TechSpot

Iexplore.exe Virus Help

By DPCTAgentZ
Jan 3, 2015
  1. Hey there, I have a virus situation, it seems I've been infected with a virus that disguises as iexplore.exe; it shows multiple times on my task manager and I can't kill it, it just keeps coming back over and over. I got this a few days ago so I've been searching for a solution and I've tried various different methods I found through out the internet, but it seems that the problem is still there. I also noticed that a lot of these situations from people I read on different forums have different issues and they got personalized help to solve this problem, so I decided to ask for professional help to see if I get rid of this issue.
    The Methods I used were: Malwarebytes, Hitman Pro, AVG Anti-Virus, MS Security Essentials, and some Registry scans. Some of them managed to clean my PC a little more, but it didn't solve the problem.
    I would appreciate any kind of help, I haven't had a virus for a long time and it really bothers me the fact that I have one now, Please help.
     
  2. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Hey, thanks for the reply I hope that with your help we get the problem solved.
    Anyway, I forgot to mention this on the previous post, apart from the iexplore.exe processes showing with about 46,500k each, there seems to be a problem with dwm.exe as well as it appears to be consuming approximately 67,000k+ which it didn't consume that before, I don't know if its related to the iexplore.exe issue, but I think it does cause it appeared to behave like that when the iexplore.exe problem emerged.
    Also I will post the different logs I had from the various software I used from other forums. If it helps to fast up the pace of this, Thanks.

    DDS Log with Attatchment

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 11.0.9600.17496 BrowserJavaVersion: 10.71.2
    Run by CASZ at 15:17:29 on 2015-01-03
    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8140.3630 [GMT -6:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
    AV: AVG Internet Security 2015 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    SP: Microsoft Security Essentials *Enabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: AVG Internet Security 2015 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    FW: AVG Internet Security 2015 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
    .
    ============== Running Processes ===============
    .
    c:\PROGRA~2\AVG\AVG2015\avgrsa.exe
    C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    c:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Program Files\IDT\WDM\STacSV64.exe
    C:\Windows\system32\Hpservice.exe
    C:\Windows\System32\WUDFHost.exe
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k WbioSvcGroup
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\IDT\WDM\AESTSr64.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\AVG\AVG2015\avgfws.exe
    C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
    C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
    C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
    C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
    C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
    C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
    C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
    C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
    C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
    C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
    C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
    C:\Program Files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe
    C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
    C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe
    C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
    c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
    C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
    C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
    C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    c:\Program Files\Microsoft Security Client\NisSrv.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\IDT\WDM\sttray64.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Program Files (x86)\Steam\Steam.exe
    C:\Program Files (x86)\RocketDock\RocketDock.exe
    C:\Windows\System32\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Rainmeter\Rainmeter.exe
    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe
    C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    C:\Program Files (x86)\AVG\AVG2015\avgui.exe
    C:\Windows\SysWOW64\RunDll32.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
    C:\Windows\SysWOW64\ctfmon.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
    C:\Windows\System32\WUDFHost.exe
    C:\Program Files (x86)\Bruteforce Save Data\BruteforceSaveData.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = about:blank
    uSearch Bar = Preserve
    uSearch Page = hxxp://www.google.com
    uDefault_Page_URL = www.google.com
    uDefault_Search_URL = www.google.com
    mStart Page = www.google.com
    mSearch Page = www.google.com
    mDefault_Page_URL = www.google.com
    mDefault_Search_URL = www.google.com
    uProxyServer = hxxp=127.0.0.1:8555;https=127.0.0.1:8555
    uProxyOverride = 127.0.0.1;localhost;10.*;192.168.*;127.0.0.1:895;127.0.0.1:896;<local>
    BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
    BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll
    BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll
    TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll
    uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
    uRun: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
    uRun: [Imcxsoft] regsvr32.exe C:\Users\CASZ\AppData\Local\Imcxsoft\LibcrtKit32.dll
    uRun: [EPSON NX125 NX127 Series] C:\Windows\System32\spool\DRIVERS\x64\3\E_IATIGGA.EXE /FU "C:\Windows\TEMP\E_S5A5F.tmp" /EF "HKCU"
    mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
    mRun: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
    mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2015\avgui.exe" /TRAYONLY
    mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    StartupFolder: C:\Users\CASZ\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\RAINME~1.LNK - C:\Program Files\Rainmeter\Rainmeter.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SYSTWE~1\NOVABA~1.LNK - C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SYSTWE~1\REALPL~1.LNK - C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-Explorer: EnableShellExecuteHooks = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    mPolicies-System: HideFastUserSwitching = dword:0
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    Trusted Zone: 4game.com
    Trusted Zone: clonewarsadventures.com
    Trusted Zone: freerealms.com
    Trusted Zone: google-analytics.com
    Trusted Zone: novastor.com
    Trusted Zone: novastor.com
    Trusted Zone: soe.com
    Trusted Zone: sony.com
    DPF: {12193C65-F0E1-4DD1-AD4E-DB73C6911011} - file:///E:/activeX/DCP.cab
    DPF: {7191F0AC-D686-46A8-BFCC-EA61778C74DD} - hxxps://la.mydlink.com/8D/activeX//DCS-93x/aplugLiteDL.cab
    TCP: NameServer = 10.213.4.14 10.213.1.11
    TCP: Interfaces\{0A56AFA7-2FFD-43B9-A3E7-137BA6623546} : NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{732EF926-EB8B-42F8-AE77-2C3F8D8A5ACC} : NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{8F9BD33E-C441-4F8A-8ED2-B1AB11ECAD95} : NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{9460A5EF-DCB1-44F1-891B-3FE12E1C00F8} : NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86} : NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86} : DHCPNameServer = 10.213.4.14 10.213.1.11
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\34F40594B40234C69656E6475637 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\94E46494E4944555D403637303 : DHCPNameServer = 192.168.1.254
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\94E46494E4944555D407239773F5548545 : DHCPNameServer = 192.168.1.254 0.0.0.0
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\94E46494E4944555D423939333 : DHCPNameServer = 192.168.1.254
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\94E46494E4944555D4533434835423 : DHCPNameServer = 192.168.1.254
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\94E46494E4944555D4542303631373 : DHCPNameServer = 192.168.1.254
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}\94E46494E4944555D454831353 : DHCPNameServer = 192.168.1.254
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    SSODL: WebCheck - <orphaned>
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    x64-mStart Page = www.google.com
    x64-mSearch Page = www.google.com
    x64-mDefault_Page_URL = www.google.com
    x64-mDefault_Search_URL = www.google.com
    x64-BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll
    x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
    x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
    x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
    x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
    x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
    x64-Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
    x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
    x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
    x64-RunOnce: [NCPluginUpdater] "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    x64-Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-Notify: WB - C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll
    x64-SSODL: WebCheck - <orphaned>
    x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
    Hosts: 192.95.55.229 www.google-analytics.com.
    Hosts: 192.95.55.229 google-analytics.com.
    Hosts: 192.95.55.229 connect.facebook.net.
    Hosts: 95.141.32.66 www.google-analytics.com.
    Hosts: 95.141.32.66 google-analytics.com.
    .
    Note: multiple HOSTS entries found. Please refer to Attach.txt
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default\
    FF - prefs.js: browser.startup.homepage - about:home
    FF - prefs.js: network.proxy.type - 4
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
    FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll
    FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
    FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
    FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll
    FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll
    FF - ExtSQL: !HIDDEN! 1970-05-28 22:26; {C7E010A3-B924-DD24-96FD-0B2E450F4D81}; -
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2014-11-18 203544]
    R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2014-7-18 313624]
    R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2014-10-5 124184]
    R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2014-6-18 31512]
    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-7-17 269008]
    R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1207020.003\symds64.sys [2013-1-15 450680]
    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1207020.003\symefa64.sys [2013-1-15 912504]
    R1 Avgdiska;AVG Disk Driver;C:\Windows\System32\drivers\avgdiska.sys [2014-6-18 153368]
    R1 Avgfwfd;AVG network filter service;C:\Windows\System32\drivers\avgfwd6a.sys [2013-9-26 57144]
    R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2014-12-8 260888]
    R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2014-8-28 243480]
    R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2014-10-10 274200]
    R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-1-16 50976]
    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [2011-6-12 953904]
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2013-1-16 283200]
    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSviA64.sys [2011-6-12 476792]
    R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1207020.003\ironx64.sys [2013-1-15 171128]
    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1207020.003\symnets.sys [2013-1-15 386168]
    R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2013-3-6 89600]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-6-12 204288]
    R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [2014-12-18 1486664]
    R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [2014-12-18 3432976]
    R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [2014-12-18 298080]
    R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-7-14 1390176]
    R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-7-14 1767520]
    R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2013-7-9 166400]
    R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2013-7-9 128512]
    R2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-2-17 265544]
    R2 FreemakeVideoCapture;FreemakeVideoCapture;C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [2013-1-14 9216]
    R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;C:\Program Files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe [2014-11-25 9216]
    R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-2-28 92216]
    R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-1-26 30520]
    R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-9 26680]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-6-12 13336]
    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-1-2 1871160]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-1-2 969016]
    R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe [2013-1-15 130008]
    R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-8-31 125584]
    R2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe [2011-11-11 371856]
    R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2014-10-26 39568]
    R2 RealPlayer Cloud Service;RealPlayer Cloud Service;C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [2014-12-15 1141848]
    R2 RealPlayerUpdateSvc;RealPlayer Update Service;C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [2014-10-30 31856]
    R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
    R2 RzKLService;RzKLService;C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [2014-4-17 105448]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-6-12 2656280]
    R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2012-8-3 40432]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-6-12 132656]
    R3 hpCMSrv;HP Connection Manager 4.0 Service;C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-2-15 1071160]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-3-30 450520]
    R3 intelkmd;intelkmd;C:\Windows\System32\drivers\igdpmd64.sys [2011-8-9 12289472]
    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2015-1-2 25816]
    R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2015-1-2 129752]
    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-8-22 368624]
    R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2013-8-12 107912]
    R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2013-8-12 226696]
    R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2014-1-7 359128]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-4-10 849992]
    R3 ScreamBAudioSvc;ScreamBee Audio;C:\Windows\System32\drivers\ScreamingBAudio64.sys [2010-7-1 38992]
    R3 wdkmd;Intel WiDi KMD;C:\Windows\System32\drivers\WDKMD.sys [2011-2-16 42392]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
    S2 ezSharedSvc;Easybits Services for Windows;C:\Windows\System32\ezSharedSvcHost.exe --> C:\Windows\System32\ezSharedSvcHost.exe [?]
    S2 Freemake Improver;Freemake Improver;C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2014-9-23 108032]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-12-11 315496]
    S3 Backup Client Agent Service;Backup Client Agent Service;C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe [2011-11-8 217600]
    S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-3-1 183560]
    S3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\System32\drivers\btwampfl.sys [2011-6-12 344616]
    S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2011-6-12 39464]
    S3 GamesAppService;GamesAppService;"C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" --> C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [?]
    S3 HTCAND64;HTC Device Driver;C:\Windows\System32\drivers\ANDROIDUSB.sys [2009-11-2 33736]
    S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-12-10 114688]
    S3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windows\System32\drivers\mwac.sys [2015-1-2 63704]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-1-5 340240]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
    S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
    S3 taphss6;Anchorfree HSS VPN Adapter;C:\Windows\System32\drivers\taphss6.sys [2013-9-17 42184]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-1-14 1255736]
    S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2015-01-03 20:30:17 75888 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E97285C1-A7D8-44BA-989A-9BF7BCA4D5B4}\offreg.dll
    2015-01-03 20:30:04 -------- d-----w- C:\FRST
    2015-01-03 19:32:33 11870360 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E97285C1-A7D8-44BA-989A-9BF7BCA4D5B4}\mpengine.dll
    2015-01-03 19:26:31 -------- d-----w- C:\ProgramData\HitmanPro
    2015-01-03 19:05:37 -------- d-----w- C:\AdwCleaner
    2015-01-03 07:32:32 -------- d-----w- C:\Windows\pss
    2015-01-03 03:03:50 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
    2015-01-03 03:02:31 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
    2015-01-03 03:02:31 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
    2015-01-03 03:02:31 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2015-01-03 03:02:07 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-01-03 02:00:53 -------- d-----w- C:\Users\CASZ\AppData\Roaming\AVG2015
    2015-01-03 01:54:41 -------- d--h--w- C:\$AVG
    2015-01-03 01:54:41 -------- d-----w- C:\ProgramData\AVG2015
    2015-01-03 01:52:41 -------- d-----w- C:\Program Files (x86)\AVG
    2015-01-03 01:49:03 -------- d-----w- C:\Users\CASZ\AppData\Local\MFAData
    2015-01-03 01:49:03 -------- d-----w- C:\Users\CASZ\AppData\Local\Avg2015
    2015-01-03 01:49:03 -------- d-----w- C:\ProgramData\MFAData
    2015-01-03 00:15:14 -------- d-----w- C:\Users\CASZ\AppData\Local\Imcxsoft
    2015-01-03 00:13:09 -------- d-sh--w- C:\Users\CASZ\AppData\Local\EmieBrowserModeList
    2015-01-03 00:13:04 -------- d-----w- C:\Users\CASZ\AppData\Local\Ihmjsoft
    2015-01-02 17:17:11 1188440 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8931C16A-A520-4C68-89AF-2A568BE7F0D6}\gapaengine.dll
    2015-01-02 17:15:38 11870360 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2015-01-02 01:58:39 -------- d-----w- C:\ProgramData\amfpanleeekjndiijbaehciilmkjeipb
    2014-12-18 16:09:08 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
    2014-12-18 16:09:08 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
    2014-12-16 06:45:27 -------- d-----w- C:\Users\CASZ\AppData\Local\{646D5578-C680-484E-A1AA-118F54C1467F}
    2014-12-15 16:43:58 -------- d-----w- C:\Users\CASZ\AppData\Roaming\RealNetworks
    2014-12-15 16:43:52 -------- d-----w- C:\ProgramData\Package Cache
    2014-12-15 16:43:08 -------- d-----w- C:\Program Files (x86)\Common Files\xing shared
    2014-12-15 16:42:34 505416 ----a-w- C:\Windows\SysWow64\msvcp71.dll
    2014-12-15 16:42:34 353864 ----a-w- C:\Windows\SysWow64\msvcr71.dll
    2014-12-11 05:49:11 -------- d-----w- C:\Windows\System32\appraiser
    2014-12-11 05:21:31 3209728 ----a-w- C:\Windows\SysWow64\mf.dll
    2014-12-11 05:21:29 4121600 ----a-w- C:\Windows\System32\mf.dll
    2014-12-10 19:26:59 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
    2014-12-10 19:24:01 165888 ----a-w- C:\Windows\System32\charmap.exe
    2014-12-10 19:24:01 155136 ----a-w- C:\Windows\SysWow64\charmap.exe
    2014-12-10 19:23:56 310272 ----a-w- C:\Windows\System32\WsmWmiPl.dll
    2014-12-10 19:23:56 2020352 ----a-w- C:\Windows\System32\WsmSvc.dll
    2014-12-10 19:23:56 1177088 ----a-w- C:\Windows\SysWow64\WsmSvc.dll
    2014-12-10 19:23:55 346624 ----a-w- C:\Windows\System32\WSManMigrationPlugin.dll
    2014-12-10 19:23:55 266240 ----a-w- C:\Windows\System32\WSManHTTPConfig.exe
    2014-12-10 19:23:55 248832 ----a-w- C:\Windows\SysWow64\WSManMigrationPlugin.dll
    2014-12-10 19:23:55 214016 ----a-w- C:\Windows\SysWow64\WsmWmiPl.dll
    2014-12-10 19:23:55 198656 ----a-w- C:\Windows\SysWow64\WSManHTTPConfig.exe
    2014-12-10 19:23:55 181248 ----a-w- C:\Windows\System32\WsmAuto.dll
    2014-12-10 19:23:55 145920 ----a-w- C:\Windows\SysWow64\WsmAuto.dll
    2014-12-10 19:23:52 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2014-12-10 19:23:52 2048 ----a-w- C:\Windows\System32\tzres.dll
    2014-12-10 02:01:59 -------- d-----w- C:\Program Files (x86)\Ultra Street Fighter IV
    2014-12-09 05:33:47 1892184 ----a-w- C:\Windows\SysWow64\D3DX9_42.dll
    2014-12-09 05:20:17 -------- d-----w- C:\Program Files (x86)\Capcom
    2014-12-09 03:24:26 260888 ----a-w- C:\Windows\System32\drivers\avgidsdrivera.sys
    .
    ==================== Find3M ====================
    .
    2014-12-17 03:49:14 701616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2014-12-17 03:49:13 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-12-04 02:50:55 413184 ----a-w- C:\Windows\System32\generaltel.dll
    2014-12-04 02:50:45 741376 ----a-w- C:\Windows\System32\invagent.dll
    2014-12-04 02:50:40 396800 ----a-w- C:\Windows\System32\devinv.dll
    2014-12-04 02:50:38 830976 ----a-w- C:\Windows\System32\appraiser.dll
    2014-12-04 02:50:37 227328 ----a-w- C:\Windows\System32\aepdu.dll
    2014-12-04 02:50:37 192000 ----a-w- C:\Windows\System32\aepic.dll
    2014-12-04 02:44:48 1083392 ----a-w- C:\Windows\System32\aeinv.dll
    2014-12-01 23:28:44 1232040 ----a-w- C:\Windows\System32\aitstatic.exe
    2014-11-22 03:06:23 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
    2014-11-22 03:06:11 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
    2014-11-22 02:50:39 66560 ----a-w- C:\Windows\System32\iesetup.dll
    2014-11-22 02:50:10 580096 ----a-w- C:\Windows\System32\vbscript.dll
    2014-11-22 02:49:54 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
    2014-11-22 02:48:20 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
    2014-11-22 02:35:29 114688 ----a-w- C:\Windows\System32\ieetwcollector.exe
    2014-11-22 02:34:51 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
    2014-11-22 02:34:07 6039552 ----a-w- C:\Windows\System32\jscript9.dll
    2014-11-22 02:26:31 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
    2014-11-22 02:20:44 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2014-11-22 02:07:43 501248 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2014-11-22 02:07:17 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
    2014-11-22 02:06:32 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
    2014-11-22 02:05:02 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
    2014-11-22 01:54:30 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
    2014-11-22 01:47:10 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
    2014-11-22 01:46:58 2125312 ----a-w- C:\Windows\System32\inetcpl.cpl
    2014-11-22 01:40:04 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
    2014-11-22 01:29:26 4299264 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2014-11-22 01:28:21 2358272 ----a-w- C:\Windows\System32\wininet.dll
    2014-11-22 01:22:49 2052096 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2014-11-22 01:21:57 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
    2014-11-22 01:00:20 1888256 ----a-w- C:\Windows\SysWow64\wininet.dll
    2014-11-19 10:31:16 1217192 ----a-w- C:\Windows\SysWow64\FM20.DLL
    2014-11-19 03:42:04 203544 ----a-w- C:\Windows\System32\drivers\avgidsha.sys
    2014-11-18 01:27:29 1648 ----a-w- C:\Windows\System32\ASOROSet.bin
    2014-11-11 03:09:06 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll
    2014-11-11 03:08:52 241152 ----a-w- C:\Windows\System32\pku2u.dll
    2014-11-11 03:08:48 728064 ----a-w- C:\Windows\System32\kerberos.dll
    2014-11-11 02:44:45 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll
    2014-11-11 02:44:32 186880 ----a-w- C:\Windows\SysWow64\pku2u.dll
    2014-11-11 02:44:25 550912 ----a-w- C:\Windows\SysWow64\kerberos.dll
    2014-11-11 01:46:26 119296 ----a-w- C:\Windows\System32\drivers\tdx.sys
    2014-10-30 11:25:26 275080 ------w- C:\Windows\System32\MpSigStub.exe
    2014-10-25 01:57:59 77824 ----a-w- C:\Windows\System32\packager.dll
    2014-10-25 01:32:37 67584 ----a-w- C:\Windows\SysWow64\packager.dll
    2014-10-20 15:40:47 98216 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2014-10-18 02:05:23 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2014-10-18 01:33:18 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2014-10-14 02:16:37 155064 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
    2014-10-14 02:13:06 683520 ----a-w- C:\Windows\System32\termsrv.dll
    2014-10-14 02:13:00 3241984 ----a-w- C:\Windows\System32\msi.dll
    2014-10-14 02:12:57 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
    2014-10-14 02:09:31 146432 ----a-w- C:\Windows\System32\msaudite.dll
    2014-10-14 02:07:31 681984 ----a-w- C:\Windows\System32\adtschema.dll
    2014-10-14 01:50:47 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
    2014-10-14 01:50:41 2363904 ----a-w- C:\Windows\SysWow64\msi.dll
    2014-10-14 01:49:38 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
    2014-10-14 01:47:30 146432 ----a-w- C:\Windows\SysWow64\msaudite.dll
    2014-10-14 01:46:02 681984 ----a-w- C:\Windows\SysWow64\adtschema.dll
    2014-10-12 17:12:26 111016 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
    2014-10-10 21:14:32 274200 ----a-w- C:\Windows\System32\drivers\avgtdia.sys
    2014-10-10 00:57:42 3198976 ----a-w- C:\Windows\System32\win32k.sys
    2014-10-06 02:41:40 124184 ----a-w- C:\Windows\System32\drivers\avgmfx64.sys
    .
    ============= FINISH: 15:19:01.48 ===============
     
  4. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Malwarebytes Log 1 Part 1
    Malwarebytes Anti-Malware
    www.malwarebytes.org
    Scan Date: 1/2/2015
    Scan Time: 9:06:17 PM
    Logfile:
    Administrator: No

    Version: 2.00.4.1028
    Malware Database: v2015.01.03.01
    Rootkit Database: v2014.12.30.01
    License: Premium
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: CASZ

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 480991
    Time Elapsed: 3 hr, 25 min, 11 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 1
    PUP.Optional.DeltaFix.A, C:\Program Files (x86)\DeltaFix\DeltaFix.dll, Delete-on-Reboot, [ce2f975b3059b482076cb2b2768ded13],

    Registry Keys: 46
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    PUP.Optional.SupTab.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [55a846ac19700f27b9cc944f36cca25e],
    Trojan.Agent, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}, Quarantined, [a15c72806a1f6fc729d9da252ed3926e],
    PUP.Optional.AdvancedSystemProtector.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~4A5BE654_is1, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [ee0fea080a7f201620b8be0922e2936d],
    PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\delta-homesSoftware, Quarantined, [04f924cec7c254e2200f80fce91ad729],
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, Quarantined, [ad502bc72762f640c53c92d7b74cb848],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\supWPM, Quarantined, [da238270e5a449edd3317cfb768d5aa6],
    PUP.Optional.FTDownloader.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\bbffdhejhaoiflnpooogkckfdcmmjppn, Quarantined, [c7364ea44b3eb28416335c09f11207f9],
    PUP.Optional.ExtendedProtection.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ogfjmhfnldnajmfaofeiaepghjenbgjo, Quarantined, [cc31e909bdcca690e24870f510f3a25e],
    PUP.Optional.Booster.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{fc67e7a0}, Quarantined, [7e7fdb171277092d441452303fc48d73],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP, Quarantined, [5da0a54d4346a2946f6389edf01315eb],
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, Quarantined, [ec11db1798f1a096ec17a8cfd52e4fb1],
    PUP.Optional.AdvancedSystemProtector.A, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\Advanced-System Protector, Quarantined, [96670de512779d99affe34422fd4768a],
    PUP.Optional.DeltaFix.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\fc67e7a0, Quarantined, [df1e16dc94f5ae88640e174d966d2ad6],
    PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginService, Quarantined, [a459886a29605cda07b1fe6a9a69bd43],
    PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginServices, Quarantined, [2fce3cb6ccbdc6709b8d71fb1de6a759],
    PUP.Optional.Softonic.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Softonic, Quarantined, [1ce117dbf49524124f50541159aaa45c],
    PUP.Optional.WebSearches.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SupHpUISoft, Quarantined, [ba431dd591f8ad89387b0375679cb64a],
    PUP.Optional.AdvancedSystemProtector.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\Advanced-System Protector, Quarantined, [53aa3db5f792af878c224c2a54af4eb2],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\TYPELIB\{1D37BD00-E9FD-40D1-80E7-1795E510ECAA}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{8B906AF1-C9E5-493C-9B36-8E1CBAE28522}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{9A71EC22-9AAE-421E-98BC-59E12779D611}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\INTERFACE\{B6E5186F-181F-48C2-A8C0-9191A1707AEA}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{8B906AF1-C9E5-493C-9B36-8E1CBAE28522}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9A71EC22-9AAE-421E-98BC-59E12779D611}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{B6E5186F-181F-48C2-A8C0-9191A1707AEA}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{1D37BD00-E9FD-40D1-80E7-1795E510ECAA}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\CLSID\{77858244-d98f-433c-8358-4d677b1c095c}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{77858244-D98F-433C-8358-4D677B1C095C}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\P77858244_d98f_433c_8358_4d677b1c095c_.P77858244_d98f_433c_8358_4d677b1c095c_, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\P77858244_d98f_433c_8358_4d677b1c095c_.P77858244_d98f_433c_8358_4d677b1c095c_.9, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\P77858244_d98f_433c_8358_4d677b1c095c_.P77858244_d98f_433c_8358_4d677b1c095c_, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\P77858244_d98f_433c_8358_4d677b1c095c_.P77858244_d98f_433c_8358_4d677b1c095c_.9, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{77858244-D98F-433C-8358-4D677B1C095C}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{77858244-D98F-433C-8358-4D677B1C095C}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{77858244-D98F-433C-8358-4D677B1C095C}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{77858244-D98F-433C-8358-4D677B1C095C}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{77858244-D98F-433C-8358-4D677B1C095C}, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, HKLM\SOFTWARE\CLASSES\CLSID\{77858244-D98F-433C-8358-4D677B1C095C}\INPROCSERVER32, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],

    Registry Values: 3
    PUP.Optional.FreeMakeConverter.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fmconverter@gmail.com, C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\, Quarantined, [fffe5999f69379bd9e79412ac14258a8]
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP|dir, C:\Program Files (x86)\SupTab, Quarantined, [5da0a54d4346a2946f6389edf01315eb]
    PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, exp, Quarantined, [ec11db1798f1a096ec17a8cfd52e4fb1]

    Registry Data: 14
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (firefox.exe), Bad: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.mystartsearch.com/?type=...),Replaced,[1edf00f2c9c041f589a5fa803dc8c040]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.mystartsearch.com/web/?t...5A9E384_J2590054H4NN9GH4NN9GX&q={searchTerms}, Good: (www.google.com), Bad: (http://www.mystartsearch.com/web/?t...),Replaced,[ba433bb7761387af4a2f2e4c1aebc43c]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (www.google.com), Bad: (http://www.mystartsearch.com/?type=...),Replaced,[02fbe50d49403006c9af98e2ed1817e9]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (www.google.com), Bad: (http://www.mystartsearch.com/?type=...),Replaced,[a558539f038663d39779acdce0259868]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.mystartsearch.com/web/?t...5A9E384_J2590054H4NN9GH4NN9GX&q={searchTerms}, Good: (www.google.com), Bad: (http://www.mystartsearch.com/web/?t...),Replaced,[f30a4da5c8c11422ef8bb7c334d1c53b]
    PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[59a40ee4fc8df046d97ebbcb7d8832ce]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (firefox.exe), Bad: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.mystartsearch.com/?type=...),Replaced,[25d8935f226787afc06ea2d859ac57a9]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://www.mystartsearch.com/web/?t...5A9E384_J2590054H4NN9GH4NN9GX&q={searchTerms}, Good: (www.google.com), Bad: (http://www.mystartsearch.com/web/?t...),Replaced,[8d70c1319aef5adc4b2ee19937ce9d63]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (www.google.com), Bad: (http://www.mystartsearch.com/?type=...),Replaced,[5da046ac3158d660cdabaad0a065857b]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (www.google.com), Bad: (http://www.mystartsearch.com/?type=...),Replaced,[42bb43afb3d660d60f013751966f6997]
    PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://www.mystartsearch.com/web/?t...5A9E384_J2590054H4NN9GH4NN9GX&q={searchTerms}, Good: (www.google.com), Bad: (http://www.mystartsearch.com/web/?t...),Replaced,[ba43d2203e4b48ee4139f486b1541be5]
    PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[1edf648eb8d187afff58c4c25baa9868]
    PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.mystartsearch.com/?type=...HitachiXHTS547575A9E384_J2590054H4NN9GH4NN9GX, Good: (www.google.com), Bad: (http://www.mystartsearch.com/?type=...),Replaced,[59a4f8faa6e3bd793546f68445c03cc4]
    PUP.Optional.Delta.A, HKU\S-1-5-21-1331771087-30956632-3492572574-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://search.delta-homes.com/web/?...GX&ts=1393443689&type=default&q={searchTerms}, Good: (www.google.com), Bad: (http://search.delta-homes.com/web/?...),Replaced,[7f7e19d9f89155e148117b0cab5a0af6]

