAntiSpyware
    2012-10-25 14:38 . 2012-10-25 14:38 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2012-10-25 09:50 . 2012-10-25 09:50 -------- d-----w- c:\users\Tamara Fulcher\AppData\Roaming\Malwarebytes
    2012-10-25 09:50 . 2012-09-29 18:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-10-25 09:50 . 2012-10-25 09:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-10-22 10:40 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys
    2012-10-22 09:16 . 2012-10-22 09:16 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1C367E82-0432-41BA-A934-9905E251D83F}\offreg.dll
    2012-10-21 16:56 . 2012-10-17 01:32 6918632 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1C367E82-0432-41BA-A934-9905E251D83F}\mpengine.dll
    2012-10-21 16:50 . 2012-10-24 15:45 -------- d-----w- c:\users\Tamara Fulcher\AppData\Roaming\Cuomw
    2012-10-21 16:50 . 2012-10-21 16:50 -------- d-----w- c:\users\Tamara Fulcher\AppData\Roaming\Yxseu
    2012-10-18 10:19 . 2012-10-18 10:19 -------- d-----w- c:\programdata\Malwarebytes
    2012-10-18 09:55 . 2012-10-18 09:57 -------- d-----w- c:\users\Administrator
    2012-10-16 19:19 . 2012-10-23 07:33 -------- d-----w- c:\users\Tamara Fulcher\AppData\Roaming\Afywxu
    2012-10-16 19:19 . 2012-10-16 19:19 -------- d-----w- c:\users\Tamara Fulcher\AppData\Roaming\Zaeh
    2012-10-11 09:03 . 2012-08-24 15:53 172544 ----a-w- c:\windows\system32\wintrust.dll
    2012-10-11 09:03 . 2012-09-13 13:28 2048 ----a-w- c:\windows\system32\tzres.dll
    2012-10-11 09:03 . 2012-08-29 11:27 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2012-10-11 09:03 . 2012-08-29 11:27 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-10-11 09:03 . 2012-06-02 00:02 985088 ----a-w- c:\windows\system32\crypt32.dll
    2012-10-11 09:03 . 2012-06-02 00:02 98304 ----a-w- c:\windows\system32\cryptnet.dll
    2012-10-11 09:03 . 2012-06-02 00:02 133120 ----a-w- c:\windows\system32\cryptsvc.dll
    2012-10-09 09:05 . 2012-10-09 09:05 9575864 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-10-26 10:23 . 2010-06-30 06:05 473072 ----a-w- c:\windows\system32\deployJava1.dll
    2012-10-09 09:05 . 2012-05-10 12:13 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-10-09 09:05 . 2011-06-21 07:20 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-08-24 06:59 . 2012-09-24 09:02 1800704 ----a-w- c:\windows\system32\jscript9.dll
    2012-08-24 06:51 . 2012-09-24 09:02 1129472 ----a-w- c:\windows\system32\wininet.dll
    2012-08-24 06:51 . 2012-09-24 09:02 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
    2012-08-24 06:47 . 2012-09-24 09:02 142848 ----a-w- c:\windows\system32\ieUnatt.exe
    2012-08-24 06:47 . 2012-09-24 09:02 420864 ----a-w- c:\windows\system32\vbscript.dll
    2012-08-24 06:43 . 2012-09-24 09:02 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-07-30 2363392]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-05-25 102400]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-30 39408]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
    "Spotify Web Helper"="c:\users\Tamara Fulcher\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-10 932528]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-10-16 4762496]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2008-09-24 6335008]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1049896]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
    "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 80896]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-14 2565520]
    "CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-08-04 1612920]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
    .
    c:\users\Tamara Fulcher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-8-25 727592]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001
    .
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - NisDrv
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-07-30 01:39 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-10-26 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 09:45]
    .
    2012-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 17:45]
    .
    2012-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-06 17:45]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.2.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    HKCU-Run-Obhai - c:\users\Tamara Fulcher\AppData\Roaming\Zyuvym\yphow.exe
    HKLM-Run-NPSStartup - (no file)
    HKLM-Run-vProt - c:\program files\AVG Secure Search\vprot.exe
    HKLM-Run-ROC_roc_dec12 - c:\program files\AVG Secure Search\ROC_roc_dec12.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-10-26 13:49
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2012-10-26 13:51:18
    ComboFix-quarantined-files.txt 2012-10-26 12:51
    .
    Pre-Run: 37,812,899,840 bytes free
    Post-Run: 40,461,225,984 bytes free
    .
    - - End Of File - - D6A999F8BD87F2814651F22C2C479295
  6. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    Just to add, I've just looked about a bit online and post ComboFix I'm (so far!) no longer getting the 'give us your name address and credit card details' page from pretend ebay, nor am I getting the constant redirects to Google homepage. So, much better already, cheers :)
  7. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Excellent!

    CapperKiller Scan

    The CapperKiller utility is designed for treating the aftermaths of a Trojan-Banker.Win32.Capper infection.

    How to use the utility:
    • Download the CapperKiller.exe utility.
    • Run CapperKiller.exe

      [​IMG]
    • A reboot may be required after the treatment. Please make sure it reboots, if it asks.
    • A report will be created in your root directory, (usually C:\ folder) in the form of "CapperKiller.[Version]_[Date]_[Time]_log.txt".
    • Please copy and paste its contents on your next reply.
    • Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

    TDSSKiller Scan

    Please download and run TDSSKiller to your desktop as outlined below:

    Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    For Windows XP, double-click to start.
    For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

    [​IMG]

    -------------------------

    Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

    [​IMG]

    ------------------------

    Click the Start Scan button.

    [​IMG]

    -----------------------

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue


    [​IMG]

    ----------------------

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.


    [​IMG]


    --------------------

    A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
    Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

    -------------------

    Here's a summary of what to do if you would like to print it out:

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  8. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    Hi DMJ and thanks again for further help.

    However - not working! I've tried clicking on both links; my computer downloads them but does not give me the option to 'Run'. Asks whether I want to 'Open' instead, and when I click to do so a small window comes up asking what I want to use to open the file eg Adobe, Notepad, Windows Media Centre, Paint (?!) etc. Have looked for them via Control Panel and also created a shortcut on Desktop but can't seem to get an option to Run. Apologies if I'm being thick but don't know what to do.
  9. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    OK I managed to Run CapperKiller via the downloads page on TechSpot. It didn't find any threats and didn't ask for a reboot. I looked at the report but it wouldn't let me copy it? Will try and get TDSS now...
  10. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    CapperKiller log:

    15:42:28.0444 1424 Trojan-Banker.Win32.Capper removal tool 1.0.5.0 Oct 17 2012 09:06:44
    15:42:28.0780 1424 ============================================================
    15:42:28.0781 1424 Current date / time: 2012/10/27 15:42:28.0780
    15:42:28.0781 1424 SystemInfo:
    15:42:28.0781 1424
    15:42:28.0781 1424 OS Version: 6.0.6002 ServicePack: 2.0
    15:42:28.0781 1424 Product type: Workstation
    15:42:28.0781 1424 ComputerName: NEWLAPTOP
    15:42:28.0782 1424 UserName: Tamara Fulcher
    15:42:28.0782 1424 Windows directory: C:\Windows
    15:42:28.0782 1424 System windows directory: C:\Windows
    15:42:28.0782 1424 Processor architecture: Intel x86
    15:42:28.0782 1424 Number of processors: 2
    15:42:28.0782 1424 Page size: 0x1000
    15:42:28.0782 1424 Boot type: Normal boot
    15:42:28.0782 1424 ============================================================
    15:42:28.0783 1424 Initialize success
    15:42:28.0783 1424 ============================================================
    15:42:50.0992 6076 ================================================================================
    15:42:50.0992 6076 Scan started
    15:42:50.0992 6076 ================================================================================
    15:42:50.0992 6076 ProcessDriveEnumEx: Drive C:\ type 3:0
    15:48:46.0748 6076 ProcessDriveEnumEx: Drive D:\ type 3:0
    15:48:56.0992 6076 ProcessDriveEnumEx: Drive E:\ type 5:0
    15:48:56.0995 6076 ================================================================================
    15:48:56.0995 6076 Scan finished
    15:48:56.0995 6076 ================================================================================
    15:50:33.0441 5764 Deinitialize success
  11. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    TDSS Log (in 2 parts):

    16:00:04.0675 5620 TDSS rootkit removing tool 2.8.13.0 Oct 12 2012 17:26:47
    16:00:05.0113 5620 ============================================================
    16:00:05.0113 5620 Current date / time: 2012/10/27 16:00:05.0113
    16:00:05.0113 5620 SystemInfo:
    16:00:05.0113 5620
    16:00:05.0113 5620 OS Version: 6.0.6002 ServicePack: 2.0
    16:00:05.0113 5620 Product type: Workstation
    16:00:05.0113 5620 ComputerName: NEWLAPTOP
    16:00:05.0114 5620 UserName: Tamara Fulcher
    16:00:05.0114 5620 Windows directory: C:\Windows
    16:00:05.0114 5620 System windows directory: C:\Windows
    16:00:05.0114 5620 Processor architecture: Intel x86
    16:00:05.0114 5620 Number of processors: 2
    16:00:05.0114 5620 Page size: 0x1000
    16:00:05.0114 5620 Boot type: Normal boot
    16:00:05.0114 5620 ============================================================
    16:00:06.0906 5620 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
    16:00:06.0909 5620 ============================================================
    16:00:06.0909 5620 \Device\Harddisk0\DR0:
    16:00:06.0910 5620 MBR partitions:
    16:00:06.0910 5620 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1400800, BlocksNum 0xAC2C800
    16:00:06.0910 5620 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC02D000, BlocksNum 0x19401000
    16:00:06.0910 5620 ============================================================
    16:00:06.0937 5620 C: <-> \Device\Harddisk0\DR0\Partition1
    16:00:06.0990 5620 D: <-> \Device\Harddisk0\DR0\Partition2
    16:00:06.0990 5620 ============================================================
    16:00:06.0990 5620 Initialize success
    16:00:06.0990 5620 ============================================================
    16:01:21.0860 5700 ============================================================
    16:01:21.0860 5700 Scan started
    16:01:21.0860 5700 Mode: Manual; SigCheck; TDLFS;
    16:01:21.0860 5700 ============================================================
    16:01:22.0316 5700 ================ Scan system memory ========================
    16:01:22.0316 5700 System memory - ok
    16:01:22.0317 5700 ================ Scan services =============================
    16:01:22.0383 5700 [ 01E81C84AD1D0ACC61CF3CFD06632210 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    16:01:22.0590 5700 !SASCORE - ok
    16:01:22.0833 5700 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
    16:01:22.0873 5700 ACPI - ok
    16:01:22.0949 5700 [ E12CFCF1DDBFC50948A75E6E38793225 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    16:01:22.0971 5700 AdobeFlashPlayerUpdateSvc - ok
    16:01:23.0028 5700 [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
    16:01:23.0076 5700 adp94xx - ok
    16:01:23.0112 5700 [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci C:\Windows\system32\drivers\adpahci.sys
    16:01:23.0151 5700 adpahci - ok
    16:01:23.0173 5700 [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
    16:01:23.0205 5700 adpu160m - ok
    16:01:23.0232 5700 [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
    16:01:23.0257 5700 adpu320 - ok
    16:01:23.0303 5700 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
    16:01:23.0347 5700 AeLookupSvc - ok
    16:01:23.0396 5700 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
    16:01:23.0448 5700 AFD - ok
    16:01:23.0521 5700 [ 1CFEBA39FC613E45B49D3EDDFBCDA289 ] AgereSoftModem C:\Windows\system32\DRIVERS\AGRSM.sys
    16:01:23.0621 5700 AgereSoftModem - ok
    16:01:23.0687 5700 [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440 C:\Windows\system32\drivers\agp440.sys
    16:01:23.0716 5700 agp440 - ok
    16:01:23.0751 5700 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
    16:01:23.0779 5700 aic78xx - ok
    16:01:23.0811 5700 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
    16:01:23.0874 5700 ALG - ok
    16:01:23.0899 5700 [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide C:\Windows\system32\drivers\aliide.sys
    16:01:23.0925 5700 aliide - ok
    16:01:23.0946 5700 [ C47344BC706E5F0B9DCE369516661578 ] amdagp C:\Windows\system32\drivers\amdagp.sys
    16:01:23.0964 5700 amdagp - ok
    16:01:23.0986 5700 [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide C:\Windows\system32\drivers\amdide.sys
    16:01:24.0001 5700 amdide - ok
    16:01:24.0047 5700 [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
    16:01:24.0081 5700 AmdK7 - ok
    16:01:24.0098 5700 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
    16:01:24.0145 5700 AmdK8 - ok
    16:01:24.0193 5700 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
    16:01:24.0231 5700 Appinfo - ok
    16:01:24.0323 5700 [ D503DF3ABA595F551B98B9BAE017A271 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    16:01:24.0350 5700 Apple Mobile Device - ok
    16:01:24.0395 5700 [ 5D2888182FB46632511ACEE92FDAD522 ] arc C:\Windows\system32\drivers\arc.sys
    16:01:24.0423 5700 arc - ok
    16:01:24.0455 5700 [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas C:\Windows\system32\drivers\arcsas.sys
    16:01:24.0470 5700 arcsas - ok
    16:01:24.0513 5700 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
    16:01:24.0543 5700 AsyncMac - ok
    16:01:24.0566 5700 [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi C:\Windows\system32\drivers\atapi.sys
    16:01:24.0581 5700 atapi - ok
    16:01:24.0626 5700 [ 600EFE56F37ADBD65A0FB076B50D1B8D ] athr C:\Windows\system32\DRIVERS\athr.sys
    16:01:24.0782 5700 athr - ok
    16:01:24.0843 5700 [ 09474A86689571309E577A3C141E66C0 ] Ati External Event Utility C:\Windows\system32\Ati2evxx.exe
    16:01:24.0963 5700 Ati External Event Utility - ok
    16:01:25.0160 5700 [ 9E2D80FA460C42E07B67A2A743BA177C ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
    16:01:25.0302 5700 atikmdag - ok
    16:01:25.0348 5700 [ 5A1465AD2E7C1BC39CDA12A355329096 ] AtiPcie C:\Windows\system32\DRIVERS\AtiPcie.sys
    16:01:25.0365 5700 AtiPcie - ok
    16:01:25.0421 5700 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
    16:01:25.0459 5700 AudioEndpointBuilder - ok
    16:01:25.0471 5700 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
    16:01:25.0498 5700 Audiosrv - ok
    16:01:25.0560 5700 [ 08015D34F6FDD0B355805BAD978497C3 ] bcm4sbxp C:\Windows\system32\DRIVERS\bcm4sbxp.sys
    16:01:25.0616 5700 bcm4sbxp - ok
    16:01:25.0704 5700 [ 6163664C7E9CD110AF70180C126C3FDC ] BcmSqlStartupSvc C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    16:01:25.0718 5700 BcmSqlStartupSvc - ok
    16:01:25.0738 5700 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
    16:01:25.0790 5700 Beep - ok
    16:01:25.0843 5700 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
    16:01:25.0890 5700 BFE - ok
    16:01:25.0973 5700 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\system32\qmgr.dll
    16:01:26.0029 5700 BITS - ok
    16:01:26.0083 5700 [ D4DF28447741FD3D953526E33A617397 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
    16:01:26.0139 5700 blbdrive - ok
    16:01:26.0237 5700 [ EBAD0F51D8D4DADE7660B1851ADDBD07 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
    16:01:26.0272 5700 Bonjour Service - ok
    16:01:26.0324 5700 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
    16:01:26.0353 5700 bowser - ok
    16:01:26.0392 5700 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
    16:01:26.0428 5700 BrFiltLo - ok
    16:01:26.0447 5700 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
    16:01:26.0474 5700 BrFiltUp - ok
    16:01:26.0503 5700 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
    16:01:26.0545 5700 Browser - ok
    16:01:26.0568 5700 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
    16:01:26.0634 5700 Brserid - ok
    16:01:26.0662 5700 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
    16:01:26.0715 5700 BrSerWdm - ok
    16:01:26.0733 5700 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
    16:01:26.0787 5700 BrUsbMdm - ok
    16:01:26.0805 5700 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
    16:01:26.0879 5700 BrUsbSer - ok
    16:01:26.0925 5700 [ DA7B195275BDA7F8FCF79B40E0F45DDE ] BthEnum C:\Windows\system32\DRIVERS\BthEnum.sys
    16:01:26.0945 5700 BthEnum - ok
    16:01:26.0977 5700 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
    16:01:27.0028 5700 BTHMODEM - ok
    16:01:27.0044 5700 [ 5904EFA25F829BF84EA6FB045134A1D8 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
    16:01:27.0075 5700 BthPan - ok
    16:01:27.0111 5700 [ 73D53F8E90550BA81E2CF44A0873B410 ] BTHPORT C:\Windows\system32\Drivers\BTHport.sys
    16:01:27.0128 5700 BTHPORT - ok
    16:01:27.0163 5700 [ A4C8377FA4A994E07075107DBE2E3DCE ] BthServ C:\Windows\System32\bthserv.dll
    16:01:27.0199 5700 BthServ - ok
    16:01:27.0214 5700 [ 32045A4BB143BBC5BAB1298C4E9E309A ] BTHUSB C:\Windows\system32\Drivers\BTHUSB.sys
    16:01:27.0229 5700 BTHUSB - ok
    16:01:27.0285 5700 [ 3EA1A20DC0CA1AD23E7AA8C37A91BCD1 ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
    16:01:27.0299 5700 btwaudio - ok
    16:01:27.0322 5700 [ 195872E48A7FB01F8BC9B800F70F4054 ] btwavdt C:\Windows\system32\drivers\btwavdt.sys
    16:01:27.0335 5700 btwavdt - ok
    16:01:27.0365 5700 [ 0724E7D6C9B6A289EDDDA33FA8176E80 ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
    16:01:27.0377 5700 btwrchid - ok
    16:01:27.0466 5700 catchme - ok
    16:01:27.0518 5700 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
    16:01:27.0570 5700 cdfs - ok
    16:01:27.0607 5700 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
    16:01:27.0652 5700 cdrom - ok
    16:01:27.0696 5700 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
    16:01:27.0737 5700 CertPropSvc - ok
    16:01:27.0754 5700 [ E5D4133F37219DBCFE102BC61072589D ] circlass C:\Windows\system32\drivers\circlass.sys
    16:01:27.0809 5700 circlass - ok
    16:01:27.0864 5700 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
    16:01:27.0884 5700 CLFS - ok
    16:01:27.0936 5700 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    16:01:27.0950 5700 clr_optimization_v2.0.50727_32 - ok
    16:01:28.0020 5700 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    16:01:28.0035 5700 clr_optimization_v4.0.30319_32 - ok
    16:01:28.0085 5700 [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
    16:01:28.0130 5700 CmBatt - ok
    16:01:28.0155 5700 [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide C:\Windows\system32\drivers\cmdide.sys
    16:01:28.0169 5700 cmdide - ok
    16:01:28.0191 5700 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
    16:01:28.0205 5700 Compbatt - ok
    16:01:28.0215 5700 COMSysApp - ok
    16:01:28.0230 5700 [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
    16:01:28.0249 5700 crcdisk - ok
    16:01:28.0271 5700 [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe C:\Windows\system32\drivers\crusoe.sys
    16:01:28.0303 5700 Crusoe - ok
    16:01:28.0358 5700 [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc C:\Windows\system32\cryptsvc.dll
    16:01:28.0382 5700 CryptSvc - ok
    16:01:28.0452 5700 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
    16:01:28.0516 5700 DcomLaunch - ok
    16:01:28.0550 5700 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
    16:01:28.0582 5700 DfsC - ok
    16:01:28.0680 5700 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
    16:01:28.0855 5700 DFSR - ok
    16:01:28.0923 5700 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
    16:01:28.0970 5700 Dhcp - ok
    16:01:29.0022 5700 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
    16:01:29.0038 5700 disk - ok
    16:01:29.0086 5700 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
    16:01:29.0109 5700 Dnscache - ok
    16:01:29.0151 5700 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
    16:01:29.0197 5700 dot3svc - ok
    16:01:29.0243 5700 [ 4F59C172C094E1A1D46463A8DC061CBD ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys
    16:01:29.0286 5700 Dot4 - ok
    16:01:29.0323 5700 [ 80BF3BA09F6F2523C8F6B7CC6DBF7BD5 ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys
    16:01:29.0353 5700 Dot4Print - ok
    16:01:29.0391 5700 [ C55004CA6B419B6695970DFE849B122F ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys
    16:01:29.0439 5700 dot4usb - ok
    16:01:29.0471 5700 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
    16:01:29.0509 5700 DPS - ok
    16:01:29.0548 5700 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
    16:01:29.0571 5700 drmkaud - ok
    16:01:29.0629 5700 [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
    16:01:29.0659 5700 DXGKrnl - ok
    16:01:29.0701 5700 [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
    16:01:29.0733 5700 E1G60 - ok
    16:01:29.0769 5700 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
    16:01:29.0797 5700 EapHost - ok
    16:01:29.0851 5700 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
    16:01:29.0883 5700 Ecache - ok
    16:01:29.0933 5700 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
    16:01:29.0998 5700 ehRecvr - ok
    16:01:30.0020 5700 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
    16:01:30.0054 5700 ehSched - ok
    16:01:30.0073 5700 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
    16:01:30.0098 5700 ehstart - ok
    16:01:30.0152 5700 [ 23B62471681A124889978F6295B3F4C6 ] elxstor C:\Windows\system32\drivers\elxstor.sys
    16:01:30.0193 5700 elxstor - ok
    16:01:30.0257 5700 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
    16:01:30.0290 5700 EMDMgmt - ok
    16:01:30.0336 5700 [ 3DB974F3935483555D7148663F726C61 ] ErrDev C:\Windows\system32\drivers\errdev.sys
    16:01:30.0366 5700 ErrDev - ok
    16:01:30.0426 5700 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
    16:01:30.0460 5700 EventSystem - ok
    16:01:30.0510 5700 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
    16:01:30.0550 5700 exfat - ok
    16:01:30.0589 5700 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
    16:01:30.0614 5700 fastfat - ok
    16:01:30.0664 5700 [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
    16:01:30.0712 5700 fdc - ok
    16:01:30.0740 5700 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
    16:01:30.0783 5700 fdPHost - ok
    16:01:30.0796 5700 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
    16:01:30.0849 5700 FDResPub - ok
    16:01:30.0876 5700 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
    16:01:30.0904 5700 FileInfo - ok
    16:01:30.0932 5700 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
    16:01:30.0962 5700 Filetrace - ok
    16:01:30.0984 5700 [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
    16:01:31.0022 5700 flpydisk - ok
    16:01:31.0058 5700 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
    16:01:31.0076 5700 FltMgr - ok
    16:01:31.0149 5700 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
    16:01:31.0235 5700 FontCache - ok
    16:01:31.0297 5700 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    16:01:31.0311 5700 FontCache3.0.0.0 - ok
    16:01:31.0339 5700 [ 790A4CA68F44BE35967B3DF61F3E4675 ] FsUsbExDisk C:\Windows\system32\FsUsbExDisk.SYS
    16:01:31.0346 5700 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
    16:01:31.0346 5700 FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
    16:01:31.0389 5700 [ D3F9205CC4CB07553F2F9472C767EA87 ] FsUsbExService C:\Windows\system32\FsUsbExService.Exe
    16:01:31.0400 5700 FsUsbExService ( UnsignedFile.Multi.Generic ) - warning
    16:01:31.0400 5700 FsUsbExService - detected UnsignedFile.Multi.Generic (1)
    16:01:31.0443 5700 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
    16:01:31.0469 5700 Fs_Rec - ok
    16:01:31.0495 5700 [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
    16:01:31.0512 5700 gagp30kx - ok
    16:01:31.0567 5700 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
    16:01:31.0625 5700 gpsvc - ok
    16:01:31.0725 5700 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
    16:01:31.0750 5700 gupdate - ok
    16:01:31.0764 5700 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
    16:01:31.0788 5700 gupdatem - ok
    16:01:31.0832 5700 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    16:01:31.0860 5700 gusvc - ok
    16:01:31.0921 5700 [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
    16:01:31.0954 5700 HdAudAddService - ok
    16:01:31.0994 5700 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
    16:01:32.0039 5700 HDAudBus - ok
    16:01:32.0072 5700 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
    16:01:32.0131 5700 HidBth - ok
    16:01:32.0151 5700 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
    16:01:32.0207 5700 HidIr - ok
    16:01:32.0249 5700 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\System32\hidserv.dll
    16:01:32.0267 5700 hidserv - ok
    16:01:32.0303 5700 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
    16:01:32.0326 5700 HidUsb - ok
    16:01:32.0357 5700 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
    16:01:32.0415 5700 hkmsvc - ok
    16:01:32.0438 5700 [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
    16:01:32.0452 5700 HpCISSs - ok
    16:01:32.0553 5700 [ ED377B3C83FDEA8D906109A085D219BA ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
    16:01:32.0565 5700 hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
    16:01:32.0565 5700 hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
    16:01:32.0615 5700 [ EE4C7A4CF2316701FFDE90F404520265 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
    16:01:32.0629 5700 hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
    16:01:32.0629 5700 hpqddsvc - detected UnsignedFile.Multi.Generic (1)
    16:01:32.0677 5700 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
    16:01:32.0739 5700 HTTP - ok
    16:01:32.0805 5700 [ 92CA47DA32009CCC00A5ADED04ABBD78 ] hwdatacard C:\Windows\system32\DRIVERS\ewusbmdm.sys
    16:01:32.0835 5700 hwdatacard - ok
    16:01:32.0884 5700 [ 1D4D6D24256F61E6B08A3CF8184A78B8 ] hwusbfake C:\Windows\system32\DRIVERS\ewusbfake.sys
    16:01:32.0906 5700 hwusbfake - ok
    16:01:32.0955 5700 [ C6B032D69650985468160FC9937CF5B4 ] i2omp C:\Windows\system32\drivers\i2omp.sys
    16:01:32.0981 5700 i2omp - ok
    16:01:33.0024 5700 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
    16:01:33.0067 5700 i8042prt - ok
    16:01:33.0141 5700 [ 496DB78E6A0C4C44023D9A92B4A7AC31 ] ialm C:\Windows\system32\DRIVERS\igdkmd32.sys
    16:01:33.0407 5700 ialm - ok
    16:01:33.0440 5700 [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
    16:01:33.0475 5700 iaStorV - ok
    16:01:33.0544 5700 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    16:01:33.0660 5700 idsvc - ok
    16:01:33.0692 5700 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
    16:01:33.0706 5700 iirsp - ok
    16:01:33.0760 5700 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
    16:01:33.0792 5700 IKEEXT - ok
    16:01:33.0886 5700 [ 0E70E4485F0ED782248E26353A08D312 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
    16:01:34.0141 5700 IntcAzAudAddService - ok
    16:01:34.0179 5700 [ 83AA759F3189E6370C30DE5DC5590718 ] intelide C:\Windows\system32\drivers\intelide.sys
    16:01:34.0206 5700 intelide - ok
    16:01:34.0251 5700 [ 224191001E78C89DFA78924C3EA595FF ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
    16:01:34.0295 5700 intelppm - ok
    16:01:34.0329 5700 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
    16:01:34.0370 5700 IPBusEnum - ok
    16:01:34.0394 5700 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
    16:01:34.0443 5700 IpFilterDriver - ok
    16:01:34.0490 5700 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
    16:01:34.0522 5700 iphlpsvc - ok
    16:01:34.0530 5700 IpInIp - ok
    16:01:34.0570 5700 [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
    16:01:34.0624 5700 IPMIDRV - ok
    16:01:34.0644 5700 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
    16:01:34.0676 5700 IPNAT - ok
    16:01:34.0702 5700 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
    16:01:34.0736 5700 IRENUM - ok
    16:01:34.0756 5700 [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp C:\Windows\system32\drivers\isapnp.sys
    16:01:34.0774 5700 isapnp - ok
    16:01:34.0830 5700 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
    16:01:34.0848 5700 iScsiPrt - ok
    16:01:34.0873 5700 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
    16:01:34.0890 5700 iteatapi - ok
    16:01:34.0907 5700 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
    16:01:34.0927 5700 iteraid - ok
    16:01:34.0961 5700 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
    16:01:34.0977 5700 kbdclass - ok
    16:01:35.0000 5700 [ 18247836959BA67E3511B62846B9C2E0 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
    16:01:35.0051 5700 kbdhid - ok
    16:01:35.0088 5700 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
    16:01:35.0117 5700 KeyIso - ok
    16:01:35.0152 5700 [ EBC507F129DF8F0E0CA270DCFC0CF87F ] KMDFMEMIO C:\Windows\system32\DRIVERS\kmdfmemio.sys
    16:01:35.0171 5700 KMDFMEMIO - ok
    16:01:35.0217 5700 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
    16:01:35.0243 5700 KSecDD - ok
    16:01:35.0296 5700 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
    16:01:35.0367 5700 KtmRm - ok
    16:01:35.0415 5700 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\System32\srvsvc.dll
    16:01:35.0447 5700 LanmanServer - ok
    16:01:35.0483 5700 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
    16:01:35.0512 5700 LanmanWorkstation - ok
    16:01:35.0563 5700 [ 4AF65F3A2253DF7D0B8D80812EAE7A7C ] LightScribeService C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    16:01:35.0575 5700 LightScribeService ( UnsignedFile.Multi.Generic ) - warning
    16:01:35.0575 5700 LightScribeService - detected UnsignedFile.Multi.Generic (1)
    16:01:35.0604 5700 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
    16:01:35.0655 5700 lltdio - ok
    16:01:35.0690 5700 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
    16:01:35.0725 5700 lltdsvc - ok
    16:01:35.0749 5700 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
    16:01:35.0835 5700 lmhosts - ok
    16:01:35.0863 5700 [ C7E15E82879BF3235B559563D4185365 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
    16:01:35.0879 5700 LSI_FC - ok
    16:01:35.0893 5700 [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
    16:01:35.0909 5700 LSI_SAS - ok
    16:01:35.0929 5700 [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
    16:01:35.0945 5700 LSI_SCSI - ok
    16:01:35.0965 5700 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
    16:01:35.0995 5700 luafv - ok
    16:01:36.0026 5700 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
    16:01:36.0043 5700 Mcx2Svc - ok
    16:01:36.0093 5700 [ 0001CE609D66632FA17B84705F658879 ] megasas C:\Windows\system32\drivers\megasas.sys
    16:01:36.0117 5700 megasas - ok
    16:01:36.0148 5700 [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR C:\Windows\system32\drivers\megasr.sys
    16:01:36.0197 5700 MegaSR - ok
    16:01:36.0236 5700 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
    16:01:36.0269 5700 MMCSS - ok
    16:01:36.0290 5700 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
    16:01:36.0321 5700 Modem - ok
    16:01:36.0345 5700 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
    16:01:36.0376 5700 monitor - ok
    16:01:36.0398 5700 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
    16:01:36.0425 5700 mouclass - ok
    16:01:36.0447 5700 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
    16:01:36.0485 5700 mouhid - ok
    16:01:36.0524 5700 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
    16:01:36.0540 5700 MountMgr - ok
    16:01:36.0574 5700 [ EE728AF83850DDAD9A3FCAC0AAB3AD97 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
    16:01:36.0598 5700 MpFilter - ok
    16:01:36.0630 5700 [ 511D011289755DD9F9A7579FB0B064E6 ] mpio C:\Windows\system32\drivers\mpio.sys
    16:01:36.0647 5700 mpio - ok
    16:01:36.0775 5700 [ A69630D039C38018689190234F866D77 ] MpKslc7314655 C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{85306031-267C-4FD2-A691-B4901624C415}\MpKslc7314655.sys
    16:01:36.0788 5700 MpKslc7314655 - ok
    16:01:36.0813 5700 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
    16:01:36.0837 5700 mpsdrv - ok
    16:01:36.0879 5700 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
    16:01:36.0912 5700 MpsSvc - ok
    16:01:36.0944 5700 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
    16:01:36.0960 5700 Mraid35x - ok
    16:01:37.0001 5700 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
    16:01:37.0018 5700 MRxDAV - ok
    16:01:37.0056 5700 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
    16:01:37.0075 5700 mrxsmb - ok
    16:01:37.0116 5700 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
    16:01:37.0139 5700 mrxsmb10 - ok
    16:01:37.0156 5700 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
    16:01:37.0183 5700 mrxsmb20 - ok
    16:01:37.0223 5700 [ 5457DCFA7C0DA43522F4D9D4049C1472 ] msahci C:\Windows\system32\drivers\msahci.sys
    16:01:37.0250 5700 msahci - ok
    16:01:37.0292 5700 [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm C:\Windows\system32\drivers\msdsm.sys
    16:01:37.0308 5700 msdsm - ok
    16:01:37.0335 5700 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
    16:01:37.0376 5700 MSDTC - ok
    16:01:37.0416 5700 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
    16:01:37.0446 5700 Msfs - ok
    16:01:37.0474 5700 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
    16:01:37.0502 5700 msisadrv - ok
    16:01:37.0542 5700 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
    16:01:37.0574 5700 MSiSCSI - ok
    16:01:37.0581 5700 msiserver - ok
    16:01:37.0620 5700 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
    16:01:37.0671 5700 MSKSSRV - ok
    16:01:37.0721 5700 [ E077FCA2A7E79FB9BF67D3E30B5CE593 ] MsMpSvc C:\Program Files\Microsoft Security Client\MsMpEng.exe
    16:01:37.0741 5700 MsMpSvc - ok
    16:01:37.0758 5700 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
    16:01:37.0788 5700 MSPCLOCK - ok
    16:01:37.0802 5700 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
    16:01:37.0832 5700 MSPQM - ok
    16:01:37.0866 5700 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
    16:01:37.0884 5700 MsRPC - ok
    16:01:37.0920 5700 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
    16:01:37.0935 5700 mssmbios - ok
    16:01:38.0005 5700 MSSQL$MSSMLBIZ - ok
    16:01:38.0055 5700 [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
    16:01:38.0068 5700 MSSQLServerADHelper - ok
    16:01:38.0087 5700 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
    16:01:38.0121 5700 MSTEE - ok
    16:01:38.0154 5700 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
    16:01:38.0169 5700 Mup - ok
    16:01:38.0225 5700 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
    16:01:38.0254 5700 napagent - ok
    16:01:38.0299 5700 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
    16:01:38.0317 5700 NativeWifiP - ok
    16:01:38.0367 5700 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
    16:01:38.0395 5700 NDIS - ok
    16:01:38.0422 5700 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
    16:01:38.0453 5700 NdisTapi - ok
    16:01:38.0469 5700 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
    16:01:38.0522 5700 Ndisuio - ok
    16:01:38.0553 5700 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
    16:01:38.0577 5700 NdisWan - ok
     