    Folders: 54
    PUP.Optional.DeltaFix.A, C:\Program Files (x86)\DeltaFix, Delete-on-Reboot, [ce2f975b3059b482076cb2b2768ded13],
    PUP.Optional.AdvancedSystemProtector, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced-System Protector, Quarantined, [f30a866cd6b34fe7f7a98fe841c2aa56],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\clamunpack, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Temp, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.Multiplug, C:\Program Files (x86)\youtubeadblocker, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, Quarantined, [45b827cb29606fc77d4a98a957acf30d],
    PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, Quarantined, [45b827cb29606fc77d4a98a957acf30d],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Users\CASZ\AppData\Roaming\SupTab, Quarantined, [0bf27280c4c50b2b2c0562e833d01fe1],
    PUP.Optional.DownTango.A, C:\Program Files (x86)\Red Sky\DownTango, Quarantined, [f40934bee5a40432e8c684c918eb0cf4],
    PUP.Optional.DownTango.A, C:\Users\CASZ\AppData\Local\DownTango, Quarantined, [af4e03ef7019c472cfe0e469b84b7f81],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector, Quarantined, [7a83876b99f0b97dd3974906f11235cb],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector\signatures, Quarantined, [7a83876b99f0b97dd3974906f11235cb],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector\updates, Quarantined, [7a83876b99f0b97dd3974906f11235cb],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector, Quarantined, [25d8dd15494070c6adbdf05f32d17789],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Backup, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\native, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.EzDownloader.A, C:\Users\CASZ\AppData\Roaming\EZDownloader, Quarantined, [07f6c62c2e5be74f90ae273a20e321df],
    PUP.Optional.EzDownloader.A, C:\Users\CASZ\AppData\Roaming\EZDownloader\Errors, Quarantined, [07f6c62c2e5be74f90ae273a20e321df],

    Files: 234
    Trojan.Agent, C:\Program Files (x86)\Missing e\Missing e.exe, Quarantined, [a15c72806a1f6fc729d9da252ed3926e],
    Trojan.Agent, C:\Program Files (x86)\youtubeadblocker\1mEC5ewRmizzkW.exe, Quarantined, [f607718156335fd7bb479b647f8257a9],
    PUP.Optional.SearchProtect, C:\Program Files (x86)\SupTab\Loader64.exe, Quarantined, [9f5e16dc5138c175f78d6c7923de7c84],
    PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, Quarantined, [e518bd3559301b1bad90b1f5ce33e818],
    Trojan.Agent, C:\$Recycle.Bin\S-1-5-21-1331771087-30956632-3492572574-1000\$RAWH47V\unisaless.exe, Quarantined, [6a93ec06513877bfdd25fe01867b8e72],
    PUP.Optional.AdvancedSystemProtector, C:\Windows\System32\sasnative64.exe, Quarantined, [6c916e84a0e95bdbf07a10ad867bfb05],
    PUP.Optional.OpenCandy, C:\Users\CASZ\AppData\Local\Temp\FreemakeVideoConverter_4.1.4.14.exe, Quarantined, [45b872803c4d78beffd50a23649d5fa1],
    Trojan.Agent, C:\Users\CASZ\AppData\Local\Temp\tmpC3A4.tmp, Quarantined, [31cc62907514b87ec2d038ca40c244bc],
    PUP.Optional.MyPCBackup.A, C:\Users\CASZ\AppData\Local\Temp\BackupSetup.exe, Quarantined, [b24be80a0287f73f81ce1fc608f92bd5],
    PUP.Optional.DeltaFix.A, C:\Program Files (x86)\DeltaFix\DeltaFix.dll, Delete-on-Reboot, [ce2f975b3059b482076cb2b2768ded13],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx, Quarantined, [1fde0ee4b2d7bf7750db85e09b68e21e],
    PUP.Optional.MyStartSearch.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml, Quarantined, [eb1291618bfe72c4c13e92d6dc276799],
    PUP.Optional.Conduit.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cap1.conduit-apps.com_0.localstorage, Quarantined, [eb1224ceaddc85b1cde0155fab58a45c],
    PUP.Optional.Conduit.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cap1.conduit-apps.com_0.localstorage-journal, Quarantined, [ea13dc16e8a167cf624bcca826dddd23],
    PUP.Optional.AdvancedSystemProtector, C:\Windows\System32\Tasks\Advanced-System Protector_startup, Quarantined, [807d16dc5a2f79bd26f5d2a5ec17e61a],
    PUP.Optional.AdvancedSystemProtector, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced-System Protector\Uninstall Advanced-System Protector.lnk, Quarantined, [f30a866cd6b34fe7f7a98fe841c2aa56],
    PUP.Optional.AdvancedSystemProtector, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced-System Protector\Advanced-System Protector.lnk, Quarantined, [f30a866cd6b34fe7f7a98fe841c2aa56],
    PUP.Optional.AdvancedSystemProtector, C:\Users\Public\Desktop\Advanced-System Protector.lnk, Quarantined, [d4294aa84148b77f564bf78058ab8e72],
    PUP.Optional.RegCleanerPro, C:\Windows\System32\Tasks\RegClean Pro, Quarantined, [03fa3eb44b3e5adc10affd7c0af958a8],
    PUP.Optional.ContinueToSave.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_continuetosave.info_0.localstorage, Quarantined, [b449faf8a0e974c22a002a5215eecc34],
    PUP.Optional.ContinueToSave.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_continuetosave.info_0.localstorage-journal, Quarantined, [7c81e70b5c2d6bcbfa307a02bd46db25],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\AdvancedSystemProtector.exe.config, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\AdvancedSystemProtector.exe, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\AppResource.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\asp.ico, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\AspManager.exe, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\aspsys.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\ASPUninstall.exe, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\categories.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Chinese_asp_ZH-CN.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Chinese_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\traditionalcn_uninst_zh-tw.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Turkish_uninst_tr.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\unins000.dat, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\unins000.exe, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\unins000.msg, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\unrar.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Xceed.Compression.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Xceed.Compression.Formats.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Xceed.FileSystem.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Xceed.Zip.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    ...
     
  5. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Malwarebytes Log 1 Part 2

    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\french_asp_FR.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\French_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\german_asp_DE.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\German_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\greek_uninst_el.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Interop.IWshRuntimeLibrary.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\italian_asp_IT.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Italian_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Communication.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\danish_asp_DA.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Danish_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\dutch_asp_NL.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Dutch_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\eng_asp_en.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\eng_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\filetypehelper.exe, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Finnish_asp_FI.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Finnish_uninst_fi.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\russian_asp_ru.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\russian_uninst_ru.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\scandll.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\spanish_asp_ES.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\spanish_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\swedish_asp_SV.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\swedish_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\System.Core.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\System.Data.SQLite.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\japanese_asp_JA.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Japanese_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\korean_uninst_ko.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\loading_withWhiteBG.avi, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Microsoft.Win32.TaskScheduler.DLL, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\norwegian_asp_NO.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Norwegian_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\polish_uninst_pl.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\portugese_uninst_pt.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\portuguese_asp_PT-BR.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Portuguese_uninst.ini, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\Register Advanced-System Protector.lnk, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\TPS.ico, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\clamunpack\clamscan.exe, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\clamunpack\libclamav.dll, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.AdvancedSystemProtector.A, C:\Program Files (x86)\ASP\clamunpack\readme.txt, Quarantined, [c538aa48fb8edb5b2139f2ec9c68cb35],
    PUP.Optional.Multiplug, C:\Program Files (x86)\youtubeadblocker\1mEC5ewRmizzkW.dat, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, C:\Program Files (x86)\youtubeadblocker\1mEC5ewRmizzkW.exe, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, C:\Program Files (x86)\youtubeadblocker\1mEC5ewRmizzkW.tlb, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.Multiplug, C:\Program Files (x86)\youtubeadblocker\1mEC5ewRmizzkW.x64.dll, Quarantined, [cd30c82a4f3aa98da9b68ba3ea19c63a],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\bk_shadow.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\btn.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\close.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml.bak, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_box.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_check.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_bk.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_check.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit-ie8.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit2.0.js, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, Quarantined, [c03dd919e4a5c86e35fbbf8bf112649c],
    PUP.Optional.DownTango.A, C:\Program Files (x86)\Red Sky\DownTango\libeay32.dll, Quarantined, [f40934bee5a40432e8c684c918eb0cf4],
    PUP.Optional.DownTango.A, C:\Program Files (x86)\Red Sky\DownTango\ssleay32.dll, Quarantined, [f40934bee5a40432e8c684c918eb0cf4],
    PUP.Optional.DownTango.A, C:\Users\CASZ\AppData\Local\DownTango\application.log, Quarantined, [af4e03ef7019c472cfe0e469b84b7f81],
    PUP.Optional.DownTango.A, C:\Users\CASZ\AppData\Local\DownTango\config.db, Quarantined, [af4e03ef7019c472cfe0e469b84b7f81],
    PUP.Optional.DownTango.A, C:\Users\CASZ\AppData\Local\DownTango\corefiles.db, Quarantined, [af4e03ef7019c472cfe0e469b84b7f81],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector\updates\aspsetup_update.exe, Quarantined, [7a83876b99f0b97dd3974906f11235cb],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\AddonSafelist, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\laststatus.lic, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\log.xslt, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\status.lic, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\completedatabase.db, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\Cookies.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\DigSign.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\FilePathFIX.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\FilePaths.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\FileSignature.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\Folders.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\Md5.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\Registry.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\SetupSign.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\signatures\StrSetupSign.bin, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\100oupdate.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\1997completedatabase.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2060mupdate.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2061update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2062update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2063update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2064update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2065update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2066update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2067update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2068update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2069update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2070update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2071update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2072update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2073update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2074update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2075update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2076update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2077update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2078update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2079update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2080update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2081update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2082update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2083update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System Protector\updates\2084update.zip, Quarantined, [d627fef4a7e2ac8aaebc202fdf24629e],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\ASPLog.txt, Quarantined, [25d8dd15494070c6adbdf05f32d17789],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\QDetail.db, Quarantined, [25d8dd15494070c6adbdf05f32d17789],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\Settings.db, Quarantined, [25d8dd15494070c6adbdf05f32d17789],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\Update.ini, Quarantined, [25d8dd15494070c6adbdf05f32d17789],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\ASPLog.txt, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\QDetail.db, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Settings.db, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Update.ini, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_01-01-15_06-21-01.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_02-01-15_03-52-09.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_17-12-14_02-39-19.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_21-12-14_11-41-46.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_22-12-14_08-06-48.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_23-12-14_06-54-53.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_24-12-14_04-03-31.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_25-12-14_05-49-09.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_25-12-14_11-34-53.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_26-12-14_03-45-26.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_27-12-14_04-20-17.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_28-12-14_05-00-13.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\log_31-12-14_06-59-34.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Logs\SMLog.xml, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\native\nativeapp.out, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine\pup.optional-nz._qt_, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine\pup.optional-snk._qt_, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine\pup.optional-wsas._qt_, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine\pup.optional._qt_, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine\Restricted Settings._qt_, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced-System Protector\Quarantine\trojan.agent._qt_, Quarantined, [5ca16f8397f26dc9aebc68e7669d738d],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\background.html, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\background.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\data.json, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\icon128.png, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\inject.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\jquery.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\manifest.json, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\xa.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_0\xagainit.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\background.html, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\background.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\data.json, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\icon128.png, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\inject.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\jquery.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\manifest.json, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\xa.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.ExtendedProtection.A, C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_1\xagainit.js, Quarantined, [9f5e8b673356da5ca3d30d500bf8e51b],
    PUP.Optional.QuickStart.A, C:\Users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), Replaced,[bc41787a8affb87e6d6d209e21e4cc34]

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  6. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Malwarebytes Log 2

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 1/3/2015
    Scan Time: 11:58:31 AM
    Logfile:
    Administrator: Yes

    Version: 2.00.4.1028
    Malware Database: v2015.01.03.07
    Rootkit Database: v2014.12.30.01
    License: Premium
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: CASZ

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 477855
    Time Elapsed: 40 min, 55 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 4
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector, Quarantined, [61a2e310345536007e5fda750102d62a],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector\signatures, Quarantined, [61a2e310345536007e5fda750102d62a],
    PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced System Protector\updates, Quarantined, [61a2e310345536007e5fda750102d62a],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector, Quarantined, [20e3d41f52374fe7e7f6b699b44f38c8],

    Files: 4
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\ASPLog.txt, Quarantined, [20e3d41f52374fe7e7f6b699b44f38c8],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\QDetail.db, Quarantined, [20e3d41f52374fe7e7f6b699b44f38c8],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\Settings.db, Quarantined, [20e3d41f52374fe7e7f6b699b44f38c8],
    PUP.Optional.AdvancedSystemProtector.A, C:\Users\CASZ\AppData\Roaming\systweak\Advanced System Protector\Update.ini, Quarantined, [20e3d41f52374fe7e7f6b699b44f38c8],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  7. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Malwarebytes Hyper Scan 1

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 1/3/2015
    Scan Time: 2:40:27 PM
    Logfile:
    Administrator: Yes

    Version: 2.00.4.1028
    Malware Database: v2015.01.03.10
    Rootkit Database: v2014.12.30.01
    License: Premium
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: CASZ

    Scan Type: Hyper Scan
    Result: Completed
    Objects Scanned: 404011
    Time Elapsed: 28 min, 52 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Disabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  8. Broni

    Broni Malware Annihilator Posts: 52,915   +344

  9. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Yeah sorry for that, my bad, here's the attach.txt, and as for the AV, I'll just uninstall AVG and Norton.

    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Ultimate
    Boot Device: \Device\HarddiskVolume1
    Install Date: 1/12/2013 10:41:27 PM
    System Uptime: 1/3/2015 1:12:19 PM (2 hours ago)
    .
    Motherboard: Hewlett-Packard | | 165A
    Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz | CPU1 | 2001/1333mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 684 GiB total, 350.998 GiB free.
    D: is FIXED (NTFS) - 14 GiB total, 1.602 GiB free.
    E: is CDROM ()
    F: is CDROM ()
    G: is CDROM ()
    H: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: Hotspot Shield Routing Driver 6
    Device ID: ROOT\LEGACY_HSSDRV6\0000
    Manufacturer:
    Name: Hotspot Shield Routing Driver 6
    PNP Device ID: ROOT\LEGACY_HSSDRV6\0000
    Service: HssDRV6
    .
    ==== System Restore Points ===================
    .
    RP426: 12/22/2014 10:53:52 AM - Windows Update
    RP427: 12/25/2014 1:31:28 PM - Windows Update
    RP428: 12/31/2014 2:43:35 PM - Windows Update
    RP429: 1/2/2015 4:11:43 PM - Advanced-System Protector
    RP430: 1/2/2015 7:51:33 PM - Installed AVG 2015
    RP431: 1/2/2015 7:53:26 PM - Installed AVG 2015
    RP432: 1/3/2015 1:52:33 PM - Checkpoint by HitmanPro
    RP433: 1/3/2015 2:19:31 PM - Checkpoint by HitmanPro
    .
    ==== Hosts File Hijack ======================
    .
    Hosts: 192.95.55.229 www.google-analytics.com.
    Hosts: 192.95.55.229 google-analytics.com.
    Hosts: 192.95.55.229 connect.facebook.net.
    Hosts: 95.141.32.66 www.google-analytics.com.
    Hosts: 95.141.32.66 google-analytics.com.
    Hosts: 95.141.32.66 connect.facebook.net.
    Hosts: 85.25.107.101 www.google-analytics.com.
    Hosts: 85.25.107.101 google-analytics.com.
    Hosts: 85.25.107.101 connect.facebook.net.
    .
    ==== Installed Programs ======================
    .
    Abogados - MF
    ActiveCheck component for HP Active Support Library
    Administrador de Despachos Jurídicos
    Adobe After Effects CS5.5
    Adobe AIR
    Adobe Community Help
    Adobe Flash Player 15 ActiveX
    Adobe Flash Player 16 NPAPI
    Adobe Media Player
    Adobe Photoshop CS5
    Adobe Premiere Pro CS5.5
    Adobe Reader X (10.1.13) MUI
    Adobe Shockwave Player 11.5
    Adobe Story
    Advanced Archive Password Recovery
    Advanced System Optimizer
    Agatha Christie - Peril at End House
    Anime Studio Pro 9.2
    Anime Studio Pro 9.2 (x86)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Install Manager
    AuthenTec TrueAPI
    AVG 2015
    Bejeweled 2 Deluxe
    Bejeweled 3
    Bing Bar
    Blackhawk Striker 2
    Blasterball 3
    Blio
    Bonjour
    Bounce Symphony
    Broadcom 2070 Bluetooth 3.0
    Bruteforce Save Data
    Build-a-lot 2
    Cake Mania
    Catalyst Control Center
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    Catalyst Control Center Profiles Mobile
    ccc-utility64
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Chuzzle Deluxe
    Company of Heroes
    Company of Heroes 2
    CyberLink YouCam
    D3DX10
    DAEMON Tools Lite
    Definition Update for Microsoft Office 2010 (KB2910899) 32-Bit Edition
    Diner Dash 2 Restaurant Rescue
    DomDomSoft Manga Downloader (remove only)
    Dora's World Adventure
    Empire Earth II
    Empire Earth II Gold Edition
    Energy Star Digital Logo
    Epson Event Manager
    EPSON NX100 Series Printer Uninstall
    EPSON NX125 NX127 Series Printer Uninstall
    EPSON Scan
    EPSON TX300F Series Printer Uninstall
    EssentialPIM
    ESU for Microsoft Windows 7
    Evernote v. 4.2.2
    FaceGen Modeller 3.5 Free
    Farm Frenzy
    FATE - The Traitor Soul
    Female Voice Pack
    Freemake Video Converter version 4.1.4
    Freemake Video Downloader
    Google Chrome
    Google Earth
    Google Update Helper
    Guitar Pro 6
    Happy Cloud Client
    Hi-Rez Studios Authenticate and Update Service
    HP 3D DriveGuard
    HP Auto
    HP Client Services
    HP Connection Manager
    HP Customer Experience Enhancements
    HP Documentation
    HP Games
    HP MovieStore
    HP On Screen Display
    HP Power Manager
    HP Quick Launch
    HP Setup
    HP Setup Manager
    HP SimplePass 2011
    HP Software Framework
    HP Support Assistant
    HPAsset component for HP Active Support Library
    iCloud
    IDT Audio
    iMindMap 6
    Intel PROSet Wireless
    Intel(R) Display Audio Driver
    Intel(R) Management Engine Components
    Intel(R) PROSet/Wireless WiFi Software
    Intel(R) Rapid Storage Technology
    Intel(R) Wireless Display
    iTunes
    Java 7 Update 67 (64-bit)
    Java 7 Update 71
    Java Auto Updater
    Junk Mail filter update
    Jurassic Park Operation Genesis
    Jurisprudencia y Tesis Aisladas IUS (Junio 1917 - Diciembre 2012) ver.USB
    Knights of the Force 2.0
    League of Legends
    Mah Jong Medley
    Malwarebytes Anti-Malware version 2.0.4.1028
    Manga Studio
    Masters of the World
    Media Player Codec Pack 4.2.2
    Mesh Runtime
    Microsoft .NET Framework 4.5.1
    Microsoft Application Error Reporting
    Microsoft Games for Windows - LIVE
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Office 2010
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office Office 64-bit Components 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook Connector
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2010
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable (x64)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft WSE 3.0 Runtime
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_ATL_x86_x64
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_CRT_x86_x64
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFC_x86_x64
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC80_MFCLOC_x86_x64
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_ATL_x86_x64
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_CRT_x86_x64
    Microsoft_VC90_MFC_x86
    Microsoft_VC90_MFC_x86_x64
    Microsoft_VC90_MFCLOC_x86
    MKLOL
    MorphVOX Pro
    Mozilla Firefox 34.0.5 (x86 en-US)
    Mozilla Maintenance Service
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Mystery P.I. - Stolen in San Francisco
    Namco All-Stars PAC-MAN
    Norton Internet Security
    NovaBACKUP
    PDF Settings CS5
    Penguins!
    Plants vs. Zombies - Game of the Year
    PlayReady PC Runtime amd64
    PlayReady PC Runtime x86
    Poker Superstars III
    Polar Bowler
    Polar Golfer
    PowerISO
    Project64 1.6
    Práctico Jurídico Forense - 2011
    PX Profile Update
    QuickTime
    Rainmeter
    Razer Game Booster
    RealDownloader
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealNetworks - Microsoft Visual C++ 2010 Runtime
    RealPlayer Cloud
    Realtek Ethernet Controller Driver
    Realtek PCIE Card Reader
    RealUpgrade 1.1
    Recovery Manager
    Renesas Electronics USB 3.0 Host Controller Driver
    Replay Video Capture 6
    RocketDock 1.3.5
    RoxioNow Player
    Samsung Universal Print Driver 2
    SecondLifeViewer (remove only)
    Security Task Manager 1.8g
    Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2978128)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)
    Security Update for Microsoft Excel 2010 (KB2910902) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553154) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2881071) 32-Bit Edition
    Security Update for Microsoft Word 2010 (KB2899519) 32-Bit Edition
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
    Skype Click to Call
    Skype™ 7.0
    Slingo Supreme
    Smite Level Up LATAM
    Spotify
    Star Wars Jedi Knight Jedi Academy
    Steam
    Synaptics Pointing Device Driver
    TeamSpeak 3 Client
    TuneUp Utilities Language Pack (en-US)
    Ultra Street Fighter IV
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
    Update for Microsoft Excel 2010 (KB2589348) 32-Bit Edition
    Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition
    Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
    Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553140) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589386) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2597089) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687275) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837602) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2883019) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2889818) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2889828) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2910896) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2597088) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
    Update for Microsoft PowerPoint 2010 (KB2880517) 32-Bit Edition
    Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
    Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition
    Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition
    Update Installer for WildTangent Games App
    UpdateService
    Validity WBF DDK
    Video Downloader
    Video Padlock
    Virtual Villagers 4 - The Tree of Life
    Visual Studio 2012 x64 Redistributables
    Visual Studio 2012 x86 Redistributables
    VLC media player
    Vuze
    WebM Project Directshow Filters
    Wheel of Fortune 2
    WildTangent Games App (HP Games)
    Windows Installer Clean Up
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Language Selector
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    WinPcap 4.1.2
    WinRAR 4.20 (64-bit)
    Xvid Video Codec
    YouWave for Android
    Zuma Deluxe
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12/31/2014 6:26:18 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer DDZM-TZ1 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{ADCA6528-C351-4285-AF74-268745990D86}. The master browser is stopping or an election is being forced.
    1/3/2015 12:48:22 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Network Acceleration service to connect.
    1/3/2015 12:08:15 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.191.1381.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.11302.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
    1/3/2015 12:08:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    1/3/2015 11:52:47 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    1/3/2015 11:52:46 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    1/3/2015 11:52:46 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    1/3/2015 11:52:38 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    1/3/2015 11:52:29 AM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
    1/3/2015 11:52:29 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    1/3/2015 11:52:12 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgdiska AVGIDSDriver Avgldx64 BHDrvx64 discache eeCtrl HssDRV6 IDSVia64 MpFilter SCDEmu spldr SRTSPX SymIRON SymNetS Wanarpv6
    1/3/2015 11:52:11 AM, Error: Service Control Manager [7001] - The Microsoft Network Inspection System service depends on the Microsoft Malware Protection Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/3/2015 11:52:11 AM, Error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/3/2015 11:52:06 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x8007043c Error description: This service cannot be started in Safe Mode Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.
    1/3/2015 1:23:02 PM, Error: Service Control Manager [7034] - The Easybits Services for Windows service terminated unexpectedly. It has done this 1 time(s).
    1/3/2015 1:16:06 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: HssDRV6
    1/3/2015 1:15:06 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Freemake Improver service to connect.
    1/3/2015 1:15:06 PM, Error: Service Control Manager [7000] - The Freemake Improver service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    1/3/2015 1:11:34 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x8007043c Error description: This service cannot be started in Safe Mode Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.
    1/3/2015 1:11:33 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
    1/3/2015 1:11:18 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    1/2/2015 8:27:10 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
    1/2/2015 8:19:28 PM, Error: Service Control Manager [7000] - The WinZiper service service failed to start due to the following error: Access is denied.
    1/2/2015 8:00:55 PM, Error: Service Control Manager [7034] - The IePlugin Services service terminated unexpectedly. It has done this 1 time(s).
    .
    ==== End Of File ===========================
     
  10. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit (MBAR) to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
    NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.
     
  11. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Alright done, I uninstalled the 2 AVs, I ran RougeKiller and MBAR, here are the logs for both; It's still there though... :(

    RogueKiller V10.1.1.0 [Dec 23 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : CASZ [Administrator]
    Mode : Delete -- Date : 01/03/2015 16:35:34

    ¤¤¤ Processes : 1 ¤¤¤
    [Suspicious.Path] rundll32.exe -- C:\Users\CASZ\AppData\Local\Imcxsoft\LibcrtKit32.dll[-] -> Unloaded

    ¤¤¤ Registry : 19 ¤¤¤
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\1SecureIconsProvider | (default) : {FC9D8189-520A-4417-AED7-9EAC810C6FBA} -> ERROR [0]
    [Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1331771087-30956632-3492572574-1000\Software\Microsoft\Windows\CurrentVersion\Run | Imcxsoft : regsvr32.exe C:\Users\CASZ\AppData\Local\Imcxsoft\LibcrtKit32.dll [x] -> ERROR [0]
    [Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1331771087-30956632-3492572574-1000\Software\Microsoft\Windows\CurrentVersion\Run | Imcxsoft : regsvr32.exe C:\Users\CASZ\AppData\Local\Imcxsoft\LibcrtKit32.dll -> ERROR [2]
    [PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-1331771087-30956632-3492572574-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:8555;https=127.0.0.1:8555 -> Not selected
    [PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-1331771087-30956632-3492572574-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:8555;https=127.0.0.1:8555 -> Not selected
    [PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Not selected
    [PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Not selected
    [PUM.SearchPage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : www.google.com -> Not selected
    [PUM.SearchPage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : www.google.com -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.213.4.14 10.213.1.11 [(Private Address) (XX)][(Private Address) (XX)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.213.4.14 10.213.1.11 [(Private Address) (XX)][(Private Address) (XX)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.213.4.14 10.213.1.11 [(Private Address) (XX)][(Private Address) (XX)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ADCA6528-C351-4285-AF74-268745990D86} | DhcpNameServer : 10.213.4.14 10.213.1.11 [(Private Address) (XX)][(Private Address) (XX)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{ADCA6528-C351-4285-AF74-268745990D86} | DhcpNameServer : 10.213.4.14 10.213.1.11 [(Private Address) (XX)][(Private Address) (XX)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{ADCA6528-C351-4285-AF74-268745990D86} | DhcpNameServer : 10.213.4.14 10.213.1.11 [(Private Address) (XX)][(Private Address) (XX)] -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

    ¤¤¤ Tasks : 9 ¤¤¤
    [Suspicious.Path] ASO-AutoCheckUpdate7Days.job -- C:\Program Files (x86)\Advanced System Optimizer 3\CheckUpdate.exe (-schedule) -> ERROR [0]
    [Suspicious.Path] ASO-OneClickCare.job -- C:\Program Files (x86)\Advanced System Optimizer 3\ASO3.exe (-schedule) -> ERROR [0]
    [Suspicious.Path] ASO-System Protector.job -- C:\Program Files (x86)\Advanced System Optimizer 3\SystemProtector.exe ( -autofix) -> ERROR [0]
    [Suspicious.Path] AVG-Secure-Search-Update_JUNE2013_TB_rmv.job -- C:\Windows\TEMP\{E7AC64EB-B3B4-4DA3-8BBA-002A7D0AB8F5}.exe (--uninstall=1) -> ERROR [0]
    [Suspicious.Path] \\4486 -- wscript.exe (C:\Users\CASZ\AppData\Local\Temp\launchie.vbs //B) -> ERROR [0]
    [Suspicious.Path] \\ASO-AutoCheckUpdate7Days -- C:\Program Files (x86)\Advanced System Optimizer 3\CheckUpdate.exe (-schedule) -> ERROR [0]
    [Suspicious.Path] \\ASO-OneClickCare -- C:\Program Files (x86)\Advanced System Optimizer 3\ASO3.exe (-schedule) -> ERROR [0]
    [Suspicious.Path] \\ASO-System Protector -- C:\Program Files (x86)\Advanced System Optimizer 3\SystemProtector.exe (-autofix) -> ERROR [0]
    [Suspicious.Path] \\AVG-Secure-Search-Update_JUNE2013_TB_rmv -- C:\Windows\TEMP\{E7AC64EB-B3B4-4DA3-8BBA-002A7D0AB8F5}.exe (--uninstall=1) -> ERROR [0]

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 [Too big!] ¤¤¤

    ¤¤¤ Antirootkit : 9 (Driver: Not loaded [0xc000036b]) ¤¤¤
    [IAT:Inl] (iexplore.exe) USER32.dll - MessageBeep : Unknown @ 0x30117c4 (push dword 0x30117c4|ret )
    [IAT:Inl] (iexplore.exe) USER32.dll - DrawTextExW : Unknown @ 0x30051dc (push dword 0x30051dc|ret )
    [IAT:Inl] (iexplore.exe) USER32.dll - DrawTextW : Unknown @ 0x3006f0c (push dword 0x3006f0c|ret )
    [IAT:Inl] (iexplore.exe) WININET.dll - HttpOpenRequestW : Unknown @ 0x300ad44 (push dword 0x300ad44|ret )
    [IAT:Inl] (iexplore.exe) WS2_32.dll - WSASend : Unknown @ 0x300111c (push dword 0x300111c|ret )
    [IAT:Inl] (iexplore.exe) WINMM.dll - waveOutOpen : Unknown @ 0x300c894 (push dword 0x300c894|ret )
    [IAT:Inl] (iexplore.exe) USER32.dll - DrawTextExW : Unknown @ 0x36051dc (push dword 0x36051dc|ret )
    [IAT:Inl] (iexplore.exe) USER32.dll - DrawTextW : Unknown @ 0x3606f0c (push dword 0x3606f0c|ret )
    [IAT:Inl] (iexplore.exe) WININET.dll - HttpOpenRequestW : Unknown @ 0x360ad44 (push dword 0x360ad44|ret )

    ¤¤¤ Web browsers : 1 ¤¤¤
    [PUM.Proxy][FIREFX:Config] 6umba1y0.default : user_pref("network.proxy.type", 4); -> Not selected

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: Hitachi HTS547575A9E384 +++++
    --- User ---
    [MBR] 34fcf8f45d629b14567902d8ce5280eb
    [BSP] 020c9e162599a6e0ef6bf64a048703f7 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 700351 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1434728448 | Size: 14750 MB
    3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 1464936448 | Size: 102 MB
    User = LL1 ... OK
    User != LL2 ... KO!
    --- LL2 ---
    [MBR] 1a6b56e3b8874dbce1e7ab81e4003acf
    [BSP] 020c9e162599a6e0ef6bf64a048703f7 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 77824 MB
    1 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 159793152 | Size: 400 MB


    ============================================
    RKreport_SCN_01032015_163103.log - RKreport_DEL_01032015_163441.log

    Malwarebytes Anti-Rootkit BETA 1.08.2.1001
    www.malwarebytes.org

    Database version: v2015.01.03.10

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17501
    CASZ :: DDZT-HP [administrator]

    1/3/2015 4:42:53 PM
    mbar-log-2015-01-03 (16-42-53).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 480032
    Time elapsed: 57 minute(s), 38 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.08.2.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 11.0.9600.17501

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
    CPU speed: 1.995000 GHz
    Memory total: 8535261184, free: 3433230336

    Downloaded database version: v2015.01.03.10
    Downloaded database version: v2014.12.30.01
    Downloaded database version: v2014.12.06.01
    =======================================
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    =======================================
    Initializing...
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    =======================================
    Initializing...
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    =======================================
    Initializing...
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    Initializing...
    ======================
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    =======================================


    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.08.2.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 11.0.9600.17501

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
    CPU speed: 1.995000 GHz
    Memory total: 8535261184, free: 3590328320

    Downloaded database version: v2015.01.03.10
    Downloaded database version: v2014.12.30.01
    Downloaded database version: v2014.12.06.01
    =======================================
    Initializing...
    ------------ Kernel report ------------
    01/03/2015 16:42:26
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kdcom.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\CLFS.SYS
    \SystemRoot\system32\CI.dll
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\system32\drivers\ACPI.sys
    \SystemRoot\system32\drivers\WMILIB.SYS
    \SystemRoot\system32\drivers\msisadrv.sys
    \SystemRoot\system32\drivers\pci.sys
    \SystemRoot\system32\drivers\vdrvroot.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\system32\drivers\compbatt.sys
    \SystemRoot\system32\drivers\BATTC.SYS
    \SystemRoot\system32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\system32\DRIVERS\iaStor.sys
    \SystemRoot\system32\drivers\atapi.sys
    \SystemRoot\system32\drivers\ataport.SYS
    \SystemRoot\system32\drivers\msahci.sys
    \SystemRoot\system32\drivers\PCIIDEX.SYS
    \SystemRoot\system32\drivers\amdxata.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\system32\drivers\fileinfo.sys
    \SystemRoot\system32\DRIVERS\MpFilter.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\msrpc.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\drivers\volsnap.sys
    \SystemRoot\System32\Drivers\spldr.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\hwpolicy.sys
    \SystemRoot\system32\DRIVERS\hpdskflt.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\system32\drivers\disk.sys
    \SystemRoot\system32\drivers\CLASSPNP.SYS
    \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \??\C:\Windows\system32\drivers\avgtpx64.sys
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\drivers\VIDEOPRT.SYS
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\system32\drivers\rdpencdd.sys
    \SystemRoot\system32\drivers\rdprefmp.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\wfplwf.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\vwififlt.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\drivers\termdd.sys
    \SystemRoot\System32\Drivers\SCDEmu.SYS
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\system32\drivers\mssmbios.sys
    \SystemRoot\System32\drivers\discache.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\drivers\blbdrive.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\system32\DRIVERS\atikmpag.sys
    \SystemRoot\system32\DRIVERS\atikmdag.sys
    \SystemRoot\system32\DRIVERS\igdpmd64.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\system32\DRIVERS\TeeDriverx64.sys
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\Rt64win7.sys
    \SystemRoot\system32\DRIVERS\NETwsw00.sys
    \SystemRoot\system32\DRIVERS\vwifibus.sys
    \SystemRoot\system32\DRIVERS\RtsPStor.sys
    \SystemRoot\system32\DRIVERS\nusb3xhc.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\i8042prt.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\SynTP.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    \SystemRoot\system32\drivers\CmBatt.sys
    \SystemRoot\system32\DRIVERS\Accelerometer.sys
    \SystemRoot\system32\drivers\wmiacpi.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\drivers\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\clwvd.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\drivers\ksthunk.sys
    \SystemRoot\system32\drivers\ScreamingBAudio64.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\rdpbus.sys
    \SystemRoot\system32\drivers\swenum.sys
    \SystemRoot\system32\DRIVERS\umbus.sys
    \SystemRoot\system32\DRIVERS\WDKMD.sys
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\DRIVERS\stwrt64.sys
    \SystemRoot\system32\DRIVERS\IntcDAud.sys
    \SystemRoot\system32\DRIVERS\nusb3hub.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\drivers\usbaudio.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\System32\Drivers\fastfat.SYS
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\System32\Drivers\usbvideo.sys
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\Drivers\dump_iaStor.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\system32\DRIVERS\monitor.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\System32\ATMFD.DLL
    \SystemRoot\system32\drivers\luafv.sys
    \SystemRoot\system32\drivers\WudfPf.sys
    \SystemRoot\system32\DRIVERS\WinUSB.sys
    \SystemRoot\system32\DRIVERS\WUDFRd.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\nwifi.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \SystemRoot\system32\DRIVERS\vwifimp.sys
    \SystemRoot\system32\DRIVERS\NisDrvWFP.sys
    \SystemRoot\system32\drivers\npf.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \??\C:\Program Files (x86)\YouWave Android\vb\VBoxDrv.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \??\C:\Windows\system32\drivers\mbamchameleon.sys
    \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
    \Windows\System32\ntdll.dll
    \Windows\System32\smss.exe
    \Windows\System32\apisetschema.dll
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xfffffa80083a1790
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IAAStorageDevice-1\
    Lower Device Object: 0xfffffa8008174050
    Lower Device Driver Name: \Driver\iaStor\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xfffffa80083a1790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa80082aa930, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa80083a1790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa80082abb10, DeviceName: Unknown, DriverName: \Driver\hpdskflt\
    DevicePointer: 0xfffffa8008174050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 1A3F0DFB

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 407552
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 409600 Numsec = 1434318848

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1434728448 Numsec = 30208000

    Partition 3 type is Other (0xc)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1464936448 Numsec = 210672

    Disk Size: 750156374016 bytes
    Sector size: 512 bytes

    Done!
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished
     
  12. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  13. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Ok done, here's the report.

    Part 1
    18:30:46.0895 0x4374 TDSS rootkit removing tool 3.0.0.42 Dec 12 2014 00:35:20
    18:30:50.0506 0x4374 ============================================================
    18:30:50.0506 0x4374 Current date / time: 2015/01/03 18:30:50.0506
    18:30:50.0506 0x4374 SystemInfo:
    18:30:50.0506 0x4374
    18:30:50.0506 0x4374 OS Version: 6.1.7601 ServicePack: 1.0
    18:30:50.0506 0x4374 Product type: Workstation
    18:30:50.0506 0x4374 ComputerName: DDZT-HP
    18:30:50.0506 0x4374 UserName: CASZ
    18:30:50.0506 0x4374 Windows directory: C:\Windows
    18:30:50.0506 0x4374 System windows directory: C:\Windows
    18:30:50.0506 0x4374 Running under WOW64
    18:30:50.0506 0x4374 Processor architecture: Intel x64
    18:30:50.0506 0x4374 Number of processors: 8
    18:30:50.0506 0x4374 Page size: 0x1000
    18:30:50.0506 0x4374 Boot type: Normal boot
    18:30:50.0506 0x4374 ============================================================
    18:30:51.0799 0x4374 KLMD registered as C:\Windows\system32\drivers\25154680.sys
    18:30:53.0063 0x4374 System UUID: {340B2213-04B8-DC0F-D883-386C11CDFEE4}
    18:30:54.0145 0x4374 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 ( 698.64 Gb ), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
    18:30:54.0149 0x4374 ============================================================
    18:30:54.0149 0x4374 \Device\Harddisk0\DR0:
    18:30:54.0183 0x4374 MBR partitions:
    18:30:54.0183 0x4374 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800
    18:30:54.0183 0x4374 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x557DF800
    18:30:54.0183 0x4374 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x55843800, BlocksNum 0x1CCF000
    18:30:54.0183 0x4374 \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x57512800, BlocksNum 0x336F0
    18:30:54.0183 0x4374 ============================================================
    18:30:54.0243 0x4374 C: <-> \Device\Harddisk0\DR0\Partition2
    18:30:54.0294 0x4374 D: <-> \Device\Harddisk0\DR0\Partition3
    18:30:54.0295 0x4374 ============================================================
    18:30:54.0295 0x4374 Initialize success
    18:30:54.0295 0x4374 ============================================================
    18:31:01.0210 0x4244 ============================================================
    18:31:01.0210 0x4244 Scan started
    18:31:01.0210 0x4244 Mode: Manual;
    18:31:01.0210 0x4244 ============================================================
    18:31:01.0210 0x4244 KSN ping started
    18:31:04.0449 0x4244 KSN ping finished: true
    18:31:06.0875 0x4244 ================ Scan system memory ========================
    18:31:06.0875 0x4244 System memory - ok
    18:31:06.0876 0x4244 ================ Scan services =============================
    18:31:07.0177 0x4244 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
    18:31:07.0192 0x4244 1394ohci - ok
    18:31:07.0225 0x4244 [ 7A330A42870EB1FA81F88BE514D2D566, FFE4F37992A7855FD5308462054BCA91B275EFC52F3402C99ED1C716CCC0E43C ] Accelerometer C:\Windows\system32\DRIVERS\Accelerometer.sys
    18:31:07.0226 0x4244 Accelerometer - ok
    18:31:07.0246 0x4244 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
    18:31:07.0254 0x4244 ACPI - ok
    18:31:07.0277 0x4244 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
    18:31:07.0278 0x4244 AcpiPmi - ok
    18:31:07.0359 0x4244 [ 4C72FDD915D62EAEF149BD9C73AB9CF4, 8EA45A1B88DFD819F0ADA3AF36D464E1BF52574269592370E0CC8D0490680E1F ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    18:31:07.0362 0x4244 AdobeARMservice - ok
    18:31:07.0712 0x4244 [ 4E48A7DF7ECACB38C686B2BEBAA687A3, D4DEE6BD464855B24A6D40BC6A9279B2041099615C6A319D869DA113AD896EA3 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    18:31:07.0717 0x4244 AdobeFlashPlayerUpdateSvc - ok
    18:31:07.0824 0x4244 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
    18:31:07.0840 0x4244 adp94xx - ok
    18:31:07.0869 0x4244 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\drivers\adpahci.sys
    18:31:07.0879 0x4244 adpahci - ok
    18:31:07.0917 0x4244 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
    18:31:07.0931 0x4244 adpu320 - ok
    18:31:07.0965 0x4244 [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
    18:31:07.0968 0x4244 AeLookupSvc - ok
    18:31:08.0049 0x4244 [ A6FB9DB8F1A86861D955FD6975977AE0, 788C6EE50719227D7A9B7F08C8D5E1289FCD0E8AC23A1021A5093D2E8368F696 ] AESTFilters C:\Program Files\IDT\WDM\AESTSr64.exe
    18:31:08.0052 0x4244 AESTFilters - ok
    18:31:08.0127 0x4244 [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
    18:31:08.0143 0x4244 AFD - ok
    18:31:08.0187 0x4244 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
    18:31:08.0188 0x4244 agp440 - ok
    18:31:08.0208 0x4244 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
    18:31:08.0211 0x4244 ALG - ok
    18:31:08.0240 0x4244 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
    18:31:08.0241 0x4244 aliide - ok
    18:31:08.0279 0x4244 [ C53D784D7303C463D004C0D5782917B4, 004918DC540E81B0034ECDBB525C4108D6D4EA896033323651FAB2490A0B7E11 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
    18:31:08.0284 0x4244 AMD External Events Utility - ok
    18:31:08.0309 0x4244 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
    18:31:08.0310 0x4244 amdide - ok
    18:31:08.0328 0x4244 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
    18:31:08.0331 0x4244 AmdK8 - ok
    18:31:08.0798 0x4244 [ 06778049A44C316E8D016039B9D14667, 78C7CA39107B4EEEBF96A0C7C0470BD2A63A3FDF5CA1E1FEC3F058F61BF16569 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
    18:31:09.0171 0x4244 amdkmdag - ok
    18:31:09.0213 0x4244 [ 94B4028F0EEA1F166D78186A254676B5, 4004ADCC91B4D6F3C516A514DA7840789D4ED14E081AD123C735495B2074EC79 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
    18:31:09.0222 0x4244 amdkmdap - ok
    18:31:09.0247 0x4244 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
    18:31:09.0249 0x4244 AmdPPM - ok
    18:31:09.0269 0x4244 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
    18:31:09.0272 0x4244 amdsata - ok
    18:31:09.0300 0x4244 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
    18:31:09.0305 0x4244 amdsbs - ok
    18:31:09.0320 0x4244 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
    18:31:09.0322 0x4244 amdxata - ok
    18:31:09.0357 0x4244 [ 80B9412C4DE09147581FC935FB4C97AB, 0C9661F7B5EF7F9D61981790B7AB64E3375BD117962166619D0CC546A2D014D3 ] AppID C:\Windows\system32\drivers\appid.sys
    18:31:09.0359 0x4244 AppID - ok
    18:31:09.0378 0x4244 [ F71CA01C24FC3798A717B5A6F682F9AD, 8CF1C209E7BBBAD02D6D087293C0B681CDA3170AF119CA2916C2708D8801E749 ] AppIDSvc C:\Windows\System32\appidsvc.dll
    18:31:09.0380 0x4244 AppIDSvc - ok
    18:31:09.0398 0x4244 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
    18:31:09.0399 0x4244 Appinfo - ok
    18:31:09.0437 0x4244 [ 4FE5C6D40664AE07BE5105874357D2ED, 70DD05EE80B77EB2F781E0919885D1BBB1119EA1A8955935AF5AECD05E30F14A ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    18:31:09.0439 0x4244 Apple Mobile Device - ok
    18:31:09.0469 0x4244 [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt C:\Windows\System32\appmgmts.dll
    18:31:09.0476 0x4244 AppMgmt - ok
    18:31:09.0505 0x4244 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\drivers\arc.sys
    18:31:09.0507 0x4244 arc - ok
    18:31:09.0519 0x4244 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\drivers\arcsas.sys
    18:31:09.0522 0x4244 arcsas - ok
    18:31:09.0595 0x4244 [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    18:31:09.0598 0x4244 aspnet_state - ok
    18:31:09.0612 0x4244 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
    18:31:09.0614 0x4244 AsyncMac - ok
    18:31:09.0643 0x4244 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
    18:31:09.0644 0x4244 atapi - ok
    18:31:09.0713 0x4244 [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
    18:31:09.0728 0x4244 AudioEndpointBuilder - ok
    18:31:09.0751 0x4244 [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioSrv C:\Windows\System32\Audiosrv.dll
    18:31:09.0767 0x4244 AudioSrv - ok
    18:31:09.0798 0x4244 [ 68430AD3FB0FADBFA5D1677617D1E1F5, CF732DD21B472653AB0A4063455F2E7608F3075C255B9882D18CB52026B6C972 ] avgtp C:\Windows\system32\drivers\avgtpx64.sys
    18:31:09.0799 0x4244 avgtp - ok
    18:31:09.0824 0x4244 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
    18:31:09.0827 0x4244 AxInstSV - ok
    18:31:09.0868 0x4244 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
    18:31:09.0880 0x4244 b06bdrv - ok
    18:31:09.0904 0x4244 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
    18:31:09.0911 0x4244 b57nd60a - ok
    18:31:10.0029 0x4244 [ E188E5CAC30C3305EDA682C897B39960, DC4CA1D4B93FF9A89ED9F7A7EDF839C7758F270C636B0D1BDB9C98BE8A046E63 ] Backup Client Agent Service C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe
    18:31:10.0036 0x4244 Backup Client Agent Service - ok
    18:31:10.0075 0x4244 [ 93EE7D9C35AE7E9FFDA148D7805F1421, 9D88D5CC08F887B35A893FEC80D8CC4A9E4EAAF533E27D0F1B9CC36C171C92DA ] BBSvc C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
    18:31:10.0080 0x4244 BBSvc - ok
    18:31:10.0150 0x4244 [ 9E84A931DBEE0292E38ED672F6293A99, 2945EAF0AC091709E0C5508B45EC343EDE507AC2B08A2D7D64F286D38424CBC4 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl664.sys
    18:31:10.0181 0x4244 BCM43XX - ok
    18:31:10.0214 0x4244 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
    18:31:10.0217 0x4244 BDESVC - ok
    18:31:10.0262 0x4244 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
    18:31:10.0262 0x4244 Beep - ok
    18:31:10.0318 0x4244 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
    18:31:10.0340 0x4244 BFE - ok
    18:31:10.0407 0x4244 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
    18:31:10.0430 0x4244 BITS - ok
    18:31:10.0455 0x4244 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
    18:31:10.0457 0x4244 blbdrive - ok
    18:31:10.0506 0x4244 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
    18:31:10.0515 0x4244 Bonjour Service - ok
    18:31:10.0535 0x4244 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
    18:31:10.0537 0x4244 bowser - ok
    18:31:10.0545 0x4244 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
    18:31:10.0546 0x4244 BrFiltLo - ok
    18:31:10.0580 0x4244 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
    18:31:10.0581 0x4244 BrFiltUp - ok
    18:31:10.0628 0x4244 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
    18:31:10.0632 0x4244 Browser - ok
    18:31:10.0667 0x4244 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
    18:31:10.0674 0x4244 Brserid - ok
    18:31:10.0693 0x4244 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
    18:31:10.0694 0x4244 BrSerWdm - ok
    18:31:10.0707 0x4244 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
    18:31:10.0709 0x4244 BrUsbMdm - ok
    18:31:10.0720 0x4244 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
    18:31:10.0721 0x4244 BrUsbSer - ok
    18:31:10.0744 0x4244 [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
    18:31:10.0746 0x4244 BthEnum - ok
    18:31:10.0760 0x4244 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
    18:31:10.0762 0x4244 BTHMODEM - ok
    18:31:10.0791 0x4244 [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
    18:31:10.0795 0x4244 BthPan - ok
    18:31:10.0839 0x4244 [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
    18:31:10.0853 0x4244 BTHPORT - ok
    18:31:10.0897 0x4244 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
    18:31:10.0900 0x4244 bthserv - ok
    18:31:10.0928 0x4244 [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
    18:31:10.0931 0x4244 BTHUSB - ok
    18:31:10.0968 0x4244 [ 7A2CE8C1BF4DAA1F2766E21E9CA11078, 2AF02D206F60F95185894D829D7CC322C4986847153269DE186E11EE2353FBBC ] btwampfl C:\Windows\system32\drivers\btwampfl.sys
    18:31:10.0979 0x4244 btwampfl - ok
    18:31:10.0991 0x4244 [ A75BF6802A967F5AACECC3C67FEBDF55, 7FD561C3817ABE48121926361ED12943A1EF5C0006689DCE3813697868D763B4 ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
    18:31:10.0994 0x4244 btwaudio - ok
    18:31:11.0015 0x4244 [ D895DC213EDBDA5FCC53AAD1F1E0E63B, FF3B483752E45911C267367B102EA0901BE13840FDBA083D0B7FF3379C37B898 ] btwavdt C:\Windows\system32\drivers\btwavdt.sys
    18:31:11.0020 0x4244 btwavdt - ok
    18:31:11.0082 0x4244 [ 692F8648D7686D91E34A65AC698019D8, CC7544513AA089BDB0FCE74156C88CBB4182C96F97785A64ED5D3061B039516E ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
    18:31:11.0106 0x4244 btwdins - ok
    18:31:11.0133 0x4244 [ 07096D2BC22CCB6CEA5A532DF0BE8A75, A9B7F2EFFDF1E4EC0A5DC098F0ED2BE44E271844A4F1CBAD2FA1655DE1E03F6E ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys
    18:31:11.0135 0x4244 btwl2cap - ok
    18:31:11.0150 0x4244 [ 6D7AA2BDE0135599C5F230D69DB3B420, 5179F57976B3903B5D45C5B383C691BCB26411B5C98296F99C1F79EF863E1E0A ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
    18:31:11.0151 0x4244 btwrchid - ok
    18:31:11.0276 0x4244 [ 1F79342D9EB530A48742F651E570983A, 99E0B613C23FA8591E248DFA6FF2D3EE19E262BE6E070A0E43E256B69687017F ] c2cautoupdatesvc C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    18:31:11.0304 0x4244 c2cautoupdatesvc - ok
    18:31:11.0426 0x4244 [ E4938E0A376CF0B9D989EE5C0A146891, 9DF6AB5781CD60862D9664CA9A8AF0696A1FB6D09D804CD8DE9630F40DE59E90 ] c2cpnrsvc C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    18:31:11.0466 0x4244 c2cpnrsvc - ok
    18:31:11.0485 0x4244 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
    18:31:11.0488 0x4244 cdfs - ok
    18:31:11.0533 0x4244 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
    18:31:11.0537 0x4244 cdrom - ok
    18:31:11.0590 0x4244 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
    18:31:11.0593 0x4244 CertPropSvc - ok
    18:31:11.0621 0x4244 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\drivers\circlass.sys
    18:31:11.0622 0x4244 circlass - ok
    18:31:11.0647 0x4244 [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
    18:31:11.0656 0x4244 CLFS - ok
    18:31:11.0729 0x4244 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    18:31:11.0732 0x4244 clr_optimization_v2.0.50727_32 - ok
    18:31:11.0784 0x4244 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    18:31:11.0787 0x4244 clr_optimization_v2.0.50727_64 - ok
    18:31:11.0850 0x4244 [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    18:31:11.0853 0x4244 clr_optimization_v4.0.30319_32 - ok
    18:31:11.0901 0x4244 [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    18:31:11.0904 0x4244 clr_optimization_v4.0.30319_64 - ok
    18:31:11.0939 0x4244 [ A4DC4C58F4B8D798E5F5D59099ADCF8A, 9EA32AAD464FFBE419F439C2761BB65556611E700589AD1EF3907962101159EA ] clwvd C:\Windows\system32\DRIVERS\clwvd.sys
    18:31:11.0940 0x4244 clwvd - ok
    18:31:11.0955 0x4244 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
    18:31:11.0956 0x4244 CmBatt - ok
    18:31:11.0987 0x4244 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
    18:31:11.0988 0x4244 cmdide - ok
    18:31:12.0046 0x4244 [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG C:\Windows\system32\Drivers\cng.sys
    18:31:12.0058 0x4244 CNG - ok
    18:31:12.0084 0x4244 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
    18:31:12.0085 0x4244 Compbatt - ok
    18:31:12.0094 0x4244 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
    18:31:12.0095 0x4244 CompositeBus - ok
    18:31:12.0099 0x4244 COMSysApp - ok
    18:31:12.0112 0x4244 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
    18:31:12.0114 0x4244 crcdisk - ok
    18:31:12.0157 0x4244 [ 19D511CC455C19DE1ADF60E6C39C85B6, 2A05DD5EF3D0BEC2C9F4EA186E0E2D0F7BE0BF6A473D51194B09D33773AC7FAA ] CryptSvc C:\Windows\system32\cryptsvc.dll
    18:31:12.0162 0x4244 CryptSvc - ok
    18:31:12.0204 0x4244 [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC C:\Windows\system32\drivers\csc.sys
    18:31:12.0219 0x4244 CSC - ok
    18:31:12.0300 0x4244 [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService C:\Windows\System32\cscsvc.dll
    18:31:12.0316 0x4244 CscService - ok
    18:31:12.0352 0x4244 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
    18:31:12.0369 0x4244 DcomLaunch - ok
    18:31:12.0398 0x4244 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
    18:31:12.0408 0x4244 defragsvc - ok
    18:31:12.0431 0x4244 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
    18:31:12.0434 0x4244 DfsC - ok
    18:31:12.0499 0x4244 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
    18:31:12.0507 0x4244 Dhcp - ok
    18:31:12.0526 0x4244 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
    18:31:12.0528 0x4244 discache - ok
    18:31:12.0557 0x4244 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\drivers\disk.sys
    18:31:12.0560 0x4244 Disk - ok
    18:31:12.0587 0x4244 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
    18:31:12.0594 0x4244 Dnscache - ok
    18:31:12.0620 0x4244 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
    18:31:12.0628 0x4244 dot3svc - ok
    18:31:12.0650 0x4244 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
    18:31:12.0654 0x4244 DPS - ok
    18:31:12.0699 0x4244 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
    18:31:12.0700 0x4244 drmkaud - ok
    18:31:12.0727 0x4244 [ 46571ED73AE84469DCA53081D33CF3C8, 8BB386BB4F6AD39F06A8607CD1DF3D67CFA45BBE52E40EDB90EB8C862283EBFF ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys
    18:31:12.0735 0x4244 dtsoftbus01 - ok
    18:31:12.0784 0x4244 [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
    18:31:12.0813 0x4244 DXGKrnl - ok
    18:31:12.0843 0x4244 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
    18:31:12.0848 0x4244 EapHost - ok
    18:31:12.0974 0x4244 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\drivers\evbda.sys
    18:31:13.0076 0x4244 ebdrv - ok
    18:31:13.0126 0x4244 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS C:\Windows\System32\lsass.exe
    18:31:13.0128 0x4244 EFS - ok
    18:31:13.0180 0x4244 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
    18:31:13.0202 0x4244 ehRecvr - ok
    18:31:13.0210 0x4244 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
    18:31:13.0214 0x4244 ehSched - ok
    18:31:13.0247 0x4244 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\drivers\elxstor.sys
    18:31:13.0260 0x4244 elxstor - ok
    18:31:13.0386 0x4244 [ B5581646636759D0DAFA8B008881C079, 0CADE029ABDCDE3A89C0786F1698C93D9A7CC981EFB3761CF243E19E178FF611 ] EPSON_EB_RPCV4_01 C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
    18:31:13.0391 0x4244 EPSON_EB_RPCV4_01 - ok
    18:31:13.0451 0x4244 [ 7DB097F4F6786307168C0DDDEC43A565, 963C0D3D88FB4BF9C2FBCB296B03603E2F8AA8B4E8976162842863B7538C1A9F ] EPSON_EB_RPCV4_04 C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
    18:31:13.0456 0x4244 EPSON_EB_RPCV4_04 - ok
    18:31:13.0515 0x4244 [ 1E345F2A2D95DA3190596E691CDE9342, 9D1D48F3B749ADA598D155E11E63CD52A4EEABF9BE92A1D997D25D07CF350084 ] EPSON_PM_RPCV4_01 C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
    18:31:13.0519 0x4244 EPSON_PM_RPCV4_01 - ok
    18:31:13.0527 0x4244 [ 258AA65A0862E19B7DE6981FDA3758AD, C090F19BEDC2CFB0B5265BCE48BD52102E06CBC15EEFE4CDB747D44F2E42D545 ] EPSON_PM_RPCV4_04 C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
    18:31:13.0531 0x4244 EPSON_PM_RPCV4_04 - ok
    18:31:13.0546 0x4244 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
    18:31:13.0547 0x4244 ErrDev - ok
    18:31:13.0613 0x4244 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
    18:31:13.0623 0x4244 EventSystem - ok
    18:31:13.0719 0x4244 [ 7EE9F35BC1DD0CE1A4976032F9AC5162, 31FF86DEEB57AC903A1A1CE2AD8ED161CE613527F9804F9BE31A9051399F1F47 ] EvtEng C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    18:31:13.0752 0x4244 EvtEng - ok
    18:31:13.0775 0x4244 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
    18:31:13.0780 0x4244 exfat - ok
    18:31:13.0787 0x4244 ezSharedSvc - ok
    18:31:13.0814 0x4244 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
    18:31:13.0821 0x4244 fastfat - ok
    18:31:13.0871 0x4244 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
    18:31:13.0888 0x4244 Fax - ok
    18:31:13.0899 0x4244 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\drivers\fdc.sys
    18:31:13.0900 0x4244 fdc - ok
    18:31:13.0925 0x4244 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
    18:31:13.0926 0x4244 fdPHost - ok
    18:31:13.0937 0x4244 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
    18:31:13.0939 0x4244 FDResPub - ok
    18:31:13.0967 0x4244 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
    18:31:13.0969 0x4244 FileInfo - ok
    18:31:13.0981 0x4244 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
    18:31:13.0982 0x4244 Filetrace - ok
    18:31:13.0993 0x4244 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
    18:31:13.0994 0x4244 flpydisk - ok
    18:31:14.0025 0x4244 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
    18:31:14.0032 0x4244 FltMgr - ok
    18:31:14.0083 0x4244 [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
    18:31:14.0119 0x4244 FontCache - ok
    18:31:14.0162 0x4244 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    18:31:14.0164 0x4244 FontCache3.0.0.0 - ok
    18:31:14.0213 0x4244 [ 2074A85A6B8F84A5A9C60B915B465FAF, 08848D6B5A7B9CCD3E6D4A35CCE93D32C2AE06D7D179C7B2EA9DAFC9DD91EC65 ] FPLService C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
    18:31:14.0220 0x4244 FPLService - ok
    18:31:14.0338 0x4244 [ D8D41D423B59F484FD194EC6A75CFBDD, 4F1C66FA3C7F3592150239054FD7864E2CFC42CE45A7EC980527122D1F0D3710 ] Freemake Improver C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
    18:31:14.0342 0x4244 Freemake Improver - ok
    18:31:14.0392 0x4244 [ 584EC84D175C87A58C32159BE92CA3C2, 152CDB28F0D1A83C43C51A61C5009A9353D8AF0419D82F3F52B6831BAC04E5C6 ] FreemakeVideoCapture C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
    18:31:14.0393 0x4244 FreemakeVideoCapture - ok
    18:31:14.0407 0x4244 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
    18:31:14.0410 0x4244 FsDepends - ok
    18:31:14.0422 0x4244 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
    18:31:14.0423 0x4244 Fs_Rec - ok
    18:31:14.0462 0x4244 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
    18:31:14.0469 0x4244 fvevol - ok
    18:31:14.0501 0x4244 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
    18:31:14.0503 0x4244 gagp30kx - ok
    18:31:14.0534 0x4244 GamesAppService - ok
    18:31:14.0570 0x4244 [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
    18:31:14.0572 0x4244 GEARAspiWDM - ok
    18:31:14.0610 0x4244 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
    18:31:14.0633 0x4244 gpsvc - ok
    18:31:14.0694 0x4244 [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    18:31:14.0697 0x4244 gupdate - ok
    18:31:14.0705 0x4244 [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    18:31:14.0707 0x4244 gupdatem - ok
    18:31:14.0734 0x4244 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
    18:31:14.0736 0x4244 hcw85cir - ok
    18:31:14.0768 0x4244 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
    18:31:14.0780 0x4244 HdAudAddService - ok
    18:31:14.0810 0x4244 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
    18:31:14.0814 0x4244 HDAudBus - ok
    18:31:14.0830 0x4244 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
    18:31:14.0831 0x4244 HidBatt - ok
    18:31:14.0854 0x4244 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\drivers\hidbth.sys
    18:31:14.0857 0x4244 HidBth - ok
    18:31:14.0877 0x4244 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\drivers\hidir.sys
    18:31:14.0879 0x4244 HidIr - ok
    18:31:14.0903 0x4244 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\system32\hidserv.dll
    18:31:14.0905 0x4244 hidserv - ok
    18:31:14.0929 0x4244 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
    18:31:14.0930 0x4244 HidUsb - ok
    18:31:15.0039 0x4244 [ 22A7C62798CA12548760123D1E4ED278, 821A988AAFC8528D4288FBE94B73DDFBE7B3BAA5424C4BE7F00F0E2F745C2609 ] HiPatchService C:\Program Files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe
    18:31:15.0039 0x4244 HiPatchService - ok
    18:31:15.0064 0x4244 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
    18:31:15.0067 0x4244 hkmsvc - ok
    18:31:15.0078 0x4244 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
    18:31:15.0084 0x4244 HomeGroupListener - ok
    18:31:15.0112 0x4244 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
    18:31:15.0117 0x4244 HomeGroupProvider - ok
    18:31:15.0168 0x4244 [ 45A12CACB97B4F15858FCFD59355A1E9, E4D671F1E413D1C45CC797C93FC042FEC9B0AE9F7039C82E516A410AD49100AA ] HP Health Check Service C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
    18:31:15.0171 0x4244 HP Health Check Service - ok
    18:31:15.0220 0x4244 [ 6A181452D4E240B8ECC7614B9A19BDE9, 3E458A737DA597DF007D278E9D81F2BF259AB4B97A4C188CEDAEA1F144B1074F ] HPClientSvc C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    18:31:15.0229 0x4244 HPClientSvc - ok
    18:31:15.0293 0x4244 [ E040F0064D39F73BB4995D494F3DCBB8, F13369719673DC7E533931EDD07464E03146D9C226E8399A062CF9A70F5942A7 ] hpCMSrv C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
    18:31:15.0320 0x4244 hpCMSrv - ok
    18:31:15.0355 0x4244 [ 18062DF0DCEB4ED88E03A8B161935722, 17F06672D454418D9C668094822E86D9FE1E84DAF56A449708B6A2AFD27FF4FE ] HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    18:31:15.0357 0x4244 HPDrvMntSvc.exe - ok
    18:31:15.0380 0x4244 [ A4BE23C451ADEB252CD17A0532CAE220, 612CF3B9CB11557C98DD0D036580C987E52585077529B8CBACD88778E2D8E31E ] hpdskflt C:\Windows\system32\DRIVERS\hpdskflt.sys
    18:31:15.0381 0x4244 hpdskflt - ok
    18:31:15.0414 0x4244 [ 7B1637E5E0476CE22E8D76AC1203205E, 0F087EADE0F49760450977104397D51567463A07ECE3475536885C673D289B04 ] hpqwmiex C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
    18:31:15.0428 0x4244 hpqwmiex - ok
    18:31:15.0454 0x4244 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
    18:31:15.0456 0x4244 HpSAMD - ok
    18:31:15.0474 0x4244 [ A88A45E82BC54BFFB49C63973010226A, A96FC7C9A7E71347756581C682F27ED0EB8B80FE8F5D2F83C3129EB75F9264C6 ] hpsrv C:\Windows\system32\Hpservice.exe
    18:31:15.0475 0x4244 hpsrv - ok
    18:31:15.0512 0x4244 [ F630DD7564EBB7248A13B1CC774D9EA6, 53BDFDB7177606DCBB5098A417542F181487227FB73C5C93BE1275752D2C002A ] HPWMISVC C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    18:31:15.0513 0x4244 HPWMISVC - ok
    18:31:15.0517 0x4244 HssDRV6 - ok
    18:31:15.0551 0x4244 [ F47CEC45FB85791D4AB237563AD0FA8F, 1035066D48BD179855BCA7F62EFA1B951E6E839D2E29E15A31844E18A126DD41 ] HTCAND64 C:\Windows\system32\Drivers\ANDROIDUSB.sys
    18:31:15.0553 0x4244 HTCAND64 - ok
    18:31:15.0590 0x4244 [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
    18:31:15.0614 0x4244 HTTP - ok
    18:31:15.0646 0x4244 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
    18:31:15.0647 0x4244 hwpolicy - ok
    18:31:15.0666 0x4244 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
    18:31:15.0670 0x4244 i8042prt - ok
    18:31:15.0695 0x4244 [ D469B77687E12FE43E344806740B624D, DFDD486FD040813BF4E5DDB504CF9E0BFBF6D4E540DDDA4829F9B675ACF63E89 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
    18:31:15.0703 0x4244 iaStor - ok
    18:31:15.0747 0x4244 [ 983FC69644DDF0486C8DFEA262948D1A, 329EC95117C31E61F6D22D79CFF339D70A70522710E7DC0CED06EC95E6D4B34F ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    18:31:15.0748 0x4244 IAStorDataMgrSvc - ok
    18:31:15.0779 0x4244 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
    18:31:15.0789 0x4244 iaStorV - ok
    18:31:15.0864 0x4244 [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
    18:31:15.0884 0x4244 idsvc - ok
    18:31:15.0889 0x4244 IEEtwCollectorService - ok
    18:31:15.0928 0x4244 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\drivers\iirsp.sys
    18:31:15.0930 0x4244 iirsp - ok
    18:31:15.0992 0x4244 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
    18:31:16.0019 0x4244 IKEEXT - ok
    18:31:16.0059 0x4244 [ 890144FA6AB42F2B54EE633BF96A019A, 8741904C66170BA11C78D31681E3759537C0BF2338538678BC64234DB8FDE93F ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
    18:31:16.0069 0x4244 IntcDAud - ok
    18:31:16.0090 0x4244 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
    18:31:16.0091 0x4244 intelide - ok
    18:31:16.0489 0x4244 [ 33FAA40B288002C89529DBD14F3AB72C, 670BA536796322122EBD93F256331899DD2E1834471B017A58F74132EE8DFDB7 ] intelkmd C:\Windows\system32\DRIVERS\igdpmd64.sys
    18:31:16.0879 0x4244 intelkmd - ok
    18:31:16.0917 0x4244 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
    18:31:16.0919 0x4244 intelppm - ok
    18:31:16.0948 0x4244 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
    18:31:16.0952 0x4244 IPBusEnum - ok
    18:31:16.0978 0x4244 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
    18:31:16.0981 0x4244 IpFilterDriver - ok
    18:31:17.0020 0x4244 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
    18:31:17.0034 0x4244 iphlpsvc - ok
    18:31:17.0048 0x4244 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
    18:31:17.0050 0x4244 IPMIDRV - ok
    18:31:17.0071 0x4244 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
    18:31:17.0074 0x4244 IPNAT - ok
    18:31:17.0132 0x4244 [ 0FF335D687C85097725A53458160E81E, BF8BB3C8AF1822BEB5FF5F8008614B982F277D862B16B6516CA91F73D336E9D4 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
    18:31:17.0147 0x4244 iPod Service - ok
    18:31:17.0180 0x4244 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
    18:31:17.0181 0x4244 IRENUM - ok
    18:31:17.0199 0x4244 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
    18:31:17.0200 0x4244 isapnp - ok
    18:31:17.0251 0x4244 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
    18:31:17.0258 0x4244 iScsiPrt - ok
    18:31:17.0276 0x4244 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
    18:31:17.0278 0x4244 kbdclass - ok
    18:31:17.0302 0x4244 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
    18:31:17.0304 0x4244 kbdhid - ok
    18:31:17.0326 0x4244 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso C:\Windows\system32\lsass.exe
    18:31:17.0329 0x4244 KeyIso - ok
    18:31:17.0376 0x4244 [ 353009DEDF918B2A51414F330CF72DEC,
     