  12. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    16:01:38.0590 5700 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
    16:01:38.0614 5700 NDProxy - ok
    16:01:38.0637 5700 [ 2969D26EEE289BE7422AA46FC55F4E38 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
    16:01:38.0644 5700 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
    16:01:38.0644 5700 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
    16:01:38.0652 5700 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
    16:01:38.0686 5700 NetBIOS - ok
    16:01:38.0722 5700 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
    16:01:38.0747 5700 netbt - ok
    16:01:38.0766 5700 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
    16:01:38.0782 5700 Netlogon - ok
    16:01:38.0816 5700 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
    16:01:38.0851 5700 Netman - ok
    16:01:38.0875 5700 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
    16:01:38.0910 5700 netprofm - ok
    16:01:38.0951 5700 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    16:01:38.0966 5700 NetTcpPortSharing - ok
    16:01:39.0055 5700 [ 35D5458D9A1B26B2005ABFFBF4C1C5E7 ] NETw3v32 C:\Windows\system32\DRIVERS\NETw3v32.sys
    16:01:39.0204 5700 NETw3v32 - ok
    16:01:39.0242 5700 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
    16:01:39.0268 5700 nfrd960 - ok
    16:01:39.0303 5700 [ 2CD24A6AF497D0E9B9BF3DA924ED05E6 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
    16:01:39.0339 5700 NisDrv - ok
    16:01:39.0388 5700 [ 3B846434055F80D9E89D0742F3ADAD34 ] NisSrv C:\Program Files\Microsoft Security Client\NisSrv.exe
    16:01:39.0432 5700 NisSrv - ok
    16:01:39.0476 5700 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
    16:01:39.0533 5700 NlaSvc - ok
    16:01:39.0577 5700 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
    16:01:39.0600 5700 Npfs - ok
    16:01:39.0616 5700 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
    16:01:39.0648 5700 nsi - ok
    16:01:39.0665 5700 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
    16:01:39.0703 5700 nsiproxy - ok
    16:01:39.0768 5700 [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
    16:01:39.0847 5700 Ntfs - ok
    16:01:39.0881 5700 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
    16:01:39.0935 5700 ntrigdigi - ok
    16:01:39.0960 5700 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
    16:01:39.0995 5700 Null - ok
    16:01:40.0028 5700 [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid C:\Windows\system32\drivers\nvraid.sys
    16:01:40.0044 5700 nvraid - ok
    16:01:40.0060 5700 [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor C:\Windows\system32\drivers\nvstor.sys
    16:01:40.0075 5700 nvstor - ok
    16:01:40.0100 5700 [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
    16:01:40.0117 5700 nv_agp - ok
    16:01:40.0123 5700 NwlnkFlt - ok
    16:01:40.0134 5700 NwlnkFwd - ok
    16:01:40.0220 5700 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
    16:01:40.0253 5700 odserv - ok
    16:01:40.0301 5700 [ 790E27C3DB53410B40FF9EF2FD10A1D9 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
    16:01:40.0355 5700 ohci1394 - ok
    16:01:40.0403 5700 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    16:01:40.0430 5700 ose - ok
    16:01:40.0486 5700 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
    16:01:40.0534 5700 p2pimsvc - ok
    16:01:40.0554 5700 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
    16:01:40.0603 5700 p2psvc - ok
    16:01:40.0631 5700 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
    16:01:40.0684 5700 Parport - ok
    16:01:40.0718 5700 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
    16:01:40.0733 5700 partmgr - ok
    16:01:40.0759 5700 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
    16:01:40.0811 5700 Parvdm - ok
    16:01:40.0847 5700 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
    16:01:40.0888 5700 PcaSvc - ok
    16:01:40.0915 5700 [ 175CC28DCF819F78CAA3FBD44AD9E52A ] pccsmcfd C:\Windows\system32\DRIVERS\pccsmcfd.sys
    16:01:40.0938 5700 pccsmcfd - ok
    16:01:40.0974 5700 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
    16:01:40.0992 5700 pci - ok
    16:01:41.0016 5700 [ FC175F5DDAB666D7F4D17449A547626F ] pciide C:\Windows\system32\drivers\pciide.sys
    16:01:41.0032 5700 pciide - ok
    16:01:41.0069 5700 [ B7C5A8769541900F6DFA6FE0C5E4D513 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
    16:01:41.0088 5700 pcmcia - ok
    16:01:41.0141 5700 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
    16:01:41.0266 5700 PEAUTH - ok
    16:01:41.0366 5700 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
    16:01:41.0563 5700 pla - ok
    16:01:41.0613 5700 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
    16:01:41.0664 5700 PlugPlay - ok
    16:01:41.0696 5700 [ BAFC9706BDF425A02B66468AB2605C59 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
    16:01:41.0708 5700 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
    16:01:41.0708 5700 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
    16:01:41.0750 5700 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
    16:01:41.0781 5700 PNRPAutoReg - ok
    16:01:41.0799 5700 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
    16:01:41.0830 5700 PNRPsvc - ok
    16:01:41.0876 5700 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
    16:01:41.0922 5700 PolicyAgent - ok
    16:01:41.0959 5700 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
    16:01:41.0998 5700 PptpMiniport - ok
    16:01:42.0015 5700 [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor C:\Windows\system32\DRIVERS\processr.sys
    16:01:42.0047 5700 Processor - ok
    16:01:42.0073 5700 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
    16:01:42.0100 5700 ProfSvc - ok
    16:01:42.0121 5700 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
    16:01:42.0138 5700 ProtectedStorage - ok
    16:01:42.0172 5700 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
    16:01:42.0199 5700 PSched - ok
    16:01:42.0254 5700 [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
    16:01:42.0392 5700 ql2300 - ok
    16:01:42.0407 5700 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
    16:01:42.0428 5700 ql40xx - ok
    16:01:42.0472 5700 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
    16:01:42.0502 5700 QWAVE - ok
    16:01:42.0541 5700 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
    16:01:42.0558 5700 QWAVEdrv - ok
    16:01:42.0573 5700 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
    16:01:42.0603 5700 RasAcd - ok
    16:01:42.0644 5700 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
    16:01:42.0677 5700 RasAuto - ok
    16:01:42.0700 5700 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
    16:01:42.0733 5700 Rasl2tp - ok
    16:01:42.0774 5700 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
    16:01:42.0803 5700 RasMan - ok
    16:01:42.0846 5700 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
    16:01:42.0869 5700 RasPppoe - ok
    16:01:42.0880 5700 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
    16:01:42.0896 5700 RasSstp - ok
    16:01:42.0944 5700 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
    16:01:42.0970 5700 rdbss - ok
    16:01:42.0993 5700 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
    16:01:43.0030 5700 RDPCDD - ok
    16:01:43.0059 5700 [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
    16:01:43.0112 5700 rdpdr - ok
    16:01:43.0119 5700 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
    16:01:43.0151 5700 RDPENCDD - ok
    16:01:43.0189 5700 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
    16:01:43.0209 5700 RDPWD - ok
    16:01:43.0253 5700 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
    16:01:43.0285 5700 RemoteAccess - ok
    16:01:43.0322 5700 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
    16:01:43.0351 5700 RemoteRegistry - ok
    16:01:43.0395 5700 [ 10536B0AD6F416FC7F1149977C28CCDC ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
    16:01:43.0412 5700 RFCOMM - ok
    16:01:43.0477 5700 [ 4D05898896EC49CF663DDA61041AB096 ] RichVideo C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    16:01:43.0496 5700 RichVideo - ok
    16:01:43.0533 5700 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
    16:01:43.0551 5700 RpcLocator - ok
    16:01:43.0582 5700 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll
    16:01:43.0617 5700 RpcSs - ok
    16:01:43.0649 5700 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
    16:01:43.0679 5700 rspndr - ok
    16:01:43.0688 5700 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
    16:01:43.0704 5700 SamSs - ok
    16:01:43.0769 5700 [ A9D840FA78F65857EB554229914F855C ] Samsung Update Plus C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe
    16:01:43.0779 5700 Samsung Update Plus ( UnsignedFile.Multi.Generic ) - warning
    16:01:43.0779 5700 Samsung Update Plus - detected UnsignedFile.Multi.Generic (1)
    16:01:43.0828 5700 [ 39763504067962108505BFF25F024345 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    16:01:43.0840 5700 SASDIFSV - ok
    16:01:43.0859 5700 [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    16:01:43.0873 5700 SASKUTIL - ok
    16:01:43.0895 5700 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
    16:01:43.0910 5700 sbp2port - ok
    16:01:43.0950 5700 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
    16:01:43.0992 5700 SCardSvr - ok
    16:01:44.0043 5700 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
    16:01:44.0099 5700 Schedule - ok
    16:01:44.0117 5700 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
    16:01:44.0160 5700 SCPolicySvc - ok
    16:01:44.0198 5700 [ 126EA89BCC413EE45E3004FB0764888F ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys
    16:01:44.0256 5700 sdbus - ok
    16:01:44.0294 5700 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
    16:01:44.0333 5700 SDRSVC - ok
    16:01:44.0366 5700 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
    16:01:44.0463 5700 secdrv - ok
    16:01:44.0484 5700 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
    16:01:44.0554 5700 seclogon - ok
    16:01:44.0574 5700 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\system32\sens.dll
    16:01:44.0633 5700 SENS - ok
    16:01:44.0658 5700 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
    16:01:44.0733 5700 Serenum - ok
    16:01:44.0781 5700 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
    16:01:44.0834 5700 Serial - ok
    16:01:44.0853 5700 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
    16:01:44.0885 5700 sermouse - ok
    16:01:44.0959 5700 [ 9D38320BB32230349379DF5DDBBF7FCE ] ServiceLayer C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    16:01:45.0004 5700 ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
    16:01:45.0004 5700 ServiceLayer - detected UnsignedFile.Multi.Generic (1)
    16:01:45.0053 5700 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
    16:01:45.0089 5700 SessionEnv - ok
    16:01:45.0112 5700 [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
    16:01:45.0136 5700 sffdisk - ok
    16:01:45.0163 5700 [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
    16:01:45.0196 5700 sffp_mmc - ok
    16:01:45.0215 5700 [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
    16:01:45.0247 5700 sffp_sd - ok
    16:01:45.0265 5700 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
    16:01:45.0319 5700 sfloppy - ok
    16:01:45.0348 5700 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
    16:01:45.0382 5700 SharedAccess - ok
    16:01:45.0427 5700 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
    16:01:45.0450 5700 ShellHWDetection - ok
    16:01:45.0480 5700 [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp C:\Windows\system32\drivers\sisagp.sys
    16:01:45.0496 5700 sisagp - ok
    16:01:45.0535 5700 [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
    16:01:45.0550 5700 SiSRaid2 - ok
    16:01:45.0569 5700 [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
    16:01:45.0585 5700 SiSRaid4 - ok
    16:01:45.0692 5700 [ 2A99850C2A6EDD6C6602E822C716EDAF ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
    16:01:46.0056 5700 Skype C2C Service - ok
    16:01:46.0110 5700 [ DDAA5F4A6B958FC313EBD02DD925752F ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
    16:01:46.0136 5700 SkypeUpdate - ok
    16:01:46.0283 5700 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
    16:01:46.0417 5700 slsvc - ok
    16:01:46.0453 5700 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
    16:01:46.0478 5700 SLUINotify - ok
    16:01:46.0521 5700 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
    16:01:46.0545 5700 Smb - ok
    16:01:46.0579 5700 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
    16:01:46.0595 5700 SNMPTRAP - ok
    16:01:46.0622 5700 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
    16:01:46.0637 5700 spldr - ok
    16:01:46.0667 5700 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
    16:01:46.0688 5700 Spooler - ok
    16:01:46.0725 5700 [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    16:01:46.0741 5700 SQLBrowser - ok
    16:01:46.0778 5700 [ D89083C4EB02DACA8F944B0E05E57F9D ] SQLWriter C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    16:01:46.0792 5700 SQLWriter - ok
    16:01:46.0836 5700 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
    16:01:46.0873 5700 srv - ok
    16:01:46.0914 5700 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
    16:01:46.0947 5700 srv2 - ok
    16:01:46.0958 5700 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
    16:01:46.0976 5700 srvnet - ok
    16:01:47.0016 5700 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
    16:01:47.0051 5700 SSDPSRV - ok
    16:01:47.0069 5700 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
    16:01:47.0090 5700 SstpSvc - ok
    16:01:47.0128 5700 [ EAA66218CD39F5BB1B4853A78C67C787 ] ss_bbus C:\Windows\system32\DRIVERS\ss_bbus.sys
    16:01:47.0149 5700 ss_bbus - ok
    16:01:47.0184 5700 [ 91765F99914ED8693D8BC76524F21581 ] ss_bmdfl C:\Windows\system32\DRIVERS\ss_bmdfl.sys
    16:01:47.0196 5700 ss_bmdfl - ok
    16:01:47.0233 5700 [ 840E7B738B03C10EE91D9B7D3D6EFF15 ] ss_bmdm C:\Windows\system32\DRIVERS\ss_bmdm.sys
    16:01:47.0247 5700 ss_bmdm - ok
    16:01:47.0309 5700 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
    16:01:47.0369 5700 stisvc - ok
    16:01:47.0396 5700 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
    16:01:47.0425 5700 swenum - ok
    16:01:47.0465 5700 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
    16:01:47.0499 5700 swprv - ok
    16:01:47.0527 5700 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
    16:01:47.0541 5700 Symc8xx - ok
    16:01:47.0566 5700 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
    16:01:47.0582 5700 Sym_hi - ok
    16:01:47.0608 5700 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
    16:01:47.0627 5700 Sym_u3 - ok
    16:01:47.0666 5700 [ 71837FBCE3FD8143953444B3FF7938DC ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
    16:01:47.0682 5700 SynTP - ok
    16:01:47.0731 5700 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
    16:01:47.0774 5700 SysMain - ok
    16:01:47.0812 5700 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
    16:01:47.0832 5700 TabletInputService - ok
    16:01:47.0876 5700 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
    16:01:47.0905 5700 TapiSrv - ok
    16:01:47.0918 5700 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
    16:01:47.0963 5700 TBS - ok
    16:01:48.0012 5700 [ EE7E10BED85C312C1D5D30C435BDDA9F ] Tcpip C:\Windows\system32\drivers\tcpip.sys
    16:01:48.0051 5700 Tcpip - ok
    16:01:48.0078 5700 [ EE7E10BED85C312C1D5D30C435BDDA9F ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
    16:01:48.0126 5700 Tcpip6 - ok
    16:01:48.0149 5700 [ 2C2D4CFF5E09C73908F9B5AF49A51365 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
    16:01:48.0170 5700 tcpipreg - ok
    16:01:48.0193 5700 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
    16:01:48.0227 5700 TDPIPE - ok
    16:01:48.0251 5700 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
    16:01:48.0293 5700 TDTCP - ok
    16:01:48.0335 5700 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
    16:01:48.0359 5700 tdx - ok
    16:01:48.0397 5700 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
    16:01:48.0412 5700 TermDD - ok
    16:01:48.0441 5700 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
    16:01:48.0494 5700 TermService - ok
    16:01:48.0538 5700 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
    16:01:48.0560 5700 Themes - ok
    16:01:48.0580 5700 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
    16:01:48.0612 5700 THREADORDER - ok
    16:01:48.0642 5700 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
    16:01:48.0675 5700 TrkWks - ok
    16:01:48.0732 5700 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
    16:01:48.0757 5700 TrustedInstaller - ok
    16:01:48.0803 5700 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
    16:01:48.0834 5700 tssecsrv - ok
    16:01:48.0868 5700 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
    16:01:48.0890 5700 tunmp - ok
    16:01:48.0920 5700 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
    16:01:48.0947 5700 tunnel - ok
    16:01:48.0973 5700 [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35 C:\Windows\system32\drivers\uagp35.sys
    16:01:49.0002 5700 uagp35 - ok
    16:01:49.0039 5700 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
    16:01:49.0073 5700 udfs - ok
    16:01:49.0107 5700 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
    16:01:49.0140 5700 UI0Detect - ok
    16:01:49.0172 5700 [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
    16:01:49.0187 5700 uliagpkx - ok
    16:01:49.0212 5700 [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci C:\Windows\system32\drivers\uliahci.sys
    16:01:49.0231 5700 uliahci - ok
    16:01:49.0255 5700 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
    16:01:49.0284 5700 UlSata - ok
    16:01:49.0305 5700 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
    16:01:49.0328 5700 ulsata2 - ok
    16:01:49.0355 5700 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
    16:01:49.0386 5700 umbus - ok
    16:01:49.0407 5700 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
    16:01:49.0448 5700 upnphost - ok
    16:01:49.0485 5700 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
    16:01:49.0511 5700 usbccgp - ok
    16:01:49.0551 5700 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
    16:01:49.0606 5700 usbcir - ok
    16:01:49.0635 5700 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
    16:01:49.0659 5700 usbehci - ok
    16:01:49.0677 5700 [ EDCA5124B54BCF04E5C0538AA397A9C1 ] usbfilter C:\Windows\system32\DRIVERS\usbfilter.sys
    16:01:49.0690 5700 usbfilter - ok
    16:01:49.0708 5700 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
    16:01:49.0733 5700 usbhub - ok
    16:01:49.0755 5700 [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
    16:01:49.0779 5700 usbohci - ok
    16:01:49.0808 5700 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
    16:01:49.0838 5700 usbprint - ok
    16:01:49.0883 5700 [ A508C9BD8724980512136B039BBA65E9 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
    16:01:49.0906 5700 usbscan - ok
    16:01:49.0937 5700 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
    16:01:49.0979 5700 USBSTOR - ok
    16:01:50.0012 5700 [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
    16:01:50.0039 5700 usbuhci - ok
    16:01:50.0072 5700 [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
    16:01:50.0116 5700 usbvideo - ok
    16:01:50.0144 5700 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
    16:01:50.0170 5700 UxSms - ok
    16:01:50.0214 5700 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
    16:01:50.0257 5700 vds - ok
    16:01:50.0295 5700 [ 87B06E1F30B749A114F74622D013F8D4 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
    16:01:50.0342 5700 vga - ok
    16:01:50.0363 5700 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
    16:01:50.0418 5700 VgaSave - ok
    16:01:50.0448 5700 [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp C:\Windows\system32\drivers\viaagp.sys
    16:01:50.0477 5700 viaagp - ok
    16:01:50.0496 5700 [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7 C:\Windows\system32\drivers\viac7.sys
    16:01:50.0538 5700 ViaC7 - ok
    16:01:50.0561 5700 [ AADF5587A4063F52C2C3FED7887426FC ] viaide C:\Windows\system32\drivers\viaide.sys
    16:01:50.0576 5700 viaide - ok
    16:01:50.0601 5700 [ 4F101E48D060E318752FBC458A4B49F0 ] VMC326 C:\Windows\system32\Drivers\VMC326.sys
    16:01:50.0620 5700 VMC326 - ok
    16:01:50.0639 5700 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
    16:01:50.0655 5700 volmgr - ok
    16:01:50.0694 5700 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
    16:01:50.0715 5700 volmgrx - ok
    16:01:50.0746 5700 [ 147281C01FCB1DF9252DE2A10D5E7093 ] volsnap C:\Windows\system32\drivers\volsnap.sys
    16:01:50.0766 5700 volsnap - ok
    16:01:50.0791 5700 [ 587253E09325E6BF226B299774B728A9 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
    16:01:50.0809 5700 vsmraid - ok
    16:01:50.0866 5700 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
    16:01:50.0914 5700 VSS - ok
    16:01:50.0976 5700 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
    16:01:51.0005 5700 W32Time - ok
    16:01:51.0044 5700 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
    16:01:51.0099 5700 WacomPen - ok
    16:01:51.0120 5700 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
    16:01:51.0143 5700 Wanarp - ok
    16:01:51.0152 5700 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
    16:01:51.0177 5700 Wanarpv6 - ok
    16:01:51.0210 5700 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
    16:01:51.0240 5700 wcncsvc - ok
    16:01:51.0272 5700 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
    16:01:51.0297 5700 WcsPlugInService - ok
    16:01:51.0314 5700 [ 78FE9542363F297B18C027B2D7E7C07F ] Wd C:\Windows\system32\drivers\wd.sys
    16:01:51.0329 5700 Wd - ok
    16:01:51.0359 5700 [ B6F0A7AD6D4BD325FBCD8BAC96CD8D96 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
    16:01:51.0406 5700 Wdf01000 - ok
    16:01:51.0423 5700 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
    16:01:51.0457 5700 WdiServiceHost - ok
    16:01:51.0462 5700 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
    16:01:51.0496 5700 WdiSystemHost - ok
    16:01:51.0537 5700 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
    16:01:51.0558 5700 WebClient - ok
    16:01:51.0591 5700 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
    16:01:51.0640 5700 Wecsvc - ok
    16:01:51.0675 5700 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
    16:01:51.0701 5700 wercplsupport - ok
    16:01:51.0743 5700 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
    16:01:51.0770 5700 WerSvc - ok
    16:01:51.0813 5700 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
    16:01:51.0832 5700 WinDefend - ok
    16:01:51.0841 5700 WinHttpAutoProxySvc - ok
    16:01:51.0885 5700 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
    16:01:51.0910 5700 Winmgmt - ok
    16:01:51.0978 5700 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
    16:01:52.0162 5700 WinRM - ok
    16:01:52.0229 5700 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
    16:01:52.0282 5700 Wlansvc - ok
    16:01:52.0306 5700 [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
    16:01:52.0336 5700 WmiAcpi - ok
    16:01:52.0385 5700 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
    16:01:52.0426 5700 wmiApSrv - ok
    16:01:52.0489 5700 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
    16:01:52.0547 5700 WMPNetworkSvc - ok
    16:01:52.0591 5700 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
    16:01:52.0618 5700 WPCSvc - ok
    16:01:52.0650 5700 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
    16:01:52.0673 5700 WPDBusEnum - ok
    16:01:52.0712 5700 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
    16:01:52.0727 5700 WpdUsb - ok
    16:01:52.0852 5700 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
    16:01:52.0905 5700 WPFFontCache_v0400 - ok
    16:01:52.0941 5700 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
    16:01:52.0996 5700 ws2ifsl - ok
    16:01:53.0038 5700 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\system32\wscsvc.dll
    16:01:53.0072 5700 wscsvc - ok
    16:01:53.0085 5700 WSearch - ok
    16:01:53.0186 5700 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
    16:01:53.0449 5700 wuauserv - ok
    16:01:53.0469 5700 [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
    16:01:53.0526 5700 WUDFRd - ok
    16:01:53.0549 5700 [ 575A4190D989F64732119E4114045A4F ] wudfsvc C:\Windows\System32\WUDFSvc.dll
    16:01:53.0586 5700 wudfsvc - ok
    16:01:53.0599 5700 yksvc - ok
    16:01:53.0647 5700 [ CBE44738AC495029A3485DF82E205722 ] yukonwlh C:\Windows\system32\DRIVERS\yk60x86.sys
    16:01:53.0695 5700 yukonwlh - ok
    16:01:53.0716 5700 ================ Scan global ===============================
    16:01:53.0742 5700 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
    16:01:53.0781 5700 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
    16:01:53.0797 5700 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
    16:01:53.0844 5700 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
    16:01:53.0853 5700 [Global] - ok
    16:01:53.0854 5700 ================ Scan MBR ==================================
    16:01:53.0872 5700 [ 61A349592C4728853F4A90FF78F7628E ] \Device\Harddisk0\DR0
    16:01:54.0971 5700 \Device\Harddisk0\DR0 - ok
    16:01:54.0972 5700 ================ Scan VBR ==================================
    16:01:54.0976 5700 [ 4AE250503787C932EEAABA7A91AFF388 ] \Device\Harddisk0\DR0\Partition1
    16:01:54.0979 5700 \Device\Harddisk0\DR0\Partition1 - ok
    16:01:55.0014 5700 [ E6A1EA94B64F010688F895F4759D9B88 ] \Device\Harddisk0\DR0\Partition2
    16:01:55.0016 5700 \Device\Harddisk0\DR0\Partition2 - ok
    16:01:55.0017 5700 ============================================================
    16:01:55.0017 5700 Scan finished
    16:01:55.0017 5700 ============================================================
    16:01:55.0036 2572 Detected object count: 9
    16:01:55.0036 2572 Actual detected object count: 9
    16:03:44.0961 2572 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0961 2572 FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0962 2572 FsUsbExService ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0962 2572 FsUsbExService ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0966 2572 hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0966 2572 hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0971 2572 hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0972 2572 hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0976 2572 LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0976 2572 LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0981 2572 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0981 2572 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0987 2572 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0987 2572 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0991 2572 Samsung Update Plus ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0991 2572 Samsung Update Plus ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:03:44.0995 2572 ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
    16:03:44.0996 2572 ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
    16:05:53.0002 1176 Deinitialize success
  13. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    PS When I was changing parameters for the TDSS scan there was an extra box: 'Loaded Modules'; this wasn't mentioned in the instructions so I left it unchecked?

    TDSS found 9 threats all 'Suspicious' rather than 'Malicious' so I clicked Skip. It didn't ask for a reboot.
  14. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    ESET Online Scan

    Please run a free online scan with the ESET Online Scanner
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
    • Click Start or wait for the scanner to load.
    • Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
    • Click Scan (This scan can take several hours, so please be patient)
    • Once the scan is completed, there are a couple of things to keep in mind:
    • 1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
    • 2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
    • Open the logfile from wherever you saved it
    • Copy and paste the contents in your next reply.
  15. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    Hi again. Have done ESET scan but I'm not sure if it deleted the threats it found? Log as follows:

    C:\Qoobox\Quarantine\C\Users\Tamara Fulcher\AppData\Roaming\Zyuvym\yphow.exe.vir a variant of Win32/Kryptik.ANCY trojan cleaned by deleting - quarantined
    Operating memory a variant of Win32/Spy.Zbot.AAO trojan
    On the scan results it said 2 threats detected, 1 cleaned file...does this mean one of the above is still present?

    Thanks (again!) for your patience :)
  16. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    We'll see...

    Download this file: http://support.kaspersky.com/downloads/utils/zbotkiller.zip

    Save it to your Desktop. Right-click on it, and click Extract All...

    Follow the prompts to get it saved to your Desktop.

    There should be a new folder called ZBOTKiller on your Desktop that is not zipped.

    Then, enter Notepad and enter in the following:

    Code:
    zbotkiller.exe -y -l report.txt -v
    Then, click File > Save as...

    In the file name box, enter in zbotkiller.bat

    Choose Save as type... All Files.

    The location will be the new ZBOTKiller folder located on your Desktop.

    Once you have it saved correctly, exit Notepad.


    Go to the new ZBOTKiller folder and double-click on ZBOTKiller.bat

    It will create a log. Please post the log in your next reply.
  17. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    OK I hope this is the report, seems awfully long after the last couple. First bit as follows:

    10:18:14:025 4388 Scanning Threads ...
    10:18:14:027 4388 KillThreads: Scan process PID: 436 Name "smss.exe" ThreadCount 4
    10:18:14:027 4388 ScanThread: Thread 440 base addr: 4791D9A2
    10:18:14:028 4388 ScanThread: Thread 544 base addr: 4791B564
    10:18:14:029 4388 ScanThread: Thread 556 base addr: 4791A0BA
    10:18:14:030 4388 ScanThread: Thread 612 base addr: 4791B564
    10:18:14:031 4388 KillThreads: Scan process PID: 560 Name "csrss.exe" ThreadCount 11
    10:18:14:031 4388 ScanThread: Thread 596 base addr: 75C18C87
    10:18:14:036 4388 ScanThread: Thread 600 base addr: 75C19DEF
    10:18:14:039 4388 ScanThread: Thread 604 base addr: 75C95633
    10:18:14:040 4388 ScanThread: Thread 608 base addr: 75C94526
    10:18:14:040 4388 ScanThread: Thread 640 base addr: 75C95633
    10:18:14:041 4388 ScanThread: Thread 652 base addr: 75C19DD3
    10:18:14:043 4388 ScanThread: Thread 656 base addr: 75C19DD3
    10:18:14:046 4388 ScanThread: Thread 696 base addr: 75C95633
    10:18:14:047 4388 ScanThread: Thread 700 base addr: 75C19DD3
    10:18:14:049 4388 ScanThread: Thread 704 base addr: 75C12D2A
    10:18:14:052 4388 ScanThread: Thread 4820 base addr: 75C12D2A
    10:18:14:055 4388 KillThreads: Scan process PID: 624 Name "csrss.exe" ThreadCount 14
    10:18:14:055 4388 ScanThread: Thread 712 base addr: 980E30A6
    10:18:14:055 4388 ScanThread: VirtualQueryEx error 87
    10:18:14:056 4388 ScanThread: Thread 760 base addr: 75C18C87
    10:18:14:058 4388 ScanThread: Thread 764 base addr: 75C19DEF
    10:18:14:061 4388 ScanThread: Thread 768 base addr: 75C95633
    10:18:14:062 4388 ScanThread: Thread 772 base addr: 75C94526
    10:18:14:062 4388 ScanThread: Thread 784 base addr: 75C95633
    10:18:14:063 4388 ScanThread: Thread 792 base addr: 75C19DD3
    10:18:14:066 4388 ScanThread: Thread 796 base addr: 75C19DD3
    10:18:14:068 4388 ScanThread: Thread 3424 base addr: 75C95633
    10:18:14:069 4388 ScanThread: Thread 3000 base addr: 75C95633
    10:18:14:070 4388 ScanThread: Thread 2708 base addr: 75C95633
    10:18:14:070 4388 ScanThread: Thread 1824 base addr: 75C95633
    10:18:14:071 4388 ScanThread: Thread 1012 base addr: 75C95633
    10:18:14:071 4388 ScanThread: Thread 2724 base addr: 75C12D2A
    10:18:14:074 4388 KillThreads: Scan process PID: 632 Name "wininit.exe" ThreadCount 3
    10:18:14:074 4388 ScanThread: Thread 636 base addr: C3634B
    10:18:14:075 4388 ScanThread: Thread 644 base addr: 766F0148
    10:18:14:095 4388 ScanThread: Thread 676 base addr: 776C2450
    10:18:14:114 4388 KillThreads: Scan process PID: 668 Name "services.exe" ThreadCount 6
    10:18:14:114 4388 ScanThread: Thread 832 base addr: 776C2450
    10:18:14:128 4388 ScanThread: Thread 916 base addr: 776C2990
    10:18:14:142 4388 ScanThread: Thread 2464 base addr: 75BA4986
    10:18:14:142 4388 ScanThread: Thread 2496 base addr: 75BA20A0
    10:18:14:143 4388 ScanThread: Thread 1100 base addr: 766F0148
    10:18:14:152 4388 ScanThread: Thread 3732 base addr: 766F0148
    10:18:14:162 4388 KillThreads: Scan process PID: 680 Name "lsass.exe" ThreadCount 13
    10:18:14:162 4388 ScanThread: Thread 708 base addr: 759A5D24
    10:18:14:200 4388 ScanThread: Thread 720 base addr: 776C2450
    10:18:14:219 4388 ScanThread: Thread 724 base addr: 776C2990
    10:18:14:236 4388 ScanThread: Thread 732 base addr: 7598EA7D
    10:18:14:246 4388 ScanThread: Thread 804 base addr: 766F0148
    10:18:14:254 4388 ScanThread: Thread 808 base addr: 759BABF3
    10:18:14:268 4388 ScanThread: Thread 816 base addr: 759BABF3
    10:18:14:283 4388 ScanThread: Thread 824 base addr: 759BABF3
    10:18:14:295 4388 ScanThread: Thread 5704 base addr: 759BABF3
    10:18:14:307 4388 ScanThread: Thread 4852 base addr: 766F0148
    10:18:14:316 4388 ScanThread: Thread 4816 base addr: 766F0148
    10:18:14:325 4388 ScanThread: Thread 4972 base addr: 759BABF3
    10:18:14:341 4388 ScanThread: Thread 2904 base addr: 776C2990
    10:18:14:356 4388 KillThreads: Scan process PID: 688 Name "lsm.exe" ThreadCount 11
    10:18:14:357 4388 ScanThread: Thread 692 base addr: 903C46
    10:18:14:358 4388 ScanThread: Thread 984 base addr: 776C2990
    10:18:14:374 4388 ScanThread: Thread 988 base addr: 776C2450
    10:18:14:387 4388 ScanThread: Thread 992 base addr: 776C2990
    10:18:14:401 4388 ScanThread: Thread 996 base addr: 776C2990
    10:18:14:421 4388 ScanThread: Thread 1000 base addr: 776C2990
    10:18:14:437 4388 ScanThread: Thread 1004 base addr: 776C2990
    10:18:14:453 4388 ScanThread: Thread 1024 base addr: 776C2990
    10:18:14:468 4388 ScanThread: Thread 3640 base addr: 766F0148
    10:18:14:476 4388 ScanThread: Thread 1064 base addr: 766F0148
    10:18:14:482 4388 ScanThread: Thread 4840 base addr: 766F0148
    10:18:14:489 4388 KillThreads: Scan process PID: 776 Name "winlogon.exe" ThreadCount 5
    10:18:14:489 4388 ScanThread: Thread 780 base addr: F15EAE
    10:18:14:491 4388 ScanThread: Thread 1048 base addr: 776C2450
    10:18:14:506 4388 ScanThread: Thread 5852 base addr: 766F0148
    10:18:14:514 4388 ScanThread: Thread 4844 base addr: 766F0148
    10:18:14:521 4388 ScanThread: Thread 5992 base addr: 776C2990
    10:18:14:536 4388 KillThreads: Scan process PID: 876 Name "svchost.exe" ThreadCount 8
    10:18:14:536 4388 ScanThread: Thread 880 base addr: A02083
    10:18:14:537 4388 ScanThread: Thread 896 base addr: 776C2450
    10:18:14:558 4388 ScanThread: Thread 908 base addr: 74FE87EA
    10:18:14:560 4388 ScanThread: Thread 928 base addr: 776C2990
    10:18:14:572 4388 ScanThread: Thread 932 base addr: 776C2990
    10:18:14:586 4388 ScanThread: Thread 3936 base addr: 6FFA17AE
    10:18:14:586 4388 ScanThread: Thread 2140 base addr: 766F0148
    10:18:14:593 4388 ScanThread: Thread 4500 base addr: 766F0148
    10:18:14:600 4388 KillThreads: Scan process PID: 940 Name "svchost.exe" ThreadCount 11
    10:18:14:600 4388 ScanThread: Thread 944 base addr: A02083
    10:18:14:600 4388 ScanThread: Thread 948 base addr: 762BF36F
    10:18:14:630 4388 ScanThread: Thread 952 base addr: 776C2990
    10:18:14:642 4388 ScanThread: Thread 956 base addr: 776C2450
    10:18:14:659 4388 ScanThread: Thread 1928 base addr: 6FFA17AE
    10:18:14:660 4388 ScanThread: Thread 5620 base addr: 74EE8AA4
    10:18:14:668 4388 ScanThread: Thread 5844 base addr: 74EE8AA4
    10:18:14:674 4388 ScanThread: Thread 4412 base addr: 766F0148
    10:18:14:683 4388 ScanThread: Thread 2480 base addr: 766F0148
    10:18:14:689 4388 ScanThread: Thread 6100 base addr: 766F0148
    10:18:14:697 4388 ScanThread: Thread 5624 base addr: 766F0148
    10:18:14:703 4388 KillThreads: Scan process PID: 1028 Name "MsMpEng.exe" ThreadCount 27
    10:18:14:703 4388 ScanThread: Thread 1032 base addr: 2710F9
    10:18:14:704 4388 ScanThread: Thread 1060 base addr: 776C2450
    10:18:14:718 4388 ScanThread: Thread 1092 base addr: 776C2990
    10:18:14:731 4388 ScanThread: Thread 1244 base addr: 776C2990
    10:18:14:743 4388 ScanThread: Thread 1280 base addr: 776C2990
    10:18:14:757 4388 ScanThread: Thread 1440 base addr: 776C2990
    10:18:14:770 4388 ScanThread: Thread 1900 base addr: 77852670
    10:18:14:790 4388 ScanThread: Thread 2236 base addr: 77852670
    10:18:14:796 4388 ScanThread: Thread 2240 base addr: 77852670
    10:18:14:801 4388 ScanThread: Thread 2244 base addr: 77852670
    10:18:14:810 4388 ScanThread: Thread 2248 base addr: 77852670
    10:18:14:818 4388 ScanThread: Thread 2252 base addr: 77852670
    10:18:14:823 4388 ScanThread: Thread 2256 base addr: 77852670
    10:18:14:831 4388 ScanThread: Thread 2260 base addr: 77852670
    10:18:14:837 4388 ScanThread: Thread 2264 base addr: 77852670
    10:18:14:843 4388 ScanThread: Thread 2400 base addr: 776C2990
    10:18:14:859 4388 ScanThread: Thread 2484 base addr: 776C2990
    10:18:14:872 4388 ScanThread: Thread 2488 base addr: 776C2990
    10:18:14:886 4388 ScanThread: Thread 936 base addr: 776C2990
    10:18:14:899 4388 ScanThread: Thread 1708 base addr: 776C2990
    10:18:14:920 4388 ScanThread: Thread 4796 base addr: 776C2990
    10:18:14:934 4388 ScanThread: Thread 5304 base addr: 776C2990
    10:18:14:947 4388 ScanThread: Thread 500 base addr: 776C2990
    10:18:14:967 4388 ScanThread: Thread 3260 base addr: 776C2990
    10:18:14:987 4388 ScanThread: Thread 3328 base addr: 766F0148
    10:18:14:994 4388 ScanThread: Thread 4516 base addr: 776C2990
    10:18:15:008 4388 ScanThread: Thread 4756 base addr: 766F0148
    10:18:15:015 4388 KillThreads: Scan process PID: 1120 Name "Ati2evxx.exe" ThreadCount 5
    10:18:15:015 4388 ScanThread: Thread 1124 base addr: 4656E9
    10:18:15:024 4388 ScanThread: Thread 1136 base addr: 762BF36F
    10:18:15:034 4388 ScanThread: Thread 1140 base addr: 42C500
    10:18:15:041 4388 ScanThread: Thread 1844 base addr: 40B860
    10:18:15:050 4388 ScanThread: Thread 1856 base addr: 40B830
    10:18:15:060 4388 KillThreads: Scan process PID: 1144 Name "svchost.exe" ThreadCount 23
    10:18:15:060 4388 ScanThread: Thread 1148 base addr: A02083
    10:18:15:061 4388 ScanThread: Thread 1156 base addr: 7422079B
    10:18:15:111 4388 ScanThread: Thread 1172 base addr: 742230CC
    10:18:15:121 4388 ScanThread: Thread 1192 base addr: 776C2450
    10:18:15:138 4388 ScanThread: Thread 1212 base addr: 7421FD09
    10:18:15:147 4388 ScanThread: Thread 1220 base addr: 7421FD09
    10:18:15:158 4388 ScanThread: Thread 1224 base addr: 7421FD09
    10:18:15:167 4388 ScanThread: Thread 1268 base addr: 7419DBA1
    10:18:15:185 4388 ScanThread: Thread 1288 base addr: 743C1F72
    10:18:15:186 4388 ScanThread: Thread 1568 base addr: 762BF36F
    10:18:15:193 4388 ScanThread: Thread 1600 base addr: 7399268C
    10:18:15:194 4388 ScanThread: Thread 1604 base addr: 73991115
    10:18:15:194 4388 ScanThread: Thread 1608 base addr: 73991115
    10:18:15:195 4388 ScanThread: Thread 1656 base addr: 762BF36F
    10:18:15:202 4388 ScanThread: Thread 1660 base addr: 75565D95
    10:18:15:203 4388 ScanThread: Thread 4648 base addr: 6EAD67DB
    10:18:15:204 4388 ScanThread: Thread 4160 base addr: 776C2990
    10:18:15:222 4388 ScanThread: Thread 2164 base addr: 6EAD1DD7
    10:18:15:223 4388 ScanThread: Thread 4156 base addr: 766F0148
    10:18:15:232 4388 ScanThread: Thread 5020 base addr: 766F0148
    10:18:15:243 4388 ScanThread: Thread 5816 base addr: 75F057E9
    10:18:15:258 4388 ScanThread: Thread 5244 base addr: 75565AB0
    10:18:15:259 4388 ScanThread: Thread 3920 base addr: 766F0148
    10:18:15:268 4388 KillThreads: Scan process PID: 1180 Name "svchost.exe" ThreadCount 43
    10:18:15:268 4388 ScanThread: Thread 1184 base addr: A02083
    10:18:15:269 4388 ScanThread: Thread 1208 base addr: 776C2450
    10:18:15:284 4388 ScanThread: Thread 1232 base addr: 7419DBA1
    10:18:15:288 4388 ScanThread: Thread 1240 base addr: 743C1F72
    10:18:15:290 4388 ScanThread: Thread 1492 base addr: 73C62C31
    10:18:15:291 4388 ScanThread: Thread 1504 base addr: 762BF36F
    10:18:15:300 4388 ScanThread: Thread 1512 base addr: 77852670
    10:18:15:307 4388 ScanThread: Thread 1528 base addr: 7393DB7A
    10:18:15:309 4388 ScanThread: Thread 1644 base addr: 77852670
    10:18:15:317 4388 ScanThread: Thread 1648 base addr: 737A5458
    10:18:15:334 4388 ScanThread: Thread 1780 base addr: 75BB743A
    10:18:15:341 4388 ScanThread: Thread 536 base addr: 762BF36F
    10:18:15:352 4388 ScanThread: Thread 552 base addr: 762BF36F
    10:18:15:361 4388 ScanThread: Thread 1160 base addr: 72521587
    10:18:15:367 4388 ScanThread: Thread 2184 base addr: 72521A7F
    10:18:15:368 4388 ScanThread: Thread 2224 base addr: 72491471
    10:18:15:375 4388 ScanThread: Thread 2460 base addr: 762BF36F
    10:18:15:382 4388 ScanThread: Thread 2552 base addr: 776C2990
    10:18:15:396 4388 ScanThread: Thread 2560 base addr: 71773796
    10:18:15:397 4388 ScanThread: Thread 2684 base addr: 768AC224
    10:18:15:399 4388 ScanThread: Thread 2288 base addr: 74F578E3
    10:18:15:400 4388 ScanThread: Thread 828 base addr: 762BF36F
    10:18:15:407 4388 ScanThread: Thread 3592 base addr: 72571267
    10:18:15:408 4388 ScanThread: Thread 3608 base addr: 72571267
    10:18:15:409 4388 ScanThread: Thread 3612 base addr: 72571267
    10:18:15:410 4388 ScanThread: Thread 3636 base addr: 72571267
    10:18:15:410 4388 ScanThread: Thread 3648 base addr: 72571267
    10:18:15:411 4388 ScanThread: Thread 3072 base addr: 72571267
    10:18:15:412 4388 ScanThread: Thread 3068 base addr: 72571267
    10:18:15:412 4388 ScanThread: Thread 3600 base addr: 72571267
    10:18:15:413 4388 ScanThread: Thread 3244 base addr: 72571267
    10:18:15:414 4388 ScanThread: Thread 3232 base addr: 72571267
    10:18:15:414 4388 ScanThread: Thread 5532 base addr: 75F057E9
    10:18:15:426 4388 ScanThread: Thread 5984 base addr: 6EB488FC
    10:18:15:427 4388 ScanThread: Thread 5988 base addr: 6EB4B5C7
    10:18:15:428 4388 ScanThread: Thread 4440 base addr: 72453289
    10:18:15:428 4388 ScanThread: Thread 5464 base addr: 718A4D2F
    10:18:15:454 4388 ScanThread: Thread 5500 base addr: 776C2990
    10:18:15:478 4388 ScanThread: Thread 5588 base addr: 766F0148
    10:18:15:489 4388 ScanThread: Thread 5688 base addr: 766F0148
    10:18:15:501 4388 ScanThread: Thread 3772 base addr: 776C2990
    10:18:15:527 4388 ScanThread: Thread 3344 base addr: 720C3B18
    10:18:15:544 4388 ScanThread: Thread 4504 base addr: 776C2990
    10:18:15:592 4388 KillThreads: Scan process PID: 1196 Name "svchost.exe" ThreadCount 57
    10:18:15:592 4388 ScanThread: Thread 1200 base addr: A02083
    10:18:15:593 4388 ScanThread: Thread 1228 base addr: 762BF36F
    10:18:15:623 4388 ScanThread: Thread 1236 base addr: 74314437
    10:18:15:624 4388 ScanThread: Thread 1316 base addr: 762BF36F
    10:18:15:631 4388 ScanThread: Thread 1356 base addr: 762BF36F
    10:18:15:638 4388 ScanThread: Thread 1384 base addr: 776C2990
    10:18:15:651 4388 ScanThread: Thread 1388 base addr: 776C2450
    10:18:15:667 4388 ScanThread: Thread 1616 base addr: 762BF36F
    10:18:15:674 4388 ScanThread: Thread 1636 base addr: 77852670
    10:18:15:682 4388 ScanThread: Thread 1668 base addr: 762BF36F
    10:18:15:689 4388 ScanThread: Thread 1672 base addr: 762BF36F
    10:18:15:697 4388 ScanThread: Thread 1676 base addr: 776C2990
    10:18:15:711 4388 ScanThread: Thread 1700 base addr: 73EA089D
    10:18:15:716 4388 ScanThread: Thread 1716 base addr: 72DC1709
    10:18:15:740 4388 ScanThread: Thread 1720 base addr: 73E99FA9
    10:18:15:745 4388 ScanThread: Thread 1976 base addr: 762BF36F
    10:18:15:757 4388 ScanThread: Thread 2040 base addr: 72D842C9
    10:18:15:758 4388 ScanThread: Thread 124 base addr: 762BF36F
    10:18:15:765 4388 ScanThread: Thread 260 base addr: 72833FA2
    10:18:15:777 4388 ScanThread: Thread 276 base addr: 7283482D
    10:18:15:778 4388 ScanThread: Thread 280 base addr: 72834526
    10:18:15:779 4388 ScanThread: Thread 2056 base addr: 75BB743A
    10:18:15:780 4388 ScanThread: Thread 2064 base addr: 722F25F9
    10:18:15:804 4388 ScanThread: Thread 2528 base addr: 762BF36F
    10:18:15:813 4388 ScanThread: Thread 2756 base addr: 74F578E3
    10:18:15:814 4388 ScanThread: Thread 2768 base addr: 776C2990
    10:18:15:827 4388 ScanThread: Thread 2788 base addr: 75BB743A
    10:18:15:828 4388 ScanThread: Thread 2808 base addr: 762BF36F
    10:18:15:834 4388 ScanThread: Thread 2844 base addr: 70B22D83
    10:18:15:835 4388 ScanThread: Thread 2880 base addr: 745B5FC6
    10:18:15:854 4388 ScanThread: Thread 2884 base addr: 70B51F6F
    10:18:15:855 4388 ScanThread: Thread 2888 base addr: 707862CC
    10:18:15:872 4388 ScanThread: Thread 2892 base addr: 702326BD
    10:18:15:875 4388 ScanThread: Thread 2732 base addr: 74663F11
    10:18:15:875 4388 ScanThread: Thread 2728 base addr: 75BA1EDE
    10:18:15:876 4388 ScanThread: Thread 2780 base addr: 75BA1EDE
    10:18:15:877 4388 ScanThread: Thread 3412 base addr: 762BF36F
    10:18:15:883 4388 ScanThread: Thread 3356 base addr: 75F057E9
    10:18:15:893 4388 ScanThread: Thread 3908 base addr: 72453289
    10:18:15:894 4388 ScanThread: Thread 5752 base addr: 70942ABB
    10:18:15:901 4388 ScanThread: Thread 5960 base addr: 70942ABB
    10:18:15:907 4388 ScanThread: Thread 4532 base addr: 762BF36F
    10:18:15:913 4388 ScanThread: Thread 5448 base addr: 65DC4F42
    10:18:15:952 4388 ScanThread: Thread 3208 base addr: 776C2450
    10:18:15:967 4388 ScanThread: Thread 5864 base addr: 77852670
    10:18:15:974 4388 ScanThread: Thread 2336 base addr: 72984B4F
    10:18:15:989 4388 ScanThread: Thread 4284 base addr: 72984511
    10:18:15:992 4388 ScanThread: Thread 1072 base addr: 72984511
    10:18:15:995 4388 ScanThread: Thread 5344 base addr: 65DC4F42
    10:18:16:019 4388 ScanThread: Thread 5348 base addr: 776C2990
    10:18:16:033 4388 ScanThread: Thread 5764 base addr: 72834526
    10:18:16:034 4388 ScanThread: Thread 2968 base addr: 766F0148
    10:18:16:041 4388 ScanThread: Thread 4996 base addr: 776C2990
    10:18:16:055 4388 ScanThread: Thread 1420 base addr: 766F0148
    10:18:16:061 4388 ScanThread: Thread 2972 base addr: 776C2990
    10:18:16:075 4388 ScanThread: Thread 3132 base addr: 766F0148
    10:18:16:082 4388 ScanThread: Thread 2992 base addr: 75F057E9
    10:18:16:094 4388 KillThreads: Scan process PID: 1272 Name "audiodg.exe" ThreadCount 8
    10:18:16:094 4388 KillThreads: OpenProcess (audiodg.exe, 1272) error 5
    10:18:16:095 4388 KillThreads: Scan process PID: 1300 Name "svchost.exe" ThreadCount 6
    10:18:16:095 4388 ScanThread: Thread 1304 base addr: A02083
    10:18:16:095 4388 ScanThread: Thread 1340 base addr: 776C2450
    10:18:16:111 4388 ScanThread: Thread 1516 base addr: 73E1A2E9
    10:18:16:141 4388 ScanThread: Thread 3332 base addr: 73E1A2E9
    10:18:16:147 4388 ScanThread: Thread 5292 base addr: 766F0148
    10:18:16:156 4388 ScanThread: Thread 1664 base addr: 766F0148
    10:18:16:167 4388 KillThreads: Scan process PID: 1320 Name "SLsvc.exe" ThreadCount 4
    10:18:16:167 4388 ScanThread: Thread 1324 base addr: 815756
    10:18:16:197 4388 ScanThread: Thread 1392 base addr: 776C2450
    10:18:16:216 4388 ScanThread: Thread 1404 base addr: 77852670
    10:18:16:226 4388 ScanThread: Thread 4316 base addr: 766F0148
    10:18:16:233 4388 KillThreads: Scan process PID: 1360 Name "svchost.exe" ThreadCount 36
    10:18:16:233 4388 ScanThread: Thread 1364 base addr: A02083
    10:18:16:233 4388 ScanThread: Thread 1452 base addr: 766F0148
    10:18:16:240 4388 ScanThread: Thread 1456 base addr: 776C2450
    10:18:16:254 4388 ScanThread: Thread 1472 base addr: 776C2990
    10:18:16:269 4388 ScanThread: Thread 1972 base addr: 72D417A7
    10:18:16:271 4388 ScanThread: Thread 1980 base addr: 72D41E5C
    10:18:16:273 4388 ScanThread: Thread 1984 base addr: 72D41E5C
    10:18:16:274 4388 ScanThread: Thread 1988 base addr: 776C2990
    10:18:16:287 4388 ScanThread: Thread 1992 base addr: 776C2990
    10:18:16:304 4388 ScanThread: Thread 1592 base addr: 776C2990
    10:18:16:322 4388 ScanThread: Thread 1596 base addr: 722C2875
    10:18:16:337 4388 ScanThread: Thread 864 base addr: 722C269E
    10:18:16:338 4388 ScanThread: Thread 2432 base addr: 762BF36F
    10:18:16:346 4388 ScanThread: Thread 2468 base addr: 776C2990
    10:18:16:363 4388 ScanThread: Thread 2472 base addr: 719BB2B8
    10:18:16:365 4388 ScanThread: Thread 2476 base addr: 719BB1DC
    10:18:16:366 4388 ScanThread: Thread 2596 base addr: 714CE833
    10:18:16:371 4388 ScanThread: Thread 2740 base addr: 70D19C63
    10:18:16:374 4388 ScanThread: Thread 2744 base addr: 70D180F4
    10:18:16:376 4388 ScanThread: Thread 5756 base addr: 766F0148
    10:18:16:383 4388 ScanThread: Thread 5948 base addr: 766F0148
    10:18:16:389 4388 ScanThread: Thread 496 base addr: 766F0148
    10:18:16:396 4388 ScanThread: Thread 5200 base addr: 776C2990
    10:18:16:410 4388 ScanThread: Thread 4884 base addr: 776C2990
    10:18:16:424 4388 ScanThread: Thread 3108 base addr: 776C2990
    10:18:16:438 4388 ScanThread: Thread 5208 base addr: 70D183DC
    10:18:16:440 4388 ScanThread: Thread 3832 base addr: 776C2990
    10:18:16:453 4388 ScanThread: Thread 3888 base addr: 776C2450
    10:18:16:477 4388 ScanThread: Thread 3756 base addr: 776C2990
    10:18:16:492 4388 ScanThread: Thread 1412 base addr: 65C98AC9
    10:18:16:492 4388 ScanThread: Thread 4668 base addr: 65C98AC9
    10:18:16:493 4388 ScanThread: Thread 848 base addr: 65C98AC9
    10:18:16:493 4388 ScanThread: Thread 904 base addr: 65C98AC9
    10:18:16:494 4388 ScanThread: Thread 3804 base addr: 72453289
    10:18:16:494 4388 ScanThread: Thread 3284 base addr: 776C2990
    10:18:16:510 4388 ScanThread: Thread 4468 base addr: 766F0148
    10:18:16:516 4388 KillThreads: Scan process PID: 1536 Name "svchost.exe" ThreadCount 24
    10:18:16:517 4388 ScanThread: Thread 1540 base addr: A02083
    10:18:16:517 4388 ScanThread: Thread 1572 base addr: 7391B19E
    10:18:16:518 4388 ScanThread: Thread 1576 base addr: 73918AB5
    10:18:16:519 4388 ScanThread: Thread 1580 base addr: 73914CF4
    10:18:16:519 4388 ScanThread: Thread 1588 base addr: 776C2450
    10:18:16:533 4388 ScanThread: Thread 2088 base addr: 776C2990
    10:18:16:548 4388 ScanThread: Thread 2100 base addr: 72107E8B
    10:18:16:551 4388 ScanThread: Thread 2644 base addr: 72453289
    10:18:16:551 4388 ScanThread: Thread 2792 base addr: 706E43D5
    10:18:16:558 4388 ScanThread: Thread 2796 base addr: 74F578E3
    10:18:16:558 4388 ScanThread: Thread 2800 base addr: 7181134D
    10:18:16:560 4388 ScanThread: Thread 2804 base addr: 7181134D
    10:18:16:562 4388 ScanThread: Thread 2812 base addr: 77852670
    10:18:16:569 4388 ScanThread: Thread 2816 base addr: 77852670
    10:18:16:575 4388 ScanThread: Thread 2860 base addr: 70A2DA43
    10:18:16:605 4388 ScanThread: Thread 2864 base addr: 70F81D37
    10:18:16:605 4388 ScanThread: Thread 2868 base addr: 70A076CA
    10:18:16:606 4388 ScanThread: Thread 2872 base addr: 70779D8D
    10:18:16:606 4388 ScanThread: Thread 2876 base addr: 70764140
    10:18:16:607 4388 ScanThread: Thread 4752 base addr: 663A4B34
    10:18:16:613 4388 ScanThread: Thread 5364 base addr: 776C2990
    10:18:16:627 4388 ScanThread: Thread 2980 base addr: 73914D8B
    10:18:16:629 4388 ScanThread: Thread 2504 base addr: 776C2990
    10:18:16:642 4388 ScanThread: Thread 4480 base addr: 766F0148
    10:18:16:648 4388 KillThreads: Scan process PID: 1544 Name "Ati2evxx.exe" ThreadCount 6
    10:18:16:649 4388 ScanThread: Thread 1548 base addr: 4656E9
    10:18:16:655 4388 ScanThread: Thread 1860 base addr: 42D510
    10:18:16:661 4388 ScanThread: Thread 1864 base addr: 42D510
    10:18:16:667 4388 ScanThread: Thread 1868 base addr: 42CA50
    10:18:16:673 4388 ScanThread: Thread 1884 base addr: 40B830
    10:18:16:679 4388 ScanThread: Thread 3120 base addr: 766F0148
    10:18:16:685 4388 KillThreads: Scan process PID: 1688 Name "wlanext.exe" ThreadCount 11
    10:18:16:685 4388 ScanThread: Thread 1692 base addr: 6F85D4
    10:18:16:686 4388 ScanThread: Thread 1696 base addr: 776C2450
    10:18:16:700 4388 ScanThread: Thread 1804 base addr: 1000AE92
    10:18:16:723 4388 ScanThread: Thread 1808 base addr: 1000AEB0
    10:18:16:725 4388 ScanThread: Thread 1812 base addr: 1000AE74
    10:18:16:728 4388 ScanThread: Thread 1820 base addr: 1002829D
    10:18:16:731 4388 ScanThread: Thread 1836 base addr: 737649F9
    10:18:16:732 4388 ScanThread: Thread 3384 base addr: 766F0148
    10:18:16:738 4388 ScanThread: Thread 1896 base addr: 776C2990
    10:18:16:750 4388 ScanThread: Thread 476 base addr: 776C2990
    10:18:16:769 4388 ScanThread: Thread 5156 base addr: 776C2990
    10:18:16:782 4388 KillThreads: Scan process PID: 1764 Name "spoolsv.exe" ThreadCount 16
    10:18:16:782 4388 ScanThread: Thread 1768 base addr: 549EDB
    10:18:16:783 4388 ScanThread: Thread 1776 base addr: 762BF36F
    10:18:16:790 4388 ScanThread: Thread 1784 base addr: 776C2450
    10:18:16:802 4388 ScanThread: Thread 1800 base addr: 543873
    10:18:16:804 4388 ScanThread: Thread 2436 base addr: 77852670
    10:18:16:814 4388 ScanThread: Thread 2440 base addr: 77852670
    10:18:16:823 4388 ScanThread: Thread 2444 base addr: 71D31775
    10:18:16:826 4388 ScanThread: Thread 2520 base addr: 71D31654
    10:18:16:827 4388 ScanThread: Thread 2548 base addr: 77852670
    10:18:16:832 4388 ScanThread: Thread 2588 base addr: 71991DFC
    10:18:16:833 4388 ScanThread: Thread 2616 base addr: 7174146C
    10:18:16:835 4388 ScanThread: Thread 2620 base addr: 722C2875
    10:18:16:836 4388 ScanThread: Thread 2624 base addr: 722C1D3B
    10:18:16:837 4388 ScanThread: Thread 2628 base addr: 722C269E
    10:18:16:838 4388 ScanThread: Thread 2656 base addr: 7201667C
    10:18:16:858 4388 ScanThread: Thread 5872 base addr: 766F0148
    10:18:16:864 4388 KillThreads: Scan process PID: 1828 Name "svchost.exe" ThreadCount 28
    10:18:16:864 4388 ScanThread: Thread 1832 base addr: A02083
    10:18:16:864 4388 ScanThread: Thread 1852 base addr: 776C2450
    10:18:16:879 4388 ScanThread: Thread 1876 base addr: 75BB743A
    10:18:16:880 4388 ScanThread: Thread 1908 base addr: 75BB743A
    10:18:16:881 4388 ScanThread: Thread 1932 base addr: 75BB743A
    10:18:16:881 4388 ScanThread: Thread 1944 base addr: 729D8A06
    10:18:16:884 4388 ScanThread: Thread 1956 base addr: 729F04FF
    10:18:16:889 4388 ScanThread: Thread 1964 base addr: 729E552D
    10:18:16:894 4388 ScanThread: Thread 1968 base addr: 776C2990
    10:18:16:911 4388 ScanThread: Thread 516 base addr: 762BF36F
    10:18:16:920 4388 ScanThread: Thread 620 base addr: 725D351F
    10:18:16:921 4388 ScanThread: Thread 756 base addr: 725D13E0
    10:18:16:922 4388 ScanThread: Thread 428 base addr: 725D13E0
    10:18:16:923 4388 ScanThread: Thread 868 base addr: 725D13E0
    10:18:16:924 4388 ScanThread: Thread 872 base addr: 725D13E0
    10:18:16:925 4388 ScanThread: Thread 684 base addr: 725D13E0
    10:18:16:927 4388 ScanThread: Thread 820 base addr: 725D7CCC
    10:18:16:929 4388 ScanThread: Thread 1188 base addr: 72571267
    10:18:16:931 4388 ScanThread: Thread 1216 base addr: 72571267
    10:18:16:932 4388 ScanThread: Thread 1260 base addr: 72571267
    10:18:16:932 4388 ScanThread: Thread 1264 base addr: 72571267
    10:18:16:933 4388 ScanThread: Thread 1312 base addr: 72571267
    10:18:16:934 4388 ScanThread: Thread 1352 base addr: 72571267
    10:18:16:934 4388 ScanThread: Thread 1432 base addr: 72571267
    10:18:16:935 4388 ScanThread: Thread 1468 base addr: 72571267
    10:18:16:936 4388 ScanThread: Thread 1416 base addr: 72571267
    10:18:16:937 4388 ScanThread: Thread 1484 base addr: 72571267
    10:18:16:937 4388 ScanThread: Thread 6060 base addr: 766F0148
    10:18:16:944 4388 KillThreads: Scan process PID: 200 Name "SASCore.exe" ThreadCount 2
    10:18:16:944 4388 ScanThread: Thread 192 base addr: D796EA
    10:18:16:957 4388 ScanThread: Thread 196 base addr: 762BF36F
    10:18:16:966 4388 KillThreads: Scan process PID: 292 Name "AppleMobileDeviceService.exe" ThreadCount 3
    10:18:16:966 4388 ScanThread: Thread 300 base addr: 10A28DE
    10:18:16:974 4388 ScanThread: Thread 304 base addr: 10A1C94
    10:18:16:974 4388 ScanThread: Thread 288 base addr: 10A1C94
    10:18:16:975 4388 KillThreads: Scan process PID: 316 Name "BcmSqlStartupSvc.exe" ThreadCount 2
    10:18:16:976 4388 ScanThread: Thread 324 base addr: 403F3B
    10:18:16:976 4388 ScanThread: Thread 312 base addr: 762BF36F
    10:18:16:987 4388 KillThreads: Scan process PID: 320 Name "mDNSResponder.exe" ThreadCount 2
    10:18:16:988 4388 ScanThread: Thread 384 base addr: E2708
    10:18:16:994 4388 ScanThread: Thread 380 base addr: 762BF36F
    10:18:17:001 4388 KillThreads: Scan process PID: 452 Name "svchost.exe" ThreadCount 3
    10:18:17:001 4388 ScanThread: Thread 456 base addr: A02083
    10:18:17:002 4388 ScanThread: Thread 532 base addr: 727F33C4
    10:18:17:003 4388 ScanThread: Thread 12 base addr: 766F0148
    10:18:17:013 4388 KillThreads: Scan process PID: 540 Name "FsUsbExService.Exe" ThreadCount 2
    10:18:17:013 4388 ScanThread: Thread 524 base addr: 40CBDD
    10:18:17:016 4388 ScanThread: Thread 564 base addr: 762BF36F
    10:18:17:024 4388 KillThreads: Scan process PID: 660 Name "svchost.exe" ThreadCount 8
    10:18:17:025 4388 ScanThread: Thread 628 base addr: A02083
    10:18:17:025 4388 ScanThread: Thread 888 base addr: 762BF36F
    10:18:17:036 4388 ScanThread: Thread 1952 base addr: 1000C8B0
    10:18:17:037 4388 ScanThread: Thread 204 base addr: 3AF10180
    10:18:17:038 4388 ScanThread: Thread 3360 base addr: 762BF36F
    10:18:17:046 4388 ScanThread: Thread 3660 base addr: 6FFA17AE
    10:18:17:046 4388 ScanThread: Thread 5024 base addr: 766F0148
    10:18:17:052 4388 ScanThread: Thread 3472 base addr: 766F0148
    10:18:17:063 4388 KillThreads: Scan process PID: 1036 Name "LSSrvc.exe" ThreadCount 2
    10:18:17:063 4388 ScanThread: Thread 1056 base addr: 407FF0
    10:18:17:064 4388 ScanThread: Thread 1508 base addr: 762BF36F
    10:18:17:073 4388 KillThreads: Scan process PID: 520 Name "svchost.exe" ThreadCount 5
    10:18:17:073 4388 ScanThread: Thread 2052 base addr: A02083
    10:18:17:074 4388 ScanThread: Thread 2076 base addr: 762BF36F
    10:18:17:084 4388 ScanThread: Thread 2156 base addr: 776C2990
    10:18:17:100 4388 ScanThread: Thread 2160 base addr: 776C2450
    10:18:17:119 4388 ScanThread: Thread 2172 base addr: 766F0148
    10:18:17:129 4388 KillThreads: Scan process PID: 2080 Name "RichVideo.exe" ThreadCount 4
    10:18:17:129 4388 ScanThread: Thread 2084 base addr: 42B9C8
    10:18:17:132 4388 ScanThread: Thread 2096 base addr: 762BF36F
    10:18:17:143 4388 ScanThread: Thread 2112 base addr: 412A30
    10:18:17:144 4388 ScanThread: Thread 6052 base addr: 766F0148
    10:18:17:151 4388 KillThreads: Scan process PID: 2196 Name "c2c_service.exe" ThreadCount 5
    10:18:17:151 4388 ScanThread: Thread 2200 base addr: 1264170
    10:18:17:182 4388 ScanThread: Thread 2204 base addr: 762BF36F
    10:18:17:189 4388 ScanThread: Thread 2208 base addr: 1269EF2