  14. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Part 2
    BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
    18:31:17.0379 0x4244 KSecDD - ok
    18:31:17.0425 0x4244 [ 41774FF331F609EF442B7398EE6202B1, AD67DA06A74895C384F4A1F1CF47050DAEE9C6CE8AD12F1A116FC977B6C3A864 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
    18:31:17.0430 0x4244 KSecPkg - ok
    18:31:17.0452 0x4244 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
    18:31:17.0453 0x4244 ksthunk - ok
    18:31:17.0488 0x4244 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
    18:31:17.0500 0x4244 KtmRm - ok
    18:31:17.0539 0x4244 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\system32\srvsvc.dll
    18:31:17.0548 0x4244 LanmanServer - ok
    18:31:17.0605 0x4244 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
    18:31:17.0611 0x4244 LanmanWorkstation - ok
    18:31:17.0629 0x4244 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
    18:31:17.0631 0x4244 lltdio - ok
    18:31:17.0685 0x4244 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
    18:31:17.0695 0x4244 lltdsvc - ok
    18:31:17.0712 0x4244 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
    18:31:17.0715 0x4244 lmhosts - ok
    18:31:17.0793 0x4244 [ D7E0BED3EA21D7BDDD410ADE51708D90, 417A9A765E50ACCAE030B37F317217C9DB366BB1503A328D064A41ACDD00AFD8 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    18:31:17.0801 0x4244 LMS - ok
    18:31:17.0823 0x4244 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
    18:31:17.0827 0x4244 LSI_FC - ok
    18:31:17.0857 0x4244 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
    18:31:17.0860 0x4244 LSI_SAS - ok
    18:31:17.0876 0x4244 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
    18:31:17.0878 0x4244 LSI_SAS2 - ok
    18:31:17.0901 0x4244 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
    18:31:17.0905 0x4244 LSI_SCSI - ok
    18:31:17.0922 0x4244 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
    18:31:17.0925 0x4244 luafv - ok
    18:31:17.0975 0x4244 [ CA43F8904E24BBE49982E4C0B29E6579, 2E3E6D02980706061C478C1643F8838310DDAC573C8722AE7F3290CE36B02CB2 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
    18:31:17.0977 0x4244 MBAMProtector - ok
    18:31:18.0106 0x4244 [ 0BB29DE40C9D9529793DCDB59A43CF5B, 251001A407D32EF22F64915EEFFAAEC229073C4549BF7D9D1D4209B7D15B4681 ] MBAMScheduler C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    18:31:18.0161 0x4244 MBAMScheduler - ok
    18:31:18.0223 0x4244 [ 5F82D8188B370B0CF185D4AE2B9B4A0E, 549B53DD989A069E1C38347C4CEF5283DF9B428CE102799B06A20D3D8F23825F ] MBAMService C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    18:31:18.0248 0x4244 MBAMService - ok
    18:31:18.0285 0x4244 [ A646C2DDB8C46E9B20A326FAF566646C, F46E3BF392CB4EB53D323BC8CC41EFBB9C5D7C935FECF255F524EB18583A2A37 ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
    18:31:18.0287 0x4244 MBAMWebAccessControl - ok
    18:31:18.0315 0x4244 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
    18:31:18.0318 0x4244 Mcx2Svc - ok
    18:31:18.0341 0x4244 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\drivers\megasas.sys
    18:31:18.0342 0x4244 megasas - ok
    18:31:18.0367 0x4244 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
    18:31:18.0374 0x4244 MegaSR - ok
    18:31:18.0405 0x4244 [ CFBDB416E1DC172327C099DB122FE15D, 64A497FC8211C00BAD593C381D55F414DC7C7EB226AA9406F3C165DEF3F1243A ] MEIx64 C:\Windows\system32\DRIVERS\TeeDriverx64.sys
    18:31:18.0408 0x4244 MEIx64 - ok
    18:31:18.0448 0x4244 Microsoft SharePoint Workspace Audit Service - ok
    18:31:18.0506 0x4244 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
    18:31:18.0509 0x4244 MMCSS - ok
    18:31:18.0537 0x4244 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
    18:31:18.0539 0x4244 Modem - ok
    18:31:18.0560 0x4244 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
    18:31:18.0562 0x4244 monitor - ok
    18:31:18.0581 0x4244 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
    18:31:18.0583 0x4244 mouclass - ok
    18:31:18.0600 0x4244 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
    18:31:18.0602 0x4244 mouhid - ok
    18:31:18.0623 0x4244 [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
    18:31:18.0627 0x4244 mountmgr - ok
    18:31:18.0703 0x4244 [ B4E9C7383A705628AD491CF0F87D901F, 5C0CD7133D4F5B1E0466CDB2A2210ECA57206A8BC41F37BC6324120AE5501C70 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    18:31:18.0707 0x4244 MozillaMaintenance - ok
    18:31:18.0765 0x4244 [ 6439D1E559D08BD8A1465A8943357053, 0E300508C22D12FBA3BE566B722F574CBE1B4A1A305356B92B8EA8B86267071B ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
    18:31:18.0774 0x4244 MpFilter - ok
    18:31:18.0792 0x4244 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
    18:31:18.0796 0x4244 mpio - ok
    18:31:18.0826 0x4244 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
    18:31:18.0828 0x4244 mpsdrv - ok
    18:31:18.0872 0x4244 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
    18:31:18.0898 0x4244 MpsSvc - ok
    18:31:18.0931 0x4244 [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
    18:31:18.0936 0x4244 MRxDAV - ok
    18:31:18.0973 0x4244 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
    18:31:18.0979 0x4244 mrxsmb - ok
    18:31:19.0007 0x4244 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
    18:31:19.0016 0x4244 mrxsmb10 - ok
    18:31:19.0024 0x4244 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
    18:31:19.0028 0x4244 mrxsmb20 - ok
    18:31:19.0046 0x4244 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
    18:31:19.0047 0x4244 msahci - ok
    18:31:19.0067 0x4244 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
    18:31:19.0071 0x4244 msdsm - ok
    18:31:19.0107 0x4244 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
    18:31:19.0113 0x4244 MSDTC - ok
    18:31:19.0147 0x4244 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
    18:31:19.0148 0x4244 Msfs - ok
    18:31:19.0163 0x4244 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
    18:31:19.0164 0x4244 mshidkmdf - ok
    18:31:19.0192 0x4244 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
    18:31:19.0193 0x4244 msisadrv - ok
    18:31:19.0228 0x4244 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
    18:31:19.0233 0x4244 MSiSCSI - ok
    18:31:19.0240 0x4244 msiserver - ok
    18:31:19.0266 0x4244 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
    18:31:19.0267 0x4244 MSKSSRV - ok
    18:31:19.0349 0x4244 [ F0D5494D8B177C37E16966262F5D0F68, DD63427DFFD9DD2BEC8336F6AD1BEFE347012331631DC5FEC65E83B1EACDBC67 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
    18:31:19.0350 0x4244 MsMpSvc - ok
    18:31:19.0362 0x4244 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
    18:31:19.0363 0x4244 MSPCLOCK - ok
    18:31:19.0386 0x4244 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
    18:31:19.0387 0x4244 MSPQM - ok
    18:31:19.0421 0x4244 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
    18:31:19.0433 0x4244 MsRPC - ok
    18:31:19.0457 0x4244 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
    18:31:19.0459 0x4244 mssmbios - ok
    18:31:19.0477 0x4244 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
    18:31:19.0478 0x4244 MSTEE - ok
    18:31:19.0513 0x4244 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
    18:31:19.0514 0x4244 MTConfig - ok
    18:31:19.0531 0x4244 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
    18:31:19.0533 0x4244 Mup - ok
    18:31:19.0576 0x4244 [ 0CF5580F27918FFD2E165ECAFA734103, BDB6805A56C1ACE91B2BEE58DF8F48CE4E1B7211BB0AEF22424362F272E09351 ] MyWiFiDHCPDNS C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
    18:31:19.0587 0x4244 MyWiFiDHCPDNS - ok
    18:31:19.0631 0x4244 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
    18:31:19.0644 0x4244 napagent - ok
    18:31:19.0671 0x4244 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
    18:31:19.0679 0x4244 NativeWifiP - ok
    18:31:19.0742 0x4244 [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
    18:31:19.0768 0x4244 NDIS - ok
    18:31:19.0806 0x4244 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
    18:31:19.0807 0x4244 NdisCap - ok
    18:31:19.0827 0x4244 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
    18:31:19.0828 0x4244 NdisTapi - ok
    18:31:19.0845 0x4244 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
    18:31:19.0847 0x4244 Ndisuio - ok
    18:31:19.0871 0x4244 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
    18:31:19.0876 0x4244 NdisWan - ok
    18:31:19.0894 0x4244 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
    18:31:19.0897 0x4244 NDProxy - ok
    18:31:19.0915 0x4244 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
    18:31:19.0917 0x4244 NetBIOS - ok
    18:31:19.0933 0x4244 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
    18:31:19.0940 0x4244 NetBT - ok
    18:31:19.0960 0x4244 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon C:\Windows\system32\lsass.exe
    18:31:19.0962 0x4244 Netlogon - ok
    18:31:19.0996 0x4244 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
    18:31:20.0005 0x4244 Netman - ok
    18:31:20.0052 0x4244 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    18:31:20.0056 0x4244 NetMsmqActivator - ok
    18:31:20.0069 0x4244 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    18:31:20.0073 0x4244 NetPipeActivator - ok
    18:31:20.0119 0x4244 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
    18:31:20.0135 0x4244 netprofm - ok
    18:31:20.0162 0x4244 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    18:31:20.0165 0x4244 NetTcpActivator - ok
    18:31:20.0178 0x4244 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    18:31:20.0182 0x4244 NetTcpPortSharing - ok
    18:31:20.0575 0x4244 [ D63AC28B74EF8CB104AA5B71AD99AEAB, D1E23348D1D9759543F85019DFDDF23478FCF53D783EEEC64B994B263388AB9D ] NETwNs64 C:\Windows\system32\DRIVERS\NETwsw00.sys
    18:31:20.0959 0x4244 NETwNs64 - ok
    18:31:20.0997 0x4244 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
    18:31:20.0999 0x4244 nfrd960 - ok
    18:31:21.0066 0x4244 [ F9EEFFC65C68A45001D1349E652B8B6F, E5F223129416083A12A85D48C65B2C8D1BF1124110399938E144308C89F9241D ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
    18:31:21.0070 0x4244 NisDrv - ok
    18:31:21.0129 0x4244 [ 9690F420A99364C1E5C439914B0DE25C, 6C6E0B27C4255001FE5F1EAD911DE1A8BF922C405B0C8031A6BD253CEB1D02A6 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
    18:31:21.0137 0x4244 NisSrv - ok
    18:31:21.0244 0x4244 [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc C:\Windows\System32\nlasvc.dll
    18:31:21.0253 0x4244 NlaSvc - ok
    18:31:21.0289 0x4244 [ 351533ACC2A069B94E80BBFC177E8FDF, 54B2749E0496ECC94CE65657627762B485CBC825767BAEDDAD0D2598820FFB9E ] npf C:\Windows\system32\drivers\npf.sys
    18:31:21.0290 0x4244 npf - ok
    18:31:21.0338 0x4244 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
    18:31:21.0340 0x4244 Npfs - ok
    18:31:21.0390 0x4244 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
    18:31:21.0393 0x4244 nsi - ok
    18:31:21.0412 0x4244 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
    18:31:21.0414 0x4244 nsiproxy - ok
    18:31:21.0489 0x4244 [ 832A8C7B130DBC768275695019EAC1B5, B82502DBE450B1D21DBF9DE62308E3154F00A522F451087B0701FD82645E8510 ] nsService C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe
    18:31:21.0497 0x4244 nsService - ok
    18:31:21.0594 0x4244 [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
    18:31:21.0633 0x4244 Ntfs - ok
    18:31:21.0651 0x4244 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
    18:31:21.0652 0x4244 Null - ok
    18:31:21.0674 0x4244 [ B01C1E6D7477961D6D1CBDCD44AF3E67, 407BD335FE7C87DFBD9EDE49BDD828263D8C8D25C8216FF04AC70320E74AE8B6 ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
    18:31:21.0678 0x4244 nusb3hub - ok
    18:31:21.0713 0x4244 [ 796BAE22DD827DB8AD7AE7C3F775E92F, D26C921679888D90EEC6FBFDF3884FF151E4C28FD3920CE7F3AB58A8EEF3845E ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
    18:31:21.0720 0x4244 nusb3xhc - ok
    18:31:21.0761 0x4244 [ A85B4F2EF3A7304A5399EF0526423040, E45854691BA6AE36E53C2922CC93FF13DC2D84CBE7FE13A2F0B1CE1C16D1D158 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys
    18:31:21.0773 0x4244 NVENETFD - ok
    18:31:21.0810 0x4244 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
    18:31:21.0815 0x4244 nvraid - ok
    18:31:21.0831 0x4244 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
    18:31:21.0836 0x4244 nvstor - ok
    18:31:21.0860 0x4244 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
    18:31:21.0864 0x4244 nv_agp - ok
    18:31:21.0889 0x4244 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
    18:31:21.0892 0x4244 ohci1394 - ok
    18:31:21.0945 0x4244 [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    18:31:21.0949 0x4244 ose - ok
    18:31:22.0154 0x4244 [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    18:31:22.0319 0x4244 osppsvc - ok
    18:31:22.0378 0x4244 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
    18:31:22.0388 0x4244 p2pimsvc - ok
    18:31:22.0406 0x4244 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
    18:31:22.0416 0x4244 p2psvc - ok
    18:31:22.0443 0x4244 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\drivers\parport.sys
    18:31:22.0446 0x4244 Parport - ok
    18:31:22.0477 0x4244 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
    18:31:22.0479 0x4244 partmgr - ok
    18:31:22.0518 0x4244 [ 256390425414F90FCBC12F525A84EB11, A4992020BF6A239AD8A77125426E2C39980C9ABC971C4DBCB24B358F946AD7F9 ] PcaSvc C:\Windows\System32\pcasvc.dll
    18:31:22.0524 0x4244 PcaSvc - ok
    18:31:22.0559 0x4244 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
    18:31:22.0564 0x4244 pci - ok
    18:31:22.0592 0x4244 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
    18:31:22.0593 0x4244 pciide - ok
    18:31:22.0637 0x4244 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
    18:31:22.0644 0x4244 pcmcia - ok
    18:31:22.0668 0x4244 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
    18:31:22.0670 0x4244 pcw - ok
    18:31:22.0738 0x4244 [ 946010CDFA91469351B22E2620CEBCD8, F099C92706D42ADC289B72724F7932E5D4F62A427AEC967DDB0A1D728AE59A63 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
    18:31:22.0757 0x4244 PEAUTH - ok
    18:31:22.0838 0x4244 [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
    18:31:22.0870 0x4244 PeerDistSvc - ok
    18:31:22.0946 0x4244 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ]
    PerfHost C:\Windows\SysWow64\perfhost.exe
    18:31:22.0948 0x4244 PerfHost - ok
    18:31:23.0015 0x4244 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
    18:31:23.0047 0x4244 pla - ok
    18:31:23.0092 0x4244 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
    18:31:23.0102 0x4244 PlugPlay - ok
    18:31:23.0126 0x4244 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
    18:31:23.0128 0x4244 PNRPAutoReg - ok
    18:31:23.0154 0x4244 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
    18:31:23.0162 0x4244 PNRPsvc - ok
    18:31:23.0253 0x4244 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
    18:31:23.0279 0x4244 PolicyAgent - ok
    18:31:23.0324 0x4244 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
    18:31:23.0346 0x4244 Power - ok
    18:31:23.0387 0x4244 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
    18:31:23.0391 0x4244 PptpMiniport - ok
    18:31:23.0426 0x4244 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\drivers\processr.sys
    18:31:23.0428 0x4244 Processor - ok
    18:31:23.0495 0x4244 [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc C:\Windows\system32\profsvc.dll
    18:31:23.0502 0x4244 ProfSvc - ok
    18:31:23.0526 0x4244 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
    18:31:23.0528 0x4244 ProtectedStorage - ok
    18:31:23.0579 0x4244 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
    18:31:23.0583 0x4244 Psched - ok
    18:31:23.0662 0x4244 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
    18:31:23.0705 0x4244 ql2300 - ok
    18:31:23.0732 0x4244 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
    18:31:23.0735 0x4244 ql40xx - ok
    18:31:23.0781 0x4244 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
    18:31:23.0789 0x4244 QWAVE - ok
    18:31:23.0814 0x4244 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
    18:31:23.0816 0x4244 QWAVEdrv - ok
    18:31:23.0839 0x4244 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
    18:31:23.0840 0x4244 RasAcd - ok
    18:31:23.0860 0x4244 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
    18:31:23.0862 0x4244 RasAgileVpn - ok
    18:31:23.0890 0x4244 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
    18:31:23.0896 0x4244 RasAuto - ok
    18:31:23.0928 0x4244 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
    18:31:23.0932 0x4244 Rasl2tp - ok
    18:31:23.0966 0x4244 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
    18:31:23.0977 0x4244 RasMan - ok
    18:31:23.0986 0x4244 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
    18:31:23.0988 0x4244 RasPppoe - ok
    18:31:24.0000 0x4244 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
    18:31:24.0003 0x4244 RasSstp - ok
    18:31:24.0033 0x4244 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
    18:31:24.0041 0x4244 rdbss - ok
    18:31:24.0065 0x4244 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
    18:31:24.0066 0x4244 rdpbus - ok
    18:31:24.0088 0x4244 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
    18:31:24.0089 0x4244 RDPCDD - ok
    18:31:24.0131 0x4244 [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
    18:31:24.0135 0x4244 RDPDR - ok
    18:31:24.0155 0x4244 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
    18:31:24.0156 0x4244 RDPENCDD - ok
    18:31:24.0180 0x4244 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
    18:31:24.0181 0x4244 RDPREFMP - ok
    18:31:24.0265 0x4244 [ 70CBA1A0C98600A2AA1863479B35CB90, 91A133297921B4955817176251AFC5283DA3C7D2099700C4C92ECC94DBE9A99E ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
    18:31:24.0267 0x4244 RdpVideoMiniport - ok
    18:31:24.0309 0x4244 [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
    18:31:24.0314 0x4244 RDPWD - ok
    18:31:24.0342 0x4244 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
    18:31:24.0349 0x4244 rdyboost - ok
    18:31:24.0462 0x4244 [ 590DE2C0FF4E367050239BD1DDC912C1, B8D1D01C276C15EDA5B6BE5F1FD16315063D1C9BA6D22D51AED51FC93D417A17 ] RealNetworks Downloader Resolver Service C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
    18:31:24.0463 0x4244 RealNetworks Downloader Resolver Service - ok
    18:31:24.0668 0x4244 [ AC36A47C010100B7EDFB2A70114D3E89, 3051841EB4FC8A9CDA5B1B9168D459A639F7E588E859F51D6B865CD073CFCE13 ] RealPlayer Cloud Service c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
    18:31:24.0697 0x4244 RealPlayer Cloud Service - ok
    18:31:24.0791 0x4244 [ A650FA927A4D1D71C53E317A0DDD6B7E, F1D476213CE15E0060440CDBF36806649F172408EC0977A35AEE67F30C43B15A ] RealPlayerUpdateSvc C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
    18:31:24.0792 0x4244 RealPlayerUpdateSvc - ok
    18:31:24.0878 0x4244 [ AA9FD849C028CCB441A78061B57DB734, 5D6E8A0BEF94C2AA4B634A754BF29F93B9A5D2B02E9376CFB8BF4152EA480193 ] RegSrvc C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    18:31:24.0893 0x4244 RegSrvc - ok
    18:31:24.0929 0x4244 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
    18:31:24.0935 0x4244 RemoteAccess - ok
    18:31:24.0958 0x4244 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
    18:31:24.0963 0x4244 RemoteRegistry - ok
    18:31:25.0000 0x4244 [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
    18:31:25.0006 0x4244 RFCOMM - ok
    18:31:25.0049 0x4244 [ 085D18C71AB2611A3D61528132B6501E, 2AD2DD88EBD8C498E3043CDAA37E83C69F7FE2FD6B65524F631527555B80C112 ] RoxioNow Service C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
    18:31:25.0056 0x4244 RoxioNow Service - ok
    18:31:25.0077 0x4244 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
    18:31:25.0080 0x4244 RpcEptMapper - ok
    18:31:25.0096 0x4244 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
    18:31:25.0097 0x4244 RpcLocator - ok
    18:31:25.0128 0x4244 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
    18:31:25.0139 0x4244 RpcSs - ok
    18:31:25.0180 0x4244 [ D23399622ED6692BF6AA1D30322345FC, 94A1C61159AC745A58E0C9C1D79BFB7E5278E0FED5E710965369C41D30EB51AF ] RSPCIESTOR C:\Windows\system32\DRIVERS\RtsPStor.sys
    18:31:25.0190 0x4244 RSPCIESTOR - ok
    18:31:25.0225 0x4244 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
    18:31:25.0228 0x4244 rspndr - ok
    18:31:25.0283 0x4244 [ 130DD683DCC902F47A4AC35201D07E2F, A1E7082D93C170CF5855007B26F96E8F8183B15126D34A9DB16CBF190BD8EF53 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
    18:31:25.0303 0x4244 RTL8167 - ok
    18:31:25.0459 0x4244 [ E4E034F79D88B34C5B4BA28BAE2259F7, A48E0ACFE75F92793E1961D108242A0B6B890ED8541757B7BF7EAAC1D6E963C1 ] RzKLService C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
    18:31:25.0462 0x4244 RzKLService - ok
    18:31:25.0483 0x4244 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs C:\Windows\system32\lsass.exe
    18:31:25.0485 0x4244 SamSs - ok
    18:31:25.0507 0x4244 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
    18:31:25.0510 0x4244 sbp2port - ok
    18:31:25.0547 0x4244 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
    18:31:25.0552 0x4244 SCardSvr - ok
    18:31:25.0580 0x4244 [ E25632DF954CE70928946BB36F829CF4, A0017814796AC42F159F73A3441A5BDD54F113EDD537EE16194BCE0E759651F3 ] SCDEmu C:\Windows\system32\drivers\SCDEmu.sys
    18:31:25.0583 0x4244 SCDEmu - ok
    18:31:25.0610 0x4244 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
    18:31:25.0612 0x4244 scfilter - ok
    18:31:25.0677 0x4244 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
    18:31:25.0713 0x4244 Schedule - ok
    18:31:25.0747 0x4244 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
    18:31:25.0749 0x4244 SCPolicySvc - ok
    18:31:25.0799 0x4244 [ 8B56BDCE6A303DDE63D63440D1CF9AD1, 66A4356C29D00A1B8A95975C073AE4E6D2A90CBF3B143FE9B83B96BEC0805D46 ] ScreamBAudioSvc C:\Windows\system32\drivers\ScreamingBAudio64.sys
    18:31:25.0801 0x4244 ScreamBAudioSvc - ok
    18:31:25.0833 0x4244 [ 111E0EBC0AD79CB0FA014B907B231CF0, B7D43D156C2524938503CF8E99C4D1F7A5C55E16C0368F57F4CD23C6D833B38F ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys
    18:31:25.0837 0x4244 sdbus - ok
    18:31:25.0870 0x4244 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
    18:31:25.0877 0x4244 SDRSVC - ok
    18:31:25.0930 0x4244 [ CC781378E7EDA615D2CDCA3B17829FA4, 137BF83A2A3D69335AD031B8D73473526F782CB8917A34B3CD92F923E7660F2A ] SeaPort C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    18:31:25.0935 0x4244 SeaPort - ok
    18:31:25.0951 0x4244 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
    18:31:25.0953 0x4244 secdrv - ok
    18:31:25.0979 0x4244 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
    18:31:25.0982 0x4244 seclogon - ok
    18:31:25.0997 0x4244 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\System32\sens.dll
    18:31:26.0000 0x4244 SENS - ok
    18:31:26.0008 0x4244 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
    18:31:26.0011 0x4244 SensrSvc - ok
    18:31:26.0034 0x4244 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\drivers\serenum.sys
    18:31:26.0036 0x4244 Serenum - ok
    18:31:26.0062 0x4244 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\drivers\serial.sys
    18:31:26.0064 0x4244 Serial - ok
    18:31:26.0085 0x4244 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\drivers\sermouse.sys
    18:31:26.0087 0x4244 sermouse - ok
    18:31:26.0137 0x4244 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
    18:31:26.0141 0x4244 SessionEnv - ok
    18:31:26.0165 0x4244 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
    18:31:26.0166 0x4244 sffdisk - ok
    18:31:26.0204 0x4244 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
    18:31:26.0205 0x4244 sffp_mmc - ok
    18:31:26.0228 0x4244 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
    18:31:26.0230 0x4244 sffp_sd - ok
    18:31:26.0267 0x4244 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
    18:31:26.0269 0x4244 sfloppy - ok
    18:31:26.0336 0x4244 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
    18:31:26.0348 0x4244 SharedAccess - ok
    18:31:26.0436 0x4244 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
    18:31:26.0449 0x4244 ShellHWDetection - ok
    18:31:26.0470 0x4244 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
    18:31:26.0471 0x4244 SiSRaid2 - ok
    18:31:26.0508 0x4244 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
    18:31:26.0511 0x4244 SiSRaid4 - ok
    18:31:26.0595 0x4244 [ F6EF225A23D336CA30001E5007644C24, B0A4B1256C1074F1B4F73E3BBA16FD4683D6EEA583DEEF8E11EFD29BA7541F2A ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
    18:31:26.0604 0x4244 SkypeUpdate - ok
    18:31:26.0641 0x4244 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
    18:31:26.0644 0x4244 Smb - ok
    18:31:26.0687 0x4244 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
    18:31:26.0689 0x4244 SNMPTRAP - ok
    18:31:26.0739 0x4244 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
    18:31:26.0740 0x4244 spldr - ok
    18:31:26.0787 0x4244 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
    18:31:26.0802 0x4244 Spooler - ok
    18:31:26.0944 0x4244 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
    18:31:27.0047 0x4244 sppsvc - ok
    18:31:27.0094 0x4244 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
    18:31:27.0098 0x4244 sppuinotify - ok
    18:31:27.0129 0x4244 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
    18:31:27.0140 0x4244 srv - ok
    18:31:27.0159 0x4244 [ B4ADEBBF5E3677CCE9651E0F01F7CC28,
     
  15. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Part 3
    726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
    18:31:27.0171 0x4244 srv2 - ok
    18:31:27.0254 0x4244 [ 0C4540311E11664B245A263E1154CEF8, 63376322BFFAFF2F166AF3FDD3F1A346C21FAE21F406F659F8630779D1D6525D ] SrvHsfHDA C:\Windows\system32\DRIVERS\VSTAZL6.SYS
    18:31:27.0263 0x4244 SrvHsfHDA - ok
    18:31:27.0342 0x4244 [ 02071D207A9858FBE3A48CBFD59C4A04, FEA4DEBAEC3465E0C7C1E8B721805922F6BBCB96A60A193B11688F4252F4B89E ] SrvHsfV92 C:\Windows\system32\DRIVERS\VSTDPV6.SYS
    18:31:27.0380 0x4244 SrvHsfV92 - ok
    18:31:27.0457 0x4244 [ 18E40C245DBFAF36FD0134A7EF2DF396, 0138A68958112101A5D3BD94114F320CE80B0C9A93E009AC78DE7415FCCC7DE7 ] SrvHsfWinac C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
    18:31:27.0477 0x4244 SrvHsfWinac - ok
    18:31:27.0515 0x4244 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
    18:31:27.0520 0x4244 srvnet - ok
    18:31:27.0579 0x4244 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
    18:31:27.0587 0x4244 SSDPSRV - ok
    18:31:27.0610 0x4244 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
    18:31:27.0613 0x4244 SstpSvc - ok
    18:31:27.0682 0x4244 [ 86678C2F5081FEA3517D78E92230B5FF, DE0847F8DDBA385661919978946DC70D77F77B48224FA4E7288BB208EF00AEE1 ] STacSV C:\Program Files\IDT\WDM\STacSV64.exe
    18:31:27.0691 0x4244 STacSV - ok
    18:31:27.0803 0x4244 [ CC7ED069C2FC82B5B1555C2044C765CC, CE43363544A3EE2C5133CD0D47BF34AFAFA4EAD6AC9EB9A772EE55E89D4D89D4 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    18:31:27.0823 0x4244 Steam Client Service - ok
    18:31:27.0855 0x4244 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\drivers\stexstor.sys
    18:31:27.0856 0x4244 stexstor - ok
    18:31:27.0898 0x4244 [ 74387B34B43F94E380608888C56A5CCD, CC8634C9EC09D9664F7371F8B62E596CF6D7AC593D7E452D4371D1AD6D1C2441 ] STHDA C:\Windows\system32\DRIVERS\stwrt64.sys
    18:31:27.0910 0x4244 STHDA - ok
    18:31:27.0960 0x4244 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
    18:31:27.0980 0x4244 stisvc - ok
    18:31:27.0999 0x4244 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
    18:31:28.0000 0x4244 swenum - ok
    18:31:28.0079 0x4244 [ F577910A133A592234EBAAD3F3AFA258, 36F514740EE2D2B2F7ABFFFA13D575233EC4CE774EB58BF889C09930FEF1F443 ] SwitchBoard C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    18:31:28.0094 0x4244 SwitchBoard - ok
    18:31:28.0146 0x4244 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
    18:31:28.0164 0x4244 swprv - ok
    18:31:28.0173 0x4244 Synth3dVsc - ok
    18:31:28.0248 0x4244 [ 33E6A285DAA5134D8EA2247914C86C09, 927A99CB3598F6F8F52ADDE125B72AFF011CBEC8F2EC0BC3569ED3899C4FBFC9 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
    18:31:28.0285 0x4244 SynTP - ok
    18:31:28.0370 0x4244 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
    18:31:28.0421 0x4244 SysMain - ok
    18:31:28.0447 0x4244 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
    18:31:28.0451 0x4244 TabletInputService - ok
    18:31:28.0496 0x4244 [ F33FDC72298DF4BF9813A55D21F4EB31, 34AADF5115CA1B275FEF4238B420FE424F0E1D0FFD1606B24A0D594D7305CF1F ] taphss C:\Windows\system32\DRIVERS\taphss.sys
    18:31:28.0498 0x4244 taphss - ok
    18:31:28.0530 0x4244 [ BD06799129D17F9BE08E2F6C168BBCF0, B115A49B14E241B4CE03274878A7ACFA9004603A08BD265BD7F75424E5FBB8F4 ] taphss6 C:\Windows\system32\DRIVERS\taphss6.sys
    18:31:28.0532 0x4244 taphss6 - ok
    18:31:28.0580 0x4244 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
    18:31:28.0591 0x4244 TapiSrv - ok
    18:31:28.0608 0x4244 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
    18:31:28.0612 0x4244 TBS - ok
    18:31:28.0702 0x4244 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
    18:31:28.0749 0x4244 Tcpip - ok
    18:31:28.0813 0x4244 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
    18:31:28.0850 0x4244 TCPIP6 - ok
    18:31:28.0888 0x4244 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
    18:31:28.0890 0x4244 tcpipreg - ok
    18:31:28.0940 0x4244 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
    18:31:28.0941 0x4244 TDPIPE - ok
    18:31:28.0971 0x4244 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
    18:31:28.0973 0x4244 TDTCP - ok
    18:31:29.0016 0x4244 [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx C:\Windows\system32\DRIVERS\tdx.sys
    18:31:29.0020 0x4244 tdx - ok
    18:31:29.0058 0x4244 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
    18:31:29.0060 0x4244 TermDD - ok
    18:31:29.0107 0x4244 [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\Windows\System32\termsrv.dll
    18:31:29.0123 0x4244 TermService - ok
    18:31:29.0170 0x4244 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
    18:31:29.0174 0x4244 Themes - ok
    18:31:29.0207 0x4244 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
    18:31:29.0210 0x4244 THREADORDER - ok
    18:31:29.0252 0x4244 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
    18:31:29.0257 0x4244 TrkWks - ok
    18:31:29.0341 0x4244 [ FD44FA80DA03EA144153A76DEBBB61B4, 0C46717F489A415A583470DAE8CF58E47BC307B9CB0F9DB6C4EDF33B7525475C ] TrueSight C:\Windows\System32\drivers\TrueSight.sys
    18:31:29.0343 0x4244 TrueSight - ok
    18:31:29.0408 0x4244 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
    18:31:29.0414 0x4244 TrustedInstaller - ok
    18:31:29.0477 0x4244 [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
    18:31:29.0479 0x4244 tssecsrv - ok
    18:31:29.0503 0x4244 [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
    18:31:29.0505 0x4244 TsUsbFlt - ok
    18:31:29.0540 0x4244 [ 9CC2CCAE8A84820EAECB886D477CBCB8, 50D8AA2D7477A6618A0C31BB4D1C4887B457865FB1105E2E7B984EEFA337B804 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
    18:31:29.0541 0x4244 TsUsbGD - ok
    18:31:29.0552 0x4244 tsusbhub - ok
    18:31:29.0578 0x4244 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
    18:31:29.0581 0x4244 tunnel - ok
    18:31:29.0607 0x4244 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
    18:31:29.0609 0x4244 uagp35 - ok
    18:31:29.0638 0x4244 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
    18:31:29.0646 0x4244 udfs - ok
    18:31:29.0694 0x4244 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
    18:31:29.0697 0x4244 UI0Detect - ok
    18:31:29.0726 0x4244 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
    18:31:29.0729 0x4244 uliagpkx - ok
    18:31:29.0756 0x4244 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\DRIVERS\umbus.sys
    18:31:29.0758 0x4244 umbus - ok
    18:31:29.0774 0x4244 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\drivers\umpass.sys
    18:31:29.0775 0x4244 UmPass - ok
    18:31:29.0811 0x4244 [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService C:\Windows\System32\umrdp.dll
    18:31:29.0819 0x4244 UmRdpService - ok
    18:31:29.0973 0x4244 [ A678E5DDD974903DD71F503BDCACA218, E8ECF79B78CF777066FF31847959A70773665ED2DAAF942B8A1C54BA56F330BA ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    18:31:30.0036 0x4244 UNS - ok
    18:31:30.0072 0x4244 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
    18:31:30.0081 0x4244 upnphost - ok
    18:31:30.0129 0x4244 [ C9E9D59C0099A9FF51697E9306A44240, 78D9A7A5E5742962B6978F475BF06CB32262F1D214699D3D40538476A58012A1 ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
    18:31:30.0131 0x4244 USBAAPL64 - ok
    18:31:30.0166 0x4244 [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
    18:31:30.0169 0x4244 usbaudio - ok
    18:31:30.0217 0x4244 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
    18:31:30.0220 0x4244 usbccgp - ok
    18:31:30.0277 0x4244 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
    18:31:30.0280 0x4244 usbcir - ok
    18:31:30.0351 0x4244 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
    18:31:30.0354 0x4244 usbehci - ok
    18:31:30.0391 0x4244 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
    18:31:30.0402 0x4244 usbhub - ok
    18:31:30.0426 0x4244 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
    18:31:30.0427 0x4244 usbohci - ok
    18:31:30.0459 0x4244 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
    18:31:30.0461 0x4244 usbprint - ok
    18:31:30.0496 0x4244 [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
    18:31:30.0498 0x4244 usbscan - ok
    18:31:30.0531 0x4244 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
    18:31:30.0534 0x4244 USBSTOR - ok
    18:31:30.0578 0x4244 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
    18:31:30.0580 0x4244 usbuhci - ok
    18:31:30.0606 0x4244 [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
    18:31:30.0611 0x4244 usbvideo - ok
    18:31:30.0666 0x4244 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
    18:31:30.0668 0x4244 UxSms - ok
    18:31:30.0694 0x4244 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc C:\Windows\system32\lsass.exe
    18:31:30.0696 0x4244 VaultSvc - ok
    18:31:30.0851 0x4244 [ C83D714B7CA4286515B5954B8F8C3C1F, 16361618FED74DEA20D8758F2ABC20F39C203E2C2406064981E8617B0D028EC2 ] VBoxDrv C:\Program Files (x86)\YouWave Android\vb\VBoxDrv.sys
    18:31:30.0856 0x4244 VBoxDrv - ok
    18:31:30.0881 0x4244 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
    18:31:30.0883 0x4244 vdrvroot - ok
    18:31:30.0928 0x4244 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
    18:31:30.0942 0x4244 vds - ok
    18:31:30.0968 0x4244 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
    18:31:30.0970 0x4244 vga - ok
    18:31:30.0989 0x4244 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
    18:31:30.0990 0x4244 VgaSave - ok
    18:31:31.0003 0x4244 VGPU - ok
    18:31:31.0031 0x4244 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
    18:31:31.0037 0x4244 vhdmp - ok
    18:31:31.0073 0x4244 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
    18:31:31.0075 0x4244 viaide - ok
    18:31:31.0105 0x4244 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
    18:31:31.0107 0x4244 volmgr - ok
    18:31:31.0127 0x4244 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
    18:31:31.0135 0x4244 volmgrx - ok
    18:31:31.0151 0x4244 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
    18:31:31.0158 0x4244 volsnap - ok
    18:31:31.0186 0x4244 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
    18:31:31.0191 0x4244 vsmraid - ok
    18:31:31.0279 0x4244 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
    18:31:31.0325 0x4244 VSS - ok
    18:31:31.0347 0x4244 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
    18:31:31.0348 0x4244 vwifibus - ok
    18:31:31.0368 0x4244 [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
    18:31:31.0370 0x4244 vwififlt - ok
    18:31:31.0393 0x4244 [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
    18:31:31.0394 0x4244 vwifimp - ok
    18:31:31.0431 0x4244 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
    18:31:31.0441 0x4244 W32Time - ok
    18:31:31.0473 0x4244 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
    18:31:31.0475 0x4244 WacomPen - ok
    18:31:31.0504 0x4244 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
    18:31:31.0507 0x4244 WANARP - ok
    18:31:31.0521 0x4244 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
    18:31:31.0523 0x4244 Wanarpv6 - ok
    18:31:31.0607 0x4244 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
    18:31:31.0637 0x4244 WatAdminSvc - ok
    18:31:31.0717 0x4244 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
    18:31:31.0762 0x4244 wbengine - ok
    18:31:31.0800 0x4244 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
    18:31:31.0806 0x4244 WbioSrvc - ok
    18:31:31.0842 0x4244 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
    18:31:31.0856 0x4244 wcncsvc - ok
    18:31:31.0869 0x4244 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
    18:31:31.0873 0x4244 WcsPlugInService - ok
    18:31:31.0901 0x4244 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\drivers\wd.sys
    18:31:31.0903 0x4244 Wd - ok
    18:31:31.0937 0x4244 [ A3D04EBF5227886029B4532F20D026F7, D90F7B9C176008675DA0B5FD7E4973CBC2A04172CEDF8FB7D3B3B4F27B5440D7 ] WDC_SAM C:\Windows\system32\DRIVERS\wdcsam64.sys
    18:31:31.0939 0x4244 WDC_SAM - ok
    18:31:32.0013 0x4244 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
    18:31:32.0033 0x4244 Wdf01000 - ok
    18:31:32.0054 0x4244 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
    18:31:32.0058 0x4244 WdiServiceHost - ok
    18:31:32.0076 0x4244 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
    18:31:32.0080 0x4244 WdiSystemHost - ok
    18:31:32.0123 0x4244 [ 5E1640435DD54D00451156CA5340B109, 414044DAA1ACA5161CEF9D48F9796B1C10E350C187A1CE0703E432E9D6248259 ] wdkmd C:\Windows\system32\DRIVERS\WDKMD.sys
    18:31:32.0125 0x4244 wdkmd - ok
    18:31:32.0151 0x4244 [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
    18:31:32.0160 0x4244 WebClient - ok
    18:31:32.0200 0x4244 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
    18:31:32.0209 0x4244 Wecsvc - ok
    18:31:32.0255 0x4244 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
    18:31:32.0260 0x4244 wercplsupport - ok
    18:31:32.0292 0x4244 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
    18:31:32.0297 0x4244 WerSvc - ok
    18:31:32.0320 0x4244 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
    18:31:32.0321 0x4244 WfpLwf - ok
    18:31:32.0338 0x4244 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
    18:31:32.0339 0x4244 WIMMount - ok
    18:31:32.0369 0x4244 WinDefend - ok
    18:31:32.0425 0x4244 WinHttpAutoProxySvc - ok
    18:31:32.0486 0x4244 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
    18:31:32.0492 0x4244 Winmgmt - ok
    18:31:32.0604 0x4244 [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM C:\Windows\system32\WsmSvc.dll
    18:31:32.0656 0x4244 WinRM - ok
    18:31:32.0733 0x4244 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUSB.sys
    18:31:32.0734 0x4244 WinUsb - ok
    18:31:32.0798 0x4244 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
    18:31:32.0820 0x4244 Wlansvc - ok
    18:31:32.0892 0x4244 [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
    18:31:32.0895 0x4244 wlcrasvc - ok
    18:31:33.0030 0x4244 [ 7E47C328FC4768CB8BEAFBCFAFA70362, C98BD6A0C2F70E069D5FD3BAB31BD028DFEAC0490D180BBC28A14BE375897D8C ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    18:31:33.0076 0x4244 wlidsvc - ok
    18:31:33.0094 0x4244 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
    18:31:33.0095 0x4244 WmiAcpi - ok
    18:31:33.0168 0x4244 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
    18:31:33.0173 0x4244 wmiApSrv - ok
    18:31:33.0200 0x4244 WMPNetworkSvc - ok
    18:31:33.0256 0x4244 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
    18:31:33.0259 0x4244 WPCSvc - ok
    18:31:33.0283 0x4244 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
    18:31:33.0287 0x4244 WPDBusEnum - ok
    18:31:33.0313 0x4244 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
    18:31:33.0315 0x4244 ws2ifsl - ok
    18:31:33.0342 0x4244 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\System32\wscsvc.dll
    18:31:33.0347 0x4244 wscsvc - ok
    18:31:33.0357 0x4244 WSearch - ok
    18:31:33.0493 0x4244 [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv C:\Windows\system32\wuaueng.dll
    18:31:33.0551 0x4244 wuauserv - ok
    18:31:33.0583 0x4244 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
    18:31:33.0586 0x4244 WudfPf - ok
    18:31:33.0617 0x4244 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
    18:31:33.0623 0x4244 WUDFRd - ok
    18:31:33.0646 0x4244 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
    18:31:33.0651 0x4244 wudfsvc - ok
    18:31:33.0710 0x4244 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
    18:31:33.0718 0x4244 WwanSvc - ok
    18:31:33.0814 0x4244 ================ Scan global ===============================
    18:31:33.0851 0x4244 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
    18:31:33.0877 0x4244 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
    18:31:33.0892 0x4244 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
    18:31:33.0924 0x4244 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
    18:31:33.0948 0x4244 [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
    18:31:33.0957 0x4244 [ Global ] - ok
    18:31:33.0958 0x4244 ================ Scan MBR ==================================
    18:31:33.0972 0x4244 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
    18:31:34.0248 0x4244 \Device\Harddisk0\DR0 - ok
    18:31:34.0249 0x4244 ================ Scan VBR ==================================
    18:31:34.0251 0x4244 [ 6D079939C5BF586C69D342F748FBAF86 ] \Device\Harddisk0\DR0\Partition1
    18:31:34.0252 0x4244 \Device\Harddisk0\DR0\Partition1 - ok
    18:31:34.0284 0x4244 [ FD937509E00AA2E10532A02A25452096 ] \Device\Harddisk0\DR0\Partition2
    18:31:34.0286 0x4244 \Device\Harddisk0\DR0\Partition2 - ok
    18:31:34.0318 0x4244 [ E5DB5A570E1206930C6602DDFB9284AE ] \Device\Harddisk0\DR0\Partition3
    18:31:34.0319 0x4244 \Device\Harddisk0\DR0\Partition3 - ok
    18:31:34.0361 0x4244 [ 15B4EBD4952CE18FB6999A5391F8E0F5 ] \Device\Harddisk0\DR0\Partition4
    18:31:34.0362 0x4244 \Device\Harddisk0\DR0\Partition4 - ok
    18:31:34.0362 0x4244 ================ Scan generic autorun ======================
    18:31:34.0478 0x4244 [ 5C430B3C872BD82E728ABB8C1821689F, 4FE6F0DF0F34F55F2C155B79CC09F2890DC903A7351968E2E60271E629E16E48 ] C:\Program Files\IDT\WDM\sttray64.exe
    18:31:34.0504 0x4244 SysTrayApp - ok
    18:31:34.0505 0x4244 SynTPEnh - ok
    18:31:34.0546 0x4244 [ 7CA105C4CCDFCA407859B2DF3D05A645, 36EEE251B2A221F1974A5BE3A743135EB317FF95A32A8B31DA3791573DB7D6BE ] C:\Windows\system32\igfxpers.exe
    18:31:34.0557 0x4244 Persistence - ok
    18:31:34.0649 0x4244 [ A6AAD37CDCAE75CB62D039E3A4D8F5E3, 4FF763B0D129175BA1B1E794BA313E6C63F7A89D377C786BF5E730AF2A1D95D1 ] c:\Program Files\Microsoft Security Client\msseces.exe
    18:31:34.0675 0x4244 MSC - ok
    18:31:34.0745 0x4244 [ D26F58CAD288E92A45A0F8517179B6A4, 50CD7E8CB80224D187ED8CDEA800FC964631DEA45616F1B53624D632DB1A9A55 ] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    18:31:34.0787 0x4244 IntelWireless - ok
    18:31:34.0817 0x4244 [ 31F52459AA89317FFB57EBAF9B4DD8BC, 05DA7048451BEF06B059A86D7FB3084942724F3359BD67A0DFADFB3FFFF6990A ] C:\Windows\system32\igfxtray.exe
    18:31:34.0821 0x4244 IgfxTray - ok
    18:31:34.0847 0x4244 [ 39AC970429FB9E56A29655FA8B959E90, 7272BD9AB1D7D84F352C6A48A4E83D34F0AE456A3404362DCCB04BC2D7D4D564 ] C:\Windows\system32\hkcmd.exe
    18:31:34.0857 0x4244 HotKeysCmds - ok
    18:31:34.0929 0x4244 [ 320681DF28D82CDCA7E3EED0846625DB, 7F709ADFB0FE36BEC857A928E9CB29BB5B6C0BAD98824D0302C7BB7185100CB9 ] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
    18:31:34.0941 0x4244 AdobeAAMUpdater-1.0 - ok
    18:31:35.0028 0x4244 [ DD79A6B15C2F28DE98DF4852AAF6B13B, 0F7E9023E0BA4B40E2DE9A9FA34E85FEAF72B93049AAB3E1D73AD046BB113E05 ] C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe
    18:31:35.0029 0x4244 NCPluginUpdater - ok
    18:31:35.0066 0x4244 [ F577910A133A592234EBAAD3F3AFA258, 36F514740EE2D2B2F7ABFFFA13D575233EC4CE774EB58BF889C09930FEF1F443 ] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    18:31:35.0075 0x4244 SwitchBoard - ok
    18:31:35.0125 0x4244 [ 14D6542607ACD4B2D1DDB1A36E0D8813, 3A270600549E8E7988D5AF3486C0F504269B9573393D87BF87BDB2287BF007B2 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    18:31:35.0132 0x4244 SunJavaUpdateSched - ok
    18:31:35.0202 0x4244 [ A0C65EA48C515771F29915C221E51908, 0F95F30A4A5393BA0F116CB70F5ED7ABA223F1D05718AD0F3AD6025D74B0675E ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    18:31:35.0210 0x4244 StartCCC - ok
    18:31:35.0259 0x4244 [ 9D51EA92A612B37E76E5E4621650C50A, 00BD61C8527A80C0F684882379A0AC2E5A54E8BBECC797087B960CDC8454C373 ] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    18:31:35.0261 0x4244 NUSB3MON - ok
    18:31:35.0303 0x4244 [ 41D1214B86A06FD29423A797EBDA17E4, ABC79107DDD5890C54B844CD5C69747121083DA69A77C02068D2B9C349FB1614 ] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    18:31:35.0310 0x4244 IAStorIcon - ok
    18:31:35.0354 0x4244 [ 894CE4301565675306C05BC50B9523DE, 97C9A603BE6F3E309FD4282B51F51B57F6B78C230B7147A3B15C9CA4B11DA6DF ] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
    18:31:35.0360 0x4244 HPOSD - ok
    18:31:35.0385 0x4244 [ E8A16EF3D77F38CC49A381F4C721716E, CB3DD116433072A19C2E386AD0F553BF4A3516090B0CD44F94135877CCE2387F ] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
    18:31:35.0388 0x4244 HPConnectionManager - ok
    18:31:35.0433 0x4244 [ D59ABED205F424BD4C52419479930BE9, AA8BF8BB2F6FAB97C51D116DE84A93A029C35745594E7CEC40911C21D8A308D2 ] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    18:31:35.0445 0x4244 HP Quick Launch - ok
    18:31:35.0537 0x4244 [ 1568FF282E268082C67CF0C3EBCC9179, B328A9B6B1B3D5FC618F4777F9F59C8C2A9882A13B27352F8B84AC3118E7FB07 ] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    18:31:35.0555 0x4244 EEventManager - ok
    18:31:35.0625 0x4244 [ 187F4C75A89E3F412322C94526320074, D78FA7EF93C8C7B4326A5B6DB04A92ADD091DF00658FA8731D07C5D3BE29ED04 ] C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    18:31:35.0627 0x4244 BCSSync - ok
    18:31:35.0737 0x4244 [ E1636F57581CAB5D995FD54D2991EF57, BB6B3D005054D386D596A4BA4D9D2F1284D7C845C1CD5EE63775B4569559E0EB ] C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe
    18:31:35.0777 0x4244 AdobeCS5.5ServiceManager - ok
    18:31:35.0860 0x4244 [ 07A37CB5C5A01E73FB69F138FAE2DB0E, 9E8B5D78D7EAB8FA35133763EDA91AFE5CDEE275D604F02CDB56FB00A0D5AA0F ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    18:31:35.0883 0x4244 Adobe ARM - ok
    18:31:35.0982 0x4244 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    18:31:36.0014 0x4244 Sidebar - ok
    18:31:36.0036 0x4244 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    18:31:36.0039 0x4244 mctadmin - ok
    18:31:36.0092 0x4244 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    18:31:36.0118 0x4244 Sidebar - ok
    18:31:36.0124 0x4244 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    18:31:36.0128 0x4244 mctadmin - ok
    18:31:36.0261 0x4244 [ 05DD0C6B983F7C2E9B4BF1B91AFC3545, C130179DAA1F06915556E802DBB6576694C36A459EADE70D52A85ED00D3CF2D4 ] C:\Program Files (x86)\Steam\steam.exe
    18:31:36.0306 0x4244 Steam - ok
    18:31:36.0366 0x4244 [ 7DFCCC67990B6DE7F30F553A4E4612A4, 9FF98D6FD2539CEFC9F42103A7F72388BED6EE590400559B92BC7430228DA36A ] C:\Program Files (x86)\RocketDock\RocketDock.exe
    18:31:36.0378 0x4244 RocketDock - ok
    18:31:36.0455 0x4244 [ 42E974C4428C22980B17547D0AE32A83, 33C55B98C9001F2F999025E43BCE6ACC2A8E95FD5D6B5BB7DF2E31C88828A210 ] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGA.EXE
    18:31:36.0461 0x4244 EPSON NX125 NX127 Series - ok
    18:31:36.0463 0x4244 Adobe Speed Launcher - ok
    18:31:36.0516 0x4244 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    18:31:36.0543 0x4244 Sidebar - ok
    18:31:36.0558 0x4244 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    18:31:36.0561 0x4244 mctadmin - ok
    18:31:36.0609 0x4244 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    18:31:36.0630 0x4244 Sidebar - ok
    18:31:36.0636 0x4244 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    18:31:36.0640 0x4244 mctadmin - ok
    18:31:36.0640 0x4244 Waiting for KSN requests completion. In queue: 95
    18:31:37.0640 0x4244 Waiting for KSN requests completion. In queue: 95
    18:31:38.0640 0x4244 Waiting for KSN requests completion. In queue: 95
    18:31:39.0640 0x4244 Waiting for KSN requests completion. In queue: 95
    18:31:40.0651 0x4244 AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.6.305.0 ), 0x61000 ( enabled : updated )
    18:31:40.0671 0x4244 Win FW state via NFP2: enabled
    18:31:43.0792 0x4244 ============================================================
    18:31:43.0792 0x4244 Scan finished
    18:31:43.0792 0x4244 ============================================================
    18:31:43.0799 0x43b4 Detected object count: 0
    18:31:43.0799 0x43b4 Actual detected object count: 0
     