    10:18:17:216 4388 ScanThread: Thread 2212 base addr: 1269EF2
    10:18:17:243 4388 ScanThread: Thread 1624 base addr: 766F0148
    10:18:17:249 4388 KillThreads: Scan process PID: 2348 Name "sqlbrowser.exe" ThreadCount 7
    10:18:17:249 4388 ScanThread: Thread 2352 base addr: 1031976
    10:18:17:274 4388 ScanThread: Thread 2356 base addr: 762BF36F
    10:18:17:283 4388 ScanThread: Thread 2364 base addr: 1029C60
    10:18:17:286 4388 ScanThread: Thread 2368 base addr: 10292C0
    10:18:17:289 4388 ScanThread: Thread 2388 base addr: 1029880
    10:18:17:292 4388 ScanThread: Thread 2392 base addr: 1029880
    10:18:17:296 4388 ScanThread: Thread 2396 base addr: 1029880
    10:18:17:299 4388 KillThreads: Scan process PID: 2416 Name "sqlwriter.exe" ThreadCount 3
    10:18:17:299 4388 ScanThread: Thread 2420 base addr: 1008A71
    10:18:17:300 4388 ScanThread: Thread 2424 base addr: 762BF36F
    10:18:17:310 4388 ScanThread: Thread 4900 base addr: 766F0148
    10:18:17:321 4388 KillThreads: Scan process PID: 2448 Name "svchost.exe" ThreadCount 7
    10:18:17:321 4388 ScanThread: Thread 2452 base addr: A02083
    10:18:17:322 4388 ScanThread: Thread 2456 base addr: 762BF36F
    10:18:17:332 4388 ScanThread: Thread 2584 base addr: 722C2875
    10:18:17:334 4388 ScanThread: Thread 2600 base addr: 722C1D3B
    10:18:17:336 4388 ScanThread: Thread 2604 base addr: 722C269E
    10:18:17:337 4388 ScanThread: Thread 2608 base addr: 717C98FE
    10:18:17:341 4388 ScanThread: Thread 4544 base addr: 766F0148
    10:18:17:348 4388 KillThreads: Scan process PID: 2512 Name "svchost.exe" ThreadCount 5
    10:18:17:348 4388 ScanThread: Thread 2516 base addr: A02083
    10:18:17:349 4388 ScanThread: Thread 2568 base addr: 776C2450
    10:18:17:364 4388 ScanThread: Thread 2576 base addr: 7153483B
    10:18:17:366 4388 ScanThread: Thread 2580 base addr: 776C2990
    10:18:17:385 4388 ScanThread: Thread 5600 base addr: 776C2990
    10:18:17:403 4388 KillThreads: Scan process PID: 2540 Name "SearchIndexer.exe" ThreadCount 15
    10:18:17:404 4388 ScanThread: Thread 2544 base addr: FBC9AD
    10:18:17:409 4388 ScanThread: Thread 2648 base addr: 762BF36F
    10:18:17:421 4388 ScanThread: Thread 2664 base addr: FBA8A9
    10:18:17:426 4388 ScanThread: Thread 2908 base addr: 776C2450
    10:18:17:446 4388 ScanThread: Thread 2924 base addr: 707FEB65
    10:18:17:460 4388 ScanThread: Thread 2928 base addr: 71589787
    10:18:17:596 4388 ScanThread: Thread 2936 base addr: 7125EE86
    10:18:17:635 4388 ScanThread: Thread 2940 base addr: 7122EAB6
    10:18:17:654 4388 ScanThread: Thread 2944 base addr: 7122240B
    10:18:17:672 4388 ScanThread: Thread 2948 base addr: 7126733E
    10:18:17:691 4388 ScanThread: Thread 4744 base addr: 776C2990
    10:18:17:714 4388 ScanThread: Thread 6000 base addr: 7123449C
    10:18:17:733 4388 ScanThread: Thread 2116 base addr: 766F0148
    10:18:17:743 4388 ScanThread: Thread 5112 base addr: 776C2990
    10:18:17:767 4388 ScanThread: Thread 5940 base addr: 776C2990
    10:18:17:790 4388 KillThreads: Scan process PID: 2672 Name "rundll32.exe" ThreadCount 4
    10:18:17:790 4388 ScanThread: Thread 2676 base addr: 311487
    10:18:17:791 4388 ScanThread: Thread 2736 base addr: 776C2450
    10:18:17:815 4388 ScanThread: Thread 5604 base addr: 776C2990
    10:18:17:838 4388 ScanThread: Thread 5740 base addr: 776C2990
    10:18:17:861 4388 KillThreads: Scan process PID: 3400 Name "taskeng.exe" ThreadCount 14
    10:18:17:861 4388 ScanThread: Thread 3404 base addr: 51B2CF
    10:18:17:864 4388 ScanThread: Thread 3416 base addr: 776C2990
    10:18:17:887 4388 ScanThread: Thread 3420 base addr: 776C2450
    10:18:17:910 4388 ScanThread: Thread 3444 base addr: 511D90
    10:18:17:913 4388 ScanThread: Thread 3508 base addr: 511D90
    10:18:17:916 4388 ScanThread: Thread 3536 base addr: 6DD220FE
    10:18:17:916 4388 ScanThread: Thread 3584 base addr: 775C5571
    10:18:17:966 4388 ScanThread: Thread 3644 base addr: 511D90
    10:18:17:969 4388 ScanThread: Thread 3668 base addr: 745713DD
    10:18:17:978 4388 ScanThread: Thread 3672 base addr: 6F30A4FB
    10:18:18:043 4388 ScanThread: Thread 4028 base addr: 6F301C38
    10:18:18:056 4388 ScanThread: Thread 2996 base addr: 511D90
    10:18:18:059 4388 ScanThread: Thread 4224 base addr: 766F0148
    10:18:18:071 4388 ScanThread: Thread 5336 base addr: 766F0148
    10:18:18:081 4388 KillThreads: Scan process PID: 3448 Name "taskeng.exe" ThreadCount 8
    10:18:18:082 4388 ScanThread: Thread 3452 base addr: 51B2CF
    10:18:18:085 4388 ScanThread: Thread 3456 base addr: 776C2990
    10:18:18:109 4388 ScanThread: Thread 3460 base addr: 776C2450
    10:18:18:132 4388 ScanThread: Thread 3476 base addr: 511D90
    10:18:18:133 4388 ScanThread: Thread 3480 base addr: 511D90
    10:18:18:135 4388 ScanThread: Thread 3520 base addr: 511D90
    10:18:18:136 4388 ScanThread: Thread 3524 base addr: 511D90
    10:18:18:138 4388 ScanThread: Thread 3016 base addr: 766F0148
    10:18:18:147 4388 KillThreads: Scan process PID: 3528 Name "MagicDoctorKbdHk.exe" ThreadCount 1
    10:18:18:147 4388 ScanThread: Thread 3532 base addr: 401DA5
    10:18:18:148 4388 KillThreads: Scan process PID: 3544 Name "dwm.exe" ThreadCount 7
    10:18:18:148 4388 ScanThread: Thread 3548 base addr: 4F538D
    10:18:18:149 4388 ScanThread: Thread 3556 base addr: 4F5007
    10:18:18:149 4388 ScanThread: Thread 3560 base addr: 776C2450
    10:18:18:167 4388 ScanThread: Thread 3688 base addr: 776C2990
    10:18:18:186 4388 ScanThread: Thread 5904 base addr: 6D818A55
    10:18:18:273 4388 ScanThread: Thread 5936 base addr: 701B8B2F
    10:18:18:276 4388 ScanThread: Thread 6024 base addr: 776C2990
    10:18:18:290 4388 KillThreads: Scan process PID: 3568 Name "EasyBatteryMgr3.exe" ThreadCount 1
    10:18:18:291 4388 ScanThread: Thread 3572 base addr: 41EF18
    10:18:18:293 4388 KillThreads: Scan process PID: 3576 Name "EasySpeedUpManager.exe" ThreadCount 3
    10:18:18:293 4388 ScanThread: Thread 3580 base addr: 41F43E
    10:18:18:298 4388 ScanThread: Thread 740 base addr: 74687456
    10:18:18:369 4388 ScanThread: Thread 2912 base addr: 409580
    10:18:18:373 4388 KillThreads: Scan process PID: 3616 Name "explorer.exe" ThreadCount 32
    10:18:18:373 4388 ScanThread: Thread 3620 base addr: C45E33
    10:18:18:393 4388 ScanThread: Thread 3724 base addr: 75F057E9
    10:18:18:405 4388 ScanThread: Thread 3728 base addr: 768AC224
    10:18:18:409 4388 ScanThread: Thread 3736 base addr: 768AC224
    10:18:18:412 4388 ScanThread: Thread 3824 base addr: 6FFA17AE
    10:18:18:413 4388 ScanThread: Thread 3856 base addr: 74147E7E
    10:18:18:424 4388 ScanThread: Thread 3860 base addr: 768AC224
    10:18:18:427 4388 ScanThread: Thread 4072 base addr: 6F7AB2DC
    10:18:18:451 4388 ScanThread: Thread 4076 base addr: 77852670
    10:18:18:461 4388 ScanThread: Thread 4080 base addr: 776C2450
    10:18:18:478 4388 ScanThread: Thread 4092 base addr: 743C1F72
    10:18:18:479 4388 ScanThread: Thread 2072 base addr: 746125C2
    10:18:18:494 4388 ScanThread: Thread 1940 base addr: 746115A2
    10:18:18:495 4388 ScanThread: Thread 2000 base addr: 768AC224
    10:18:18:498 4388 ScanThread: Thread 736 base addr: 776C2990
    10:18:18:513 4388 ScanThread: Thread 2300 base addr: 737649F9
    10:18:18:514 4388 ScanThread: Thread 1380 base addr: 768AC224
    10:18:18:516 4388 ScanThread: Thread 728 base addr: 768AC224
    10:18:18:518 4388 ScanThread: Thread 1372 base addr: 75F057E9
    10:18:18:532 4388 ScanThread: Thread 1308 base addr: 768AC224
    10:18:18:536 4388 ScanThread: Thread 2132 base addr: 768AC224
    10:18:18:538 4388 ScanThread: Thread 1772 base addr: 722C2875
    10:18:18:539 4388 ScanThread: Thread 5520 base addr: 74687456
    10:18:18:554 4388 ScanThread: Thread 4872 base addr: 6FD63AC8
    10:18:18:702 4388 ScanThread: Thread 2312 base addr: 768AC224
    10:18:18:706 4388 ScanThread: Thread 4716 base addr: 6FD63AC8
    10:18:18:723 4388 ScanThread: Thread 5148 base addr: 766F0148
    10:18:18:734 4388 ScanThread: Thread 3048 base addr: 745713DD
    10:18:18:738 4388 ScanThread: Thread 4780 base addr: 766F0148
    10:18:18:748 4388 ScanThread: Thread 5436 base addr: 776C2990
    10:18:18:771 4388 ScanThread: Thread 5440 base addr: 776C2990
    10:18:18:794 4388 ScanThread: Thread 5996 base addr: 776C2990
    10:18:18:816 4388 KillThreads: Scan process PID: 3624 Name "dmhkcore.exe" ThreadCount 4
    10:18:18:817 4388 ScanThread: Thread 3628 base addr: 43E19E
    10:18:18:843 4388 ScanThread: Thread 1788 base addr: 74687456
    10:18:18:867 4388 ScanThread: Thread 3388 base addr: 743C1F72
    10:18:18:869 4388 ScanThread: Thread 3184 base addr: 766F0148
    10:18:18:879 4388 KillThreads: Scan process PID: 3796 Name "RtHDVCpl.exe" ThreadCount 10
    10:18:18:879 4388 ScanThread: Thread 3800 base addr: 508EC2
    10:18:18:966 4388 ScanThread: Thread 1296 base addr: 478200
    10:18:19:031 4388 ScanThread: Thread 3848 base addr: 74687456
    10:18:19:046 4388 ScanThread: Thread 2896 base addr: 50B72F
    10:18:19:106 4388 ScanThread: Thread 3868 base addr: 50B72F
    10:18:19:173 4388 ScanThread: Thread 2144 base addr: 50B72F
    10:18:19:236 4388 ScanThread: Thread 3348 base addr: 743C1F72
    10:18:19:237 4388 ScanThread: Thread 3960 base addr: 776C2450
    10:18:19:251 4388 ScanThread: Thread 3604 base addr: 42CE20
    10:18:19:309 4388 ScanThread: Thread 3080 base addr: 766F0148
    10:18:19:316 4388 KillThreads: Scan process PID: 3808 Name "SynTPEnh.exe" ThreadCount 5
    10:18:19:316 4388 ScanThread: Thread 3812 base addr: 445A84
    10:18:19:368 4388 ScanThread: Thread 2640 base addr: 1000B1A2
    10:18:19:375 4388 ScanThread: Thread 3768 base addr: 41CFE0
    10:18:19:393 4388 ScanThread: Thread 664 base addr: 766F0148
    10:18:19:400 4388 ScanThread: Thread 3228 base addr: 1000AFE8
  18. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:19:401 4388 KillThreads: Scan process PID: 3816 Name "PDVDServ.exe" ThreadCount 2
    10:18:19:401 4388 ScanThread: Thread 3820 base addr: 403E75
    10:18:19:402 4388 ScanThread: Thread 4952 base addr: 766F0148
    10:18:19:410 4388 KillThreads: Scan process PID: 3836 Name "hpwuSchd2.exe" ThreadCount 2
    10:18:19:410 4388 ScanThread: Thread 3840 base addr: 40213F
    10:18:19:411 4388 ScanThread: Thread 4184 base addr: 766F0148
    10:18:19:418 4388 KillThreads: Scan process PID: 3972 Name "BJMYPRT.EXE" ThreadCount 1
    10:18:19:418 4388 ScanThread: Thread 3976 base addr: 433894
    10:18:19:444 4388 KillThreads: Scan process PID: 3980 Name "CNSEMAIN.EXE" ThreadCount 3
    10:18:19:444 4388 ScanThread: Thread 3984 base addr: 4E7037
    10:18:19:458 4388 ScanThread: Thread 4340 base addr: 72B429E1
    10:18:19:472 4388 ScanThread: Thread 4572 base addr: 766F0148
    10:18:19:479 4388 KillThreads: Scan process PID: 3988 Name "jusched.exe" ThreadCount 1
    10:18:19:479 4388 ScanThread: Thread 3992 base addr: 41602C
    10:18:19:481 4388 KillThreads: Scan process PID: 3996 Name "msseces.exe" ThreadCount 5
    10:18:19:481 4388 ScanThread: Thread 4000 base addr: D00408
    10:18:19:514 4388 ScanThread: Thread 1680 base addr: 776C2990
    10:18:19:528 4388 ScanThread: Thread 2636 base addr: 776C2450
    10:18:19:540 4388 ScanThread: Thread 3056 base addr: 766F0148
    10:18:19:546 4388 ScanThread: Thread 3692 base addr: 74687456
    10:18:19:561 4388 KillThreads: Scan process PID: 4004 Name "sidebar.exe" ThreadCount 7
    10:18:19:561 4388 ScanThread: Thread 4008 base addr: 3CF529
    10:18:19:602 4388 ScanThread: Thread 2272 base addr: 3EC83A
    10:18:19:612 4388 ScanThread: Thread 160 base addr: 74687456
    10:18:19:627 4388 ScanThread: Thread 2952 base addr: 766F0148
    10:18:19:635 4388 ScanThread: Thread 3428 base addr: 737649F9
    10:18:19:635 4388 ScanThread: Thread 3052 base addr: 3ED92D
    10:18:19:644 4388 ScanThread: Thread 5668 base addr: 766F0148
    10:18:19:650 4388 KillThreads: Scan process PID: 4012 Name "LightScribeControlPanel.exe" ThreadCount 1
    10:18:19:650 4388 ScanThread: Thread 4016 base addr: 419087
    10:18:19:753 4388 KillThreads: Scan process PID: 4020 Name "ehtray.exe" ThreadCount 2
    10:18:19:753 4388 ScanThread: Thread 4024 base addr: 11E5A94
    10:18:19:755 4388 ScanThread: Thread 4988 base addr: 766F0148
    10:18:19:761 4388 KillThreads: Scan process PID: 4032 Name "NPSAgent.exe" ThreadCount 1
    10:18:19:761 4388 ScanThread: Thread 4036 base addr: 405C85
    10:18:19:762 4388 KillThreads: Scan process PID: 4084 Name "SpotifyWebHelper.exe" ThreadCount 3
    10:18:19:762 4388 ScanThread: Thread 4088 base addr: 13E22EF
    10:18:19:798 4388 ScanThread: Thread 3944 base addr: 766F0148
    10:18:19:805 4388 ScanThread: Thread 2092 base addr: 136B6E0
    10:18:19:814 4388 KillThreads: Scan process PID: 2128 Name "Skype.exe" ThreadCount 26
    10:18:19:815 4388 ScanThread: Thread 448 base addr: 5CBD5E
    10:18:20:111 4388 ScanThread: Thread 2696 base addr: 74687456
    10:18:20:125 4388 ScanThread: Thread 3060 base addr: 4070CC
    10:18:20:375 4388 ScanThread: Thread 1284 base addr: B72874
    10:18:20:638 4388 ScanThread: Thread 840 base addr: B72874
    10:18:20:930 4388 ScanThread: Thread 3064 base addr: B72874
    10:18:21:224 4388 ScanThread: Thread 3588 base addr: B72874
    10:18:21:513 4388 ScanThread: Thread 2988 base addr: B72874
    10:18:21:805 4388 ScanThread: Thread 3516 base addr: B72874
    10:18:22:096 4388 ScanThread: Thread 3012 base addr: B72874
    10:18:22:388 4388 ScanThread: Thread 2228 base addr: B72874
    10:18:22:696 4388 ScanThread: Thread 2984 base addr: B72874
    10:18:22:983 4388 ScanThread: Thread 3300 base addr: B72874
    10:18:23:260 4388 ScanThread: Thread 2704 base addr: B72874
    10:18:23:509 4388 ScanThread: Thread 2668 base addr: B72874
    10:18:23:765 4388 ScanThread: Thread 3324 base addr: B72874
    10:18:24:037 4388 ScanThread: Thread 3024 base addr: B72874
    10:18:24:341 4388 ScanThread: Thread 1464 base addr: B72874
    10:18:24:642 4388 ScanThread: Thread 1168 base addr: B7BDF0
    10:18:24:944 4388 ScanThread: Thread 3788 base addr: B7BDF0
    10:18:25:221 4388 ScanThread: Thread 1840 base addr: 743C1F72
    10:18:25:222 4388 ScanThread: Thread 1996 base addr: 776C2450
    10:18:25:235 4388 ScanThread: Thread 4684 base addr: 77852670
    10:18:25:242 4388 ScanThread: Thread 4688 base addr: 77852670
    10:18:25:247 4388 ScanThread: Thread 4692 base addr: 672CD9B3
    10:18:25:479 4388 ScanThread: Thread 4788 base addr: 766F0148
    10:18:25:488 4388 KillThreads: Scan process PID: 1488 Name "SUPERAntiSpyware.exe" ThreadCount 5
    10:18:25:489 4388 ScanThread: Thread 1888 base addr: 548A40
    10:18:25:530 4388 ScanThread: Very large region size: 114688
    10:18:25:531 4388 ScanThread: Thread 4220 base addr: 48BB20
    10:18:25:533 4388 ScanThread: Very large region size: 888832
    10:18:25:533 4388 ScanThread: Thread 4252 base addr: 4927E0
    10:18:25:535 4388 ScanThread: Very large region size: 860160
    10:18:25:536 4388 ScanThread: Thread 5980 base addr: 776C2450
    10:18:25:550 4388 ScanThread: Thread 5672 base addr: 766F0148
    10:18:25:558 4388 KillThreads: Scan process PID: 2296 Name "BTTray.exe" ThreadCount 2
    10:18:25:558 4388 ScanThread: Thread 2284 base addr: 471ECB
    10:18:25:570 4388 ScanThread: Thread 2372 base addr: 72B429E1
    10:18:25:575 4388 KillThreads: Scan process PID: 2292 Name "hpqtra08.exe" ThreadCount 8
    10:18:25:575 4388 ScanThread: Thread 2232 base addr: 4179F8
    10:18:25:597 4388 ScanThread: Thread 3380 base addr: 6FFA17AE
    10:18:25:598 4388 ScanThread: Thread 3744 base addr: 72B429E1
    10:18:25:603 4388 ScanThread: Thread 2840 base addr: 2CA1F00
    10:18:25:604 4388 ScanThread: Thread 4204 base addr: 72B429E1
    10:18:25:612 4388 ScanThread: Thread 4232 base addr: 72B429E1
    10:18:25:617 4388 ScanThread: Thread 5216 base addr: 6F2C9585
    10:18:25:630 4388 ScanThread: Thread 4704 base addr: 766F0148
    10:18:25:636 4388 KillThreads: Scan process PID: 2316 Name "ONENOTEM.EXE" ThreadCount 1
    10:18:25:636 4388 ScanThread: Thread 2308 base addr: 2FC170D5
    10:18:25:643 4388 KillThreads: Scan process PID: 2772 Name "MOM.exe" ThreadCount 14
    10:18:25:643 4388 ScanThread: Thread 2848 base addr: 9930EE
    10:18:25:643 4388 ScanThread: Thread 2932 base addr: 6BBF7E7F
    10:18:25:778 4388 ScanThread: Thread 3880 base addr: 6BC46EB3
    10:18:25:834 4388 ScanThread: Thread 3676 base addr: 6BC46EB3
    10:18:25:892 4388 ScanThread: Thread 1344 base addr: 6BC46EB3
    10:18:25:945 4388 ScanThread: Thread 3496 base addr: 766F0148
    10:18:25:952 4388 ScanThread: Thread 1564 base addr: 6BC46EB3
    10:18:26:004 4388 ScanThread: Thread 2524 base addr: 6BC46EB3
    10:18:26:061 4388 ScanThread: Thread 3100 base addr: 6BB17F9F
    10:18:26:123 4388 ScanThread: Thread 1076 base addr: 6BC46EB3
    10:18:26:177 4388 ScanThread: Thread 1560 base addr: 6BC46EB3
    10:18:26:240 4388 ScanThread: Thread 3632 base addr: 6BB23A8F
    10:18:26:287 4388 ScanThread: Thread 2564 base addr: 6BDD0EBC
    10:18:26:333 4388 ScanThread: Thread 2344 base addr: 6BC46EB3
    10:18:26:379 4388 KillThreads: Scan process PID: 2536 Name "unsecapp.exe" ThreadCount 3
    10:18:26:379 4388 ScanThread: Thread 1336 base addr: 7442DC
    10:18:26:380 4388 ScanThread: Thread 5212 base addr: 766F0148
    10:18:26:386 4388 KillThreads: OpenThread 5044 in process 2536 error 87
    10:18:26:386 4388 KillThreads: Scan process PID: 2748 Name "WmiPrvSE.exe" ThreadCount 6
    10:18:26:387 4388 ScanThread: Thread 2680 base addr: 36F87B
    10:18:26:389 4388 ScanThread: Thread 2784 base addr: 75BA1EDE
    10:18:26:390 4388 ScanThread: Thread 2192 base addr: 75F057E9
    10:18:26:401 4388 ScanThread: Thread 2188 base addr: 36674F
    10:18:26:402 4388 ScanThread: Thread 5748 base addr: 766F0148
    10:18:26:409 4388 ScanThread: Thread 4564 base addr: 766F0148
    10:18:26:416 4388 KillThreads: Scan process PID: 3488 Name "NisSrv.exe" ThreadCount 11
    10:18:26:416 4388 ScanThread: Thread 3564 base addr: C5BA0D
    10:18:26:437 4388 ScanThread: Thread 3296 base addr: 776C2450
    10:18:26:451 4388 ScanThread: Thread 3288 base addr: 776C2990
    10:18:26:464 4388 ScanThread: Thread 3304 base addr: 762BF36F
    10:18:26:471 4388 ScanThread: Thread 3700 base addr: 776C2990
    10:18:26:485 4388 ScanThread: Thread 1912 base addr: 77852670
    10:18:26:491 4388 ScanThread: Thread 4068 base addr: 766F0148
    10:18:26:498 4388 ScanThread: Thread 5644 base addr: 776C2990
    10:18:26:513 4388 ScanThread: Thread 5840 base addr: 776C2990
    10:18:26:526 4388 ScanThread: Thread 3044 base addr: 776C2990
    10:18:26:538 4388 ScanThread: Thread 6032 base addr: 776C2990
    10:18:26:551 4388 KillThreads: Scan process PID: 2532 Name "ehmsas.exe" ThreadCount 3
    10:18:26:551 4388 ScanThread: Thread 2492 base addr: 80188D
    10:18:26:551 4388 ScanThread: Thread 3716 base addr: 801FD8
    10:18:26:552 4388 ScanThread: Thread 3464 base addr: 766F0148
    10:18:26:558 4388 KillThreads: Scan process PID: 1256 Name "hpqste08.exe" ThreadCount 7
    10:18:26:558 4388 ScanThread: Thread 980 base addr: 419347
    10:18:26:559 4388 ScanThread: Thread 2324 base addr: 40E9D0
    10:18:26:560 4388 ScanThread: Thread 3248 base addr: 6FFA17AE
    10:18:26:561 4388 ScanThread: Thread 4608 base addr: 72B429E1
    10:18:26:565 4388 ScanThread: Thread 5908 base addr: 1D15440
    10:18:26:566 4388 ScanThread: Thread 5916 base addr: 1D15440
    10:18:26:567 4388 ScanThread: Thread 4332 base addr: 766F0148
    10:18:26:573 4388 KillThreads: Scan process PID: 3828 Name "CCC.exe" ThreadCount 17
    10:18:26:573 4388 ScanThread: Thread 3748 base addr: 9B30EE
    10:18:26:573 4388 ScanThread: Thread 2168 base addr: 6BBF7E7F
    10:18:26:618 4388 ScanThread: Thread 884 base addr: 6BC46EB3
    10:18:26:661 4388 ScanThread: Thread 3904 base addr: 6BC46EB3
    10:18:26:708 4388 ScanThread: Thread 3900 base addr: 6BC46EB3
    10:18:26:756 4388 ScanThread: Thread 3032 base addr: 6BB17F9F
    10:18:26:802 4388 ScanThread: Thread 2688 base addr: 6BC46EB3
    10:18:26:849 4388 ScanThread: Thread 4060 base addr: 6BDD0EBC
    10:18:26:895 4388 ScanThread: Thread 2176 base addr: 74687456
    10:18:26:909 4388 ScanThread: Thread 4120 base addr: 6BC46EB3
    10:18:26:956 4388 ScanThread: Thread 4124 base addr: 6BC46EB3
    10:18:27:002 4388 ScanThread: Thread 4128 base addr: 6BC46EB3
    10:18:27:048 4388 ScanThread: Thread 4136 base addr: 6BC46EB3
    10:18:27:095 4388 ScanThread: Thread 4244 base addr: 6BB23A8F
    10:18:27:141 4388 ScanThread: Thread 4264 base addr: 6BC46EB3
    10:18:27:197 4388 ScanThread: Thread 4272 base addr: 6BC46EB3
    10:18:27:254 4388 ScanThread: Thread 5576 base addr: 766F0148
    10:18:27:265 4388 KillThreads: Scan process PID: 3036 Name "hpqbam08.exe" ThreadCount 4
    10:18:27:265 4388 ScanThread: Thread 1524 base addr: 425160
    10:18:27:287 4388 ScanThread: Thread 1652 base addr: 41D8F0
    10:18:27:290 4388 ScanThread: Thread 3964 base addr: 72B429E1
    10:18:27:296 4388 ScanThread: Thread 5760 base addr: 766F0148
    10:18:27:303 4388 KillThreads: Scan process PID: 2592 Name "SynTPHelper.exe" ThreadCount 1
    10:18:27:304 4388 ScanThread: Thread 1684 base addr: 4028BA
    10:18:27:306 4388 KillThreads: Scan process PID: 4140 Name "hpqgpc01.exe" ThreadCount 3
    10:18:27:306 4388 ScanThread: Thread 4144 base addr: 41821A
    10:18:27:320 4388 ScanThread: Thread 4548 base addr: 4019F6
    10:18:27:322 4388 ScanThread: Thread 912 base addr: 766F0148
    10:18:27:330 4388 KillThreads: Scan process PID: 4576 Name "CNSEUPDT.EXE" ThreadCount 5
    10:18:27:330 4388 ScanThread: Thread 4580 base addr: 43217F
    10:18:27:364 4388 ScanThread: Thread 4584 base addr: 72B429E1
    10:18:27:369 4388 ScanThread: Thread 5724 base addr: 74F578E3
    10:18:27:370 4388 ScanThread: Thread 5952 base addr: 72B429E1
    10:18:27:374 4388 ScanThread: Thread 5968 base addr: 72B429E1
    10:18:27:379 4388 KillThreads: Scan process PID: 4696 Name "svchost.exe" ThreadCount 4
    10:18:27:379 4388 ScanThread: Thread 4700 base addr: A02083
    10:18:27:380 4388 ScanThread: Thread 4736 base addr: 776C2450
    10:18:27:397 4388 ScanThread: Thread 4740 base addr: 68C2CA50
    10:18:27:407 4388 ScanThread: Thread 4748 base addr: 776C2990
    10:18:27:423 4388 KillThreads: Scan process PID: 6124 Name "taskeng.exe" ThreadCount 6
    10:18:27:423 4388 ScanThread: Thread 6128 base addr: 51B2CF
    10:18:27:425 4388 ScanThread: Thread 4488 base addr: 776C2990
    10:18:27:439 4388 ScanThread: Thread 4492 base addr: 776C2450
    10:18:27:454 4388 ScanThread: Thread 3236 base addr: 511D90
    10:18:27:457 4388 ScanThread: Thread 4180 base addr: 766F0148
    10:18:27:465 4388 ScanThread: Thread 1424 base addr: 511D90
    10:18:27:466 4388 KillThreads: Scan process PID: 1080 Name "GoogleUpdate.exe" ThreadCount 4
    10:18:27:466 4388 ScanThread: Thread 4192 base addr: 4050CE
    10:18:27:477 4388 ScanThread: Thread 3008 base addr: 661565E7
    10:18:27:508 4388 ScanThread: Thread 4600 base addr: 776C2450
    10:18:27:524 4388 ScanThread: Thread 4596 base addr: 660F1DEF
    10:18:27:536 4388 KillThreads: Scan process PID: 5036 Name "TrustedInstaller.exe" ThreadCount 5
    10:18:27:536 4388 ScanThread: Thread 5432 base addr: C11CA9
    10:18:27:536 4388 ScanThread: Thread 2976 base addr: 762BF36F
    10:18:27:543 4388 ScanThread: Thread 3512 base addr: 766F0148
    10:18:27:549 4388 ScanThread: Thread 3148 base addr: 776C2990
    10:18:27:568 4388 ScanThread: Thread 3128 base addr: 776C2450
    10:18:27:583 4388 KillThreads: Scan process PID: 4348 Name "iexplore.exe" ThreadCount 15
    10:18:27:583 4388 ScanThread: Thread 4352 base addr: 12628A0
    10:18:27:614 4388 ScanThread: Thread 4368 base addr: 776C2450
    10:18:27:635 4388 ScanThread: Thread 4376 base addr: 764C1134
    10:18:27:704 4388 ScanThread: Thread 4380 base addr: 764C0FAC
    10:18:27:730 4388 ScanThread: Thread 4384 base addr: 6C1A432D
    10:18:28:101 4388 ScanThread: Thread 4392 base addr: 77852670
    10:18:28:116 4388 ScanThread: Thread 6108 base addr: 764C15E2
    10:18:28:150 4388 ScanThread: Thread 964 base addr: 6C17634A
    10:18:28:229 4388 ScanThread: Thread 1348 base addr: 7692CCAE
    10:18:28:260 4388 ScanThread: Thread 4828 base addr: 75F057E9
    10:18:28:272 4388 ScanThread: Thread 5196 base addr: 776C2990
    10:18:28:285 4388 ScanThread: Thread 6120 base addr: 6C37B52D
    10:18:28:360 4388 ScanThread: Thread 3704 base addr: 776C2990
    10:18:28:373 4388 ScanThread: Thread 5072 base addr: 766F0148
    10:18:28:380 4388 ScanThread: Thread 1476 base addr: 766F0148
    10:18:28:386 4388 KillThreads: Scan process PID: 4256 Name "iexplore.exe" ThreadCount 38
    10:18:28:387 4388 ScanThread: Thread 4260 base addr: 12628A0
    10:18:28:393 4388 ScanThread: Thread 4408 base addr: 776C2450
    10:18:28:406 4388 ScanThread: Thread 4416 base addr: 6C190258
    10:18:28:483 4388 ScanThread: Thread 4420 base addr: 6C190258
    10:18:28:560 4388 ScanThread: Thread 4424 base addr: 6C190258
    10:18:28:630 4388 ScanThread: Thread 5616 base addr: 6C190258
    10:18:28:705 4388 ScanThread: Thread 5608 base addr: 6C190258
    10:18:28:788 4388 ScanThread: Thread 5416 base addr: 6C190258
    10:18:28:869 4388 ScanThread: Thread 6104 base addr: 6C190258
    10:18:28:954 4388 ScanThread: Thread 4100 base addr: 776C2990
    10:18:28:968 4388 ScanThread: Thread 4196 base addr: 6C190258
    10:18:29:049 4388 ScanThread: Thread 4568 base addr: 6C190258
    10:18:29:125 4388 ScanThread: Thread 5592 base addr: 6C190258
    10:18:29:203 4388 ScanThread: Thread 4636 base addr: 6C190258
    10:18:29:278 4388 ScanThread: Thread 4624 base addr: 6C190258
    10:18:29:354 4388 ScanThread: Thread 4628 base addr: 6C190258
    10:18:29:429 4388 ScanThread: Thread 4520 base addr: 6C190258
    10:18:29:504 4388 ScanThread: Thread 6064 base addr: 6C190258
    10:18:29:577 4388 ScanThread: Thread 5736 base addr: 6C190258
    10:18:29:646 4388 ScanThread: Thread 6084 base addr: 6C190258
    10:18:29:720 4388 ScanThread: Thread 5732 base addr: 6C190258
    10:18:29:797 4388 ScanThread: Thread 5316 base addr: 6C190258
    10:18:29:871 4388 ScanThread: Thread 1712 base addr: 6C190258
    10:18:29:945 4388 ScanThread: Thread 4764 base addr: 6C190258
    10:18:30:019 4388 ScanThread: Thread 4808 base addr: 6C190258
    10:18:30:093 4388 ScanThread: Thread 3292 base addr: 6C190258
    10:18:30:172 4388 ScanThread: Thread 2404 base addr: 6C190258
    10:18:30:255 4388 ScanThread: Thread 4632 base addr: 6C190258
    10:18:30:341 4388 ScanThread: Thread 1096 base addr: 6C190258
    10:18:30:431 4388 ScanThread: Thread 4640 base addr: 6C190258
    10:18:30:507 4388 ScanThread: Thread 5836 base addr: 776C2990
    10:18:30:521 4388 ScanThread: Thread 5932 base addr: 6C190258
    10:18:30:590 4388 ScanThread: Thread 3708 base addr: 6C190258
    10:18:30:661 4388 ScanThread: Thread 5276 base addr: 6C190258
    10:18:30:735 4388 ScanThread: Thread 3432 base addr: 6C190258
    10:18:30:808 4388 ScanThread: Thread 4984 base addr: 6C190258
    10:18:30:883 4388 ScanThread: Thread 5280 base addr: 6C190258
    10:18:30:963 4388 ScanThread: Thread 1792 base addr: 6C190258
    10:18:31:046 4388 KillThreads: Scan process PID: 5340 Name "GoogleToolbarUser_32.exe" ThreadCount 4
    10:18:31:046 4388 ScanThread: Thread 4472 base addr: E41072
    10:18:31:075 4388 ScanThread: Thread 5896 base addr: 65310C34
    10:18:31:240 4388 ScanThread: Thread 4496 base addr: 652AF1EE
    10:18:31:292 4388 ScanThread: Thread 5256 base addr: 766F0148
    10:18:31:299 4388 KillThreads: Scan process PID: 5676 Name "FlashUtil32_11_4_402_287_ActiveX.exe" ThreadCount 2
    10:18:31:299 4388 ScanThread: Thread 5656 base addr: 134042C
    10:18:31:330 4388 ScanThread: Thread 5552 base addr: 766F0148
    10:18:31:337 4388 KillThreads: Scan process PID: 5240 Name "iexplore.exe" ThreadCount 26
    10:18:31:337 4388 ScanThread: Thread 5192 base addr: 12628A0
    10:18:31:343 4388 ScanThread: Thread 5176 base addr: 776C2450
    10:18:31:356 4388 ScanThread: Thread 5152 base addr: 6C190258
    10:18:31:433 4388 ScanThread: Thread 5228 base addr: 6C190258
    10:18:31:508 4388 ScanThread: Thread 5224 base addr: 6C190258
    10:18:31:579 4388 ScanThread: Thread 6028 base addr: 776C2990
    10:18:31:592 4388 ScanThread: Thread 2044 base addr: 6C190258
    10:18:31:667 4388 ScanThread: Thread 3872 base addr: 6C190258
    10:18:31:741 4388 ScanThread: Thread 852 base addr: 6C190258
    10:18:31:839 4388 ScanThread: Thread 1916 base addr: 6C190258
    10:18:31:925 4388 ScanThread: Thread 4108 base addr: 6C190258
    10:18:32:002 4388 ScanThread: Thread 3268 base addr: 6C190258
    10:18:32:085 4388 ScanThread: Thread 4064 base addr: 6C190258
    10:18:32:204 4388 ScanThread: Thread 2752 base addr: 6C190258
    10:18:32:294 4388 ScanThread: Thread 3192 base addr: 776C2990
    10:18:32:312 4388 ScanThread: Thread 472 base addr: 6C190258
    10:18:32:388 4388 ScanThread: Thread 3092 base addr: 6C190258
    10:18:32:461 4388 ScanThread: Thread 4672 base addr: 6C190258
    10:18:32:536 4388 ScanThread: Thread 5572 base addr: 6C190258
    10:18:32:608 4388 ScanThread: Thread 5352 base addr: 6C190258
    10:18:32:681 4388 ScanThread: Thread 6092 base addr: 6C190258
    10:18:32:758 4388 ScanThread: Thread 5964 base addr: 6C190258
    10:18:32:848 4388 ScanThread: Thread 5428 base addr: 6C190258
    10:18:32:927 4388 KillThreads: OpenThread 5108 in process 5240 error 87
    10:18:32:928 4388 KillThreads: OpenThread 2108 in process 5240 error 87
    10:18:32:928 4388 ScanThread: Thread 3680 base addr: 6C190258
    10:18:33:008 4388 KillThreads: Scan process PID: 2764 Name "cmd.exe" ThreadCount 3
    10:18:33:008 4388 ScanThread: Thread 4400 base addr: 4A589797
    10:18:33:013 4388 KillThreads: OpenThread 4212 in process 2764 error 87
    10:18:33:013 4388 ScanThread: Thread 5972 base addr: 766F0148
    10:18:33:022 4388 KillThreads: Scan process PID: 5508 Name "dllhost.exe" ThreadCount 5