  16. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  17. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Alright, done with Combofix, here's the Log. Now that I checked my Task Manager it seems iexplore.exe is not running though dwm.exe is and still with the same values and same position in process list, I don't know if this is normal, your the expert haha, but please tell me if it's all good now or is there more work to be done to be totally clean??? Your help has been very useful by the way :)

    ComboFix 15-01-04.01 - CASZ 01/03/2015 18:59:06.1.8 - x64
    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8140.4329 [GMT -6:00]
    Running from: c:\users\CASZ\Downloads\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
    SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files (x86)\SaveShare
    c:\programdata\Roaming
    c:\users\CASZ\AppData\Local\DeSmuME
    c:\users\CASZ\AppData\Local\DeSmuME\Battery\0663 - Digimon World (U).dsv
    c:\users\CASZ\AppData\Local\DeSmuME\desmume.ini
    c:\windows\msdownld.tmp
    c:\windows\SysWow64\Packet.dll
    c:\windows\SysWow64\pthreadVC.dll
    c:\windows\SysWow64\wpcap.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_NPF
    -------\Service_npf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-12-04 to 2015-01-04 )))))))))))))))))))))))))))))))
    .
    .
    2015-01-04 01:09 . 2015-01-04 01:09 -------- d-----w- c:\users\TEMP\AppData\Local\temp
    2015-01-04 01:09 . 2015-01-04 01:09 -------- d-----w- c:\users\hedev\AppData\Local\temp
    2015-01-03 22:42 . 2015-01-03 23:40 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2015-01-03 22:23 . 2015-01-03 22:23 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2015-01-03 22:23 . 2015-01-03 22:23 -------- d-----w- c:\programdata\RogueKiller
    2015-01-03 21:30 . 2015-01-03 21:32 -------- d-----w- c:\users\CASZ\AppData\Local\WinZip
    2015-01-03 21:30 . 2015-01-03 21:31 -------- d-----w- c:\programdata\WinZip
    2015-01-03 20:30 . 2015-01-03 20:32 -------- d-----w- C:\FRST
    2015-01-03 19:32 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E97285C1-A7D8-44BA-989A-9BF7BCA4D5B4}\mpengine.dll
    2015-01-03 19:26 . 2015-01-03 20:20 -------- d-----w- c:\programdata\HitmanPro
    2015-01-03 19:05 . 2015-01-03 19:27 -------- d-----w- C:\AdwCleaner
    2015-01-03 03:03 . 2015-01-04 01:13 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2015-01-03 03:02 . 2015-01-03 22:42 96472 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2015-01-03 03:02 . 2014-11-21 12:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
    2015-01-03 03:02 . 2014-11-21 12:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
    2015-01-03 03:02 . 2015-01-03 03:02 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2015-01-03 02:00 . 2015-01-03 02:00 -------- d-----w- c:\users\CASZ\AppData\Roaming\AVG2015
    2015-01-03 01:54 . 2015-01-03 22:01 -------- d-----w- c:\programdata\AVG2015
    2015-01-03 01:54 . 2015-01-03 21:53 -------- d-----w- C:\$AVG
    2015-01-03 01:49 . 2015-01-03 22:01 -------- d-----w- c:\programdata\MFAData
    2015-01-03 01:49 . 2015-01-03 02:30 -------- d-----w- c:\users\CASZ\AppData\Local\Avg2015
    2015-01-03 01:49 . 2015-01-03 01:49 -------- d-----w- c:\users\CASZ\AppData\Local\MFAData
    2015-01-03 00:15 . 2015-01-03 00:15 -------- d-----w- c:\users\CASZ\AppData\Local\Imcxsoft
    2015-01-03 00:13 . 2015-01-03 00:13 -------- d-sh--w- c:\users\CASZ\AppData\Local\EmieBrowserModeList
    2015-01-03 00:13 . 2015-01-03 02:15 -------- d-----w- c:\users\CASZ\AppData\Local\Ihmjsoft
    2015-01-02 17:17 . 2014-09-16 16:04 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8931C16A-A520-4C68-89AF-2A568BE7F0D6}\gapaengine.dll
    2015-01-02 17:15 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2015-01-02 01:58 . 2015-01-02 01:58 -------- d-----w- c:\programdata\amfpanleeekjndiijbaehciilmkjeipb
    2014-12-18 16:09 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe
    2014-12-18 16:09 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
    2014-12-15 16:43 . 2014-12-15 16:43 -------- d-----w- c:\users\CASZ\AppData\Roaming\RealNetworks
    2014-12-15 16:43 . 2014-12-15 16:43 -------- d-----w- c:\programdata\Package Cache
    2014-12-15 16:43 . 2014-12-15 16:43 -------- d-----w- c:\program files (x86)\Common Files\xing shared
    2014-12-15 16:42 . 2014-12-15 16:42 505416 ----a-w- c:\windows\SysWow64\msvcp71.dll
    2014-12-15 16:42 . 2014-12-15 16:42 353864 ----a-w- c:\windows\SysWow64\msvcr71.dll
    2014-12-11 05:49 . 2014-12-11 05:49 -------- d-----w- c:\windows\system32\appraiser
    2014-12-11 05:21 . 2014-10-18 01:33 3209728 ----a-w- c:\windows\SysWow64\mf.dll
    2014-12-11 05:21 . 2014-10-18 02:05 4121600 ----a-w- c:\windows\system32\mf.dll
    2014-12-10 19:26 . 2014-11-22 02:40 171008 ----a-w- c:\program files\Internet Explorer\Timeline_is.dll
    2014-12-10 19:24 . 2014-10-30 02:03 165888 ----a-w- c:\windows\system32\charmap.exe
    2014-12-10 19:24 . 2014-10-30 01:45 155136 ----a-w- c:\windows\SysWow64\charmap.exe
    2014-12-10 19:23 . 2014-10-03 02:12 310272 ----a-w- c:\windows\system32\WsmWmiPl.dll
    2014-12-10 19:23 . 2014-10-03 02:12 2020352 ----a-w- c:\windows\system32\WsmSvc.dll
    2014-12-10 19:23 . 2014-10-03 01:45 1177088 ----a-w- c:\windows\SysWow64\WsmSvc.dll
    2014-12-10 19:23 . 2014-10-03 02:12 346624 ----a-w- c:\windows\system32\WSManMigrationPlugin.dll
    2014-12-10 19:23 . 2014-10-03 02:12 181248 ----a-w- c:\windows\system32\WsmAuto.dll
    2014-12-10 19:23 . 2014-10-03 02:11 266240 ----a-w- c:\windows\system32\WSManHTTPConfig.exe
    2014-12-10 19:23 . 2014-10-03 01:45 248832 ----a-w- c:\windows\SysWow64\WSManMigrationPlugin.dll
    2014-12-10 19:23 . 2014-10-03 01:45 214016 ----a-w- c:\windows\SysWow64\WsmWmiPl.dll
    2014-12-10 19:23 . 2014-10-03 01:45 145920 ----a-w- c:\windows\SysWow64\WsmAuto.dll
    2014-12-10 19:23 . 2014-10-03 01:44 198656 ----a-w- c:\windows\SysWow64\WSManHTTPConfig.exe
    2014-12-10 19:23 . 2014-11-08 03:16 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-12-10 19:23 . 2014-11-08 02:45 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-12-10 02:01 . 2015-01-03 05:03 -------- d-----w- c:\program files (x86)\Ultra Street Fighter IV
    2014-12-09 05:32 . 2006-02-03 14:42 355536 ----a-w- c:\windows\system32\xactengine2_0.dll
    2014-12-09 05:20 . 2014-12-09 05:20 -------- d-----w- c:\program files (x86)\Capcom
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-12-17 03:49 . 2013-01-20 18:00 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-12-17 03:49 . 2013-01-20 18:00 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-12-11 05:24 . 2013-01-14 18:13 112710672 ----a-w- c:\windows\system32\MRT.exe
    2014-11-19 10:31 . 2014-11-19 10:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
    2014-11-18 01:27 . 2013-01-24 20:41 1648 ----a-w- c:\windows\system32\ASOROSet.bin
    2014-11-11 03:08 . 2014-11-19 16:42 241152 ----a-w- c:\windows\system32\pku2u.dll
    2014-11-11 03:08 . 2014-11-19 16:42 728064 ----a-w- c:\windows\system32\kerberos.dll
    2014-11-11 02:44 . 2014-11-19 16:42 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
    2014-11-11 02:44 . 2014-11-19 16:42 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
    2014-10-30 11:25 . 2010-11-21 03:27 275080 ------w- c:\windows\system32\MpSigStub.exe
    2014-10-25 01:57 . 2014-11-13 15:05 77824 ----a-w- c:\windows\system32\packager.dll
    2014-10-25 01:32 . 2014-11-13 15:05 67584 ----a-w- c:\windows\SysWow64\packager.dll
    2014-10-20 15:40 . 2014-10-20 15:40 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2014-10-18 02:05 . 2014-11-13 15:04 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2014-10-18 01:33 . 2014-11-13 15:04 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2014-10-14 02:16 . 2014-11-12 14:59 155064 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
    2014-10-14 02:13 . 2014-11-12 14:59 683520 ----a-w- c:\windows\system32\termsrv.dll
    2014-10-14 02:13 . 2014-11-13 15:04 3241984 ----a-w- c:\windows\system32\msi.dll
    2014-10-14 02:12 . 2014-11-12 14:59 1460736 ----a-w- c:\windows\system32\lsasrv.dll
    2014-10-14 02:09 . 2014-11-12 14:59 146432 ----a-w- c:\windows\system32\msaudite.dll
    2014-10-14 02:07 . 2014-11-12 14:59 681984 ----a-w- c:\windows\system32\adtschema.dll
    2014-10-14 01:50 . 2014-11-12 14:59 22016 ----a-w- c:\windows\SysWow64\secur32.dll
    2014-10-14 01:50 . 2014-11-13 15:05 2363904 ----a-w- c:\windows\SysWow64\msi.dll
    2014-10-14 01:49 . 2014-11-12 14:59 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
    2014-10-14 01:47 . 2014-11-12 14:59 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
    2014-10-14 01:46 . 2014-11-12 14:59 681984 ----a-w- c:\windows\SysWow64\adtschema.dll
    2014-10-12 17:12 . 2014-10-12 17:12 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
    2014-10-12 17:12 . 2014-10-12 17:12 319912 ----a-w- c:\windows\system32\javaws.exe
    2014-10-12 17:12 . 2014-10-12 17:12 189352 ----a-w- c:\windows\system32\javaw.exe
    2014-10-12 17:12 . 2014-10-12 17:12 189352 ----a-w- c:\windows\system32\java.exe
    2014-10-10 00:57 . 2014-11-13 15:05 3198976 ----a-w- c:\windows\system32\win32k.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Steam"="c:\program files (x86)\Steam\steam.exe" [2014-11-18 1940160]
    "RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-26 271744]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-03-15 336384]
    "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
    "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]
    "HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-01-27 318520]
    "HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-02-15 94264]
    "HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]
    "EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
    "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-11-20 1021128]
    .
    c:\users\CASZ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2012-11-4 41160]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SystweakDisabled\
    NovaBACKUP Tray Control.lnk - c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe [2011-11-11 222352]
    RealPlayer Cloud Service UI.lnk - c:\program files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe [2014-12-15 1024608]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "HideFastUserSwitching"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "EnableShellExecuteHooks"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs"=1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ sasnative64\0autocheck autochk *\0autocheck sasnative64\0autocheck ROBoot64\0ROBoot64 \??\c:\windows\system32\ASOROSet.bin
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
    "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
    "TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
    .
    R1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 Backup Client Agent Service;Backup Client Agent Service;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe [x]
    R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
    R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
    R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
    R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
    R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
    R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
    R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
    R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
    R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
    S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
    S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
    S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
    S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
    S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]
    S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
    S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
    S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [x]
    S2 FreemakeVideoCapture;FreemakeVideoCapture;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe [x]
    S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe [x]
    S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
    S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
    S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
    S2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe [x]
    S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
    S2 RealPlayer Cloud Service;RealPlayer Cloud Service;c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe;c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [x]
    S2 RealPlayerUpdateSvc;RealPlayer Update Service;c:\program files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe;c:\program files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [x]
    S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [x]
    S2 RzKLService;RzKLService;c:\program files (x86)\Razer\Razer Game Booster\RzKLService.exe;c:\program files (x86)\Razer\Razer Game Booster\RzKLService.exe [x]
    S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
    S2 VBoxDrv;VBox Support Driver;c:\program files (x86)\YouWave Android\vb\VBoxDrv.sys;c:\program files (x86)\YouWave Android\vb\VBoxDrv.sys [x]
    S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
    S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
    S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
    S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
    S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
    S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
    S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - MBAMSWISSARMY
    *NewlyCreated* - WS2IFSL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2013-12-05 05:03 1210320 ------w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2015-01-04 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-12 03:49]
    .
    2015-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-13 02:56]
    .
    2015-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-13 02:56]
    .
    2014-12-31 c:\windows\Tasks\HPCeeScheduleForCASZ.job
    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
    .
    2014-12-16 c:\windows\Tasks\HPCeeScheduleForDDZT-HP$.job
    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-11 1128448]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-09 416024]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
    "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-09 167704]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-09 392472]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    ustart page = about:blank
    uDefault_Search_URL = www.google.com
    mDefault_Search_URL = www.google.com
    mDefault_Page_URL = www.google.com
    mStart Page = www.google.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    mSearch Page = www.google.com
    uInternet Settings,ProxyOverride = 127.0.0.1;localhost;10.*;192.168.*;127.0.0.1:895;127.0.0.1:896;<local>
    uInternet Settings,ProxyServer = http=127.0.0.1:8555;https=127.0.0.1:8555
    Trusted Zone: 4game.com
    Trusted Zone: cleverreach.com\novastor
    Trusted Zone: clonewarsadventures.com
    Trusted Zone: freerealms.com
    Trusted Zone: google-analytics.com
    Trusted Zone: novastor.com
    Trusted Zone: soe.com
    Trusted Zone: sony.com
    TCP: DhcpNameServer = 10.213.4.14 10.213.1.11
    TCP: Interfaces\{0A56AFA7-2FFD-43B9-A3E7-137BA6623546}: NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{732EF926-EB8B-42F8-AE77-2C3F8D8A5ACC}: NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{8F9BD33E-C441-4F8A-8ED2-B1AB11ECAD95}: NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{9460A5EF-DCB1-44F1-891B-3FE12E1C00F8}: NameServer = 8.8.8.8,8.8.8.8
    TCP: Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}: NameServer = 8.8.8.8,8.8.8.8
    DPF: {12193C65-F0E1-4DD1-AD4E-DB73C6911011} - file:///E:/activeX/DCP.cab
    FF - ProfilePath - c:\users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default\
    FF - prefs.js: browser.startup.homepage - about:home
    FF - prefs.js: network.proxy.type - 4
    FF - ExtSQL: !HIDDEN! 1970-05-28 22:26; {C7E010A3-B924-DD24-96FD-0B2E450F4D81}; -
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
    AddRemove-{A1E21995-127E-4B7F-8C4D-CB04AA8A58EF}_is1 - c:\program files (x86)\Advanced System Optimizer 3\unins000.exe
    AddRemove-{E92D47A1-D27D-430A-8368-0BAFD956507D} - c:\program files (x86)\InstallShield Installation Information\{E92D47A1-D27D-430A-8368-0BAFD956507D}\setup.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.15"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Key"="ActionsPane3"
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\windows\SysWOW64\ezSharedSvcHost.exe
    c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
    c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe
    c:\program files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
    c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    .
    **************************************************************************
    .
    Completion time: 2015-01-03 19:20:59 - machine was rebooted
    ComboFix-quarantined-files.txt 2015-01-04 01:20
    .
    Pre-Run: 376,843,247,616 bytes free
    Post-Run: 380,920,152,064 bytes free
    .
    - - End Of File - - DA9AF796F6C9EB991FBB706CD9517EA3
     
  18. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Good news :)

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
    Last edited: Jan 3, 2015
  19. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    Alright, done, I've scanned the PC with AdwCleaner, JRT, and FRST, and everything seems good now, here are the logs:

    # AdwCleaner v4.106 - Report created 03/01/2015 at 19:54:01
    # Updated 21/12/2014 by Xplode
    # Database : 2014-12-21.4 [Local]
    # Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
    # Username : CASZ - DDZT-HP
    # Running from : C:\Users\CASZ\Downloads\AdwCleaner.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****


    ***** [ Scheduled Tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****


    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17496


    -\\ Mozilla Firefox v34.0.5 (x86 en-US)


    -\\ Google Chrome v31.0.1650.63


    *************************

    AdwCleaner[R0].txt - [41314 octets] - [03/01/2015 13:05:40]
    AdwCleaner[R1].txt - [906 octets] - [03/01/2015 13:24:40]
    AdwCleaner[R2].txt - [966 octets] - [03/01/2015 19:51:53]
    AdwCleaner[S0].txt - [42751 octets] - [03/01/2015 13:11:06]
    AdwCleaner[S1].txt - [888 octets] - [03/01/2015 19:54:01]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [947 octets] ##########

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.4.1 (12.28.2014:1)
    OS: Windows 7 Ultimate x64
    Ran by CASZ on Sat 01/03/2015 at 20:05:50.05
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181102}
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211181102}
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}



    ~~~ Files

    Successfully deleted: [File] C:\Windows\prefetch\TOOLBARUPDATER.EXE-678CD7F9.pf



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\CASZ\appdata\local\cre"
    Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{1FD69AA0-CFE8-409A-86B7-0748024EAAE4}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{23B5085F-827E-4E8E-890A-C8E40F91E6A8}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{40AE8E02-FA80-450B-8304-2DC5201B102C}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{556F3801-DC1D-4A35-A464-1ECC633FB800}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{58D4C33C-75D9-4D22-ABB1-255D07C2E285}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{646D5578-C680-484E-A1AA-118F54C1467F}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{6F34C80E-658E-410C-A50E-862B26CDCAC4}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{707E2230-AC9F-4F86-AFD2-E0BD7E172319}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{965BA0CA-E87A-41A5-88AF-1ECD3A1AD0B2}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{9C164D98-B199-4679-83D9-4051073594CD}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{9CF01C9A-1FE7-408C-B4BA-40EF60235E74}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{A28A7343-B5C8-46D5-B627-1671B51AF5DA}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{B3CF204D-9FB9-49B3-B776-4D510880CAB7}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{B496EF4A-D3CC-4D32-A68C-CFF082850F38}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{BB9980A8-15BB-4F3F-827E-C9E96B8A26B6}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{C176DD58-8BCE-4028-8178-90AE22920769}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{D27C7A7F-1AE7-4E10-8C64-D95D695D7A92}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{E5265412-8705-4A21-A60C-A5892592DE39}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{E90F8306-6B91-4C7A-9603-195B4C34C851}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{ED73F0A2-2721-429A-8F04-E1B19FA5DCFF}
    Successfully deleted: [Empty Folder] C:\Users\CASZ\appdata\local\{F80F5138-252E-40B4-B32A-6B53E18BC267}



    ~~~ FireFox

    Successfully deleted: [Folder] "C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com"
    Successfully deleted the following from C:\Users\CASZ\AppData\Roaming\mozilla\firefox\profiles\6umba1y0.default\prefs.js

    user_pref("extensions.y33FT34ytwr47Jrv.url", "hxxp://skyfunnjobbest.info/sync2/?q=hfZ9ofV9CShEAen0rTa7pjwMg708BNmGWj8qechGheDUojw8rdwErTaFqjUGqihIC7n0rjkErjaGrdsErTr4tNhVCT94t
    user_pref("valueApps.storage.mam_gk_userId", "37386537376264352D653362332D346535642D396637652D653762353033346664353234");
    Emptied folder: C:\Users\CASZ\AppData\Roaming\mozilla\firefox\profiles\6umba1y0.default\minidumps [13 files]



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sat 01/03/2015 at 20:09:41.42
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  20. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    FRST Part 1
    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2015 03
    Ran by CASZ (administrator) on DDZT-HP on 03-01-2015 20:11:36
    Running from C:\Users\CASZ\Downloads
    Loaded Profile: CASZ (Available profiles: CASZ & fbwuser)
    Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (AMD) C:\Windows\System32\atiesrxx.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
    (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
    (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
    (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
    (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
    (Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
    (Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
    (Hi-Rez Studios) C:\Program Files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe
    (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    (NovaStor) C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe
    () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
    (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
    () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
    (Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
    (Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    (HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
    () C:\Program Files (x86)\RocketDock\RocketDock.exe
    (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    () C:\Program Files\Rainmeter\Rainmeter.exe
    (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
    (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
    (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.)
    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-16] (Synaptics Incorporated)
    HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
    HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation)
    HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
    HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-15] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
    HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
    HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.)
    HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.)
    HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
    HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
    HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
    HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\WB: C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll [X]
    HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation)
    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\Policies\system: [DisableLockWorkstation] 0
    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\Policies\system: [DisableChangePassword] 0
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
    ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystweakDisabled ()
    Startup: C:\Users\CASZ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
    ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
    BootExecute: sasnative64autocheck autochk * autocheck sasnative64autocheck ROBoot64ROBoot64 \??\C:\Windows\system32\ASOROSet.bin
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    ProxyServer: [S-1-5-21-1331771087-30956632-3492572574-1000] => http=127.0.0.1:8555;https=127.0.0.1:8555
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\S-1-5-21-1331771087-30956632-3492572574-1000\Software\Microsoft\Internet Explorer\Main,start page = about:blank
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    SearchScopes: HKLM -> {A195C577-4E26-4327-AEA3-CE76B29C425C} URL = http://www.amazon.com/s/ref=azs_osd...ode=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}
    SearchScopes: HKLM-x32 -> {A195C577-4E26-4327-AEA3-CE76B29C425C} URL = http://www.amazon.com/s/ref=azs_osd...ode=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-1331771087-30956632-3492572574-1000 -> {A195C577-4E26-4327-AEA3-CE76B29C425C} URL = http://www.amazon.com/s/ref=azs_osd...ode=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKU\S-1-5-21-1331771087-30956632-3492572574-1000 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}
    BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader)
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Toolbar: HKU\S-1-5-21-1331771087-30956632-3492572574-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    DPF: HKLM-x32 {12193C65-F0E1-4DD1-AD4E-DB73C6911011} file:///E:/activeX/DCP.cab
    DPF: HKLM-x32 {7191F0AC-D686-46A8-BFCC-EA61778C74DD} https://la.mydlink.com/8D/activeX//DCS-93x/aplugLiteDL.cab
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    Tcpip\Parameters: [DhcpNameServer] 10.213.4.14 10.213.1.11
    Tcpip\..\Interfaces\{0A56AFA7-2FFD-43B9-A3E7-137BA6623546}: [NameServer] 8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{732EF926-EB8B-42F8-AE77-2C3F8D8A5ACC}: [NameServer] 8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{8F9BD33E-C441-4F8A-8ED2-B1AB11ECAD95}: [NameServer] 8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{9460A5EF-DCB1-44F1-891B-3FE12E1C00F8}: [NameServer] 8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{ADCA6528-C351-4285-AF74-268745990D86}: [NameServer] 8.8.8.8,8.8.8.8