    10:18:33:023 4388 KillThreads: OpenProcess (dllhost.exe, 5508) error 87
    10:18:33:023 4388 KillThreads: Scan process PID: 2660 Name "dllhost.exe" ThreadCount 5
    10:18:33:023 4388 KillThreads: OpenProcess (dllhost.exe, 2660) error 87
    10:18:33:023 4388 KillThreads: Scan process PID: 5288 Name "ZBotKiller.exe" ThreadCount 1
  19. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:33:023 4388 KillThreads: Current thread, skipping...
    10:18:33:023 4388
    10:18:33:024 4388 Scanning Hooks ...
    10:18:33:197 4388 ScanProcess: OpenProcess (PID 0) error 87
    10:18:33:197 4388 ScanProcess: OpenProcess (PID 4) error 5
    10:18:33:198 4388 Process 436: Module smss.exe:
    10:18:33:204 4388 Process 436: Module ntdll.dll:
    10:18:33:205 4388 Process 560: Module csrss.exe:
    10:18:33:207 4388 Process 560: Module ntdll.dll:
    10:18:33:208 4388 Process 560: Module CSRSRV.dll:
    10:18:33:226 4388 Process 560: Module basesrv.dll:
    10:18:33:230 4388 Process 560: Module winsrv.dll:
    10:18:33:238 4388 Process 560: Module USER32.dll:
    10:18:33:243 4388 Process 560: Module KERNEL32.dll:
    10:18:33:253 4388 Process 560: Module GDI32.dll:
    10:18:33:256 4388 Process 560: Module ADVAPI32.dll:
    10:18:33:262 4388 Process 560: Module RPCRT4.dll:
    10:18:33:264 4388 Process 560: Module LPK.DLL:
    10:18:33:286 4388 Process 560: Module USP10.dll:
    10:18:33:288 4388 Process 560: Module msvcrt.dll:
    10:18:33:289 4388 Process 560: Module sxs.dll:
    10:18:33:291 4388 Process 624: Module csrss.exe:
    10:18:33:294 4388 Process 624: Module ntdll.dll:
    10:18:33:294 4388 Process 624: Module CSRSRV.dll:
    10:18:33:296 4388 Process 624: Module basesrv.dll:
    10:18:33:298 4388 Process 624: Module winsrv.dll:
    10:18:33:302 4388 Process 624: Module USER32.dll:
    10:18:33:306 4388 Process 624: Module KERNEL32.dll:
    10:18:33:317 4388 Process 624: Module GDI32.dll:
    10:18:33:320 4388 Process 624: Module ADVAPI32.dll:
    10:18:33:326 4388 Process 624: Module RPCRT4.dll:
    10:18:33:328 4388 Process 624: Module LPK.DLL:
    10:18:33:330 4388 Process 624: Module USP10.dll:
    10:18:33:333 4388 Process 624: Module msvcrt.dll:
    10:18:33:334 4388 Process 624: Module sxs.dll:
    10:18:33:340 4388 Process 632: Module wininit.exe:
    10:18:33:344 4388 Process 632: Module ntdll.dll:
    10:18:33:348 4388 Process 632: Module kernel32.dll:
    10:18:33:363 4388 Process 632: Module ADVAPI32.dll:
    10:18:33:369 4388 Process 632: Module RPCRT4.dll:
    10:18:33:373 4388 Process 632: Module USER32.dll:
    10:18:33:375 4388 Process 632: Module GDI32.dll:
    10:18:33:378 4388 Process 632: Module msvcrt.dll:
    10:18:33:379 4388 Process 632: Module USERENV.dll:
    10:18:33:380 4388 Process 632: Module Secur32.dll:
    10:18:33:381 4388 Process 632: Module IMM32.DLL:
    10:18:33:385 4388 Process 632: Module MSCTF.dll:
    10:18:33:387 4388 Process 632: Module LPK.DLL:
    10:18:33:389 4388 Process 632: Module USP10.dll:
    10:18:33:396 4388 Process 632: Module apphelp.dll:
    10:18:33:398 4388 Process 632: Module WS2_32.dll:
    10:18:33:412 4388 Process 632: Module NSI.dll:
    10:18:33:428 4388 Process 632: Module mswsock.dll:
    10:18:33:430 4388 Process 632: Module wshtcpip.dll:
    10:18:33:434 4388 Process 632: Module wship6.dll:
    10:18:33:444 4388 Process 632: Module CRYPT32.dll:
    10:18:33:445 4388 Process 632: Module MSASN1.dll:
    10:18:33:445 4388 Process 632: Module credssp.dll:
    10:18:33:446 4388 Process 632: Module schannel.dll:
    10:18:33:449 4388 Process 632: Module NETAPI32.dll:
    10:18:33:454 4388 Process 632: Module PSAPI.DLL:
    10:18:33:456 4388 Process 668: Module services.exe:
    10:18:33:460 4388 Process 668: Module ntdll.dll:
    10:18:33:462 4388 Process 668: Module kernel32.dll:
    10:18:33:471 4388 Process 668: Module ADVAPI32.dll:
    10:18:33:477 4388 Process 668: Module RPCRT4.dll:
    10:18:33:480 4388 Process 668: Module USER32.dll:
    10:18:33:482 4388 Process 668: Module GDI32.dll:
    10:18:33:485 4388 Process 668: Module msvcrt.dll:
    10:18:33:485 4388 Process 668: Module USERENV.dll:
    10:18:33:486 4388 Process 668: Module Secur32.dll:
    10:18:33:503 4388 Process 668: Module SCESRV.dll:
    10:18:33:506 4388 Process 668: Module AUTHZ.dll:
    10:18:33:508 4388 Process 668: Module NETAPI32.dll:
    10:18:33:510 4388 Process 668: Module PSAPI.DLL:
    10:18:33:510 4388 Process 668: Module NCObjAPI.DLL:
    10:18:33:511 4388 Process 668: Module IMM32.DLL:
    10:18:33:514 4388 Process 668: Module MSCTF.dll:
    10:18:33:516 4388 Process 668: Module LPK.DLL:
    10:18:33:517 4388 Process 668: Module USP10.dll:
    10:18:33:519 4388 Process 668: Module CRYPT32.dll:
    10:18:33:520 4388 Process 668: Module MSASN1.dll:
    10:18:33:520 4388 Process 668: Module credssp.dll:
    10:18:33:521 4388 Process 668: Module schannel.dll:
    10:18:33:522 4388 Process 668: Module apphelp.dll:
    10:18:33:524 4388 Process 668: Module NTMARTA.DLL:
    10:18:33:525 4388 Process 668: Module WLDAP32.dll:
    10:18:33:526 4388 Process 668: Module WS2_32.dll:
    10:18:33:526 4388 Process 668: Module NSI.dll:
    10:18:33:527 4388 Process 668: Module SAMLIB.dll:
    10:18:33:530 4388 Process 668: Module ole32.dll:
    10:18:33:561 4388 Process 668: Module Comctl32.dll:
    10:18:33:564 4388 Process 668: Module SHLWAPI.dll:
    10:18:33:565 4388 Process 668: Module mswsock.dll:
    10:18:33:566 4388 Process 668: Module wshtcpip.dll:
    10:18:33:566 4388 Process 668: Module wship6.dll:
    10:18:33:571 4388 Process 680: Module lsass.exe:
    10:18:33:574 4388 Process 680: Module ntdll.dll:
    10:18:33:576 4388 Process 680: Module kernel32.dll:
    10:18:33:589 4388 Process 680: Module ADVAPI32.dll:
    10:18:33:595 4388 Process 680: Module RPCRT4.dll:
    10:18:33:599 4388 Process 680: Module msvcrt.dll:
    10:18:33:601 4388 Process 680: Module LSASRV.dll:
    10:18:33:606 4388 Process 680: Module Secur32.dll:
    10:18:33:610 4388 Process 680: Module USER32.dll:
    10:18:33:613 4388 Process 680: Module GDI32.dll:
    10:18:33:616 4388 Process 680: Module SAMSRV.dll:
    10:18:33:619 4388 Process 680: Module cryptdll.dll:
    10:18:33:620 4388 Process 680: Module DNSAPI.dll:
    10:18:33:622 4388 Process 680: Module WS2_32.dll:
    10:18:33:623 4388 Process 680: Module NSI.dll:
    10:18:33:624 4388 Process 680: Module NETAPI32.dll:
    10:18:33:627 4388 Process 680: Module PSAPI.DLL:
    10:18:33:628 4388 Process 680: Module SAMLIB.dll:
    10:18:33:629 4388 Process 680: Module MSASN1.dll:
    10:18:33:629 4388 Process 680: Module NTDSAPI.dll:
    10:18:33:630 4388 Process 680: Module WLDAP32.dll:
    10:18:33:635 4388 Process 680: Module FeClient.dll:
    10:18:33:636 4388 Process 680: Module MPR.dll:
    10:18:33:637 4388 Process 680: Module USERENV.dll:
    10:18:33:639 4388 Process 680: Module CRYPT32.dll:
    10:18:33:640 4388 Process 680: Module slc.dll:
    10:18:33:651 4388 Process 680: Module SYSNTFY.dll:
    10:18:33:652 4388 Process 680: Module wevtapi.dll:
    10:18:33:653 4388 Process 680: Module IPHLPAPI.DLL:
    10:18:33:654 4388 Process 680: Module dhcpcsvc.DLL:
    10:18:33:656 4388 Process 680: Module WINNSI.DLL:
    10:18:33:656 4388 Process 680: Module dhcpcsvc6.DLL:
    10:18:33:657 4388 Process 680: Module IMM32.DLL:
    10:18:33:660 4388 Process 680: Module MSCTF.dll:
    10:18:33:662 4388 Process 680: Module LPK.DLL:
    10:18:33:663 4388 Process 680: Module USP10.dll:
    10:18:33:663 4388 Process 680: Module cngaudit.dll:
    10:18:33:663 4388 Process 680: Module AUTHZ.dll:
    10:18:33:664 4388 Process 680: Module ncrypt.dll:
    10:18:33:676 4388 Process 680: Module BCRYPT.dll:
    10:18:33:677 4388 Process 680: Module credssp.dll:
    10:18:33:677 4388 Process 680: Module msprivs.dll:
    10:18:33:685 4388 Process 680: Module kerberos.dll:
    10:18:33:687 4388 Process 680: Module mswsock.dll:
    10:18:33:688 4388 Process 680: Module wship6.dll:
    10:18:33:688 4388 Process 680: Module msv1_0.dll:
    10:18:33:715 4388 Process 680: Module netlogon.dll:
    10:18:33:719 4388 Process 680: Module WINBRAND.dll:
    10:18:33:720 4388 Process 680: Module schannel.dll:
    10:18:33:730 4388 Process 680: Module wdigest.dll:
    10:18:33:732 4388 Process 680: Module rsaenh.dll:
    10:18:33:743 4388 Process 680: Module tspkg.dll:
    10:18:33:743 4388 Process 680: Module GPAPI.dll:
    10:18:33:791 4388 Process 680: Module setupapi.dll:
    10:18:33:794 4388 Process 680: Module OLEAUT32.dll:
    10:18:33:798 4388 Process 680: Module ole32.dll:
    10:18:33:807 4388 Process 680: Module scecli.dll:
    10:18:33:820 4388 Process 680: Module keyiso.dll:
    10:18:33:821 4388 Process 680: Module wshtcpip.dll:
    10:18:33:822 4388 Process 680: Module dssenh.dll:
    10:18:33:824 4388 Process 688: Module lsm.exe:
    10:18:33:827 4388 Process 688: Module ntdll.dll:
    10:18:33:829 4388 Process 688: Module kernel32.dll:
    10:18:33:842 4388 Process 688: Module ADVAPI32.dll:
    10:18:33:851 4388 Process 688: Module RPCRT4.dll:
    10:18:33:856 4388 Process 688: Module msvcrt.dll:
    10:18:33:856 4388 Process 688: Module SYSNTFY.dll:
    10:18:33:857 4388 Process 688: Module WMsgAPI.dll:
    10:18:33:857 4388 Process 688: Module secur32.dll:
    10:18:33:862 4388 Process 688: Module CRYPT32.dll:
    10:18:33:864 4388 Process 688: Module USER32.dll:
    10:18:33:866 4388 Process 688: Module GDI32.dll:
    10:18:33:867 4388 Process 688: Module MSASN1.dll:
    10:18:33:867 4388 Process 688: Module USERENV.dll:
    10:18:33:868 4388 Process 688: Module IMM32.DLL:
    10:18:33:871 4388 Process 688: Module MSCTF.dll:
    10:18:33:872 4388 Process 688: Module LPK.DLL:
    10:18:33:873 4388 Process 688: Module USP10.dll:
    10:18:33:874 4388 Process 688: Module credssp.dll:
    10:18:33:874 4388 Process 688: Module schannel.dll:
    10:18:33:876 4388 Process 688: Module NETAPI32.dll:
    10:18:33:878 4388 Process 688: Module PSAPI.DLL:
    10:18:33:880 4388 Process 776: Module winlogon.exe:
    10:18:33:885 4388 Process 776: Module ntdll.dll:
    10:18:33:886 4388 Process 776: Module kernel32.dll:
    10:18:33:896 4388 Process 776: Module ADVAPI32.dll:
    10:18:33:901 4388 Process 776: Module RPCRT4.dll:
    10:18:33:906 4388 Process 776: Module USER32.dll:
    10:18:33:908 4388 Process 776: Module GDI32.dll:
    10:18:33:912 4388 Process 776: Module msvcrt.dll:
    10:18:33:912 4388 Process 776: Module Secur32.dll:
    10:18:33:915 4388 Process 776: Module WINSTA.dll:
    10:18:33:916 4388 Process 776: Module PSAPI.DLL:
    10:18:33:917 4388 Process 776: Module USERENV.dll:
    10:18:33:917 4388 Process 776: Module IMM32.DLL:
    10:18:33:920 4388 Process 776: Module MSCTF.dll:
    10:18:33:921 4388 Process 776: Module LPK.DLL:
    10:18:33:922 4388 Process 776: Module USP10.dll:
    10:18:33:923 4388 Process 776: Module apphelp.dll:
    10:18:33:925 4388 Process 776: Module NTMARTA.DLL:
    10:18:33:926 4388 Process 776: Module WLDAP32.dll:
    10:18:33:927 4388 Process 776: Module WS2_32.dll:
    10:18:33:927 4388 Process 776: Module NSI.dll:
    10:18:33:928 4388 Process 776: Module SAMLIB.dll:
    10:18:33:933 4388 Process 776: Module ole32.dll:
    10:18:33:954 4388 Process 776: Module SHSVCS.dll:
    10:18:33:955 4388 Process 776: Module uxtheme.dll:
    10:18:33:957 4388 Process 776: Module rsaenh.dll:
    10:18:33:959 4388 Process 776: Module WindowsCodecs.dll:
    10:18:33:960 4388 Process 776: Module NETAPI32.dll:
    10:18:33:962 4388 Process 776: Module slc.dll:
    10:18:33:963 4388 Process 776: Module MPR.dll:
    10:18:33:966 4388 Process 876: Module svchost.exe:
    10:18:33:968 4388 Process 876: Module ntdll.dll:
    10:18:33:970 4388 Process 876: Module kernel32.dll:
    10:18:33:981 4388 Process 876: Module msvcrt.dll:
    10:18:33:983 4388 Process 876: Module ADVAPI32.dll:
    10:18:33:989 4388 Process 876: Module RPCRT4.dll:
    10:18:33:991 4388 Process 876: Module umpnpmgr.dll:
    10:18:33:993 4388 Process 876: Module USER32.dll:
    10:18:33:995 4388 Process 876: Module GDI32.dll:
    10:18:33:997 4388 Process 876: Module USERENV.dll:
    10:18:33:997 4388 Process 876: Module Secur32.dll:
    10:18:33:998 4388 Process 876: Module IMM32.DLL:
    10:18:34:001 4388 Process 876: Module MSCTF.dll:
    10:18:34:002 4388 Process 876: Module LPK.DLL:
    10:18:34:004 4388 Process 876: Module USP10.dll:
    10:18:34:005 4388 Process 876: Module POWRPROF.dll:
    10:18:34:005 4388 Process 876: Module GPAPI.dll:
    10:18:34:007 4388 Process 876: Module slc.dll:
    10:18:34:008 4388 Process 876: Module rpcss.dll:
    10:18:34:009 4388 Process 876: Module WS2_32.dll:
    10:18:34:010 4388 Process 876: Module NSI.dll:
    10:18:34:021 4388 Process 876: Module FirewallAPI.dll:
    10:18:34:022 4388 Process 876: Module OLEAUT32.dll:
    10:18:34:026 4388 Process 876: Module ole32.dll:
    10:18:34:028 4388 Process 876: Module VERSION.dll:
    10:18:34:031 4388 Process 876: Module CRYPT32.dll:
    10:18:34:032 4388 Process 876: Module MSASN1.dll:
    10:18:34:032 4388 Process 876: Module credssp.dll:
    10:18:34:034 4388 Process 876: Module schannel.dll:
    10:18:34:036 4388 Process 876: Module NETAPI32.dll:
    10:18:34:038 4388 Process 876: Module PSAPI.DLL:
    10:18:34:041 4388 Process 876: Module SETUPAPI.dll:
    10:18:34:049 4388 Process 876: Module Cabinet.dll:
    10:18:34:049 4388 Process 876: Module NTMARTA.DLL:
    10:18:34:052 4388 Process 876: Module WLDAP32.dll:
    10:18:34:052 4388 Process 876: Module SAMLIB.dll:
    10:18:34:055 4388 Process 876: Module CLBCatQ.DLL:
    10:18:34:056 4388 Process 876: Module WINSTA.dll:
    10:18:34:058 4388 Process 876: Module apphelp.dll:
    10:18:34:061 4388 Process 876: Module WTSAPI32.dll:
    10:18:34:106 4388 Process 876: Module msi.dll:
    10:18:34:107 4388 Process 876: Module msiltcfg.dll:
    10:18:34:108 4388 Process 876: Module SXS.DLL:
    10:18:34:109 4388 Process 876: Module SFC.DLL:
    10:18:34:110 4388 Process 876: Module sfc_os.dll:
    10:18:34:114 4388 Process 940: Module svchost.exe:
    10:18:34:118 4388 Process 940: Module ntdll.dll:
    10:18:34:121 4388 Process 940: Module kernel32.dll:
    10:18:34:131 4388 Process 940: Module msvcrt.dll:
    10:18:34:133 4388 Process 940: Module ADVAPI32.dll:
    10:18:34:141 4388 Process 940: Module RPCRT4.dll:
    10:18:34:144 4388 Process 940: Module rpcss.dll:
    10:18:34:146 4388 Process 940: Module WS2_32.dll:
    10:18:34:146 4388 Process 940: Module NSI.dll:
    10:18:34:146 4388 Process 940: Module Secur32.dll:
    10:18:34:148 4388 Process 940: Module FirewallAPI.dll:
    10:18:34:150 4388 Process 940: Module USER32.dll:
    10:18:34:152 4388 Process 940: Module GDI32.dll:
    10:18:34:155 4388 Process 940: Module OLEAUT32.dll:
    10:18:34:158 4388 Process 940: Module ole32.dll:
    10:18:34:160 4388 Process 940: Module VERSION.dll:
    10:18:34:160 4388 Process 940: Module IMM32.DLL:
    10:18:34:163 4388 Process 940: Module MSCTF.dll:
    10:18:34:164 4388 Process 940: Module LPK.DLL:
    10:18:34:165 4388 Process 940: Module USP10.dll:
    10:18:34:168 4388 Process 940: Module CRYPT32.dll:
    10:18:34:168 4388 Process 940: Module MSASN1.dll:
    10:18:34:169 4388 Process 940: Module USERENV.dll:
    10:18:34:169 4388 Process 940: Module credssp.dll:
    10:18:34:170 4388 Process 940: Module schannel.dll:
    10:18:34:172 4388 Process 940: Module NETAPI32.dll:
    10:18:34:176 4388 Process 940: Module PSAPI.DLL:
    10:18:34:177 4388 Process 940: Module rsaenh.dll:
    10:18:34:178 4388 Process 940: Module mswsock.dll:
    10:18:34:180 4388 Process 940: Module wshtcpip.dll:
    10:18:34:181 4388 Process 940: Module wship6.dll:
    10:18:34:183 4388 Process 940: Module CLBCatQ.DLL:
    10:18:34:206 4388 Process 940: Module fwpuclnt.dll:
    10:18:34:212 4388 Process 940: Module msi.dll:
    10:18:34:214 4388 Process 940: Module msiltcfg.dll:
    10:18:34:214 4388 Process 940: Module SXS.DLL:
    10:18:34:216 4388 Process 940: Module SFC.DLL:
    10:18:34:216 4388 Process 940: Module sfc_os.dll:
    10:18:34:220 4388 Process 940: Module SETUPAPI.dll:
    10:18:34:221 4388 Process 940: Module WTSAPI32.dll:
    10:18:34:222 4388 Process 940: Module WINSTA.dll:
    10:18:34:225 4388 Process 1028: Module MsMpEng.exe:
    10:18:34:227 4388 Process 1028: Module ntdll.dll:
    10:18:34:230 4388 Process 1028: Module kernel32.dll:
    10:18:34:262 4388 Process 1028: Module mpsvc.dll:
    10:18:34:264 4388 Process 1028: Module msvcrt.dll:
    10:18:34:266 4388 Process 1028: Module USER32.dll:
    10:18:34:270 4388 Process 1028: Module GDI32.dll:
    10:18:34:273 4388 Process 1028: Module ADVAPI32.dll:
    10:18:34:279 4388 Process 1028: Module RPCRT4.dll:
    10:18:34:284 4388 Process 1028: Module ole32.dll:
    10:18:34:287 4388 Process 1028: Module OLEAUT32.dll:
    10:18:34:288 4388 Process 1028: Module USERENV.dll:
    10:18:34:288 4388 Process 1028: Module Secur32.dll:
    10:18:34:289 4388 Process 1028: Module WTSAPI32.dll:
    10:18:34:304 4388 Process 1028: Module mpclient.dll:
    10:18:34:312 4388 Process 1028: Module WINTRUST.dll:
    10:18:34:316 4388 Process 1028: Module CRYPT32.dll:
    10:18:34:317 4388 Process 1028: Module MSASN1.dll:
    10:18:34:318 4388 Process 1028: Module imagehlp.dll:
    10:18:34:318 4388 Process 1028: Module VERSION.dll:
    10:18:34:319 4388 Process 1028: Module IMM32.DLL:
    10:18:34:321 4388 Process 1028: Module MSCTF.dll:
    10:18:34:323 4388 Process 1028: Module LPK.DLL:
    10:18:34:324 4388 Process 1028: Module USP10.dll:
    10:18:34:325 4388 Process 1028: Module GPAPI.dll:
    10:18:34:326 4388 Process 1028: Module slc.dll:
    10:18:34:326 4388 Process 1028: Module NTMARTA.DLL:
    10:18:34:327 4388 Process 1028: Module WLDAP32.dll:
    10:18:34:328 4388 Process 1028: Module WS2_32.dll:
    10:18:34:329 4388 Process 1028: Module NSI.dll:
    10:18:34:330 4388 Process 1028: Module PSAPI.DLL:
    10:18:34:330 4388 Process 1028: Module SAMLIB.dll:
    10:18:34:331 4388 Process 1028: Module rsaenh.dll:
    10:18:34:343 4388 Process 1028: Module mprtp.dll:
    10:18:34:356 4388 Process 1028: Module FLTLIB.DLL:
    10:18:34:369 4388 Process 1028: Module NisIpsPlugin.dll:
    10:18:34:438 4388 Process 1028: Module mpengine.dll:
    10:18:34:440 4388 Process 1028: Module credssp.dll:
    10:18:34:441 4388 Process 1028: Module schannel.dll:
    10:18:34:444 4388 Process 1028: Module NETAPI32.dll:
    10:18:34:448 4388 Process 1028: Module apphelp.dll:
    10:18:34:451 4388 Process 1028: Module wscapi.dll:
    10:18:34:487 4388 Process 1028: Module urlmon.dll:
    10:18:34:490 4388 Process 1028: Module SHLWAPI.dll:
    10:18:34:497 4388 Process 1028: Module iertutil.dll:
    10:18:34:502 4388 Process 1028: Module WININET.dll:
    10:18:34:504 4388 Process 1028: Module Normaliz.dll:
    10:18:34:510 4388 Process 1028: Module comctl32.dll:
    10:18:34:515 4388 Process 1028: Module ncrypt.dll:
    10:18:34:517 4388 Process 1028: Module BCRYPT.dll:
    10:18:34:873 4388 Process 1028: Module SHELL32.dll:
    10:18:34:877 4388 Process 1028: Module CLBCatQ.DLL:
    10:18:34:882 4388 Process 1120: Module Ati2evxx.exe:
    10:18:34:886 4388 Process 1120: Module ntdll.dll:
    10:18:34:889 4388 Process 1120: Module kernel32.dll:
    10:18:34:898 4388 Process 1120: Module USER32.dll:
    10:18:34:901 4388 Process 1120: Module GDI32.dll:
    10:18:34:904 4388 Process 1120: Module ADVAPI32.dll:
    10:18:34:910 4388 Process 1120: Module RPCRT4.dll:
    10:18:34:916 4388 Process 1120: Module ole32.dll:
    10:18:34:920 4388 Process 1120: Module msvcrt.dll:
    10:18:34:922 4388 Process 1120: Module OLEAUT32.dll:
    10:18:34:922 4388 Process 1120: Module USERENV.dll:
    10:18:34:923 4388 Process 1120: Module Secur32.dll:
    10:18:34:924 4388 Process 1120: Module PSAPI.DLL:
    10:18:34:929 4388 Process 1120: Module SETUPAPI.dll:
    10:18:34:931 4388 Process 1120: Module IMM32.DLL:
    10:18:34:935 4388 Process 1120: Module MSCTF.dll:
    10:18:34:936 4388 Process 1120: Module LPK.DLL:
    10:18:34:939 4388 Process 1120: Module USP10.dll:
    10:18:34:939 4388 Process 1120: Module wtsapi32.dll:
    10:18:34:940 4388 Process 1120: Module powrprof.dll:
    10:18:34:953 4388 Process 1120: Module cfgMgr32.dll:
    10:18:34:954 4388 Process 1120: Module WINSTA.dll:
    10:18:34:955 4388 Process 1120: Module apphelp.dll:
    10:18:34:959 4388 Process 1120: Module NTMARTA.DLL:
    10:18:34:962 4388 Process 1120: Module WLDAP32.dll:
    10:18:34:963 4388 Process 1120: Module WS2_32.dll:
    10:18:34:964 4388 Process 1120: Module NSI.dll:
    10:18:34:964 4388 Process 1120: Module SAMLIB.dll:
    10:18:34:973 4388 Process 1144: Module svchost.exe:
    10:18:34:978 4388 Process 1144: Module ntdll.dll:
    10:18:34:981 4388 Process 1144: Module kernel32.dll:
    10:18:34:998 4388 Process 1144: Module msvcrt.dll:
    10:18:35:001 4388 Process 1144: Module ADVAPI32.dll:
    10:18:35:012 4388 Process 1144: Module RPCRT4.dll:
    10:18:35:024 4388 Process 1144: Module wevtsvc.dll:
    10:18:35:026 4388 Process 1144: Module USERENV.dll:
    10:18:35:027 4388 Process 1144: Module Secur32.dll:
    10:18:35:031 4388 Process 1144: Module USER32.dll:
    10:18:35:034 4388 Process 1144: Module GDI32.dll:
    10:18:35:035 4388 Process 1144: Module VERSION.dll:
    10:18:35:035 4388 Process 1144: Module GPAPI.dll:
    10:18:35:036 4388 Process 1144: Module slc.dll:
    10:18:35:036 4388 Process 1144: Module IMM32.DLL:
    10:18:35:040 4388 Process 1144: Module MSCTF.dll:
    10:18:35:041 4388 Process 1144: Module LPK.DLL:
    10:18:35:042 4388 Process 1144: Module USP10.dll:
    10:18:35:045 4388 Process 1144: Module CRYPT32.dll:
    10:18:35:046 4388 Process 1144: Module MSASN1.dll:
    10:18:35:046 4388 Process 1144: Module credssp.dll:
    10:18:35:047 4388 Process 1144: Module schannel.dll:
    10:18:35:048 4388 Process 1144: Module NETAPI32.dll:
    10:18:35:051 4388 Process 1144: Module PSAPI.DLL:
    10:18:35:052 4388 Process 1144: Module WS2_32.dll:
    10:18:35:052 4388 Process 1144: Module NSI.dll:
    10:18:35:053 4388 Process 1144: Module mswsock.dll:
    10:18:35:054 4388 Process 1144: Module wshtcpip.dll:
    10:18:35:054 4388 Process 1144: Module wship6.dll:
    10:18:35:055 4388 Process 1144: Module audiosrv.dll:
    10:18:35:058 4388 Process 1144: Module ole32.dll:
    10:18:35:061 4388 Process 1144: Module OLEAUT32.dll:
    10:18:35:062 4388 Process 1144: Module MMDevAPI.DLL:
    10:18:35:062 4388 Process 1144: Module SHLWAPI.dll:
    10:18:35:063 4388 Process 1144: Module WTSAPI32.dll:
    10:18:35:064 4388 Process 1144: Module WINSTA.dll:
    10:18:35:069 4388 Process 1144: Module comctl32.dll:
    10:18:35:072 4388 Process 1144: Module CLBCatQ.DLL:
    10:18:35:077 4388 Process 1144: Module SETUPAPI.dll:
    10:18:35:078 4388 Process 1144: Module WINTRUST.dll:
    10:18:35:080 4388 Process 1144: Module imagehlp.dll:
    10:18:35:080 4388 Process 1144: Module rsaenh.dll:
    10:18:35:089 4388 Process 1144: Module audioses.dll:
    10:18:35:108 4388 Process 1144: Module audioeng.dll:
    10:18:35:122 4388 Process 1144: Module AVRT.dll:
    10:18:35:122 4388 Process 1144: Module lmhsvc.dll:
    10:18:35:123 4388 Process 1144: Module IPHLPAPI.DLL:
    10:18:35:123 4388 Process 1144: Module dhcpcsvc.DLL:
    10:18:35:125 4388 Process 1144: Module DNSAPI.dll:
    10:18:35:125 4388 Process 1144: Module WINNSI.DLL:
    10:18:35:126 4388 Process 1144: Module dhcpcsvc6.DLL:
    10:18:35:127 4388 Process 1144: Module EDSAPODll.dll:
    10:18:35:131 4388 Process 1144: Module WMALFXGFXDSP.dll:
    10:18:35:143 4388 Process 1144: Module mfplat.dll:
    10:18:35:143 4388 Process 1144: Module wscsvc.dll:
    10:18:35:144 4388 Process 1144: Module FirewallAPI.dll:
    10:18:35:163 4388 Process 1144: Module dbghelp.dll:
    10:18:35:169 4388 Process 1144: Module wbemprox.dll:
    10:18:35:171 4388 Process 1144: Module wbemcomn.dll:
    10:18:35:171 4388 Process 1144: Module wbemsvc.dll:
    10:18:35:173 4388 Process 1144: Module fastprox.dll:
    10:18:35:174 4388 Process 1144: Module NTDSAPI.dll:
    10:18:35:174 4388 Process 1144: Module WLDAP32.dll:
    10:18:35:175 4388 Process 1144: Module ncrypt.dll:
    10:18:35:176 4388 Process 1144: Module BCRYPT.dll:
    10:18:35:196 4388 Process 1144: Module wuapi.dll:
    10:18:35:197 4388 Process 1144: Module Cabinet.dll:
  20. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:35:205 4388 Process 1180: Module svchost.exe:
    10:18:35:207 4388 Process 1180: Module ntdll.dll:
    10:18:35:210 4388 Process 1180: Module kernel32.dll:
    10:18:35:219 4388 Process 1180: Module msvcrt.dll:
    10:18:35:221 4388 Process 1180: Module ADVAPI32.dll:
    10:18:35:226 4388 Process 1180: Module RPCRT4.dll:
    10:18:35:228 4388 Process 1180: Module NTMARTA.DLL:
    10:18:35:231 4388 Process 1180: Module USER32.dll:
    10:18:35:233 4388 Process 1180: Module GDI32.dll:
    10:18:35:235 4388 Process 1180: Module WLDAP32.dll:
    10:18:35:235 4388 Process 1180: Module WS2_32.dll:
    10:18:35:236 4388 Process 1180: Module NSI.dll:
    10:18:35:236 4388 Process 1180: Module PSAPI.DLL:
    10:18:35:236 4388 Process 1180: Module SAMLIB.dll:
    10:18:35:239 4388 Process 1180: Module ole32.dll:
    10:18:35:241 4388 Process 1180: Module IMM32.DLL:
    10:18:35:245 4388 Process 1180: Module MSCTF.dll:
    10:18:35:247 4388 Process 1180: Module LPK.DLL:
    10:18:35:248 4388 Process 1180: Module USP10.dll:
    10:18:35:249 4388 Process 1180: Module audiosrv.dll:
    10:18:35:251 4388 Process 1180: Module OLEAUT32.dll:
    10:18:35:252 4388 Process 1180: Module MMDevAPI.DLL:
    10:18:35:252 4388 Process 1180: Module SHLWAPI.dll:
    10:18:35:253 4388 Process 1180: Module WTSAPI32.dll:
    10:18:35:254 4388 Process 1180: Module WINSTA.dll:
    10:18:35:258 4388 Process 1180: Module comctl32.dll:
    10:18:35:262 4388 Process 1180: Module CLBCatQ.DLL:
    10:18:35:266 4388 Process 1180: Module SETUPAPI.dll:
    10:18:35:268 4388 Process 1180: Module WINTRUST.dll:
    10:18:35:271 4388 Process 1180: Module CRYPT32.dll:
    10:18:35:272 4388 Process 1180: Module MSASN1.dll:
    10:18:35:272 4388 Process 1180: Module USERENV.dll:
    10:18:35:273 4388 Process 1180: Module Secur32.dll:
    10:18:35:274 4388 Process 1180: Module imagehlp.dll:
    10:18:35:275 4388 Process 1180: Module uxsms.dll:
    10:18:35:286 4388 Process 1180: Module tabsvc.dll:
    10:18:35:287 4388 Process 1180: Module HID.DLL:
    10:18:35:288 4388 Process 1180: Module slc.dll:
    10:18:35:289 4388 Process 1180: Module wudfsvc.dll:
    10:18:35:289 4388 Process 1180: Module WUDFPlatform.dll:
    10:18:35:290 4388 Process 1180: Module VERSION.dll:
    10:18:35:290 4388 Process 1180: Module wevtapi.dll:
    10:18:35:292 4388 Process 1180: Module wlansvc.dll:
    10:18:35:293 4388 Process 1180: Module NETAPI32.dll:
    10:18:35:323 4388 Process 1180: Module SHELL32.dll:
    10:18:35:328 4388 Process 1180: Module WLANMSM.DLL:
    10:18:35:340 4388 Process 1180: Module WLANSEC.dll:
    10:18:35:389 4388 Process 1180: Module OneX.DLL:
    10:18:35:390 4388 Process 1180: Module eappprxy.dll:
    10:18:35:390 4388 Process 1180: Module eappcfg.dll:
    10:18:35:395 4388 Process 1180: Module gdiplus.dll:
    10:18:35:396 4388 Process 1180: Module DUser.dll:
    10:18:35:397 4388 Process 1180: Module UxTheme.dll:
    10:18:35:413 4388 Process 1180: Module OLEACC.dll:
    10:18:35:414 4388 Process 1180: Module AUTHZ.dll:
    10:18:35:415 4388 Process 1180: Module dhcpcsvc.DLL:
    10:18:35:416 4388 Process 1180: Module DNSAPI.dll:
    10:18:35:416 4388 Process 1180: Module WINNSI.DLL:
    10:18:35:416 4388 Process 1180: Module wlgpclnt.dll:
    10:18:35:429 4388 Process 1180: Module l2gpstore.dll:
    10:18:35:439 4388 Process 1180: Module wlanutil.dll:
    10:18:35:439 4388 Process 1180: Module SYSNTFY.dll:
    10:18:35:440 4388 Process 1180: Module WinSCard.dll:
    10:18:35:440 4388 Process 1180: Module IPHLPAPI.DLL:
    10:18:35:441 4388 Process 1180: Module dhcpcsvc6.DLL:
    10:18:35:442 4388 Process 1180: Module bcrypt.dll:
    10:18:35:446 4388 Process 1180: Module msxml6.dll:
    10:18:35:447 4388 Process 1180: Module rsaenh.dll:
    10:18:35:448 4388 Process 1180: Module credssp.dll:
    10:18:35:448 4388 Process 1180: Module schannel.dll:
    10:18:35:450 4388 Process 1180: Module kerberos.dll:
    10:18:35:452 4388 Process 1180: Module cryptdll.dll:
    10:18:35:453 4388 Process 1180: Module apphelp.dll:
    10:18:35:456 4388 Process 1180: Module emdmgmt.dll:
    10:18:35:457 4388 Process 1180: Module WDSCORE.dll:
    10:18:35:458 4388 Process 1180: Module hidserv.dll:
    10:18:35:459 4388 Process 1180: Module netcfgx.dll:
    10:18:35:460 4388 Process 1180: Module Cabinet.dll:
    10:18:35:460 4388 Process 1180: Module netman.dll:
    10:18:35:469 4388 Process 1180: Module RASAPI32.dll:
    10:18:35:470 4388 Process 1180: Module rasman.dll:
    10:18:35:470 4388 Process 1180: Module TAPI32.dll:
    10:18:35:471 4388 Process 1180: Module rtutils.dll:
    10:18:35:471 4388 Process 1180: Module WINMM.dll:
    10:18:35:472 4388 Process 1180: Module pcasvc.dll:
    10:18:35:474 4388 Process 1180: Module sysmain.dll:
    10:18:35:475 4388 Process 1180: Module trkwks.dll:
    10:18:35:475 4388 Process 1180: Module wpdbusenum.dll:
    10:18:35:476 4388 Process 1180: Module GPAPI.dll:
    10:18:35:492 4388 Process 1180: Module PortableDeviceApi.dll:
    10:18:35:493 4388 Process 1180: Module portabledeviceconnectapi.dll:
    10:18:35:612 4388 Process 1180: Module netshell.dll:
    10:18:35:614 4388 Process 1180: Module nlaapi.dll:
    10:18:35:656 4388 Process 1180: Module RASDLG.dll:
    10:18:35:658 4388 Process 1180: Module MPRAPI.dll:
    10:18:35:671 4388 Process 1180: Module ACTIVEDS.dll:
    10:18:35:677 4388 Process 1180: Module adsldpc.dll:
    10:18:35:677 4388 Process 1180: Module credui.dll:
    10:18:35:678 4388 Process 1180: Module ATL.DLL:
    10:18:35:679 4388 Process 1180: Module wdi.dll:
    10:18:35:679 4388 Process 1180: Module pcadm.dll:
    10:18:35:680 4388 Process 1180: Module hnetcfg.dll:
    10:18:35:682 4388 Process 1180: Module WINHTTP.dll:
    10:18:35:682 4388 Process 1180: Module mswsock.dll:
    10:18:35:683 4388 Process 1180: Module wshtcpip.dll:
    10:18:35:684 4388 Process 1180: Module upnp.dll:
    10:18:35:684 4388 Process 1180: Module SSDPAPI.dll:
    10:18:35:685 4388 Process 1180: Module SXS.DLL:
    10:18:35:686 4388 Process 1180: Module radardt.dll:
    10:18:35:686 4388 Process 1180: Module wbemprox.dll:
    10:18:35:687 4388 Process 1180: Module wbemcomn.dll:
    10:18:35:688 4388 Process 1180: Module wbemsvc.dll:
    10:18:35:689 4388 Process 1180: Module fastprox.dll:
    10:18:35:689 4388 Process 1180: Module NTDSAPI.dll:
    10:18:35:693 4388 Process 1180: Module msxml3.dll:
    10:18:35:701 4388 Process 1196: Module svchost.exe:
    10:18:35:703 4388 Process 1196: Module ntdll.dll:
    10:18:35:705 4388 Process 1196: Module kernel32.dll:
    10:18:35:713 4388 Process 1196: Module msvcrt.dll:
    10:18:35:715 4388 Process 1196: Module ADVAPI32.dll:
    10:18:35:721 4388 Process 1196: Module RPCRT4.dll:
    10:18:35:723 4388 Process 1196: Module NTMARTA.DLL:
    10:18:35:725 4388 Process 1196: Module USER32.dll:
    10:18:35:727 4388 Process 1196: Module GDI32.dll:
    10:18:35:728 4388 Process 1196: Module WLDAP32.dll:
    10:18:35:729 4388 Process 1196: Module WS2_32.dll:
    10:18:35:729 4388 Process 1196: Module NSI.dll:
    10:18:35:730 4388 Process 1196: Module PSAPI.DLL:
    10:18:35:730 4388 Process 1196: Module SAMLIB.dll:
    10:18:35:734 4388 Process 1196: Module ole32.dll:
    10:18:35:736 4388 Process 1196: Module IMM32.DLL:
    10:18:35:739 4388 Process 1196: Module MSCTF.dll:
    10:18:35:740 4388 Process 1196: Module LPK.DLL:
    10:18:35:741 4388 Process 1196: Module USP10.dll:
    10:18:35:742 4388 Process 1196: Module mmcss.dll:
    10:18:35:743 4388 Process 1196: Module AVRT.dll:
    10:18:35:744 4388 Process 1196: Module profsvc.dll:
    10:18:35:745 4388 Process 1196: Module SYSNTFY.dll:
    10:18:35:745 4388 Process 1196: Module USERENV.dll:
    10:18:35:745 4388 Process 1196: Module Secur32.dll:
    10:18:35:750 4388 Process 1196: Module nlaapi.dll:
    10:18:35:750 4388 Process 1196: Module IPHLPAPI.DLL:
    10:18:35:751 4388 Process 1196: Module dhcpcsvc.DLL:
    10:18:35:752 4388 Process 1196: Module DNSAPI.dll:
    10:18:35:753 4388 Process 1196: Module WINNSI.DLL:
    10:18:35:753 4388 Process 1196: Module dhcpcsvc6.DLL:
    10:18:35:754 4388 Process 1196: Module ATL.DLL:
    10:18:35:755 4388 Process 1196: Module shsvcs.dll:
    10:18:35:758 4388 Process 1196: Module WINSTA.dll:
    10:18:35:759 4388 Process 1196: Module UxTheme.dll:
    10:18:35:760 4388 Process 1196: Module rsaenh.dll:
    10:18:35:761 4388 Process 1196: Module sens.dll:
    10:18:35:761 4388 Process 1196: Module WTSAPI32.dll:
    10:18:35:761 4388 Process 1196: Module eapsvc.dll:
    10:18:35:762 4388 Process 1196: Module eapphost.dll:
    10:18:35:763 4388 Process 1196: Module OLEAUT32.dll:
    10:18:35:765 4388 Process 1196: Module CLBCatQ.DLL:
    10:18:35:766 4388 Process 1196: Module umb.dll:
    10:18:35:769 4388 Process 1196: Module SETUPAPI.dll:
    10:18:35:771 4388 Process 1196: Module WINTRUST.dll:
    10:18:35:774 4388 Process 1196: Module CRYPT32.dll:
    10:18:35:774 4388 Process 1196: Module MSASN1.dll:
    10:18:35:775 4388 Process 1196: Module imagehlp.dll:
    10:18:35:790 4388 Process 1196: Module COMCTL32.dll:
    10:18:35:793 4388 Process 1196: Module schedsvc.dll:
    10:18:35:794 4388 Process 1196: Module SHLWAPI.dll:
    10:18:35:795 4388 Process 1196: Module wevtapi.dll:
    10:18:35:796 4388 Process 1196: Module AUTHZ.dll:
    10:18:35:796 4388 Process 1196: Module ktmw32.dll:
    10:18:35:801 4388 Process 1196: Module comctl32.dll:
    10:18:35:803 4388 Process 1196: Module credssp.dll:
    10:18:35:803 4388 Process 1196: Module schannel.dll:
    10:18:35:805 4388 Process 1196: Module NETAPI32.dll:
    10:18:35:807 4388 Process 1196: Module taskcomp.dll:
    10:18:35:808 4388 Process 1196: Module VERSION.dll:
    10:18:35:808 4388 Process 1196: Module mswsock.dll:
    10:18:35:809 4388 Process 1196: Module wshtcpip.dll:
    10:18:35:809 4388 Process 1196: Module wship6.dll:
    10:18:35:824 4388 Process 1196: Module wiarpc.dll:
    10:18:35:824 4388 Process 1196: Module srvsvc.dll:
    10:18:35:826 4388 Process 1196: Module slc.dll:
    10:18:35:830 4388 Process 1196: Module SSCORE.DLL:
    10:18:35:831 4388 Process 1196: Module FirewallAPI.DLL:
    10:18:35:832 4388 Process 1196: Module CLUSAPI.DLL:
    10:18:35:832 4388 Process 1196: Module NTDSAPI.dll:
    10:18:35:833 4388 Process 1196: Module cryptdll.dll:
    10:18:35:833 4388 Process 1196: Module ACTIVEDS.dll:
    10:18:35:834 4388 Process 1196: Module adsldpc.dll:
    10:18:35:835 4388 Process 1196: Module credui.dll:
    10:18:35:859 4388 Process 1196: Module SHELL32.dll:
    10:18:35:870 4388 Process 1196: Module RESUTILS.DLL:
    10:18:35:871 4388 Process 1196: Module browser.dll:
    10:18:35:872 4388 Process 1196: Module aelupsvc.dll:
    10:18:35:873 4388 Process 1196: Module apphelp.dll:
    10:18:35:875 4388 Process 1196: Module ikeext.dll:
    10:18:35:877 4388 Process 1196: Module fwpuclnt.dll:
    10:18:35:878 4388 Process 1196: Module ncrypt.dll:
    10:18:35:879 4388 Process 1196: Module BCRYPT.dll:
    10:18:35:880 4388 Process 1196: Module seclogon.dll:
    10:18:35:881 4388 Process 1196: Module wmisvc.dll:
    10:18:35:882 4388 Process 1196: Module wbemcomn.dll:
    10:18:35:895 4388 Process 1196: Module iphlpsvc.dll:
    10:18:35:896 4388 Process 1196: Module rtutils.dll:
    10:18:35:896 4388 Process 1196: Module sqmapi.dll:
    10:18:35:897 4388 Process 1196: Module Cabinet.dll:
    10:18:35:897 4388 Process 1196: Module hnetcfg.dll:
    10:18:35:898 4388 Process 1196: Module GPAPI.dll:
    10:18:35:899 4388 Process 1196: Module WINHTTP.dll:
    10:18:35:939 4388 Process 1196: Module VSSAPI.DLL:
    10:18:35:940 4388 Process 1196: Module vsstrace.dll:
    10:18:35:940 4388 Process 1196: Module XmlLite.dll:
    10:18:35:940 4388 Process 1196: Module MPR.dll:
    10:18:35:974 4388 Process 1196: Module PROPSYS.dll:
    10:18:35:975 4388 Process 1196: Module wbemcore.dll:
    10:18:35:977 4388 Process 1196: Module esscli.dll:
    10:18:35:978 4388 Process 1196: Module FastProx.dll:
    10:18:35:978 4388 Process 1196: Module wbemsvc.dll:
    10:18:35:979 4388 Process 1196: Module wmiutils.dll:
    10:18:35:980 4388 Process 1196: Module repdrvfs.dll:
    10:18:35:982 4388 Process 1196: Module wmiprvsd.dll:
    10:18:35:983 4388 Process 1196: Module NCObjAPI.DLL:
    10:18:35:984 4388 Process 1196: Module rasmans.dll:
    10:18:35:985 4388 Process 1196: Module wbemess.dll:
    10:18:35:986 4388 Process 1196: Module rastapi.dll:
    10:18:35:986 4388 Process 1196: Module TAPI32.dll:
    10:18:35:987 4388 Process 1196: Module WINMM.dll:
    10:18:35:988 4388 Process 1196: Module OLEACC.dll:
    10:18:35:989 4388 Process 1196: Module napinsp.dll:
    10:18:35:989 4388 Process 1196: Module pnrpnsp.dll:
    10:18:35:992 4388 Process 1196: Module wshbth.dll:
    10:18:35:993 4388 Process 1196: Module mdnsNSP.dll:
    10:18:35:993 4388 Process 1196: Module winrnr.dll:
    10:18:35:993 4388 Process 1196: Module rasadhlp.dll:
    10:18:35:994 4388 Process 1196: Module rasppp.dll:
    10:18:35:994 4388 Process 1196: Module MPRAPI.dll:
    10:18:35:995 4388 Process 1196: Module RASAPI32.dll:
    10:18:35:996 4388 Process 1196: Module rasman.dll:
    10:18:35:997 4388 Process 1196: Module kerberos.dll:
    10:18:35:999 4388 Process 1196: Module RASQEC.DLL:
    10:18:36:009 4388 Process 1196: Module QUtil.dll:
    10:18:36:028 4388 Process 1196: Module raschap.dll:
    10:18:36:030 4388 Process 1196: Module rastls.dll:
    10:18:36:069 4388 Process 1196: Module CRYPTUI.dll:
    10:18:36:070 4388 Process 1196: Module MSIMG32.dll:
    10:18:36:070 4388 Process 1196: Module WinSCard.dll:
    10:18:36:071 4388 Process 1196: Module tschannel.dll:
    10:18:36:071 4388 Process 1196: Module SXS.DLL:
    10:18:36:073 4388 Process 1196: Module ncprov.dll:
    10:18:36:079 4388 Process 1196: Module qmgr.dll:
    10:18:36:080 4388 Process 1196: Module SHFOLDER.dll:
    10:18:36:080 4388 Process 1196: Module bitsperf.dll:
    10:18:36:081 4388 Process 1196: Module bitsigd.dll:
    10:18:36:081 4388 Process 1196: Module upnp.dll:
    10:18:36:082 4388 Process 1196: Module SSDPAPI.dll:
    10:18:36:082 4388 Process 1196: Module qmgrprxy.dll:
    10:18:36:082 4388 Process 1196: Module appinfo.dll:
    10:18:36:086 4388 Process 1196: Module wuaueng.dll:
    10:18:36:090 4388 Process 1196: Module ESENT.dll:
    10:18:36:106 4388 Process 1196: Module WINSPOOL.DRV:
    10:18:36:107 4388 Process 1196: Module mspatcha.dll:
    10:18:36:107 4388 Process 1196: Module WMsgAPI.dll:
    10:18:36:110 4388 Process 1196: Module msxml3.dll:
    10:18:36:113 4388 Process 1196: Module wer.dll:
    10:18:36:127 4388 Process 1196: Module SensApi.dll:
    10:18:36:134 4388 Process 1196: Module msi.dll:
    10:18:36:137 4388 Process 1196: Module advpack.dll:
    10:18:36:138 4388 Process 1196: Module dssenh.dll:
    10:18:36:141 4388 Process 1196: Module urlmon.dll:
    10:18:36:146 4388 Process 1196: Module iertutil.dll:
    10:18:36:149 4388 Process 1196: Module WININET.dll:
    10:18:36:150 4388 Process 1196: Module Normaliz.dll:
    10:18:36:150 4388 Process 1196: Module cryptnet.dll:
    10:18:36:151 4388 ScanProcess: OpenProcess (PID 1272) error 5
    10:18:36:153 4388 Process 1300: Module svchost.exe:
    10:18:36:156 4388 Process 1300: Module ntdll.dll:
    10:18:36:158 4388 Process 1300: Module kernel32.dll:
    10:18:36:167 4388 Process 1300: Module msvcrt.dll:
    10:18:36:169 4388 Process 1300: Module ADVAPI32.dll:
    10:18:36:175 4388 Process 1300: Module RPCRT4.dll:
    10:18:36:178 4388 Process 1300: Module NTMARTA.DLL:
    10:18:36:181 4388 Process 1300: Module USER32.dll:
    10:18:36:185 4388 Process 1300: Module GDI32.dll:
    10:18:36:187 4388 Process 1300: Module WLDAP32.dll:
    10:18:36:187 4388 Process 1300: Module WS2_32.dll:
    10:18:36:188 4388 Process 1300: Module NSI.dll:
    10:18:36:188 4388 Process 1300: Module PSAPI.DLL:
    10:18:36:188 4388 Process 1300: Module SAMLIB.dll:
    10:18:36:192 4388 Process 1300: Module ole32.dll:
    10:18:36:194 4388 Process 1300: Module IMM32.DLL:
    10:18:36:196 4388 Process 1300: Module MSCTF.dll:
    10:18:36:198 4388 Process 1300: Module LPK.DLL:
    10:18:36:199 4388 Process 1300: Module USP10.dll:
    10:18:36:200 4388 Process 1300: Module gpsvc.dll:
    10:18:36:201 4388 Process 1300: Module Secur32.dll:
    10:18:36:204 4388 Process 1300: Module NETAPI32.dll:
    10:18:36:207 4388 Process 1300: Module NTDSAPI.dll:
    10:18:36:208 4388 Process 1300: Module DNSAPI.dll:
    10:18:36:209 4388 Process 1300: Module WTSAPI32.dll:
    10:18:36:211 4388 Process 1300: Module OLEAUT32.dll:
    10:18:36:211 4388 Process 1300: Module USERENV.dll:
    10:18:36:212 4388 Process 1300: Module GPAPI.dll:
    10:18:36:213 4388 Process 1300: Module slc.dll:
    10:18:36:213 4388 Process 1300: Module AUTHZ.dll:
    10:18:36:214 4388 Process 1300: Module SYSNTFY.dll:
    10:18:36:214 4388 Process 1300: Module WINSTA.dll:
    10:18:36:215 4388 Process 1300: Module nlaapi.dll:
    10:18:36:215 4388 Process 1300: Module IPHLPAPI.DLL:
    10:18:36:216 4388 Process 1300: Module dhcpcsvc.DLL:
    10:18:36:216 4388 Process 1300: Module WINNSI.DLL:
    10:18:36:217 4388 Process 1300: Module dhcpcsvc6.DLL:
    10:18:36:229 4388 Process 1320: Module SLsvc.exe:
    10:18:36:233 4388 Process 1320: Module ntdll.dll:
    10:18:36:235 4388 Process 1320: Module kernel32.dll:
    10:18:36:245 4388 Process 1320: Module ADVAPI32.dll:
    10:18:36:251 4388 Process 1320: Module RPCRT4.dll:
    10:18:36:257 4388 Process 1320: Module msvcrt.dll:
    10:18:36:257 4388 Process 1320: Module slc.dll:
    10:18:36:259 4388 Process 1320: Module USER32.dll:
    10:18:36:262 4388 Process 1320: Module GDI32.dll:
    10:18:36:263 4388 Process 1320: Module DNSAPI.dll:
    10:18:36:264 4388 Process 1320: Module WS2_32.dll:
    10:18:36:265 4388 Process 1320: Module NSI.dll:
    10:18:36:265 4388 Process 1320: Module IMM32.DLL:
    10:18:36:269 4388 Process 1320: Module MSCTF.dll:
    10:18:36:272 4388 Process 1320: Module LPK.DLL:
    10:18:36:273 4388 Process 1320: Module USP10.dll:
    10:18:36:274 4388 Process 1320: Module rsaenh.dll:
    10:18:36:315 4388 Process 1320: Module SHELL32.dll:
    10:18:36:320 4388 Process 1320: Module SHLWAPI.dll:
    10:18:36:325 4388 Process 1320: Module comctl32.dll:
    10:18:36:331 4388 Process 1320: Module ole32.dll:
    10:18:36:335 4388 Process 1320: Module USERENV.dll:
    10:18:36:336 4388 Process 1320: Module Secur32.dll:
    10:18:36:342 4388 Process 1360: Module svchost.exe:
    10:18:36:345 4388 Process 1360: Module ntdll.dll:
    10:18:36:348 4388 Process 1360: Module kernel32.dll:
    10:18:36:362 4388 Process 1360: Module msvcrt.dll:
    10:18:36:364 4388 Process 1360: Module ADVAPI32.dll:
    10:18:36:370 4388 Process 1360: Module RPCRT4.dll:
    10:18:36:372 4388 Process 1360: Module NTMARTA.DLL:
    10:18:36:374 4388 Process 1360: Module USER32.dll:
  21. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    This report is ridiculously long, I'm not even half way to posting the complete thing....have I gone wrong somewhere?
  22. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:36:377 4388 Process 1360: Module GDI32.dll:
    10:18:36:379 4388 Process 1360: Module WLDAP32.dll:
    10:18:36:380 4388 Process 1360: Module WS2_32.dll:
    10:18:36:380 4388 Process 1360: Module NSI.dll:
    10:18:36:381 4388 Process 1360: Module PSAPI.DLL:
    10:18:36:381 4388 Process 1360: Module SAMLIB.dll:
    10:18:36:384 4388 Process 1360: Module ole32.dll:
    10:18:36:386 4388 Process 1360: Module IMM32.DLL:
    10:18:36:389 4388 Process 1360: Module MSCTF.dll:
    10:18:36:392 4388 Process 1360: Module LPK.DLL:
    10:18:36:394 4388 Process 1360: Module USP10.dll:
    10:18:36:395 4388 Process 1360: Module es.dll:
    10:18:36:398 4388 Process 1360: Module OLEAUT32.dll:
    10:18:36:401 4388 Process 1360: Module PROPSYS.dll:
    10:18:36:402 4388 Process 1360: Module rsaenh.dll:
    10:18:36:405 4388 Process 1360: Module CLBCatQ.DLL:
    10:18:36:412 4388 Process 1360: Module nsisvc.dll:
    10:18:36:412 4388 Process 1360: Module secur32.dll:
    10:18:36:417 4388 Process 1360: Module CRYPT32.dll:
    10:18:36:418 4388 Process 1360: Module MSASN1.dll:
    10:18:36:419 4388 Process 1360: Module USERENV.dll:
    10:18:36:419 4388 Process 1360: Module credssp.dll:
    10:18:36:420 4388 Process 1360: Module schannel.dll:
    10:18:36:423 4388 Process 1360: Module NETAPI32.dll:
    10:18:36:427 4388 Process 1360: Module SXS.DLL:
    10:18:36:428 4388 Process 1360: Module webclnt.dll:
    10:18:36:429 4388 Process 1360: Module WINHTTP.dll:
    10:18:36:430 4388 Process 1360: Module SHLWAPI.dll:
    10:18:36:435 4388 Process 1360: Module urlmon.dll:
    10:18:36:441 4388 Process 1360: Module iertutil.dll:
    10:18:36:444 4388 Process 1360: Module WININET.dll:
    10:18:36:445 4388 Process 1360: Module Normaliz.dll:
    10:18:36:448 4388 Process 1360: Module comctl32.dll:
    10:18:36:451 4388 Process 1360: Module wkssvc.dll:
    10:18:36:452 4388 Process 1360: Module IPHLPAPI.DLL:
    10:18:36:453 4388 Process 1360: Module dhcpcsvc.DLL:
    10:18:36:454 4388 Process 1360: Module DNSAPI.dll:
    10:18:36:455 4388 Process 1360: Module WINNSI.DLL:
    10:18:36:455 4388 Process 1360: Module dhcpcsvc6.DLL:
    10:18:36:456 4388 Process 1360: Module NTDSAPI.dll:
    10:18:36:458 4388 Process 1360: Module WINBRAND.dll:
    10:18:36:486 4388 Process 1360: Module shell32.dll:
    10:18:36:490 4388 Process 1360: Module fdrespub.dll:
    10:18:36:490 4388 Process 1360: Module wsdapi.dll:
    10:18:36:491 4388 Process 1360: Module HTTPAPI.dll:
    10:18:36:491 4388 Process 1360: Module WINTRUST.dll:
    10:18:36:492 4388 Process 1360: Module imagehlp.dll:
    10:18:36:493 4388 Process 1360: Module XmlLite.dll:
    10:18:36:494 4388 Process 1360: Module FirewallAPI.dll:
    10:18:36:494 4388 Process 1360: Module VERSION.dll:
    10:18:36:494 4388 Process 1360: Module FunDisc.dll:
    10:18:36:495 4388 Process 1360: Module ATL.DLL:
    10:18:36:504 4388 Process 1360: Module SETUPAPI.dll:
    10:18:36:507 4388 Process 1360: Module mswsock.dll:
    10:18:36:508 4388 Process 1360: Module wshtcpip.dll:
    10:18:36:508 4388 Process 1360: Module wship6.dll:
    10:18:36:511 4388 Process 1360: Module msxml3.dll:
    10:18:36:512 4388 Process 1360: Module ssdpsrv.dll:
    10:18:36:519 4388 Process 1360: Module sstpsvc.dll:
    10:18:36:519 4388 Process 1360: Module rtutils.dll:
    10:18:36:534 4388 Process 1360: Module upnphost.dll:
    10:18:36:534 4388 Process 1360: Module SSDPAPI.dll:
    10:18:36:534 4388 Process 1360: Module w32time.dll:
    10:18:36:535 4388 Process 1360: Module cryptdll.dll:
    10:18:36:535 4388 Process 1360: Module GPAPI.dll:
    10:18:36:536 4388 Process 1360: Module slc.dll:
    10:18:36:537 4388 Process 1360: Module netprofm.dll:
    10:18:36:537 4388 Process 1360: Module nlaapi.dll:
    10:18:36:537 4388 Process 1360: Module npmproxy.dll:
    10:18:36:537 4388 Process 1360: Module WTSAPI32.dll:
    10:18:36:538 4388 Process 1360: Module WINSTA.dll:
    10:18:36:538 4388 Process 1360: Module napinsp.dll:
    10:18:36:539 4388 Process 1360: Module pnrpnsp.dll:
    10:18:36:539 4388 Process 1360: Module wshbth.dll:
    10:18:36:540 4388 Process 1360: Module mdnsNSP.dll:
    10:18:36:540 4388 Process 1360: Module winrnr.dll:
    10:18:36:540 4388 Process 1360: Module rasadhlp.dll:
    10:18:36:541 4388 Process 1360: Module fdphost.dll:
    10:18:36:541 4388 Process 1360: Module fdwsd.dll:
    10:18:36:542 4388 Process 1360: Module MLANG.dll:
    10:18:36:543 4388 Process 1360: Module fdssdp.dll:
    10:18:36:543 4388 Process 1360: Module fdproxy.dll:
    10:18:36:552 4388 Process 1536: Module svchost.exe:
    10:18:36:555 4388 Process 1536: Module ntdll.dll:
    10:18:36:558 4388 Process 1536: Module kernel32.dll:
    10:18:36:574 4388 Process 1536: Module msvcrt.dll:
    10:18:36:576 4388 Process 1536: Module ADVAPI32.dll:
    10:18:36:586 4388 Process 1536: Module RPCRT4.dll:
    10:18:36:589 4388 Process 1536: Module NTMARTA.DLL:
    10:18:36:591 4388 Process 1536: Module USER32.dll:
    10:18:36:593 4388 Process 1536: Module GDI32.dll:
    10:18:36:595 4388 Process 1536: Module WLDAP32.dll:
    10:18:36:595 4388 Process 1536: Module WS2_32.dll:
    10:18:36:596 4388 Process 1536: Module NSI.dll:
    10:18:36:596 4388 Process 1536: Module PSAPI.DLL:
    10:18:36:596 4388 Process 1536: Module SAMLIB.dll:
    10:18:36:599 4388 Process 1536: Module ole32.dll:
    10:18:36:602 4388 Process 1536: Module IMM32.DLL:
    10:18:36:604 4388 Process 1536: Module MSCTF.dll:
    10:18:36:606 4388 Process 1536: Module LPK.DLL:
    10:18:36:607 4388 Process 1536: Module USP10.dll:
    10:18:36:607 4388 Process 1536: Module dnsrslvr.dll:
    10:18:36:608 4388 Process 1536: Module DNSAPI.dll:
    10:18:36:609 4388 Process 1536: Module dhcpcsvc.DLL:
    10:18:36:609 4388 Process 1536: Module Secur32.dll:
    10:18:36:611 4388 Process 1536: Module WINNSI.DLL:
    10:18:36:612 4388 Process 1536: Module dhcpcsvc6.DLL:
    10:18:36:613 4388 Process 1536: Module IPHLPAPI.DLL:
    10:18:36:614 4388 Process 1536: Module mswsock.dll:
    10:18:36:615 4388 Process 1536: Module wship6.dll:
    10:18:36:616 4388 Process 1536: Module cryptsvc.dll:
    10:18:36:617 4388 Process 1536: Module OLEAUT32.dll:
    10:18:36:620 4388 Process 1536: Module VSSAPI.DLL:
    10:18:36:622 4388 Process 1536: Module ATL.DLL:
    10:18:36:623 4388 Process 1536: Module vsstrace.dll:
    10:18:36:623 4388 Process 1536: Module AUTHZ.dll:
    10:18:36:625 4388 Process 1536: Module XmlLite.dll:
    10:18:36:626 4388 Process 1536: Module NETAPI32.dll:
    10:18:36:630 4388 Process 1536: Module MPR.dll:
    10:18:36:635 4388 Process 1536: Module SETUPAPI.dll:
    10:18:36:637 4388 Process 1536: Module CRYPTNET.dll:
    10:18:36:639 4388 Process 1536: Module CRYPT32.dll:
    10:18:36:640 4388 Process 1536: Module MSASN1.dll:
    10:18:36:640 4388 Process 1536: Module USERENV.dll:
    10:18:36:641 4388 Process 1536: Module SensApi.dll:
    10:18:36:642 4388 Process 1536: Module SHLWAPI.dll:
    10:18:36:646 4388 Process 1536: Module comctl32.dll:
    10:18:36:648 4388 Process 1536: Module rsaenh.dll:
    10:18:36:649 4388 Process 1536: Module CLBCatQ.DLL:
    10:18:36:650 4388 Process 1536: Module es.dll:
    10:18:36:653 4388 Process 1536: Module PROPSYS.dll:
    10:18:36:654 4388 Process 1536: Module nlasvc.dll:
    10:18:36:655 4388 Process 1536: Module wevtapi.dll:
    10:18:36:656 4388 Process 1536: Module ncsi.dll:
    10:18:36:657 4388 Process 1536: Module WINHTTP.dll:
    10:18:36:658 4388 Process 1536: Module WTSAPI32.dll:
    10:18:36:659 4388 Process 1536: Module bcrypt.dll:
    10:18:36:661 4388 Process 1536: Module CFGMGR32.dll:
    10:18:36:661 4388 Process 1536: Module credssp.dll:
    10:18:36:662 4388 Process 1536: Module schannel.dll:
    10:18:36:663 4388 Process 1536: Module ssdpapi.dll:
    10:18:36:664 4388 Process 1536: Module WINSTA.dll:
    10:18:36:665 4388 Process 1536: Module tapisrv.dll:
    10:18:36:666 4388 Process 1536: Module ACTIVEDS.dll:
    10:18:36:666 4388 Process 1536: Module adsldpc.dll:
    10:18:36:667 4388 Process 1536: Module credui.dll:
    10:18:36:691 4388 Process 1536: Module SHELL32.dll:
    10:18:36:695 4388 Process 1536: Module rtutils.dll:
    10:18:36:695 4388 Process 1536: Module WINMM.dll:
    10:18:36:696 4388 Process 1536: Module OLEACC.dll:
    10:18:36:700 4388 Process 1536: Module ESENT.dll:
    10:18:36:701 4388 Process 1536: Module termsrv.dll:
    10:18:36:702 4388 Process 1536: Module ICAAPI.dll:
    10:18:36:703 4388 Process 1536: Module WINTRUST.dll:
    10:18:36:705 4388 Process 1536: Module imagehlp.dll:
    10:18:36:706 4388 Process 1536: Module unimdm.tsp:
    10:18:36:707 4388 Process 1536: Module uniplat.dll:
    10:18:36:707 4388 Process 1536: Module kmddsp.tsp:
    10:18:36:708 4388 Process 1536: Module ndptsp.tsp:
    10:18:36:708 4388 Process 1536: Module hidphone.tsp:
    10:18:36:708 4388 Process 1536: Module HID.DLL:
    10:18:36:709 4388 Process 1536: Module msdtckrm.dll:
    10:18:36:710 4388 Process 1536: Module VERSION.dll:
    10:18:36:710 4388 Process 1536: Module ktmw32.dll:
    10:18:36:711 4388 Process 1536: Module CLUSAPI.dll:
    10:18:36:711 4388 Process 1536: Module NTDSAPI.dll:
    10:18:36:712 4388 Process 1536: Module cryptdll.dll:
    10:18:36:712 4388 Process 1536: Module wshtcpip.dll:
    10:18:36:713 4388 Process 1536: Module NLAapi.dll:
    10:18:36:713 4388 Process 1536: Module napinsp.dll:
    10:18:36:714 4388 Process 1536: Module pnrpnsp.dll:
    10:18:36:714 4388 Process 1536: Module wshbth.dll:
    10:18:36:715 4388 Process 1536: Module mdnsNSP.dll:
    10:18:36:715 4388 Process 1536: Module winrnr.dll:
    10:18:36:715 4388 Process 1536: Module rasadhlp.dll:
    10:18:36:716 4388 Process 1536: Module Cabinet.dll:
    10:18:36:716 4388 Process 1536: Module ncrypt.dll:
    10:18:36:721 4388 Process 1544: Module Ati2evxx.exe:
    10:18:36:724 4388 Process 1544: Module ntdll.dll:
    10:18:36:726 4388 Process 1544: Module kernel32.dll:
    10:18:36:739 4388 Process 1544: Module USER32.dll:
    10:18:36:741 4388 Process 1544: Module GDI32.dll:
    10:18:36:746 4388 Process 1544: Module ADVAPI32.dll:
    10:18:36:755 4388 Process 1544: Module RPCRT4.dll:
    10:18:36:759 4388 Process 1544: Module ole32.dll:
    10:18:36:763 4388 Process 1544: Module msvcrt.dll:
    10:18:36:764 4388 Process 1544: Module OLEAUT32.dll:
    10:18:36:765 4388 Process 1544: Module USERENV.dll:
    10:18:36:765 4388 Process 1544: Module Secur32.dll:
    10:18:36:766 4388 Process 1544: Module PSAPI.DLL:
    10:18:36:770 4388 Process 1544: Module SETUPAPI.dll:
    10:18:36:772 4388 Process 1544: Module IMM32.DLL:
    10:18:36:774 4388 Process 1544: Module MSCTF.dll:
    10:18:36:776 4388 Process 1544: Module LPK.DLL:
    10:18:36:778 4388 Process 1544: Module USP10.dll:
    10:18:36:779 4388 Process 1544: Module wtsapi32.dll:
    10:18:36:779 4388 Process 1544: Module powrprof.dll:
    10:18:36:780 4388 Process 1544: Module cfgMgr32.dll:
    10:18:36:781 4388 Process 1544: Module uxtheme.dll:
    10:18:36:784 4388 Process 1544: Module WINTRUST.dll:
    10:18:36:788 4388 Process 1544: Module CRYPT32.dll:
    10:18:36:789 4388 Process 1544: Module MSASN1.dll:
    10:18:36:789 4388 Process 1544: Module imagehlp.dll:
    10:18:36:814 4388 Process 1544: Module Ati2edxx.dll:
    10:18:36:815 4388 Process 1544: Module atipdlxx.dll:
    10:18:36:815 4388 Process 1544: Module ati2evxx.dll:
    10:18:36:816 4388 Process 1544: Module WINSTA.dll:
    10:18:36:818 4388 Process 1544: Module CLBCatQ.DLL:
    10:18:36:818 4388 Process 1544: Module es.dll:
    10:18:36:821 4388 Process 1544: Module PROPSYS.dll:
    10:18:36:822 4388 Process 1544: Module rsaenh.dll:
    10:18:36:823 4388 Process 1544: Module SXS.DLL:
    10:18:36:826 4388 Process 1688: Module WLANExt.exe:
    10:18:36:829 4388 Process 1688: Module ntdll.dll:
    10:18:36:832 4388 Process 1688: Module kernel32.dll:
    10:18:36:845 4388 Process 1688: Module ADVAPI32.dll:
    10:18:36:855 4388 Process 1688: Module RPCRT4.dll:
    10:18:36:859 4388 Process 1688: Module msvcrt.dll:
    10:18:36:861 4388 Process 1688: Module USER32.dll:
    10:18:36:863 4388 Process 1688: Module GDI32.dll:
    10:18:36:866 4388 Process 1688: Module CRYPT32.dll:
    10:18:36:867 4388 Process 1688: Module MSASN1.dll:
    10:18:36:868 4388 Process 1688: Module USERENV.dll:
    10:18:36:869 4388 Process 1688: Module Secur32.dll:
    10:18:36:871 4388 Process 1688: Module IMM32.DLL:
    10:18:36:874 4388 Process 1688: Module MSCTF.dll:
    10:18:36:875 4388 Process 1688: Module LPK.DLL:
    10:18:36:877 4388 Process 1688: Module USP10.dll:
    10:18:36:877 4388 Process 1688: Module credssp.dll:
    10:18:36:879 4388 Process 1688: Module schannel.dll:
    10:18:36:881 4388 Process 1688: Module NETAPI32.dll:
    10:18:36:885 4388 Process 1688: Module PSAPI.DLL:
    10:18:36:886 4388 Process 1688: Module athihvs.dll:
    10:18:36:887 4388 Process 1688: Module Wlanapi.dll:
    10:18:36:890 4388 Process 1688: Module OneX.DLL:
    10:18:36:891 4388 Process 1688: Module WTSAPI32.dll:
    10:18:36:891 4388 Process 1688: Module eappprxy.dll:
    10:18:36:894 4388 Process 1688: Module ole32.dll:
    10:18:36:896 4388 Process 1688: Module eappcfg.dll:
    10:18:36:898 4388 Process 1688: Module OLEAUT32.dll:
    10:18:36:902 4388 Process 1688: Module gdiplus.dll:
    10:18:36:904 4388 Process 1688: Module SHLWAPI.dll:
    10:18:36:905 4388 Process 1688: Module DUser.dll:
    10:18:36:905 4388 Process 1688: Module UxTheme.dll:
    10:18:36:907 4388 Process 1688: Module OLEACC.dll:
    10:18:36:908 4388 Process 1688: Module bcrypt.dll:
  23. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:36:909 4388 Process 1688: Module wlanutil.dll:
    10:18:36:910 4388 Process 1688: Module WS2_32.dll:
    10:18:36:911 4388 Process 1688: Module NSI.dll:
    10:18:36:911 4388 Process 1688: Module XmlLite.dll:
    10:18:36:913 4388 Process 1688: Module MSVCR80.dll:
    10:18:36:914 4388 Process 1688: Module IPHLPAPI.DLL:
    10:18:36:915 4388 Process 1688: Module dhcpcsvc.DLL:
    10:18:36:917 4388 Process 1688: Module DNSAPI.dll:
    10:18:36:917 4388 Process 1688: Module WINNSI.DLL:
    10:18:36:918 4388 Process 1688: Module dhcpcsvc6.DLL:
    10:18:36:922 4388 Process 1688: Module comctl32.dll:
    10:18:36:929 4388 Process 1764: Module spoolsv.exe:
    10:18:36:932 4388 Process 1764: Module ntdll.dll:
    10:18:36:934 4388 Process 1764: Module kernel32.dll:
    10:18:36:943 4388 Process 1764: Module ADVAPI32.dll:
    10:18:36:949 4388 Process 1764: Module RPCRT4.dll:
    10:18:36:952 4388 Process 1764: Module msvcrt.dll:
    10:18:36:952 4388 Process 1764: Module slc.dll:
    10:18:36:953 4388 Process 1764: Module secur32.dll:
    10:18:36:956 4388 Process 1764: Module CRYPT32.dll:
    10:18:36:958 4388 Process 1764: Module USER32.dll:
    10:18:36:960 4388 Process 1764: Module GDI32.dll:
    10:18:36:961 4388 Process 1764: Module MSASN1.dll:
    10:18:36:961 4388 Process 1764: Module USERENV.dll:
    10:18:36:962 4388 Process 1764: Module IMM32.DLL:
    10:18:36:964 4388 Process 1764: Module MSCTF.dll:
    10:18:36:966 4388 Process 1764: Module LPK.DLL:
    10:18:36:967 4388 Process 1764: Module USP10.dll:
    10:18:36:967 4388 Process 1764: Module credssp.dll:
    10:18:36:968 4388 Process 1764: Module schannel.dll:
    10:18:36:970 4388 Process 1764: Module NETAPI32.dll:
    10:18:36:972 4388 Process 1764: Module PSAPI.DLL:
    10:18:36:972 4388 Process 1764: Module SPOOLSS.DLL:
    10:18:36:973 4388 Process 1764: Module WTSAPI32.dll:
    10:18:36:974 4388 Process 1764: Module WS2_32.dll:
    10:18:36:974 4388 Process 1764: Module NSI.dll:
    10:18:36:975 4388 Process 1764: Module mswsock.dll:
    10:18:36:976 4388 Process 1764: Module IPHLPAPI.DLL:
    10:18:36:977 4388 Process 1764: Module dhcpcsvc.DLL:
    10:18:36:978 4388 Process 1764: Module DNSAPI.dll:
    10:18:36:978 4388 Process 1764: Module WINNSI.DLL:
    10:18:36:978 4388 Process 1764: Module dhcpcsvc6.DLL:
    10:18:36:979 4388 Process 1764: Module rasadhlp.dll:
    10:18:36:982 4388 Process 1764: Module ole32.dll:
    10:18:36:985 4388 Process 1764: Module CLBCatQ.DLL:
    10:18:36:987 4388 Process 1764: Module OLEAUT32.dll:
    10:18:36:988 4388 Process 1764: Module WINTRUST.dll:
    10:18:36:988 4388 Process 1764: Module imagehlp.dll:
    10:18:36:990 4388 Process 1764: Module localspl.dll:
    10:18:36:991 4388 Process 1764: Module VERSION.dll:
    10:18:36:991 4388 Process 1764: Module sfc.dll:
    10:18:36:992 4388 Process 1764: Module SHLWAPI.dll:
    10:18:37:015 4388 Process 1764: Module SHELL32.dll:
    10:18:37:022 4388 Process 1764: Module SETUPAPI.dll:
    10:18:37:027 4388 Process 1764: Module comctl32.dll:
    10:18:37:029 4388 Process 1764: Module winspool.drv:
    10:18:37:030 4388 Process 1764: Module CNMLMAR.DLL:
    10:18:37:053 4388 Process 1764: Module CNMNPPM.DLL:
    10:18:37:068 4388 Process 1764: Module hpzlllhn.dll:
    10:18:37:068 4388 Process 1764: Module wshtcpip.dll:
    10:18:37:068 4388 Process 1764: Module wship6.dll:
    10:18:37:069 4388 Process 1764: Module NLAapi.dll:
    10:18:37:069 4388 Process 1764: Module hpz3l5mu.dll:
    10:18:37:070 4388 Process 1764: Module napinsp.dll:
    10:18:37:082 4388 Process 1764: Module msonpmon.dll:
    10:18:37:084 4388 Process 1764: Module MSVCR80.dll:
    10:18:37:089 4388 Process 1764: Module msi.dll:
    10:18:37:090 4388 Process 1764: Module pnrpnsp.dll:
    10:18:37:090 4388 Process 1764: Module tcpmon.dll:
    10:18:37:091 4388 Process 1764: Module snmpapi.dll:
    10:18:37:092 4388 Process 1764: Module wsnmp32.dll:
    10:18:37:092 4388 Process 1764: Module wshbth.dll:
    10:18:37:095 4388 Process 1764: Module msxml6.dll:
    10:18:37:095 4388 Process 1764: Module mdnsNSP.dll:
    10:18:37:095 4388 Process 1764: Module tcpmib.dll:
    10:18:37:096 4388 Process 1764: Module mgmtapi.dll:
    10:18:37:096 4388 Process 1764: Module winrnr.dll:
    10:18:37:097 4388 Process 1764: Module WLDAP32.dll:
    10:18:37:097 4388 Process 1764: Module usbmon.dll:
    10:18:37:097 4388 Process 1764: Module wls0wndh.dll:
    10:18:37:097 4388 Process 1764: Module WSDMon.dll:
    10:18:37:099 4388 Process 1764: Module wsdapi.dll:
    10:18:37:099 4388 Process 1764: Module HTTPAPI.dll:
    10:18:37:100 4388 Process 1764: Module WINHTTP.dll:
    10:18:37:101 4388 Process 1764: Module XmlLite.dll:
    10:18:37:101 4388 Process 1764: Module CFGMGR32.dll:
    10:18:37:102 4388 Process 1764: Module FunDisc.dll:
    10:18:37:102 4388 Process 1764: Module ATL.DLL:
    10:18:37:105 4388 Process 1764: Module msxml3.dll:
    10:18:37:105 4388 Process 1764: Module CNMPDAR.DLL:
    10:18:37:115 4388 Process 1764: Module hpzpp5mu.dll:
    10:18:37:116 4388 Process 1764: Module hpzpplhn.dll:
    10:18:37:128 4388 Process 1764: Module msonpppr.dll:
    10:18:37:128 4388 Process 1764: Module NTMARTA.DLL:
    10:18:37:129 4388 Process 1764: Module SAMLIB.dll:
    10:18:37:151 4388 Process 1764: Module win32spl.dll:
    10:18:37:153 4388 Process 1764: Module NETRAP.dll:
    10:18:37:154 4388 Process 1764: Module printcom.dll:
    10:18:37:154 4388 Process 1764: Module SensApi.dll:
    10:18:37:154 4388 Process 1764: Module GPAPI.dll:
    10:18:37:155 4388 Process 1764: Module inetpp.dll:
    10:18:37:156 4388 Process 1764: Module WINSTA.dll:
    10:18:37:157 4388 Process 1764: Module rsaenh.dll:
    10:18:37:286 4388 Process 1764: Module CNMUIAR.DLL:
    10:18:37:288 4388 Process 1764: Module MSIMG32.dll:
    10:18:37:290 4388 Process 1764: Module mscms.dll:
    10:18:37:294 4388 Process 1828: Module svchost.exe:
    10:18:37:297 4388 Process 1828: Module ntdll.dll:
    10:18:37:299 4388 Process 1828: Module kernel32.dll:
    10:18:37:310 4388 Process 1828: Module msvcrt.dll:
    10:18:37:312 4388 Process 1828: Module ADVAPI32.dll:
    10:18:37:318 4388 Process 1828: Module RPCRT4.dll:
    10:18:37:322 4388 Process 1828: Module bfe.dll:
    10:18:37:323 4388 Process 1828: Module AUTHZ.dll:
    10:18:37:324 4388 Process 1828: Module Secur32.dll:
    10:18:37:326 4388 Process 1828: Module USER32.dll:
    10:18:37:328 4388 Process 1828: Module GDI32.dll:
    10:18:37:329 4388 Process 1828: Module IMM32.DLL:
    10:18:37:333 4388 Process 1828: Module MSCTF.dll:
    10:18:37:336 4388 Process 1828: Module LPK.DLL:
    10:18:37:337 4388 Process 1828: Module USP10.dll:
    10:18:37:338 4388 Process 1828: Module mpssvc.dll:
    10:18:37:339 4388 Process 1828: Module FirewallAPI.dll:
    10:18:37:341 4388 Process 1828: Module OLEAUT32.dll:
    10:18:37:344 4388 Process 1828: Module ole32.dll:
    10:18:37:348 4388 Process 1828: Module VERSION.dll:
    10:18:37:348 4388 Process 1828: Module nlaapi.dll:
    10:18:37:349 4388 Process 1828: Module IPHLPAPI.DLL:
    10:18:37:350 4388 Process 1828: Module dhcpcsvc.DLL:
    10:18:37:351 4388 Process 1828: Module DNSAPI.dll:
    10:18:37:352 4388 Process 1828: Module WS2_32.dll:
    10:18:37:353 4388 Process 1828: Module NSI.dll:
    10:18:37:353 4388 Process 1828: Module WINNSI.DLL:
    10:18:37:354 4388 Process 1828: Module dhcpcsvc6.DLL:
    10:18:37:358 4388 Process 1828: Module CRYPT32.dll:
    10:18:37:359 4388 Process 1828: Module MSASN1.dll:
    10:18:37:359 4388 Process 1828: Module USERENV.dll:
    10:18:37:361 4388 Process 1828: Module bcrypt.dll:
    10:18:37:362 4388 Process 1828: Module WTSAPI32.dll:
    10:18:37:363 4388 Process 1828: Module SHLWAPI.dll:
    10:18:37:367 4388 Process 1828: Module fwpuclnt.dll:
    10:18:37:371 4388 Process 1828: Module comctl32.dll:
    10:18:37:373 4388 Process 1828: Module credssp.dll:
    10:18:37:374 4388 Process 1828: Module schannel.dll:
    10:18:37:375 4388 Process 1828: Module NETAPI32.dll:
    10:18:37:379 4388 Process 1828: Module PSAPI.DLL:
    10:18:37:379 4388 Process 1828: Module GPAPI.dll:
    10:18:37:381 4388 Process 1828: Module slc.dll:
    10:18:37:392 4388 Process 1828: Module wfapigp.dll:
    10:18:37:392 4388 Process 1828: Module ntmarta.dll:
    10:18:37:394 4388 Process 1828: Module WLDAP32.dll:
    10:18:37:395 4388 Process 1828: Module SAMLIB.dll:
    10:18:37:396 4388 Process 1828: Module dps.dll:
    10:18:37:397 4388 Process 1828: Module wdi.dll:
    10:18:37:398 4388 Process 1828: Module CLBCatQ.DLL:
    10:18:37:399 4388 Process 1828: Module taskschd.dll:
    10:18:37:400 4388 Process 1828: Module XmlLite.dll:
    10:18:37:423 4388 Process 1828: Module diagperf.dll:
    10:18:37:451 4388 Process 1828: Module SHELL32.dll:
    10:18:37:457 4388 Process 1828: Module pnpts.dll:
    10:18:37:457 4388 Process 1828: Module rsaenh.dll:
    10:18:37:458 4388 Process 1828: Module npmproxy.dll:
    10:18:37:458 4388 Process 1828: Module WINTRUST.dll:
    10:18:37:459 4388 Process 1828: Module imagehlp.dll:
    10:18:37:459 4388 Process 1828: Module pots.dll:
    10:18:37:477 4388 Process 1828: Module tdh.dll:
    10:18:37:477 4388 Process 1828: Module POWRPROF.dll:
    10:18:37:480 4388 Process 1828: Module SETUPAPI.dll:
    10:18:37:482 4388 Process 1828: Module mswsock.dll:
    10:18:37:483 4388 Process 1828: Module wshtcpip.dll:
    10:18:37:484 4388 Process 1828: Module wship6.dll:
    10:18:37:485 4388 Process 200: Module SASCORE.EXE:
    10:18:37:488 4388 Process 200: Module ntdll.dll:
    10:18:37:490 4388 Process 200: Module kernel32.dll:
    10:18:37:498 4388 Process 200: Module VERSION.dll:
    10:18:37:499 4388 Process 200: Module msvcrt.dll:
    10:18:37:501 4388 Process 200: Module USER32.dll:
    10:18:37:504 4388 Process 200: Module GDI32.dll:
    10:18:37:507 4388 Process 200: Module ADVAPI32.dll:
    10:18:37:513 4388 Process 200: Module RPCRT4.dll:
    10:18:37:535 4388 Process 200: Module SHELL32.dll:
    10:18:37:540 4388 Process 200: Module SHLWAPI.dll:
    10:18:37:542 4388 Process 200: Module OLEAUT32.dll:
    10:18:37:545 4388 Process 200: Module ole32.dll:
    10:18:37:547 4388 Process 200: Module IMM32.DLL:
    10:18:37:551 4388 Process 200: Module MSCTF.dll:
    10:18:37:553 4388 Process 200: Module LPK.DLL:
    10:18:37:555 4388 Process 200: Module USP10.dll:
    10:18:37:561 4388 Process 200: Module comctl32.dll:
    10:18:37:565 4388 Process 292: Module AppleMobileDeviceService.exe:
    10:18:37:568 4388 Process 292: Module ntdll.dll:
    10:18:37:570 4388 Process 292: Module kernel32.dll:
    10:18:37:578 4388 Process 292: Module WSOCK32.dll:
    10:18:37:578 4388 Process 292: Module WS2_32.dll:
    10:18:37:581 4388 Process 292: Module msvcrt.dll:
    10:18:37:584 4388 Process 292: Module ADVAPI32.dll:
    10:18:37:593 4388 Process 292: Module RPCRT4.dll:
    10:18:37:595 4388 Process 292: Module NSI.dll:
    10:18:37:599 4388 Process 292: Module SETUPAPI.dll:
    10:18:37:601 4388 Process 292: Module GDI32.dll:
    10:18:37:604 4388 Process 292: Module USER32.dll:
    10:18:37:608 4388 Process 292: Module OLEAUT32.dll:
    10:18:37:612 4388 Process 292: Module ole32.dll:
    10:18:37:615 4388 Process 292: Module WTSAPI32.dll:
    10:18:37:615 4388 Process 292: Module USERENV.dll:
    10:18:37:616 4388 Process 292: Module Secur32.dll:
    10:18:37:617 4388 Process 292: Module IMM32.DLL:
    10:18:37:620 4388 Process 292: Module MSCTF.dll:
    10:18:37:621 4388 Process 292: Module LPK.DLL:
    10:18:37:622 4388 Process 292: Module USP10.dll:
    10:18:37:623 4388 Process 292: Module NTMARTA.DLL:
    10:18:37:624 4388 Process 292: Module WLDAP32.dll:
    10:18:37:625 4388 Process 292: Module PSAPI.DLL:
    10:18:37:625 4388 Process 292: Module SAMLIB.dll:
    10:18:37:626 4388 Process 292: Module mswsock.dll:
    10:18:37:627 4388 Process 292: Module wshtcpip.dll:
    10:18:37:627 4388 Process 292: Module WINTRUST.dll:
    10:18:37:630 4388 Process 292: Module CRYPT32.dll:
    10:18:37:631 4388 Process 292: Module MSASN1.dll:
    10:18:37:631 4388 Process 292: Module imagehlp.dll:
    10:18:37:632 4388 Process 292: Module WINSTA.dll:
    10:18:37:637 4388 Process 316: Module BcmSqlStartupSvc.exe:
    10:18:37:641 4388 Process 316: Module ntdll.dll:
    10:18:37:645 4388 Process 316: Module kernel32.dll:
    10:18:37:654 4388 Process 316: Module MSVCR80.dll:
    10:18:37:657 4388 Process 316: Module msvcrt.dll:
    10:18:37:659 4388 Process 316: Module ADVAPI32.dll:
    10:18:37:666 4388 Process 316: Module RPCRT4.dll:
    10:18:37:708 4388 Process 316: Module SHELL32.dll:
    10:18:37:713 4388 Process 316: Module GDI32.dll:
    10:18:37:716 4388 Process 316: Module USER32.dll:
    10:18:37:719 4388 Process 316: Module SHLWAPI.dll:
    10:18:37:725 4388 Process 316: Module ole32.dll:
    10:18:37:729 4388 Process 316: Module OLEAUT32.dll:
    10:18:37:730 4388 Process 316: Module IMM32.DLL:
    10:18:37:734 4388 Process 316: Module MSCTF.dll:
    10:18:37:735 4388 Process 316: Module LPK.DLL:
    10:18:37:737 4388 Process 316: Module USP10.dll:
    10:18:37:743 4388 Process 316: Module comctl32.dll:
    10:18:37:745 4388 Process 316: Module USERENV.dll:
    10:18:37:746 4388 Process 316: Module Secur32.dll:
    10:18:37:752 4388 Process 320: Module mDNSResponder.exe:
    10:18:37:756 4388 Process 320: Module ntdll.dll:
    10:18:37:758 4388 Process 320: Module kernel32.dll:
    10:18:37:766 4388 Process 320: Module WS2_32.dll:
    10:18:37:768 4388 Process 320: Module msvcrt.dll:
    10:18:37:770 4388 Process 320: Module ADVAPI32.dll:
    10:18:37:776 4388 Process 320: Module RPCRT4.dll:
    10:18:37:778 4388 Process 320: Module NSI.dll:
    10:18:37:778 4388 Process 320: Module IPHLPAPI.DLL:
    10:18:37:779 4388 Process 320: Module dhcpcsvc.DLL:
    10:18:37:780 4388 Process 320: Module DNSAPI.dll:
    10:18:37:780 4388 Process 320: Module Secur32.dll:
    10:18:37:781 4388 Process 320: Module WINNSI.DLL:
    10:18:37:781 4388 Process 320: Module dhcpcsvc6.DLL:
    10:18:37:783 4388 Process 320: Module NETAPI32.dll:
    10:18:37:784 4388 Process 320: Module PSAPI.DLL:
    10:18:37:785 4388 Process 320: Module POWRPROF.dll:
    10:18:37:787 4388 Process 320: Module USER32.dll:
    10:18:37:788 4388 Process 320: Module GDI32.dll:
    10:18:37:792 4388 Process 320: Module ole32.dll:
    10:18:37:796 4388 Process 320: Module OLEAUT32.dll:
    10:18:37:797 4388 Process 320: Module IMM32.DLL:
    10:18:37:800 4388 Process 320: Module MSCTF.dll:
    10:18:37:801 4388 Process 320: Module LPK.DLL:
    10:18:37:803 4388 Process 320: Module USP10.dll:
    10:18:37:804 4388 Process 320: Module rsaenh.dll:
    10:18:37:838 4388 Process 320: Module SHELL32.dll:
    10:18:37:843 4388 Process 320: Module SHLWAPI.dll:
    10:18:37:849 4388 Process 320: Module comctl32.dll:
    10:18:37:852 4388 Process 320: Module USERENV.dll:
    10:18:37:853 4388 Process 320: Module mswsock.dll:
    10:18:37:855 4388 Process 320: Module wshtcpip.dll:
    10:18:37:856 4388 Process 320: Module wship6.dll:
    10:18:37:860 4388 Process 452: Module svchost.exe:
    10:18:37:864 4388 Process 452: Module ntdll.dll:
    10:18:37:869 4388 Process 452: Module kernel32.dll:
    10:18:37:884 4388 Process 452: Module msvcrt.dll:
    10:18:37:888 4388 Process 452: Module ADVAPI32.dll:
    10:18:37:895 4388 Process 452: Module RPCRT4.dll:
    10:18:37:897 4388 Process 452: Module bthserv.dll:
    10:18:37:905 4388 Process 452: Module SETUPAPI.dll:
    10:18:37:908 4388 Process 452: Module GDI32.dll:
    10:18:37:912 4388 Process 452: Module USER32.dll:
    10:18:37:916 4388 Process 452: Module OLEAUT32.dll:
    10:18:37:921 4388 Process 452: Module ole32.dll:
    10:18:37:924 4388 Process 452: Module IMM32.DLL:
    10:18:37:929 4388 Process 452: Module MSCTF.dll:
    10:18:37:930 4388 Process 452: Module LPK.DLL:
    10:18:37:932 4388 Process 452: Module USP10.dll:
    10:18:37:933 4388 Process 452: Module WINTRUST.dll:
    10:18:37:938 4388 Process 452: Module CRYPT32.dll:
    10:18:37:939 4388 Process 452: Module MSASN1.dll:
    10:18:37:939 4388 Process 452: Module USERENV.dll:
    10:18:37:940 4388 Process 452: Module Secur32.dll:
    10:18:37:941 4388 Process 452: Module imagehlp.dll:
    10:18:37:942 4388 Process 452: Module credssp.dll:
    10:18:37:943 4388 Process 452: Module schannel.dll:
    10:18:37:945 4388 Process 452: Module NETAPI32.dll:
    10:18:37:947 4388 Process 452: Module PSAPI.DLL:
    10:18:37:948 4388 Process 452: Module msv1_0.dll:
    10:18:37:950 4388 Process 452: Module cryptdll.dll:
    10:18:37:951 4388 Process 452: Module WS2_32.dll:
    10:18:37:951 4388 Process 452: Module NSI.dll:
    10:18:37:955 4388 Process 540: Module FsUsbExService.Exe:
    10:18:37:962 4388 Process 540: Module ntdll.dll:
    10:18:37:966 4388 Process 540: Module kernel32.dll:
    10:18:37:976 4388 Process 540: Module USER32.dll:
    10:18:37:983 4388 Process 540: Module GDI32.dll:
    10:18:37:987 4388 Process 540: Module ADVAPI32.dll:
    10:18:37:995 4388 Process 540: Module RPCRT4.dll:
    10:18:38:029 4388 Process 540: Module comdlg32.dll:
    10:18:38:032 4388 Process 540: Module msvcrt.dll:
    10:18:38:033 4388 Process 540: Module SHLWAPI.dll:
    10:18:38:035 4388 Process 540: Module COMCTL32.dll:
    10:18:38:067 4388 Process 540: Module SHELL32.dll:
    10:18:38:072 4388 Process 540: Module WINSPOOL.DRV:
    10:18:38:086 4388 Process 540: Module oledlg.dll:
    10:18:38:090 4388 Process 540: Module ole32.dll:
    10:18:38:092 4388 Process 540: Module OLEPRO32.DLL:
    10:18:38:094 4388 Process 540: Module OLEAUT32.dll:
    10:18:38:095 4388 Process 540: Module IMM32.DLL:
    10:18:38:099 4388 Process 540: Module MSCTF.dll:
    10:18:38:100 4388 Process 540: Module LPK.DLL:
    10:18:38:102 4388 Process 540: Module USP10.dll:
    10:18:38:107 4388 Process 540: Module comctl32.dll:
    10:18:38:109 4388 Process 540: Module Secur32.dll:
    10:18:38:113 4388 Process 660: Module svchost.exe:
    10:18:38:115 4388 Process 660: Module ntdll.dll:
    10:18:38:117 4388 Process 660: Module kernel32.dll:
    10:18:38:126 4388 Process 660: Module msvcrt.dll:
    10:18:38:128 4388 Process 660: Module ADVAPI32.dll:
    10:18:38:134 4388 Process 660: Module RPCRT4.dll:
    10:18:38:136 4388 Process 660: Module hpqddsvc.dll:
    10:18:38:142 4388 Process 660: Module USER32.dll:
    10:18:38:144 4388 Process 660: Module GDI32.dll:
    10:18:38:148 4388 Process 660: Module ole32.dll:
    10:18:38:151 4388 Process 660: Module OLEAUT32.dll:
    10:18:38:152 4388 Process 660: Module hpqddcmn.dll:
    10:18:38:156 4388 Process 660: Module SETUPAPI.dll:
    10:18:38:157 4388 Process 660: Module VERSION.dll:
    10:18:38:158 4388 Process 660: Module WINSPOOL.DRV:
    10:18:38:180 4388 Process 660: Module SHELL32.dll:
    10:18:38:185 4388 Process 660: Module SHLWAPI.dll:
    10:18:38:187 4388 Process 660: Module MSVCP80.dll:
    10:18:38:188 4388 Process 660: Module MSVCR80.dll:
    10:18:38:189 4388 Process 660: Module IMM32.DLL:
    10:18:38:191 4388 Process 660: Module MSCTF.dll:
    10:18:38:193 4388 Process 660: Module LPK.DLL:
    10:18:38:194 4388 Process 660: Module USP10.dll:
    10:18:38:197 4388 Process 660: Module comctl32.dll:
    10:18:38:200 4388 Process 660: Module CLBCatQ.DLL:
    10:18:38:201 4388 Process 660: Module rsaenh.dll:
    10:18:38:202 4388 Process 660: Module hpqcxs08.dll:
    10:18:38:202 4388 Process 660: Module SHFOLDER.dll:
    10:18:38:203 4388 Process 660: Module SXS.DLL:
    10:18:38:205 4388 Process 660: Module WINTRUST.dll:
    10:18:38:207 4388 Process 660: Module CRYPT32.dll:
    10:18:38:208 4388 Process 660: Module MSASN1.dll:
    10:18:38:208 4388 Process 660: Module USERENV.dll:
    10:18:38:209 4388 Process 660: Module Secur32.dll:
    10:18:38:210 4388 Process 660: Module imagehlp.dll:
    10:18:38:211 4388 Process 660: Module msiltcfg.dll:
    10:18:38:216 4388 Process 660: Module msi.dll:
    10:18:38:218 4388 Process 660: Module hpocxi08.dll:
    10:18:38:218 4388 Process 660: Module SFC.DLL:
    10:18:38:218 4388 Process 660: Module sfc_os.dll:
    10:18:38:219 4388 Process 660: Module hpqcob08.dll:
    10:18:38:222 4388 Process 1036: Module LSSrvc.exe:
    10:18:38:225 4388 Process 1036: Module ntdll.dll:
    10:18:38:227 4388 Process 1036: Module kernel32.dll:
    10:18:38:319 4388 Process 1036: Module LSSProxy.dll:
    10:18:38:321 4388 Process 1036: Module ADVAPI32.dll:
    10:18:38:329 4388 Process 1036: Module RPCRT4.dll:
    10:18:38:331 4388 Process 1036: Module SHLWAPI.dll:
    10:18:38:333 4388 Process 1036: Module GDI32.dll:
    10:18:38:336 4388 Process 1036: Module USER32.dll:
    10:18:38:341 4388 Process 1036: Module msvcrt.dll:
    10:18:38:341 4388 Process 1036: Module PSAPI.DLL:
    10:18:38:379 4388 Process 1036: Module SHELL32.dll:
    10:18:38:385 4388 Process 1036: Module LSLog.dll:
    10:18:38:387 4388 Process 1036: Module MSVCR80.dll:
    10:18:38:390 4388 Process 1036: Module MSVCP80.dll:
    10:18:38:390 4388 Process 1036: Module IMM32.DLL:
    10:18:38:395 4388 Process 1036: Module MSCTF.dll:
    10:18:38:398 4388 Process 1036: Module LPK.DLL:
    10:18:38:399 4388 Process 1036: Module USP10.dll:
    10:18:38:404 4388 Process 1036: Module comctl32.dll:
    10:18:38:410 4388 Process 1036: Module ole32.dll:
    10:18:38:412 4388 Process 1036: Module USERENV.dll:
    10:18:38:413 4388 Process 1036: Module Secur32.dll:
  24. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:38:420 4388 Process 520: Module svchost.exe:
    10:18:38:424 4388 Process 520: Module ntdll.dll:
    10:18:38:427 4388 Process 520: Module kernel32.dll:
    10:18:38:443 4388 Process 520: Module msvcrt.dll:
    10:18:38:446 4388 Process 520: Module ADVAPI32.dll:
    10:18:38:457 4388 Process 520: Module RPCRT4.dll:
    10:18:38:461 4388 Process 520: Module ipsecsvc.dll:
    10:18:38:461 4388 Process 520: Module AUTHZ.dll:
    10:18:38:466 4388 Process 520: Module ole32.dll:
    10:18:38:468 4388 Process 520: Module GDI32.dll:
    10:18:38:471 4388 Process 520: Module USER32.dll:
    10:18:38:473 4388 Process 520: Module IPHLPAPI.DLL:
    10:18:38:474 4388 Process 520: Module dhcpcsvc.DLL:
    10:18:38:475 4388 Process 520: Module DNSAPI.dll:
    10:18:38:476 4388 Process 520: Module WS2_32.dll:
    10:18:38:477 4388 Process 520: Module NSI.dll:
    10:18:38:477 4388 Process 520: Module Secur32.dll:
    10:18:38:478 4388 Process 520: Module WINNSI.DLL:
    10:18:38:479 4388 Process 520: Module dhcpcsvc6.DLL:
    10:18:38:482 4388 Process 520: Module CRYPT32.dll:
    10:18:38:483 4388 Process 520: Module MSASN1.dll:
    10:18:38:483 4388 Process 520: Module USERENV.dll:
    10:18:38:486 4388 Process 520: Module fwpuclnt.dll:
    10:18:38:489 4388 Process 520: Module OLEAUT32.dll:
    10:18:38:491 4388 Process 520: Module FirewallAPI.dll:
    10:18:38:491 4388 Process 520: Module VERSION.dll:
    10:18:38:516 4388 Process 520: Module FwRemoteSvr.DLL:
    10:18:38:517 4388 Process 520: Module WLDAP32.dll:
    10:18:38:517 4388 Process 520: Module PSAPI.DLL:
    10:18:38:518 4388 Process 520: Module IMM32.DLL:
    10:18:38:521 4388 Process 520: Module MSCTF.dll:
    10:18:38:522 4388 Process 520: Module LPK.DLL:
    10:18:38:524 4388 Process 520: Module USP10.dll:
    10:18:38:525 4388 Process 520: Module CLBCatQ.DLL:
    10:18:38:527 4388 Process 520: Module SHLWAPI.dll:
    10:18:38:532 4388 Process 520: Module comctl32.dll:
    10:18:38:535 4388 Process 520: Module mswsock.dll:
    10:18:38:536 4388 Process 520: Module wshtcpip.dll:
    10:18:38:537 4388 Process 520: Module wship6.dll:
    10:18:38:537 4388 Process 520: Module credssp.dll:
    10:18:38:538 4388 Process 520: Module schannel.dll:
    10:18:38:540 4388 Process 520: Module NETAPI32.dll:
    10:18:38:543 4388 Process 2080: Module RichVideo.exe:
    10:18:38:545 4388 Process 2080: Module ntdll.dll:
    10:18:38:547 4388 Process 2080: Module kernel32.dll:
    10:18:38:557 4388 Process 2080: Module MSVCRT.dll:
    10:18:38:559 4388 Process 2080: Module USER32.dll:
    10:18:38:561 4388 Process 2080: Module GDI32.dll:
    10:18:38:564 4388 Process 2080: Module ADVAPI32.dll:
    10:18:38:569 4388 Process 2080: Module RPCRT4.dll:
    10:18:38:592 4388 Process 2080: Module SHELL32.dll:
    10:18:38:596 4388 Process 2080: Module SHLWAPI.dll:
    10:18:38:600 4388 Process 2080: Module ole32.dll:
    10:18:38:605 4388 Process 2080: Module OLEAUT32.dll:
    10:18:38:607 4388 Process 2080: Module WINMM.dll:
    10:18:38:608 4388 Process 2080: Module OLEACC.dll:
    10:18:38:609 4388 Process 2080: Module IMM32.DLL:
    10:18:38:614 4388 Process 2080: Module MSCTF.dll:
    10:18:38:616 4388 Process 2080: Module LPK.DLL:
    10:18:38:618 4388 Process 2080: Module USP10.dll:
    10:18:38:624 4388 Process 2080: Module comctl32.dll:
    10:18:38:626 4388 Process 2080: Module wls0wndh.dll:
    10:18:38:627 4388 Process 2080: Module CLBCatQ.DLL:
    10:18:38:628 4388 Process 2080: Module rsaenh.dll:
    10:18:38:636 4388 Process 2196: Module c2c_service.exe:
    10:18:38:639 4388 Process 2196: Module ntdll.dll:
    10:18:38:641 4388 Process 2196: Module kernel32.dll:
    10:18:38:649 4388 Process 2196: Module USER32.dll:
    10:18:38:651 4388 Process 2196: Module GDI32.dll:
    10:18:38:655 4388 Process 2196: Module ADVAPI32.dll:
    10:18:38:660 4388 Process 2196: Module RPCRT4.dll:
    10:18:38:684 4388 Process 2196: Module SHELL32.dll:
    10:18:38:690 4388 Process 2196: Module msvcrt.dll:
    10:18:38:691 4388 Process 2196: Module SHLWAPI.dll:
    10:18:38:694 4388 Process 2196: Module ole32.dll:
    10:18:38:696 4388 Process 2196: Module IPHLPAPI.DLL:
    10:18:38:697 4388 Process 2196: Module dhcpcsvc.DLL:
    10:18:38:697 4388 Process 2196: Module DNSAPI.dll:
    10:18:38:698 4388 Process 2196: Module WS2_32.dll:
    10:18:38:699 4388 Process 2196: Module NSI.dll:
    10:18:38:699 4388 Process 2196: Module Secur32.dll:
    10:18:38:700 4388 Process 2196: Module WINNSI.DLL:
    10:18:38:700 4388 Process 2196: Module dhcpcsvc6.DLL:
    10:18:38:701 4388 Process 2196: Module WINTRUST.dll:
    10:18:38:704 4388 Process 2196: Module CRYPT32.dll:
    10:18:38:705 4388 Process 2196: Module MSASN1.dll:
    10:18:38:706 4388 Process 2196: Module USERENV.dll:
    10:18:38:707 4388 Process 2196: Module imagehlp.dll:
    10:18:38:708 4388 Process 2196: Module WINHTTP.dll:
    10:18:38:709 4388 Process 2196: Module VERSION.dll:
    10:18:38:710 4388 Process 2196: Module IMM32.DLL:
    10:18:38:713 4388 Process 2196: Module MSCTF.dll:
    10:18:38:715 4388 Process 2196: Module LPK.DLL:
    10:18:38:716 4388 Process 2196: Module USP10.dll:
    10:18:38:719 4388 Process 2196: Module comctl32.dll:
    10:18:38:723 4388 Process 2196: Module CLBCatQ.DLL:
    10:18:38:724 4388 Process 2196: Module OLEAUT32.dll:
    10:18:38:725 4388 Process 2196: Module rsaenh.dll:
    10:18:38:726 4388 Process 2196: Module qmgrprxy.dll:
    10:18:38:726 4388 Process 2196: Module rasadhlp.dll:
    10:18:38:730 4388 Process 2348: Module sqlbrowser.exe:
    10:18:38:734 4388 Process 2348: Module ntdll.dll:
    10:18:38:738 4388 Process 2348: Module kernel32.dll:
    10:18:38:750 4388 Process 2348: Module MSVCR80.dll:
    10:18:38:752 4388 Process 2348: Module msvcrt.dll:
    10:18:38:756 4388 Process 2348: Module ADVAPI32.dll:
    10:18:38:762 4388 Process 2348: Module RPCRT4.dll:
    10:18:38:764 4388 Process 2348: Module WS2_32.dll:
    10:18:38:765 4388 Process 2348: Module NSI.dll:
    10:18:38:765 4388 Process 2348: Module psapi.dll:
    10:18:38:781 4388 Process 2348: Module instapi.dll:
    10:18:38:783 4388 Process 2348: Module USER32.dll:
    10:18:38:785 4388 Process 2348: Module GDI32.dll:
    10:18:38:786 4388 Process 2348: Module IMM32.DLL:
    10:18:38:790 4388 Process 2348: Module MSCTF.dll:
    10:18:38:791 4388 Process 2348: Module LPK.DLL:
    10:18:38:793 4388 Process 2348: Module USP10.dll:
    10:18:38:793 4388 Process 2348: Module mswsock.dll:
    10:18:38:794 4388 Process 2348: Module wship6.dll:
    10:18:38:795 4388 Process 2348: Module wshtcpip.dll:
    10:18:38:797 4388 Process 2416: Module sqlwriter.exe:
    10:18:38:799 4388 Process 2416: Module ntdll.dll:
    10:18:38:801 4388 Process 2416: Module kernel32.dll:
    10:18:38:811 4388 Process 2416: Module MSVCR80.dll:
    10:18:38:813 4388 Process 2416: Module msvcrt.dll:
    10:18:38:816 4388 Process 2416: Module ADVAPI32.dll:
    10:18:38:825 4388 Process 2416: Module RPCRT4.dll:
    10:18:38:833 4388 Process 2416: Module ole32.dll:
    10:18:38:835 4388 Process 2416: Module GDI32.dll:
    10:18:38:838 4388 Process 2416: Module USER32.dll:
    10:18:38:840 4388 Process 2416: Module IMM32.DLL:
    10:18:38:842 4388 Process 2416: Module MSCTF.dll:
    10:18:38:844 4388 Process 2416: Module LPK.DLL:
    10:18:38:846 4388 Process 2416: Module USP10.dll:
    10:18:38:846 4388 Process 2416: Module psapi.dll:
    10:18:38:859 4388 Process 2416: Module sqlwvss.dll:
    10:18:38:861 4388 Process 2416: Module MSVCP80.dll:
    10:18:38:862 4388 Process 2416: Module OLEAUT32.dll:
    10:18:38:866 4388 Process 2416: Module VSSAPI.DLL:
    10:18:38:867 4388 Process 2416: Module ATL.DLL:
    10:18:38:867 4388 Process 2416: Module vsstrace.dll:
    10:18:38:868 4388 Process 2416: Module AUTHZ.dll:
    10:18:38:868 4388 Process 2416: Module XmlLite.dll:
    10:18:38:869 4388 Process 2416: Module NETAPI32.dll:
    10:18:38:871 4388 Process 2416: Module MPR.dll:
    10:18:38:875 4388 Process 2416: Module SETUPAPI.dll:
    10:18:38:877 4388 Process 2416: Module SAMLIB.dll:
    10:18:38:878 4388 Process 2416: Module CLBCatQ.DLL:
    10:18:38:879 4388 Process 2416: Module es.dll:
    10:18:38:881 4388 Process 2416: Module PROPSYS.dll:
    10:18:38:882 4388 Process 2416: Module rsaenh.dll:
    10:18:38:885 4388 Process 2448: Module svchost.exe:
    10:18:38:888 4388 Process 2448: Module ntdll.dll:
    10:18:38:890 4388 Process 2448: Module kernel32.dll:
    10:18:38:898 4388 Process 2448: Module msvcrt.dll:
    10:18:38:900 4388 Process 2448: Module ADVAPI32.dll:
    10:18:38:909 4388 Process 2448: Module RPCRT4.dll:
    10:18:38:911 4388 Process 2448: Module wiaservc.dll:
    10:18:38:913 4388 Process 2448: Module USER32.dll:
    10:18:38:917 4388 Process 2448: Module GDI32.dll:
    10:18:38:921 4388 Process 2448: Module OLEAUT32.dll:
    10:18:38:925 4388 Process 2448: Module ole32.dll:
    10:18:38:927 4388 Process 2448: Module VERSION.dll:
    10:18:38:928 4388 Process 2448: Module COMDLG32.dll:
    10:18:38:929 4388 Process 2448: Module SHLWAPI.dll:
    10:18:38:932 4388 Process 2448: Module COMCTL32.dll:
    10:18:38:964 4388 Process 2448: Module SHELL32.dll:
    10:18:38:969 4388 Process 2448: Module IMM32.DLL:
    10:18:38:972 4388 Process 2448: Module MSCTF.dll:
    10:18:38:973 4388 Process 2448: Module LPK.DLL:
    10:18:38:974 4388 Process 2448: Module USP10.dll:
    10:18:38:978 4388 Process 2448: Module comctl32.dll:
    10:18:38:996 4388 Process 2448: Module wiatrace.dll:
    10:18:38:997 4388 Process 2448: Module secur32.dll:
    10:18:39:000 4388 Process 2448: Module CRYPT32.dll:
    10:18:39:000 4388 Process 2448: Module MSASN1.dll:
    10:18:39:001 4388 Process 2448: Module USERENV.dll:
    10:18:39:001 4388 Process 2448: Module credssp.dll:
    10:18:39:002 4388 Process 2448: Module schannel.dll:
    10:18:39:004 4388 Process 2448: Module NETAPI32.dll:
    10:18:39:007 4388 Process 2448: Module PSAPI.DLL:
    10:18:39:008 4388 Process 2448: Module msv1_0.dll:
    10:18:39:011 4388 Process 2448: Module cryptdll.dll:
    10:18:39:012 4388 Process 2448: Module WS2_32.dll:
    10:18:39:013 4388 Process 2448: Module NSI.dll:
    10:18:39:013 4388 Process 2448: Module WSDCHNGR.DLL:
    10:18:39:015 4388 Process 2448: Module CLBCatQ.DLL:
    10:18:39:015 4388 Process 2448: Module FunDisc.dll:
    10:18:39:016 4388 Process 2448: Module ATL.DLL:
    10:18:39:019 4388 Process 2448: Module SETUPAPI.dll:
    10:18:39:023 4388 Process 2448: Module msxml3.dll:
    10:18:39:024 4388 Process 2448: Module WINTRUST.dll:
    10:18:39:025 4388 Process 2448: Module imagehlp.dll:
    10:18:39:025 4388 Process 2448: Module rsaenh.dll:
    10:18:39:026 4388 Process 2448: Module CFGMGR32.dll:
    10:18:39:026 4388 Process 2448: Module sti.dll:
    10:18:39:030 4388 Process 2448: Module gdiplus.dll:
    10:18:39:032 4388 Process 2512: Module svchost.exe:
    10:18:39:036 4388 Process 2512: Module ntdll.dll:
    10:18:39:039 4388 Process 2512: Module kernel32.dll:
    10:18:39:048 4388 Process 2512: Module msvcrt.dll:
    10:18:39:051 4388 Process 2512: Module ADVAPI32.dll:
    10:18:39:060 4388 Process 2512: Module RPCRT4.dll:
    10:18:39:063 4388 Process 2512: Module wersvc.dll:
    10:18:39:063 4388 Process 2512: Module WTSAPI32.dll:
    10:18:39:064 4388 Process 2512: Module WINSTA.dll:
  25. MatSeven