    FireFox:
    ========
    FF ProfilePath: C:\Users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default
    FF DefaultSearchEngine: Google
    FF Homepage: about:home
    FF NetworkProxy: "no_proxies_on", ""
    FF NetworkProxy: "type", 4
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
    FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
    FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
    FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
    FF Plugin HKU\S-1-5-21-1331771087-30956632-3492572574-1000: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
    FF Extension: RCMListCntrl Class - C:\Users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default\Extensions\{C7E010A3-B924-DD24-96FD-0B2E450F4D81} [2015-01-02]
    FF Extension: translator - C:\Users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default\Extensions\translator@dontfollowme.net.xpi [2014-08-15]
    FF Extension: Adblock Plus - C:\Users\CASZ\AppData\Roaming\Mozilla\Firefox\Profiles\6umba1y0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-02]
    FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files (x86)\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2014-12-09]
    FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-12-09]
    FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-09]
    FF HKLM-x32\...\Firefox\Extensions: [fmdownloader@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com
    FF Extension: Freemake Video Downloader Plugin - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com [2013-01-14]
    FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
    FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-12-15]
    FF HKLM-x32\...\Firefox\Extensions: [ytfmdownloader@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com
    FF Extension: Freemake Youtube Download Button - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com [2013-01-14]
    FF HKLM-x32\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
    FF StartMenuInternet: FIREFOX.EXE - firefox.exe

    Chrome:
    =======
    CHR dev: Chrome dev build detected! <======= ATTENTION
    CHR Profile: C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Website Logon) - C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe [2013-01-12]
    CHR Extension: (RCMListCntrl Class) - C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla [2015-01-02]
    CHR Extension: (RealDownloader) - C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-01-13]
    CHR Extension: (No Name) - C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldjcbfljkplgifccngillicohclloidg [2013-01-12]
    CHR Extension: (Google Wallet) - C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
    CHR Extension: (No Name) - C:\Users\CASZ\AppData\Local\Google\Chrome\User Data\Default\Extensions\odmcboalfdjgoakoandgafgolonjpfpg [2014-02-19]
    CHR Extension: (unisaless) - C:\ProgramData\amfpanleeekjndiijbaehciilmkjeipb\ [2014-02-19]
    CHR HKLM-x32\...\Chrome\Extension: [aepeildmfnnehghlknddebgjghlompfe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-02-11]
    CHR StartMenuInternet: Google Chrome - Chrome.exe

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    S3 Backup Client Agent Service; C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe [217600 2011-11-08] (NovaStor Corporation) [File not signed]
    R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
    R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
    R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
    R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-09-18] (Freemake) [File not signed]
    R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2014-02-04] (Ellora Assets Corp.) [File not signed]
    R2 HiPatchService; C:\Program Files (x86)\JuegosLevelUp\Hi-Rez Studios\HiPatchService.exe [9216 2014-12-15] (Hi-Rez Studios) [File not signed]
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
    R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] ()
    S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
    R2 nsService; C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe [371856 2011-11-11] (NovaStor) [File not signed]
    R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-10-26] ()
    R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-12-15] (RealNetworks, Inc.)
    R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2014-10-30] ()
    R2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2014-02-25] (Razer Inc.)
    S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
    S3 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies)
    R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-01-16] (DT Soft Ltd)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
    R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-03] (Malwarebytes Corporation)
    R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
    R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
    S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
    S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-09-17] (Anchorfree Inc.)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-01-03] ()
    R2 VBoxDrv; C:\Program Files (x86)\YouWave Android\vb\VBoxDrv.sys [202592 2011-11-19] (Oracle Corporation)
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S1 HssDRV6; system32\DRIVERS\hssdrv6.sys [X]
    S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
    S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-01-03 20:09 - 2015-01-03 20:09 - 00004173 _____ () C:\Users\CASZ\Desktop\JRT.txt
    2015-01-03 20:05 - 2015-01-03 20:05 - 00000000 ____D () C:\Windows\ERUNT
    2015-01-03 19:50 - 2015-01-03 19:51 - 01707939 _____ (Thisisu) C:\Users\CASZ\Downloads\JRT.exe
    2015-01-03 19:20 - 2015-01-03 19:20 - 00033687 _____ () C:\ComboFix.txt
    2015-01-03 18:56 - 2015-01-03 19:21 - 00000000 ____D () C:\Qoobox
    2015-01-03 18:56 - 2015-01-03 19:19 - 00000000 ____D () C:\Windows\erdnt
    2015-01-03 18:56 - 2011-06-26 00:45 - 00256000 _____ () C:\Windows\PEV.exe
    2015-01-03 18:56 - 2010-11-07 11:20 - 00208896 _____ () C:\Windows\MBR.exe
    2015-01-03 18:56 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2015-01-03 18:56 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2015-01-03 18:56 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
     
  21. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    FRST Part 2

    2015-01-03 18:56 - 2000-08-30 18:00 - 00098816 _____ () C:\Windows\sed.exe
    2015-01-03 18:56 - 2000-08-30 18:00 - 00080412 _____ () C:\Windows\grep.exe
    2015-01-03 18:56 - 2000-08-30 18:00 - 00068096 _____ () C:\Windows\zip.exe
    2015-01-03 18:55 - 2015-01-03 18:56 - 05609858 ____R (Swearware) C:\Users\CASZ\Downloads\ComboFix.exe
    2015-01-03 18:29 - 2015-01-03 18:29 - 04187592 _____ (Kaspersky Lab ZAO) C:\Users\CASZ\Downloads\tdsskiller.exe
    2015-01-03 16:42 - 2015-01-03 17:40 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2015-01-03 16:39 - 2015-01-03 17:40 - 00000000 ____D () C:\Users\CASZ\Desktop\mbar
    2015-01-03 16:37 - 2015-01-03 16:37 - 16448208 _____ (Malwarebytes Corp.) C:\Users\CASZ\Downloads\mbar-1.08.2.1001.exe
    2015-01-03 16:23 - 2015-01-03 16:23 - 00035064 _____ () C:\Windows\system32\Drivers\TrueSight.sys
    2015-01-03 16:23 - 2015-01-03 16:23 - 00000000 ____D () C:\ProgramData\RogueKiller
    2015-01-03 15:59 - 2015-01-03 15:59 - 15298136 _____ () C:\Users\CASZ\Downloads\RogueKiller.exe
    2015-01-03 15:30 - 2015-01-03 15:32 - 00000000 ____D () C:\Users\CASZ\AppData\Local\WinZip
    2015-01-03 15:30 - 2015-01-03 15:31 - 00000000 ____D () C:\ProgramData\WinZip
    2015-01-03 15:30 - 2015-01-03 15:30 - 00002253 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
    2015-01-03 15:30 - 2015-01-03 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
    2015-01-03 15:29 - 2015-01-03 15:29 - 00000000 ____D () C:\Program Files (x86)\WinZip
    2015-01-03 15:16 - 2015-01-03 15:16 - 00688992 ____R (Swearware) C:\Users\CASZ\Downloads\dds.com
    2015-01-03 15:08 - 2015-01-03 15:08 - 01201806 _____ () C:\Users\CASZ\Downloads\Cheats 30-12-14.rar
    2015-01-03 14:31 - 2015-01-03 14:32 - 00055056 _____ () C:\Users\CASZ\Downloads\Addition.txt
    2015-01-03 14:30 - 2015-01-03 20:11 - 00028907 _____ () C:\Users\CASZ\Downloads\FRST.txt
    2015-01-03 14:30 - 2015-01-03 20:11 - 00000000 ____D () C:\FRST
    2015-01-03 14:29 - 2015-01-03 14:29 - 02123776 _____ (Farbar) C:\Users\CASZ\Downloads\FRST64.exe
    2015-01-03 13:26 - 2015-01-03 14:20 - 00000000 ____D () C:\ProgramData\HitmanPro
    2015-01-03 13:25 - 2015-01-03 13:26 - 11222744 _____ (SurfRight B.V.) C:\Users\CASZ\Downloads\HitmanPro_x64.exe
    2015-01-03 13:05 - 2015-01-03 19:54 - 00000000 ____D () C:\AdwCleaner
    2015-01-03 13:05 - 2015-01-03 13:05 - 02173952 _____ () C:\Users\CASZ\Downloads\AdwCleaner.exe
    2015-01-03 13:04 - 2015-01-03 13:04 - 01061112 _____ (Bleeping Computer, LLC) C:\Users\CASZ\Downloads\rkill64.exe
    2015-01-03 01:32 - 2015-01-03 01:34 - 00000000 ____D () C:\Windows\pss
    2015-01-02 21:03 - 2015-01-03 19:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2015-01-02 21:02 - 2015-01-03 16:42 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2015-01-02 21:02 - 2015-01-02 21:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-01-02 21:02 - 2015-01-02 21:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-01-02 21:02 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2015-01-02 21:02 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2015-01-02 21:01 - 2015-01-02 21:01 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\CASZ\Downloads\mbam-setup-2.0.4.1028.exe
    2015-01-02 20:00 - 2015-01-02 20:00 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\AVG2015
    2015-01-02 19:54 - 2015-01-03 16:01 - 00000000 ____D () C:\ProgramData\AVG2015
    2015-01-02 19:54 - 2015-01-03 15:53 - 00000000 ____D () C:\$AVG
    2015-01-02 19:49 - 2015-01-03 16:01 - 00000000 ____D () C:\ProgramData\MFAData
    2015-01-02 19:49 - 2015-01-02 20:30 - 00000000 ____D () C:\Users\CASZ\AppData\Local\Avg2015
    2015-01-02 19:49 - 2015-01-02 19:49 - 00000000 ____D () C:\Users\CASZ\AppData\Local\MFAData
    2015-01-02 18:26 - 2015-01-02 18:26 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
    2015-01-02 18:15 - 2015-01-02 18:15 - 00000000 ____D () C:\Users\CASZ\AppData\Local\Imcxsoft
    2015-01-02 18:13 - 2015-01-02 20:15 - 00000000 ____D () C:\Users\CASZ\AppData\Local\Ihmjsoft
    2015-01-02 18:13 - 2015-01-02 18:13 - 00000000 __SHD () C:\Users\CASZ\AppData\Local\EmieBrowserModeList
    2015-01-01 19:58 - 2015-01-01 19:58 - 00000000 ____D () C:\ProgramData\amfpanleeekjndiijbaehciilmkjeipb
    2014-12-18 10:09 - 2014-12-12 23:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-12-18 10:09 - 2014-12-12 21:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-12-16 21:40 - 2014-12-16 21:40 - 00000003 _____ () C:\Windows\system32\HRUPPROG.EXIT
    2014-12-16 21:39 - 2014-12-16 21:40 - 00000003 _____ () C:\Windows\system32\HRUPPROG.TXT
    2014-12-15 10:44 - 2014-12-15 10:44 - 00003420 _____ () C:\Windows\System32\Tasks\RealDownloader Update Check
    2014-12-15 10:44 - 2014-12-15 10:44 - 00001042 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk
    2014-12-15 10:43 - 2014-12-15 10:43 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\RealNetworks
    2014-12-15 10:43 - 2014-12-15 10:43 - 00000000 ____D () C:\ProgramData\Package Cache
    2014-12-15 10:42 - 2014-12-15 10:42 - 00505416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
    2014-12-15 10:42 - 2014-12-15 10:42 - 00353864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
    2014-12-15 10:42 - 2014-12-15 10:42 - 00278600 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
    2014-12-15 10:42 - 2014-12-15 10:42 - 00201800 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
    2014-12-15 10:30 - 2014-12-15 10:44 - 00003358 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1331771087-30956632-3492572574-1000
    2014-12-15 10:30 - 2014-12-15 10:44 - 00003222 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1331771087-30956632-3492572574-1000
    2014-12-10 23:49 - 2014-12-10 23:49 - 00000000 ____D () C:\Windows\system32\appraiser
    2014-12-10 23:21 - 2014-10-17 20:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2014-12-10 23:21 - 2014-10-17 19:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2014-12-10 13:27 - 2014-12-03 20:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
    2014-12-10 13:27 - 2014-12-03 20:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
    2014-12-10 13:27 - 2014-12-03 20:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
    2014-12-10 13:27 - 2014-12-03 20:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
    2014-12-10 13:27 - 2014-12-03 20:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2014-12-10 13:27 - 2014-12-03 20:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
    2014-12-10 13:27 - 2014-12-03 20:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2014-12-10 13:27 - 2014-12-01 17:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
    2014-12-10 13:27 - 2014-11-26 19:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-12-10 13:27 - 2014-11-21 21:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-12-10 13:27 - 2014-11-21 20:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-12-10 13:27 - 2014-11-21 20:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-12-10 13:27 - 2014-11-21 20:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-12-10 13:27 - 2014-11-21 20:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-12-10 13:27 - 2014-11-21 19:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-12-10 13:27 - 2014-11-21 19:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-12-10 13:27 - 2014-11-21 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-12-10 13:27 - 2014-11-21 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-12-10 13:27 - 2014-11-21 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-12-10 13:27 - 2014-11-10 21:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
    2014-12-10 13:27 - 2014-11-10 20:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
    2014-12-10 13:27 - 2014-11-10 19:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
    2014-12-10 13:26 - 2014-11-26 19:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-12-10 13:26 - 2014-11-21 21:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-12-10 13:26 - 2014-11-21 21:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-12-10 13:26 - 2014-11-21 20:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-12-10 13:26 - 2014-11-21 20:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-12-10 13:26 - 2014-11-21 20:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-12-10 13:26 - 2014-11-21 20:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-12-10 13:26 - 2014-11-21 20:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-12-10 13:26 - 2014-11-21 20:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-12-10 13:26 - 2014-11-21 20:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-12-10 13:26 - 2014-11-21 20:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-12-10 13:26 - 2014-11-21 20:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-12-10 13:26 - 2014-11-21 20:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-12-10 13:26 - 2014-11-21 20:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-12-10 13:26 - 2014-11-21 20:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-12-10 13:26 - 2014-11-21 20:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-12-10 13:26 - 2014-11-21 20:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-12-10 13:26 - 2014-11-21 20:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-12-10 13:26 - 2014-11-21 20:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-12-10 13:26 - 2014-11-21 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-12-10 13:26 - 2014-11-21 20:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-12-10 13:26 - 2014-11-21 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-12-10 13:26 - 2014-11-21 20:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-12-10 13:26 - 2014-11-21 19:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-12-10 13:26 - 2014-11-21 19:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-12-10 13:26 - 2014-11-21 19:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-12-10 13:26 - 2014-11-21 19:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-12-10 13:26 - 2014-11-21 19:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-12-10 13:26 - 2014-11-21 19:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-12-10 13:26 - 2014-11-21 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-12-10 13:26 - 2014-11-21 19:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-12-10 13:26 - 2014-11-21 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-12-10 13:26 - 2014-11-21 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-12-10 13:26 - 2014-11-21 19:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-12-10 13:26 - 2014-11-21 19:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-12-10 13:26 - 2014-11-21 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-12-10 13:26 - 2014-11-21 19:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-12-10 13:26 - 2014-11-21 19:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-12-10 13:26 - 2014-11-21 19:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-12-10 13:26 - 2014-11-21 19:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-12-10 13:26 - 2014-11-21 19:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-12-10 13:26 - 2014-11-21 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-12-10 13:26 - 2014-11-21 18:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-12-10 13:24 - 2014-10-29 20:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
    2014-12-10 13:24 - 2014-10-29 19:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
    2014-12-10 13:23 - 2014-11-07 21:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2014-12-10 13:23 - 2014-11-07 20:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2014-12-10 13:23 - 2014-10-02 20:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
    2014-12-10 13:23 - 2014-10-02 20:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
    2014-12-10 13:23 - 2014-10-02 20:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
    2014-12-10 13:23 - 2014-10-02 20:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
    2014-12-10 13:23 - 2014-10-02 20:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
    2014-12-10 13:23 - 2014-10-02 19:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
    2014-12-10 13:23 - 2014-10-02 19:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
    2014-12-10 13:23 - 2014-10-02 19:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
    2014-12-10 13:23 - 2014-10-02 19:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
    2014-12-10 13:23 - 2014-10-02 19:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
    2014-12-09 20:15 - 2014-12-09 20:15 - 00000890 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultra Street Fighter IV.lnk
    2014-12-09 20:15 - 2014-12-09 20:15 - 00000878 _____ () C:\Users\Public\Desktop\Ultra Street Fighter IV.lnk
    2014-12-09 20:01 - 2015-01-02 23:03 - 00000000 ____D () C:\Program Files (x86)\Ultra Street Fighter IV
    2014-12-09 11:20 - 2014-12-09 11:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
    2014-12-08 23:56 - 2014-12-08 23:56 - 00000000 ____D () C:\Users\CASZ\Documents\CAPCOM
    2014-12-08 23:33 - 2014-12-08 23:33 - 00000000 ____D () C:\Windows\SysWOW64\xlive
    2014-12-08 23:33 - 2014-12-08 23:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows - LIVE
    2014-12-08 23:33 - 2014-12-08 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE
    2014-12-08 23:33 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
    2014-12-08 23:33 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
    2014-12-08 23:33 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
    2014-12-08 23:33 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
    2014-12-08 23:33 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
    2014-12-08 23:33 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
    2014-12-08 23:33 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
    2014-12-08 23:33 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
    2014-12-08 23:33 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
    2014-12-08 23:33 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
    2014-12-08 23:33 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
    2014-12-08 23:33 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
    2014-12-08 23:32 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
    2014-12-08 23:32 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
    2014-12-08 23:32 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
    2014-12-08 23:32 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
    2014-12-08 23:32 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
    2014-12-08 23:32 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
    2014-12-08 23:32 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
    2014-12-08 23:32 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
    2014-12-08 23:32 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
    2014-12-08 23:32 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
    2014-12-08 23:32 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
    2014-12-08 23:32 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
    2014-12-08 23:32 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
    2014-12-08 23:32 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
    2014-12-08 23:20 - 2014-12-08 23:20 - 00000000 ____D () C:\Program Files (x86)\Capcom

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-01-03 20:12 - 2013-09-12 12:17 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2015-01-03 20:10 - 2012-01-14 13:40 - 00000000 ___RD () C:\Users\Public\Documents\Temporary
    2015-01-03 20:04 - 2009-07-13 22:45 - 00042192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-01-03 20:04 - 2009-07-13 22:45 - 00042192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-01-03 19:58 - 2013-08-30 12:10 - 00000000 ____D () C:\Program Files (x86)\Steam
    2015-01-03 19:57 - 2013-01-12 20:56 - 00000890 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-01-03 19:55 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-01-03 19:55 - 2009-07-13 22:51 - 00151199 _____ () C:\Windows\setupact.log
    2015-01-03 19:54 - 2011-06-12 23:24 - 01236862 _____ () C:\Windows\WindowsUpdate.log
    2015-01-03 19:54 - 2010-11-20 21:47 - 01412824 _____ () C:\Windows\PFRO.log
    2015-01-03 19:23 - 2013-01-12 20:56 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-01-03 19:14 - 2009-07-13 20:34 - 00000215 _____ () C:\Windows\system.ini
    2015-01-03 19:10 - 2009-07-13 20:34 - 97517568 _____ () C:\Windows\system32\config\software.bak
    2015-01-03 19:10 - 2009-07-13 20:34 - 22806528 _____ () C:\Windows\system32\config\system.bak
    2015-01-03 19:10 - 2009-07-13 20:34 - 01310720 _____ () C:\Windows\system32\config\default.bak
    2015-01-03 19:10 - 2009-07-13 20:34 - 00061440 _____ () C:\Windows\system32\config\sam.bak
    2015-01-03 19:10 - 2009-07-13 20:34 - 00024576 _____ () C:\Windows\system32\config\security.bak
    2015-01-03 18:47 - 2013-01-12 20:49 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{ADEFCD43-CD08-4562-809E-0070E88FE432}
    2015-01-03 16:14 - 2011-06-12 23:37 - 00000000 ____D () C:\ProgramData\Norton
    2015-01-03 15:30 - 2013-01-12 22:41 - 00000000 ____D () C:\Users\CASZ
    2015-01-03 15:29 - 2013-01-12 21:05 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\Azureus
    2015-01-03 14:47 - 2009-07-13 23:13 - 00786622 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-01-03 13:11 - 2013-06-30 12:02 - 00001061 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2015-01-03 13:11 - 2013-06-30 12:02 - 00001049 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2015-01-03 13:11 - 2013-01-12 21:03 - 00001286 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2015-01-03 13:11 - 2013-01-12 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-01-03 13:11 - 2013-01-12 20:49 - 00000987 _____ () C:\Users\CASZ\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-01-03 13:11 - 2009-07-13 23:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
    2015-01-03 02:01 - 2014-08-24 10:03 - 00000000 ____D () C:\Users\CASZ\AppData\Local\Adobe
    2015-01-03 00:46 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\Branding
    2015-01-02 21:20 - 2013-12-29 20:58 - 00000000 ____D () C:\ProgramData\jnefdonjenhpjkagfnkkeohklbcalcjm
    2015-01-02 21:12 - 2013-03-04 13:22 - 00007592 _____ () C:\Users\CASZ\AppData\Local\Resmon.ResmonCfg
    2015-01-02 20:42 - 2013-01-30 11:30 - 00006110 _____ () C:\StartUpManager_scandataOUTPUT.xml
    2015-01-02 20:41 - 2013-01-30 11:30 - 00010382 _____ () C:\StartUpManager_scandataINPUT.xml
    2015-01-02 17:44 - 2013-01-18 20:46 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
    2014-12-31 17:21 - 2014-11-07 20:01 - 00003180 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForCASZ
    2014-12-31 17:21 - 2014-11-07 20:01 - 00000328 _____ () C:\Windows\Tasks\HPCeeScheduleForCASZ.job
    2014-12-28 18:58 - 2013-01-16 22:55 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\Skype
    2014-12-28 01:52 - 2013-01-12 23:07 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\vlc
    2014-12-26 11:12 - 2013-11-08 13:41 - 00000000 ____D () C:\Users\CASZ\Documents\Masters of the World
    2014-12-19 11:31 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
    2014-12-18 16:25 - 2013-01-16 22:54 - 00000000 ____D () C:\ProgramData\Skype
    2014-12-18 10:05 - 2013-01-12 21:05 - 00001794 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
    2014-12-18 10:05 - 2013-01-12 21:05 - 00000000 ____D () C:\Program Files\Vuze
    2014-12-17 17:03 - 2014-01-01 20:23 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\Spotify
    2014-12-17 17:02 - 2014-01-01 20:24 - 00000000 ____D () C:\Users\CASZ\AppData\Local\Spotify
    2014-12-16 21:49 - 2013-09-12 12:17 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2014-12-16 21:49 - 2013-01-20 12:00 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2014-12-16 21:49 - 2013-01-20 12:00 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2014-12-16 14:16 - 2013-01-12 21:41 - 00003216 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForDDZT-HP$
    2014-12-16 14:16 - 2013-01-12 21:41 - 00000340 _____ () C:\Windows\Tasks\HPCeeScheduleForDDZT-HP$.job
    2014-12-15 10:44 - 2013-01-12 23:51 - 00000000 ____D () C:\Program Files (x86)\Real
    2014-12-15 10:44 - 2013-01-12 23:48 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\Real
    2014-12-15 10:43 - 2013-01-12 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks
    2014-12-15 10:43 - 2013-01-12 23:51 - 00000000 ____D () C:\Program Files (x86)\RealNetworks
    2014-12-15 10:43 - 2013-01-12 22:53 - 00000000 ____D () C:\ProgramData\Real
    2014-12-11 22:07 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\system32\NDF
    2014-12-10 23:49 - 2014-05-06 12:50 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2014-12-10 23:49 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
    2014-12-10 23:49 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\AppCompat
    2014-12-10 23:33 - 2013-01-15 22:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2014-12-10 23:31 - 2013-07-14 22:42 - 00000000 ____D () C:\Windows\system32\MRT
    2014-12-10 23:24 - 2013-01-14 12:13 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-12-10 17:52 - 2013-01-16 13:11 - 00000000 ____D () C:\Users\CASZ\AppData\Roaming\EssentialPIM
    2014-12-10 08:45 - 2011-04-08 14:53 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
    2014-12-10 07:59 - 2013-06-30 12:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
    2014-12-08 23:33 - 2011-04-08 14:49 - 00050002 _____ () C:\Windows\DirectX.log
    2014-12-05 14:23 - 2014-01-09 14:43 - 00000072 _____ () C:\Users\Public\LMDebug.log

    Some content of TEMP:
    ====================
    C:\Users\CASZ\AppData\Local\Temp\Quarantine.exe
    C:\Users\CASZ\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-12-19 11:19

    ==================== End Of Log ============================
     
  22. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    FRST Additional Part 1

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-01-2015 03
    Ran by CASZ at 2015-01-03 14:31:08
    Running from C:\Users\CASZ\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
    AV: AVG Internet Security 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
    AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: AVG Internet Security 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
    AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
    FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    FW: AVG Internet Security 2015 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Abogados - MF (HKLM-x32\...\Abogados - MF) (Version: - )
    ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
    Administrador de Despachos Jurídicos (HKLM-x32\...\Administrador de Despachos Jurídicos) (Version: - )
    Adobe After Effects CS5.5 (HKLM-x32\...\{E82097B9-A3B8-404A-9A92-AC16A8AC9576}) (Version: 10.5 - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
    Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
    Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
    Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
    Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
    Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
    Adobe Premiere Pro CS5.5 (HKLM-x32\...\{0497EAED-70DA-4BBE-BEB3-AF77FD8788EA}) (Version: 5.5 - Adobe Systems Incorporated)
    Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
    Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
    Adobe Story (HKLM-x32\...\com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.0.571 - Adobe Systems Incorporated)
    Advanced Archive Password Recovery (HKLM-x32\...\{01011662-76A8-41E8-B1A8-4F8821570AC5}) (Version: 4.54.48.1338 - Elcomsoft Co. Ltd.)
    Advanced System Optimizer (HKLM-x32\...\{A1E21995-127E-4B7F-8C4D-CB04AA8A58EF}_is1) (Version: 3.5.1000.14284 - Systweak, Inc.)
    Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Anime Studio Pro 9.2 (HKLM\...\ASP920_is1) (Version: 9.2 - Smith Micro Software, Inc.)
    Anime Studio Pro 9.2 (x86) (HKLM-x32\...\ASP920_is1) (Version: 9.2 - Smith Micro Software, Inc.)
    Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    ATI Catalyst Install Manager (HKLM\...\{DA0D8FDA-D538-1145-8BA2-6F22C4EB4F75}) (Version: 3.0.816.0 - ATI Technologies, Inc.)
    AuthenTec TrueAPI (Version: 1.2.1.33 - AuthenTec, Inc.) Hidden
    AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
    AVG 2015 (Version: 15.0.4257 - AVG Technologies) Hidden
    AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
    Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Bejeweled 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
    Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blio (HKLM-x32\...\{9EAAB95B-17B6-43CF-B4E9-4A90937C83FD}) (Version: 3.2.9594 - K-NFB Reading Technology, Inc.)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6300 - Broadcom Corporation)
    Bruteforce Save Data (HKLM-x32\...\Bruteforce Save Data) (Version: - )
    Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Company of Heroes (HKLM-x32\...\{BA801B94-C28D-46EE-B806-E1E021A3D519}) (Version: 1.0.0.78 - THQ Inc.)
    Company of Heroes 2 (HKLM-x32\...\Q29tcGFueW9mSGVyb2VzMg==_is1) (Version: 1 - )
    CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.4.5822 - CyberLink Corp.)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0328 - DT Soft Ltd)
    Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
    DomDomSoft Manga Downloader (remove only) (HKLM-x32\...\DomDomSoft Manga Downloader) (Version: - )
    Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Empire Earth II (HKLM-x32\...\{DF315348-721C-40B8-BAE2-58C6C7D935A2}) (Version: - )
    Empire Earth II Gold Edition (HKLM-x32\...\Empire Earth II Gold Edition_is1) (Version: - GOG.com)
    Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
    Epson Event Manager (HKLM-x32\...\{0A91B119-D61E-4526-8E32-5B2BA711C2A1}) (Version: 2.40.0000 - SEIKO EPSON CORPORATION)
    EPSON NX100 Series Printer Uninstall (HKLM\...\EPSON NX100 Series) (Version: - SEIKO EPSON Corporation)
    EPSON NX125 NX127 Series Printer Uninstall (HKLM\...\EPSON NX125 NX127 Series) (Version: - SEIKO EPSON Corporation)
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
    EPSON TX300F Series Printer Uninstall (HKLM\...\EPSON TX300F Series) (Version: - SEIKO EPSON Corporation)
    EssentialPIM (HKLM-x32\...\EssentialPIM) (Version: 4.24 - )
    ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
    Evernote v. 4.2.2 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.2.3979 - Evernote Corp.)
    FaceGen Modeller 3.5 Free (HKLM-x32\...\{86BDD105-114A-4B20-BF8B-E46C7159A641}) (Version: 3.5.3 - Singular Inversions Inc.)
    Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
    FATE - The Traitor Soul (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Female Voice Pack (HKLM-x32\...\{71F8C486-8A13-468E-8B73-06051075556A}) (Version: 3.3.1 - Screaming Bee)
    Freemake Video Converter version 4.1.4 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.4 - Ellora Assets Corporation)
    Freemake Video Downloader (HKLM-x32\...\Freemake Video Downloader_is1) (Version: 3.6.2 - Ellora Assets Corporation)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 31.0.1650.63 - Google Inc.)
    Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
    Guitar Pro 6 (HKLM-x32\...\{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1) (Version: - Arobas Music)
    Happy Cloud Client (HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\HappyCloud) (Version: 4.28 - Happy Cloud, Inc.)
    Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
    HP 3D DriveGuard (HKLM\...\{0128D231-B23B-409C-A531-39D8D8774BA1}) (Version: 4.1.5.1 - Hewlett-Packard Company)
    HP Connection Manager (HKLM-x32\...\{795AADBF-58C2-42D0-B779-E730702A247E}) (Version: 4.0.45.1 - Hewlett-Packard Company)
    HP Documentation (HKLM-x32\...\{83A375B6-6FC2-4F8A-948E-E506DB9DCDF0}) (Version: 1.1.0.0 - Hewlett-Packard)
    HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.4 - WildTangent)
    HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard)
    HP On Screen Display (HKLM-x32\...\{9B9B8EE4-2EDB-41C2-AF2E-63E75D37CDDF}) (Version: 1.1.2 - Hewlett-Packard Company)
    HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
    HP Quick Launch (HKLM-x32\...\{EB58480C-0721-483C-B354-9D35A147999F}) (Version: 2.3.6 - Hewlett-Packard Company)
    HP Setup (HKLM-x32\...\{210A03F5-B2ED-4947-B27E-516F50CBB292}) (Version: 8.6.4530.3651 - Hewlett-Packard Company)
    HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13231.3673 - Hewlett-Packard Company)
    HP SimplePass 2011 (HKLM-x32\...\{BCFAA37D-A6DB-43BF-A351-43F183E52D07}) (Version: 5.1.0.495 - Hewlett-Packard)
    HP Software Framework (HKLM-x32\...\{F8070C51-4B1D-430C-8BCF-19696368366F}) (Version: 4.0.110.1 - Hewlett-Packard Company)
    HP Support Assistant (HKLM-x32\...\{E92D47A1-D27D-430A-8368-0BAFD956507D}) (Version: 5.2.9.2 - Hewlett-Packard Company)
    HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) Hidden
    iCloud (HKLM\...\{704C0303-D20C-45AF-BD2B-556EAF31BE09}) (Version: 2.1.2.8 - Apple Inc.)
    IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6329.0 - IDT)
    iMindMap 6 (HKLM-x32\...\{AEBB7047-7670-48D2-9D27-1A8F0CDEDA9E}) (Version: 6.0.617 - ThinkBuzan)
    Intel(R) Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3074 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
    Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}) (Version: 14.0.2000 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
    Intel(R) Wireless Display (HKLM-x32\...\{5B46CEC7-DAD0-46A2-BCD6-B46A3CFD9B61}) (Version: 2.0.30.0 - Intel Corporation)
    iTunes (HKLM\...\{76FF0F03-B707-4332-B5D1-A56C8303514E}) (Version: 11.0.4.4 - Apple Inc.)
    Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
    Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Jurassic Park Operation Genesis (HKLM-x32\...\InstallShield_{A347C572-F7B4-43A3-BD51-FFC99184F70D}) (Version: 1.00.0000 - Universal Interactive)
    Jurassic Park Operation Genesis (x32 Version: 1.00.0000 - Universal Interactive) Hidden
    Jurisprudencia y Tesis Aisladas IUS (Junio 1917 - Diciembre 2012) ver.USB (HKLM-x32\...\{CB653983-D3F7-4AA8-A654-F7786DBF71A1}) (Version: 1.0.2.0 - Suprema Corte de Justicia de la Nación)
    Knights of the Force 2.0 (HKLM-x32\...\Knights of the Force 2.0) (Version: 2.0 - KotF.com)
    League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
    League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
    Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
    Manga Studio (HKLM-x32\...\{CFA66508-B19D-4032-AB0A-EBBA2BDF1368}) (Version: 5.0.2 - Smith Micro)
    Masters of the World (HKLM-x32\...\MOW 2013 ENGLISH DL) (Version: 5.07 - Eversim)
    Media Player Codec Pack 4.2.2 (HKLM-x32\...\Media Player - Codec Pack) (Version: 4.2.2 - Media Player Codec Pack)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Games for Windows - LIVE (HKLM-x32\...\{F97E3841-CA9D-4964-9D64-26066241D26F}) (Version: 3.3.24.0 - Microsoft Corporation)
    Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{8FB1B528-E260-451E-9B55-E9152F94B80B}) (Version: 3.2.3.0 - Microsoft Corporation)
    Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0409-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
    Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    MKLOL (HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\MKLOL) (Version: - )
    MorphVOX Pro (HKLM-x32\...\{DE289787-7ECA-4BED-9D8C-99FAC407E3D6}) (Version: 4.3.13 - Screaming Bee)
    Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Mystery P.I. - Stolen in San Francisco (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Norton Internet Security (HKLM-x32\...\NIS) (Version: 18.7.2.3 - Symantec Corporation)
    NovaBACKUP (HKLM-x32\...\NovaBACKUP) (Version: 12.5.9 - NovaStor)
    NovaBACKUP (x32 Version: 12.5.9 - NovaStor) Hidden
    PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
    Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
    PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
    PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
    Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
    PowerISO (HKLM-x32\...\PowerISO) (Version: 5.5 - Power Software Ltd)
    Práctico Jurídico Forense - 2011 (HKLM-x32\...\{AA0D0735-F940-46FD-836C-C62CC7727D3D}) (Version: 25.11.0408 - Leopoldo López Quintero)
    Project64 1.6 (HKLM-x32\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
    PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
    QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
    Rainmeter (HKLM-x32\...\Rainmeter) (Version: 2.4 r1678 - )
    Razer Game Booster (HKLM-x32\...\Razer Game Booster_is1) (Version: 4.2.45.0 - Razer Inc.)
    RealDownloader (x32 Version: 17.0.15.4 - RealNetworks, Inc.) Hidden
    RealDownloader (x32 Version: 17.0.15.7 - RealNetworks) Hidden
    RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
    RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
    RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
    RealPlayer Cloud (HKLM-x32\...\RealPlayer 17.0) (Version: 17.0.15 - RealNetworks)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.41.216.2011 - Realtek)
    Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.74 - Realtek Semiconductor Corp.)
    RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
    Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
    Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
    Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
    Replay Video Capture 6 (HKLM-x32\...\Replay Video Capture6.0.6.1) (Version: 6.0.6.1 - Applian Technologies Inc.)
    RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version: - Punk Software)
    RoxioNow Player (HKLM-x32\...\{0EDEB615-1A60-425E-8306-0E10519C7B55}) (Version: 1.9.5.103 - RoxioNow)
    Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.02.00 - Samsung Electronics Co., Ltd.)
    SecondLifeViewer (remove only) (HKLM-x32\...\SecondLifeViewer) (Version: - )
    Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
    Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
    Slingo Supreme (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Smite Level Up LATAM (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF310}) (Version: 1.0.2476.1 - Hi-Rez Studios)
    Spotify (HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB)
    Star Wars Jedi Knight Jedi Academy (HKLM-x32\...\{1EECBA68-8BE4-4076-94DF-E9ED206B1D21}) (Version: - )
    Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.4.4 - Synaptics Incorporated)
    TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
    TuneUp Utilities Language Pack (en-US) (x32 Version: 12.0.3600.104 - TuneUp Software) Hidden
    Ultra Street Fighter IV (HKLM-x32\...\VWx0cmFTdHJlZXRGaWdodGVySVY=_is1) (Version: 1 - )
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
    Validity WBF DDK (HKLM\...\{7C54D017-21BB-43AE-9746-33E78AF4A425}) (Version: 4.3.118.0 - Validity Sensors, Inc.)
    Video Downloader (x32 Version: 1.0.0 - RealNetworks) Hidden
    Video Padlock (HKLM-x32\...\Video Padlock1.20) (Version: 1.20 - Applian Technologies Inc.)
    Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
    Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
    VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
    Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.5.0.0 - Azureus Software, Inc.)
    WebM Project Directshow Filters (HKU\S-1-5-21-1331771087-30956632-3492572574-1000\...\webmdshow) (Version: - )
    Wheel of Fortune 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    WildTangent Games App (HP Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden
    Windows Installer Clean Up (HKLM-x32\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
    WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
    Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
    YouWave for Android (HKLM-x32\...\YouWave) (Version: - )
    Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


    ==================== Restore Points =========================

    22-12-2014 10:53:52 Windows Update
    25-12-2014 13:31:28 Windows Update
    31-12-2014 14:43:35 Windows Update
    02-01-2015 16:11:43 Advanced-System Protector
    02-01-2015 19:51:33 Installed AVG 2015
    02-01-2015 19:53:26 Installed AVG 2015
    03-01-2015 13:52:33 Checkpoint by HitmanPro
    03-01-2015 14:19:31 Checkpoint by HitmanPro

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 20:34 - 2015-01-02 18:26 - 00001503 _RASH C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost
    192.95.55.229 www.google-analytics.com.
    192.95.55.229 google-analytics.com.
    192.95.55.229 connect.facebook.net.
    95.141.32.66 www.google-analytics.com.
    95.141.32.66 google-analytics.com.
    95.141.32.66 connect.facebook.net.
    85.25.107.101 www.google-analytics.com.
    85.25.107.101 google-analytics.com.
    85.25.107.101 connect.facebook.net.


    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {02FAB4B2-6973-4503-A8E6-0890FD3EC531} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-07] (Symantec Corporation)
    Task: {11AACBCA-4C29-4824-B28C-F3B29E58DCF4} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
    Task: {15A42BD6-7C9E-4490-B51B-E66CE07BFA79} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1331771087-30956632-3492572574-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
    Task: {1A7A9818-44CA-4BAA-AC45-0E1D5E693FB8} - System32\Tasks\{940B76F3-771D-439E-B8CF-B2D5F95C12A7} => pcalua.exe -a "C:\Users\CASZ\Downloads\Downloads X\Games\PC Games\Star Wars Jedi Knight - Jedi Academy (2 Cds)\Knights of the Force 2.0 Add-On\KotF2.0Setup\KotFSetup.exe" -d "C:\Users\CASZ\Downloads\Downloads X\Games\PC Games\Star Wars Jedi Knight - Jedi Academy (2 Cds)\Knights of the Force 2.0 Add-On\KotF2.0Setup"
    Task: {2E3BC37F-1274-4914-9B49-58BCE94FA457} - System32\Tasks\HPCeeScheduleForDDZT-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
    Task: {2F130054-8017-47DA-85E6-2D5F374116E5} - System32\Tasks\ASO-System Protector => C:\Program Files (x86)\Advanced System Optimizer 3\SystemProtector.exe
    Task: {45E98517-406A-4900-80C6-F55BCFEF636B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {4CE624F6-1B0B-4919-849C-286486AEBEAF} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] ()
    Task: {50637026-21AD-4285-ACDA-B31A06AC69E5} - System32\Tasks\HPCeeScheduleForCASZ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
    Task: {5B48B9F8-7FA7-4543-8532-7C0587FE42FB} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-07] (Symantec Corporation)
    Task: {6D880609-F613-4991-A3E5-920360AC5C32} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1331771087-30956632-3492572574-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.)
    Task: {6FEF8415-CE35-4FEF-A484-F75C1B328194} - System32\Tasks\ASO-AutoCheckUpdate7Days => C:\Program Files (x86)\Advanced System Optimizer 3\CheckUpdate.exe
    Task: {703C104E-7C98-4B68-BA13-A51D033CC44E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-16] (Adobe Systems Incorporated)
    Task: {8060E0C6-5CA2-4D23-BEF5-15DB9A9B167A} - System32\Tasks\{2C5CAD68-D51B-4724-9FA2-80D27A099700} => pcalua.exe -a C:\Users\CASZ\Downloads\msicuu2.exe -d C:\Users\CASZ\Downloads
    Task: {82DDA65D-19B4-47A7-ADF1-D4B0008BA3B8} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
    Task: {854D98D8-ACB9-4D5D-AE9C-E3E96907413D} - System32\Tasks\{6D91DB24-4B37-495B-8DDC-07BB4DDBDA04} => pcalua.exe -a "C:\Program Files (x86)\TuneUp Utilities 2013\TUUUnInstallHelper.exe" -d "C:\Program Files (x86)\TuneUp Utilities 2013"
    Task: {8AEB66D0-2963-4FD6-8CDC-59BE95D27B06} - System32\Tasks\{2C9763E2-5FBC-47A8-A553-BABD8F99B48A} => Iexplore.exe http://www.skype.com/go/downloading?source=lightinstaller&amp;ver=5.5.0.124.259&amp;LastError=404
    Task: {8DF2EEB5-7B8E-4B14-BEEA-CB5E0D080FCA} - System32\Tasks\ASO-OneClickCare => C:\Program Files (x86)\Advanced System Optimizer 3\ASO3.exe
    Task: {8E902994-9A33-469D-BCC7-C903EF13AF40} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-10-26] (CyberLink)
    Task: {92AF8A81-D9D4-4F8F-A965-790A595B6B23} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: {A6E8FFE2-A1C0-4481-BCE7-5D913FCF04F3} - System32\Tasks\4486 => Wscript.exe C:\Users\CASZ\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
    Task: {A7D99DDE-50DC-4836-A5B2-D971F4FEF0B4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-12] (Google Inc.)
    Task: {A8349B29-E690-41E1-818D-0958D1027CAA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-12] (Google Inc.)
    Task: {AB8AB467-2B14-445F-81B9-FCBA233CD076} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Ghost Resign Task => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\HPResignFileLoader.exe [2014-12-16] (Microsoft)
    Task: {ACF3AE36-C8A9-4EFF-B4BD-5FD07F507255} - System32\Tasks\AdobeAAMUpdater-1.0-DDZT-HP-CASZ => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
    Task: {AD923178-AF6C-4E1F-BDD2-07C15CA49D80} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2014-12-16] (Microsoft)
    Task: {C0719697-7B6C-4CF4-B38B-2AA480E9BFAF} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20] (Adobe Systems Incorporated)
    Task: {D5A32D07-6BC6-4014-909E-546B0FEDDB48} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-02-23] (Hewlett-Packard Company)
    Task: {E00B665A-9B43-4CC2-B9D1-C0F6D96A498E} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{E7AC64EB-B3B4-4DA3-8BBA-002A7D0AB8F5}.exe
    Task: {E098DBE3-1336-4CDF-A75D-7B3CACE02BA5} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
    Task: {E9F505A6-33EC-4F70-8630-B52986040CE1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-02-23] (Hewlett-Packard Company)
    Task: {F6EBC5A6-9771-4BF8-9AEE-0D284753B78D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-02-23] (Hewlett-Packard Company)
    Task: {F7F383C4-6867-4F7F-AF66-C2842B850421} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1331771087-30956632-3492572574-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
    Task: {F8D39EBF-5443-426D-B8B6-528694A0BF03} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1331771087-30956632-3492572574-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [2014-10-26] (RealNetworks, Inc.)
    Task: {FAC7BF6C-C12D-4494-8528-48C3D7A76364} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1331771087-30956632-3492572574-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2014-10-26] (RealNetworks, Inc.)
    Task: {FF2D0F32-6D7A-437B-8911-96E4B40B7537} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\ASO-AutoCheckUpdate7Days.job => C:\Program Files (x86)\Advanced System Optimizer 3\CheckUpdate.exe
    Task: C:\Windows\Tasks\ASO-OneClickCare.job => C:\Program Files (x86)\Advanced System Optimizer 3\ASO3.exe
    Task: C:\Windows\Tasks\ASO-System Protector.job => C:\Program Files (x86)\Advanced System Optimizer 3\SystemProtector.exe
    Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{E7AC64EB-B3B4-4DA3-8BBA-002A7D0AB8F5}.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForCASZ.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForDDZT-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
     
  23. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    FRST Additional Part 2

    ==================== Loaded Modules (whitelisted) =============

    2011-01-05 13:53 - 2011-01-05 13:53 - 01501696 ____N () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
    2014-01-08 14:50 - 2011-04-10 23:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll
    2014-10-26 22:59 - 2014-10-26 22:59 - 00039568 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
    2014-10-30 05:41 - 2014-10-30 05:41 - 00031856 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
    2011-06-12 23:21 - 2011-01-27 10:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2011-01-05 13:53 - 2011-01-05 13:53 - 01501696 ____N () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
    2013-01-16 21:54 - 2007-09-02 13:58 - 00495616 ____N () C:\Program Files (x86)\RocketDock\RocketDock.exe
    2010-07-29 20:39 - 2010-07-29 20:39 - 00173856 ____N () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
    2012-11-04 08:25 - 2012-11-04 08:25 - 00041160 ____N () C:\Program Files\Rainmeter\Rainmeter.exe
    2012-11-04 08:25 - 2012-11-04 08:25 - 00736968 ____N () C:\Program Files\Rainmeter\Rainmeter.dll
    2012-11-04 08:23 - 2012-11-04 08:23 - 00056832 ____N () C:\Program Files\Rainmeter\Plugins\WebParser.DLL
    2012-11-04 08:23 - 2012-11-04 08:23 - 00011776 ____N () C:\Program Files\Rainmeter\Plugins\PowerPlugin.DLL
    2012-11-04 08:23 - 2012-11-04 08:23 - 00020480 ____N () C:\Program Files\Rainmeter\Plugins\WifiStatus.DLL
    2012-11-04 08:23 - 2012-11-04 08:23 - 00013824 ____N () C:\Program Files\Rainmeter\Plugins\SysInfo.DLL
    2010-06-24 03:21 - 2010-06-24 03:21 - 01102336 ____N () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll
    2011-03-14 15:21 - 2011-03-14 15:21 - 00016384 ____N () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
    2011-03-15 10:57 - 2011-03-15 10:57 - 00243712 ____N () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
    2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 ____N () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
    2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 ____N () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
    2013-04-05 11:58 - 2013-04-05 11:58 - 00954696 ____N () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
    2014-10-29 19:06 - 2014-10-29 19:06 - 00560192 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe
    2012-10-11 21:56 - 2012-10-11 21:56 - 00087952 ____N () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2012-10-11 21:56 - 2012-10-11 21:56 - 01242512 ____N () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2015-01-02 18:15 - 2015-01-02 18:15 - 00036352 _____ () C:\Users\CASZ\AppData\Local\Imcxsoft\LibcrtKit32.dll
    2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 ____N () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
    2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 ____N () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
    2011-11-11 17:20 - 2011-11-11 17:20 - 00014848 _____ () C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\WindowsEventLogWriter.dll
    2011-11-11 17:17 - 2011-11-11 17:17 - 00179344 _____ () C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsEngineRes409.dll
    2011-09-16 14:40 - 2011-09-16 14:40 - 00005120 _____ () C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\throttle.dll
    2011-11-11 17:32 - 2011-11-11 17:32 - 00124560 _____ () C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsSQLBackupRestore.dll
    2011-11-11 17:39 - 2011-11-11 17:39 - 00082576 _____ () C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsHyperVBackupRestore.dll
    2014-12-15 10:42 - 2014-12-15 10:42 - 00865880 _____ () c:\program files (x86)\real\realplayer\RPDS\Plugins\cldplin.dll
    2014-10-30 05:41 - 2014-10-30 05:41 - 00035976 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll
    2014-10-30 05:41 - 2014-10-30 05:41 - 00039560 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll
    2014-10-30 05:41 - 2014-10-30 05:41 - 00032888 _____ () C:\Program Files (x86)\Real\UpdateService\RPDSUpdatePlugin.dll
    2013-01-16 21:54 - 2007-09-02 13:57 - 00069632 ____N () C:\Program Files (x86)\RocketDock\RocketDock.dll
    2014-08-31 10:00 - 2014-11-11 12:48 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
    2014-08-31 10:00 - 2014-11-11 12:48 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
    2014-08-31 10:00 - 2014-11-11 12:48 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
    2013-08-21 13:18 - 2014-11-11 12:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
    2014-05-22 14:57 - 2014-11-18 14:23 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll
    2014-08-31 10:00 - 2014-11-11 12:48 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
    2014-08-31 10:00 - 2014-11-11 12:48 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
    2013-08-28 12:47 - 2014-11-18 14:23 - 00690880 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
    2010-06-24 03:19 - 2010-06-24 03:19 - 00514570 ____N () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll
    2014-10-16 13:26 - 2014-10-16 13:26 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9b1cac8d98bd69d3e56a26ff2f96f266\IsdiInterop.ni.dll
    2011-06-12 23:21 - 2011-01-12 19:56 - 00058880 ____N () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
    2013-08-07 10:31 - 2014-11-11 12:48 - 34589888 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
    2014-12-09 11:20 - 2014-12-09 11:20 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
    2014-12-15 10:42 - 2014-12-15 10:42 - 00573528 _____ () c:\program files (x86)\real\realplayer\RPDS\Lib\r1api.dll
    2014-10-29 19:01 - 2014-10-29 19:01 - 01382048 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\cpprest100_1_2.dll
    2014-12-16 21:49 - 2014-12-16 21:49 - 16843952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\Users\CASZ\Local Settings:jbgNjI2dNUkAJcElkxdrFHH
    AlternateDataStreams: C:\Users\CASZ\AppData\Local:jbgNjI2dNUkAJcElkxdrFHH
    AlternateDataStreams: C:\Users\CASZ\AppData\Local\Application Data:jbgNjI2dNUkAJcElkxdrFHH

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)

    MSCONFIG\Services: TuneUp.UtilitiesSvc => 2

    ========================= Accounts: ==========================

    Administrator (S-1-5-21-1331771087-30956632-3492572574-500 - Administrator - Disabled)
    CASZ (S-1-5-21-1331771087-30956632-3492572574-1000 - Administrator - Enabled) => C:\Users\CASZ
    fbwuser (S-1-5-21-1331771087-30956632-3492572574-1003 - Limited - Disabled) => C:\Users\fbwuser
    Guest (S-1-5-21-1331771087-30956632-3492572574-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1331771087-30956632-3492572574-1002 - Limited - Enabled)

    ==================== Faulty Device Manager Devices =============

    Name: Hotspot Shield Routing Driver 6
    Description: Hotspot Shield Routing Driver 6
    Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Manufacturer:
    Service: HssDRV6
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (01/03/2015 02:19:31 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak). hr = 0x80070539, The security ID structure is invalid.
    .


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {991233b7-6611-4e0b-bf21-6afeb912db28}

    Error: (01/03/2015 01:52:33 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak). hr = 0x80070539, The security ID structure is invalid.
    .


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {86c353c4-1fff-4603-ba56-b41a9d64e17a}

    Error: (01/03/2015 01:22:03 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
    Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24
    Exception code: 0xc0000374
    Fault offset: 0x00000000000c4102
    Faulting process id: 0x504
    Faulting application start time: 0xExplorer.EXE0
    Faulting application path: Explorer.EXE1
    Faulting module path: Explorer.EXE2
    Report Id: Explorer.EXE3

    Error: (01/03/2015 01:16:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/03/2015 11:53:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/03/2015 00:50:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/02/2015 08:22:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/02/2015 08:15:20 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
    Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24
    Exception code: 0xc0000374
    Fault offset: 0x00000000000c4102
    Faulting process id: 0xafc
    Faulting application start time: 0xExplorer.EXE0
    Faulting application path: Explorer.EXE1
    Faulting module path: Explorer.EXE2
    Report Id: Explorer.EXE3

    Error: (01/02/2015 07:53:56 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak). hr = 0x80070539, The security ID structure is invalid.
    .


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {ad9a3ae3-dc9e-4c29-a35d-9320a027e06b}

    Error: (01/02/2015 07:51:36 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak). hr = 0x80070539, The security ID structure is invalid.
    .


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {ad9a3ae3-dc9e-4c29-a35d-9320a027e06b}


    System errors:
    =============
    Error: (01/03/2015 01:23:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Easybits Services for Windows service terminated unexpectedly. It has done this 1 time(s).

    Error: (01/03/2015 01:16:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    HssDRV6

    Error: (01/03/2015 01:15:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Freemake Improver service failed to start due to the following error:
    %%1053

    Error: (01/03/2015 01:15:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the Freemake Improver service to connect.

    Error: (01/03/2015 01:11:34 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )
    Description: %%860 Real-Time Protection feature has encountered an error and failed.

    Feature: %%834

    Error Code: 0x8007043c

    Error description: This service cannot be started in Safe Mode

    Reason: %%858

    Error: (01/03/2015 01:11:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.

    Error: (01/03/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068

    Error: (01/03/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068

    Error: (01/03/2015 01:11:18 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068

    Error: (01/03/2015 01:09:16 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
    Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
    %%1068


    Microsoft Office Sessions:
    =========================
    Error: (01/03/2015 02:19:31 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak)0x80070539, The security ID structure is invalid.


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {991233b7-6611-4e0b-bf21-6afeb912db28}

    Error: (01/03/2015 01:52:33 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak)0x80070539, The security ID structure is invalid.


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {86c353c4-1fff-4603-ba56-b41a9d64e17a}

    Error: (01/03/2015 01:22:03 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c000037400000000000c410250401d02789782221fdC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dllcbafeb9f-937d-11e4-ae22-2c27d7ac6547

    Error: (01/03/2015 01:16:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/03/2015 11:53:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/03/2015 00:50:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/02/2015 08:22:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (01/02/2015 08:15:20 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c000037400000000000c4102afc01d026efc5047fd2C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll5d69dcdc-92ee-11e4-997a-2c27d7ac6547

    Error: (01/02/2015 07:53:56 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak)0x80070539, The security ID structure is invalid.


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {ad9a3ae3-dc9e-4c29-a35d-9320a027e06b}

    Error: (01/02/2015 07:51:36 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: ConvertStringSidToSid(S-1-5-21-1331771087-30956632-3492572574-1000.bak)0x80070539, The security ID structure is invalid.


    Operation:
    OnIdentify event
    Gathering Writer Data

    Context:
    Execution Context: Shadow Copy Optimization Writer
    Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
    Writer Name: Shadow Copy Optimization Writer
    Writer Instance ID: {ad9a3ae3-dc9e-4c29-a35d-9320a027e06b}


    CodeIntegrity Errors:
    ===================================
    Date: 2013-03-06 16:17:35.284
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:17:34.956
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:17:34.597
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:17:34.160
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:16:53.590
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:16:28.673
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:14:28.740
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:14:28.131
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:14:27.710
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.

    Date: 2013-03-06 16:14:27.289
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\AESTAR64.dll because the set of per-page image hashes could not be found on the system.
     
  24. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    You said you uninstalled two of your AV programs but I still see all three there.
    What's the story there?
     
  25. DPCTAgentZ

    DPCTAgentZ TS Rookie Topic Starter Posts: 21

    They are uninstalled, they are not anywhere on my PC, just the setups, maybe its an older log that I pasted; Which log is showing you that cause maybe I pasted an older one, do I run a new scan?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...