    MatSeven TS Rookie Topic Starter Posts: 49

    10:18:39:068 4388 Process 2540: Module SearchIndexer.exe:
    10:18:39:070 4388 Process 2540: Module ntdll.dll:
    10:18:39:072 4388 Process 2540: Module kernel32.dll:
    10:18:39:081 4388 Process 2540: Module ADVAPI32.dll:
    10:18:39:087 4388 Process 2540: Module RPCRT4.dll:
    10:18:39:090 4388 Process 2540: Module USER32.dll:
    10:18:39:092 4388 Process 2540: Module GDI32.dll:
    10:18:39:094 4388 Process 2540: Module msvcrt.dll:
    10:18:39:097 4388 Process 2540: Module ole32.dll:
    10:18:39:100 4388 Process 2540: Module OLEAUT32.dll:
    10:18:39:101 4388 Process 2540: Module WTSAPI32.dll:
    10:18:39:104 4388 Process 2540: Module TQUERY.DLL:
    10:18:39:107 4388 Process 2540: Module PROPSYS.dll:
    10:18:39:107 4388 Process 2540: Module WINTRUST.dll:
    10:18:39:110 4388 Process 2540: Module CRYPT32.dll:
    10:18:39:111 4388 Process 2540: Module MSASN1.dll:
    10:18:39:111 4388 Process 2540: Module USERENV.dll:
    10:18:39:112 4388 Process 2540: Module Secur32.dll:
    10:18:39:114 4388 Process 2540: Module imagehlp.dll:
    10:18:39:115 4388 Process 2540: Module SHLWAPI.dll:
    10:18:39:117 4388 Process 2540: Module NETAPI32.dll:
    10:18:39:121 4388 Process 2540: Module PSAPI.DLL:
    10:18:39:156 4388 Process 2540: Module SHELL32.dll:
    10:18:39:163 4388 Process 2540: Module MPR.dll:
    10:18:39:167 4388 Process 2540: Module MSSRCH.DLL:
    10:18:39:169 4388 Process 2540: Module dbghelp.dll:
    10:18:39:170 4388 Process 2540: Module WSOCK32.dll:
    10:18:39:170 4388 Process 2540: Module WS2_32.dll:
    10:18:39:171 4388 Process 2540: Module NSI.dll:
    10:18:39:171 4388 Process 2540: Module VERSION.dll:
    10:18:39:171 4388 Process 2540: Module IMM32.DLL:
    10:18:39:175 4388 Process 2540: Module MSCTF.dll:
    10:18:39:176 4388 Process 2540: Module LPK.DLL:
    10:18:39:177 4388 Process 2540: Module USP10.dll:
    10:18:39:181 4388 Process 2540: Module comctl32.dll:
    10:18:39:183 4388 Process 2540: Module credssp.dll:
    10:18:39:184 4388 Process 2540: Module schannel.dll:
    10:18:39:186 4388 Process 2540: Module CLBCatQ.DLL:
    10:18:39:213 4388 Process 2540: Module Msidle.dll:
    10:18:39:214 4388 Process 2540: Module rsaenh.dll:
    10:18:39:251 4388 Process 2540: Module query.dll:
    10:18:39:268 4388 Process 2540: Module tQuery.dll.mui:
    10:18:39:270 4388 Process 2540: Module esent.dll:
    10:18:39:271 4388 Process 2540: Module msscb.dll:
    10:18:39:271 4388 Process 2540: Module NTMARTA.DLL:
    10:18:39:272 4388 Process 2540: Module WLDAP32.dll:
    10:18:39:273 4388 Process 2540: Module SAMLIB.dll:
    10:18:39:276 4388 Process 2540: Module VSSAPI.DLL:
    10:18:39:277 4388 Process 2540: Module ATL.DLL:
    10:18:39:277 4388 Process 2540: Module vsstrace.dll:
    10:18:39:277 4388 Process 2540: Module AUTHZ.dll:
    10:18:39:279 4388 Process 2540: Module XmlLite.dll:
    10:18:39:285 4388 Process 2540: Module SETUPAPI.dll:
    10:18:39:288 4388 Process 2540: Module es.dll:
    10:18:39:289 4388 Process 2540: Module WINSTA.dll:
    10:18:39:290 4388 Process 2540: Module mssprxy.dll:
    10:18:39:291 4388 Process 2540: Module SXS.DLL:
    10:18:39:293 4388 Process 2540: Module cscapi.dll:
    10:18:39:294 4388 Process 2540: Module apphelp.dll:
    10:18:39:304 4388 Process 2540: Module NaturalLanguage6.dll:
    10:18:39:415 4388 Process 2540: Module NLSData0009.dll:
    10:18:39:515 4388 Process 2540: Module NLSLexicons0009.dll:
    10:18:39:518 4388 Process 2672: Module RUNDLL32.EXE:
    10:18:39:520 4388 Process 2672: Module ntdll.dll:
    10:18:39:522 4388 Process 2672: Module kernel32.dll:
    10:18:39:531 4388 Process 2672: Module USER32.dll:
    10:18:39:533 4388 Process 2672: Module GDI32.dll:
    10:18:39:535 4388 Process 2672: Module ADVAPI32.dll:
    10:18:39:541 4388 Process 2672: Module RPCRT4.dll:
    10:18:39:544 4388 Process 2672: Module msvcrt.dll:
    10:18:39:545 4388 Process 2672: Module imagehlp.dll:
    10:18:39:546 4388 Process 2672: Module ShimEng.dll:
    10:18:39:547 4388 Process 2672: Module apphelp.dll:
    10:18:39:551 4388 Process 2672: Module AcLayers.DLL:
    10:18:39:579 4388 Process 2672: Module SHELL32.dll:
    10:18:39:584 4388 Process 2672: Module SHLWAPI.dll:
    10:18:39:588 4388 Process 2672: Module ole32.dll:
    10:18:39:593 4388 Process 2672: Module OLEAUT32.dll:
    10:18:39:594 4388 Process 2672: Module USERENV.dll:
    10:18:39:595 4388 Process 2672: Module Secur32.dll:
    10:18:39:597 4388 Process 2672: Module WINSPOOL.DRV:
    10:18:39:598 4388 Process 2672: Module MPR.dll:
    10:18:39:600 4388 Process 2672: Module IMM32.DLL:
    10:18:39:602 4388 Process 2672: Module MSCTF.dll:
    10:18:39:605 4388 Process 2672: Module LPK.DLL:
    10:18:39:607 4388 Process 2672: Module USP10.dll:
    10:18:39:611 4388 Process 2672: Module comctl32.dll:
    10:18:39:615 4388 Process 2672: Module ykx32mpcoinst.dll:
    10:18:39:620 4388 Process 2672: Module SETUPAPI.dll:
    10:18:39:623 4388 Process 2672: Module iphlpapi.dll:
    10:18:39:625 4388 Process 2672: Module dhcpcsvc.DLL:
    10:18:39:626 4388 Process 2672: Module DNSAPI.dll:
    10:18:39:627 4388 Process 2672: Module WS2_32.dll:
    10:18:39:628 4388 Process 2672: Module NSI.dll:
    10:18:39:629 4388 Process 2672: Module WINNSI.DLL:
    10:18:39:629 4388 Process 2672: Module dhcpcsvc6.DLL:
    10:18:39:631 4388 Process 2672: Module CLBCatQ.DLL:
    10:18:39:632 4388 Process 2672: Module Cabinet.dll:
    10:18:39:633 4388 Process 2672: Module WINTRUST.dll:
    10:18:39:637 4388 Process 2672: Module CRYPT32.dll:
    10:18:39:638 4388 Process 2672: Module MSASN1.dll:
    10:18:39:644 4388 Process 3400: Module taskeng.exe:
    10:18:39:646 4388 Process 3400: Module ntdll.dll:
    10:18:39:649 4388 Process 3400: Module kernel32.dll:
    10:18:39:661 4388 Process 3400: Module ADVAPI32.dll:
    10:18:39:667 4388 Process 3400: Module RPCRT4.dll:
    10:18:39:670 4388 Process 3400: Module USER32.dll:
    10:18:39:672 4388 Process 3400: Module GDI32.dll:
    10:18:39:675 4388 Process 3400: Module msvcrt.dll:
    10:18:39:698 4388 Process 3400: Module SHELL32.dll:
    10:18:39:704 4388 Process 3400: Module SHLWAPI.dll:
    10:18:39:707 4388 Process 3400: Module ole32.dll:
    10:18:39:711 4388 Process 3400: Module OLEAUT32.dll:
    10:18:39:712 4388 Process 3400: Module Secur32.dll:
    10:18:39:714 4388 Process 3400: Module XmlLite.dll:
    10:18:39:715 4388 Process 3400: Module MPR.dll:
    10:18:39:717 4388 Process 3400: Module IMM32.DLL:
    10:18:39:720 4388 Process 3400: Module MSCTF.dll:
    10:18:39:721 4388 Process 3400: Module LPK.DLL:
    10:18:39:722 4388 Process 3400: Module USP10.dll:
    10:18:39:726 4388 Process 3400: Module comctl32.dll:
    10:18:39:729 4388 Process 3400: Module rsaenh.dll:
    10:18:39:730 4388 Process 3400: Module CLBCatQ.DLL:
    10:18:39:731 4388 Process 3400: Module tschannel.dll:
    10:18:39:732 4388 Process 3400: Module uxtheme.dll:
    10:18:39:734 4388 Process 3400: Module PlaySndSrv.dll:
    10:18:39:734 4388 Process 3400: Module WINMM.dll:
    10:18:39:735 4388 Process 3400: Module OLEACC.dll:
    10:18:39:736 4388 Process 3400: Module HotStartUserAgent.dll:
    10:18:39:737 4388 Process 3400: Module slc.dll:
    10:18:39:737 4388 Process 3400: Module MsCtfMonitor.dll:
    10:18:39:738 4388 Process 3400: Module MSUTB.dll:
    10:18:39:739 4388 Process 3400: Module dwmapi.dll:
    10:18:39:739 4388 Process 3400: Module WTSAPI32.dll:
    10:18:39:740 4388 Process 3400: Module wdmaud.drv:
    10:18:39:740 4388 Process 3400: Module ksuser.dll:
    10:18:39:740 4388 Process 3400: Module MMDevAPI.DLL:
    10:18:39:741 4388 Process 3400: Module AVRT.dll:
    10:18:39:745 4388 Process 3400: Module SETUPAPI.dll:
    10:18:39:747 4388 Process 3400: Module WINTRUST.dll:
    10:18:39:750 4388 Process 3400: Module CRYPT32.dll:
    10:18:39:751 4388 Process 3400: Module MSASN1.dll:
    10:18:39:751 4388 Process 3400: Module USERENV.dll:
    10:18:39:752 4388 Process 3400: Module imagehlp.dll:
    10:18:39:752 4388 Process 3400: Module AUDIOSES.DLL:
    10:18:39:754 4388 Process 3400: Module audioeng.dll:
    10:18:39:758 4388 Process 3400: Module PSAPI.DLL:
    10:18:39:763 4388 Process 3400: Module TMM.dll:
    10:18:39:765 4388 Process 3400: Module POWRPROF.dll:
    10:18:39:811 4388 Process 3400: Module d3d9.dll:
    10:18:39:812 4388 Process 3400: Module VERSION.dll:
    10:18:39:813 4388 Process 3400: Module d3d8thk.dll:
    10:18:39:813 4388 Process 3400: Module msacm32.drv:
    10:18:39:814 4388 Process 3400: Module MSACM32.dll:
    10:18:39:814 4388 Process 3400: Module midimap.dll:
    10:18:39:815 4388 Process 3400: Module atitmmxx.dll:
    10:18:39:815 4388 Process 3400: Module ATL.DLL:
    10:18:39:817 4388 Process 3400: Module atipdlxx.dll:
    10:18:39:827 4388 Process 3400: Module QAgent.dll:
    10:18:39:828 4388 Process 3400: Module fwpuclnt.dll:
    10:18:39:829 4388 Process 3400: Module QUtil.dll:
    10:18:39:830 4388 Process 3400: Module wevtapi.dll:
    10:18:39:830 4388 Process 3400: Module WS2_32.dll:
    10:18:39:831 4388 Process 3400: Module NSI.dll:
    10:18:39:832 4388 Process 3400: Module WINSTA.dll:
    10:18:39:833 4388 Process 3400: Module apphelp.dll:
    10:18:39:836 4388 Process 3400: Module dimsjob.dll:
    10:18:39:838 4388 Process 3400: Module ncrypt.dll:
    10:18:39:839 4388 Process 3400: Module GPAPI.dll:
    10:18:39:840 4388 Process 3400: Module pautoenr.dll:
    10:18:39:840 4388 Process 3400: Module NETAPI32.dll:
    10:18:39:843 4388 Process 3400: Module WLDAP32.dll:
    10:18:39:853 4388 Process 3400: Module certcli.dll:
    10:18:39:856 4388 Process 3400: Module WININET.dll:
    10:18:39:857 4388 Process 3400: Module Normaliz.dll:
    10:18:39:861 4388 Process 3400: Module iertutil.dll:
    10:18:39:863 4388 Process 3400: Module urlmon.dll:
    10:18:39:907 4388 Process 3400: Module certenroll.dll:
    10:18:39:909 4388 Process 3400: Module NTDSAPI.dll:
    10:18:39:909 4388 Process 3400: Module DNSAPI.dll:
    10:18:39:910 4388 Process 3400: Module WinSCard.dll:
    10:18:39:912 4388 Process 3448: Module taskeng.exe:
    10:18:39:915 4388 Process 3448: Module ntdll.dll:
    10:18:39:917 4388 Process 3448: Module kernel32.dll:
    10:18:39:926 4388 Process 3448: Module ADVAPI32.dll:
    10:18:39:932 4388 Process 3448: Module RPCRT4.dll:
    10:18:39:937 4388 Process 3448: Module USER32.dll:
    10:18:39:940 4388 Process 3448: Module GDI32.dll:
    10:18:39:944 4388 Process 3448: Module msvcrt.dll:
    10:18:39:971 4388 Process 3448: Module SHELL32.dll:
    10:18:39:975 4388 Process 3448: Module SHLWAPI.dll:
    10:18:39:979 4388 Process 3448: Module ole32.dll:
    10:18:39:982 4388 Process 3448: Module OLEAUT32.dll:
    10:18:39:983 4388 Process 3448: Module Secur32.dll:
    10:18:39:984 4388 Process 3448: Module XmlLite.dll:
    10:18:39:985 4388 Process 3448: Module MPR.dll:
    10:18:39:986 4388 Process 3448: Module IMM32.DLL:
    10:18:39:990 4388 Process 3448: Module MSCTF.dll:
    10:18:39:991 4388 Process 3448: Module LPK.DLL:
    10:18:39:992 4388 Process 3448: Module USP10.dll:
    10:18:39:996 4388 Process 3448: Module comctl32.dll:
    10:18:39:998 4388 Process 3448: Module rsaenh.dll:
    10:18:40:000 4388 Process 3448: Module CLBCatQ.DLL:
    10:18:40:000 4388 Process 3448: Module tschannel.dll:
    10:18:40:001 4388 Process 3448: Module uxtheme.dll:
    10:18:40:002 4388 Process 3448: Module apphelp.dll:
    10:18:40:006 4388 Process 3528: Module MagicDoctorKbdHk.exe:
    10:18:40:009 4388 Process 3528: Module ntdll.dll:
    10:18:40:011 4388 Process 3528: Module kernel32.dll:
    10:18:40:106 4388 Process 3528: Module HookDllPS2.dll:
    10:18:40:108 4388 Process 3528: Module USER32.dll:
    10:18:40:110 4388 Process 3528: Module GDI32.dll:
    10:18:40:114 4388 Process 3528: Module ADVAPI32.dll:
    10:18:40:125 4388 Process 3528: Module RPCRT4.dll:
    10:18:40:162 4388 Process 3528: Module MFC80U.DLL:
    10:18:40:167 4388 Process 3528: Module MSVCR80.dll:
    10:18:40:171 4388 Process 3528: Module msvcrt.dll:
    10:18:40:172 4388 Process 3528: Module SHLWAPI.dll:
    10:18:40:224 4388 Process 3528: Module SHELL32.dll:
    10:18:40:235 4388 Process 3528: Module COMCTL32.dll:
    10:18:40:238 4388 Process 3528: Module IMM32.DLL:
    10:18:40:240 4388 Process 3528: Module MSCTF.dll:
    10:18:40:242 4388 Process 3528: Module LPK.DLL:
    10:18:40:243 4388 Process 3528: Module USP10.dll:
    10:18:40:253 4388 Process 3528: Module MFC80ENU.DLL:
    10:18:40:254 4388 Process 3528: Module uxtheme.dll:
    10:18:40:257 4388 Process 3544: Module Dwm.exe:
    10:18:40:260 4388 Process 3544: Module ntdll.dll:
    10:18:40:262 4388 Process 3544: Module kernel32.dll:
    10:18:40:271 4388 Process 3544: Module ADVAPI32.dll:
    10:18:40:277 4388 Process 3544: Module RPCRT4.dll:
    10:18:40:279 4388 Process 3544: Module GDI32.dll:
    10:18:40:282 4388 Process 3544: Module USER32.dll:
    10:18:40:285 4388 Process 3544: Module msvcrt.dll:
    10:18:40:288 4388 Process 3544: Module ole32.dll:
    10:18:40:291 4388 Process 3544: Module OLEAUT32.dll:
    10:18:40:292 4388 Process 3544: Module UxTheme.dll:
    10:18:40:293 4388 Process 3544: Module IMM32.dll:
    10:18:40:296 4388 Process 3544: Module MSCTF.dll:
    10:18:40:297 4388 Process 3544: Module dwmredir.dll:
    10:18:40:298 4388 Process 3544: Module LPK.DLL:
    10:18:40:299 4388 Process 3544: Module USP10.dll:
    10:18:40:303 4388 Process 3544: Module milcore.dll:
    10:18:40:304 4388 Process 3544: Module PSAPI.DLL:
    10:18:40:304 4388 Process 3544: Module dwmapi.dll:
    10:18:40:305 4388 Process 3544: Module NTMARTA.DLL:
    10:18:40:306 4388 Process 3544: Module WLDAP32.dll:
    10:18:40:306 4388 Process 3544: Module WS2_32.dll:
    10:18:40:307 4388 Process 3544: Module NSI.dll:
    10:18:40:307 4388 Process 3544: Module SAMLIB.dll:
    10:18:40:308 4388 Process 3544: Module uDWM.dll:
    10:18:40:309 4388 Process 3544: Module slc.dll:
    10:18:40:311 4388 Process 3544: Module WindowsCodecs.dll:
    10:18:40:315 4388 Process 3544: Module d3d9.dll:
    10:18:40:316 4388 Process 3544: Module VERSION.dll:
    10:18:40:317 4388 Process 3544: Module d3d8thk.dll:
    10:18:40:410 4388 Process 3544: Module atiumdag.dll:
    10:18:40:427 4388 Process 3544: Module atiumdva.dll:
    10:18:40:428 4388 Process 3544: Module btmmhook.dll:
    10:18:40:430 4388 Process 3568: Module EasyBatteryMgr3.exe:
    10:18:40:433 4388 Process 3568: Module ntdll.dll:
    10:18:40:436 4388 Process 3568: Module kernel32.dll:
    10:18:40:460 4388 Process 3568: Module SABI2.dll:
    10:18:40:461 4388 Process 3568: Module MSVCR80.dll:
    10:18:40:463 4388 Process 3568: Module msvcrt.dll:
    10:18:40:463 4388 Process 3568: Module WTSAPI32.dll:
    10:18:40:465 4388 Process 3568: Module ADVAPI32.dll:
    10:18:40:471 4388 Process 3568: Module RPCRT4.dll:
    10:18:40:474 4388 Process 3568: Module USER32.dll:
    10:18:40:476 4388 Process 3568: Module GDI32.dll:
    10:18:40:478 4388 Process 3568: Module COMDLG32.dll:
    10:18:40:480 4388 Process 3568: Module SHLWAPI.dll:
    10:18:40:484 4388 Process 3568: Module COMCTL32.dll:
    10:18:40:508 4388 Process 3568: Module SHELL32.dll:
    10:18:40:513 4388 Process 3568: Module WINSPOOL.DRV:
    10:18:40:513 4388 Process 3568: Module oledlg.dll:
    10:18:40:517 4388 Process 3568: Module ole32.dll:
    10:18:40:520 4388 Process 3568: Module OLEAUT32.dll:
    10:18:40:521 4388 Process 3568: Module IMM32.DLL:
    10:18:40:524 4388 Process 3568: Module MSCTF.dll:
    10:18:40:525 4388 Process 3568: Module LPK.DLL:
    10:18:40:526 4388 Process 3568: Module USP10.dll:
    10:18:40:527 4388 Process 3568: Module uxtheme.dll:
    10:18:40:531 4388 Process 3576: Module EasySpeedUpManager.exe:
    10:18:40:535 4388 Process 3576: Module ntdll.dll:
    10:18:40:538 4388 Process 3576: Module kernel32.dll:
    10:18:40:562 4388 Process 3576: Module HookDllPS2.dll:
    10:18:40:564 4388 Process 3576: Module USER32.dll:
    10:18:40:566 4388 Process 3576: Module GDI32.dll:
    10:18:40:568 4388 Process 3576: Module ADVAPI32.dll:
    10:18:40:575 4388 Process 3576: Module RPCRT4.dll:
    10:18:40:579 4388 Process 3576: Module gdiplus.dll:
    10:18:40:581 4388 Process 3576: Module msvcrt.dll:
    10:18:40:585 4388 Process 3576: Module ole32.dll:
    10:18:40:589 4388 Process 3576: Module SABI2.dll:
    10:18:40:590 4388 Process 3576: Module MSVCR80.dll:
    10:18:40:591 4388 Process 3576: Module WINMM.dll:
    10:18:40:592 4388 Process 3576: Module OLEAUT32.dll:
    10:18:40:593 4388 Process 3576: Module OLEACC.dll:
    10:18:40:594 4388 Process 3576: Module WTSAPI32.dll:
    10:18:40:595 4388 Process 3576: Module comdlg32.dll:
    10:18:40:597 4388 Process 3576: Module SHLWAPI.dll:
    10:18:40:599 4388 Process 3576: Module COMCTL32.dll:
    10:18:40:626 4388 Process 3576: Module SHELL32.dll:
    10:18:40:631 4388 Process 3576: Module WINSPOOL.DRV:
    10:18:40:632 4388 Process 3576: Module oledlg.dll:
    10:18:40:635 4388 Process 3576: Module IMM32.DLL:
    10:18:40:639 4388 Process 3576: Module MSCTF.dll:
    10:18:40:642 4388 Process 3576: Module LPK.DLL:
    10:18:40:643 4388 Process 3576: Module USP10.dll:
    10:18:40:649 4388 Process 3576: Module comctl32.dll:
    10:18:40:651 4388 Process 3576: Module uxtheme.dll:
    10:18:40:653 4388 Process 3576: Module PSAPI.DLL:
    10:18:40:669 4388 Process 3576: Module VDMDBG.DLL:
    10:18:40:683 4388 Process 3616: Module Explorer.EXE:
    10:18:40:687 4388 Process 3616: Module ntdll.dll:
    10:18:40:690 4388 Process 3616: Module kernel32.dll:
    10:18:40:701 4388 Process 3616: Module ADVAPI32.dll:
    10:18:40:710 4388 Process 3616: Module RPCRT4.dll:
    10:18:40:714 4388 Process 3616: Module GDI32.dll:
    10:18:40:718 4388 Process 3616: Module USER32.dll:
    10:18:40:722 4388 Process 3616: Module msvcrt.dll:
    10:18:40:724 4388 Process 3616: Module SHLWAPI.dll:
    10:18:40:747 4388 Process 3616: Module SHELL32.dll:
    10:18:40:754 4388 Process 3616: Module ole32.dll:
    10:18:40:757 4388 Process 3616: Module OLEAUT32.dll:
    10:18:40:760 4388 Process 3616: Module SHDOCVW.dll:
    10:18:40:762 4388 Process 3616: Module UxTheme.dll:
    10:18:40:763 4388 Process 3616: Module POWRPROF.dll:
    10:18:40:764 4388 Process 3616: Module dwmapi.dll:
    10:18:40:767 4388 Process 3616: Module gdiplus.dll:
    10:18:40:768 4388 Process 3616: Module slc.dll:
    10:18:40:770 4388 Process 3616: Module PROPSYS.dll:
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.