TechSpot

Internet access gets blocked after working for few min.

By Vaibhav Gupta
May 1, 2013
  1. BAM Log
    --------------------------------------
    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.04.29.05

    Windows 7 Service Pack 1 x64 NTFS (Safe Mode)
    Internet Explorer 10.0.9200.16540
    vibs :: VIBS-PC [administrator]

    4/29/2013 9:07:04 PM
    mbam-log-2013-04-29 (21-07-04).txt

    Scan type: Full scan (C:\|D:\|E:\|F:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 645527
    Time elapsed: 1 hour(s), 7 minute(s), 6 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 6
    D:\MMI\Sygic KEYGEN 2010 FOR V8.16\SygicKG_win.exe (Worm.AutoRun) -> No action taken.
    E:\Software\XP Related\Removing windows xp validation activation\amd64\AntiWPA.Dll (PUP.Wpakill) -> No action taken.
    E:\Software\XP Related\Removing windows xp validation activation\x86\AntiWPA.Dll (PUP.Wpakill) -> No action taken.
    D:\downloads\tetris setup.exe (PUP.AdBundle) -> Quarantined and deleted successfully.
    E:\Work Softwares\Altova MapForce Enterprise 2010 12.3\MESMERiZE\keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
    E:\Work Softwares\Altova MapForce Enterprise 2010 12.3\MESMERiZE\patch.exe (PUP.Hacktool.Patcher) -> Quarantined and deleted successfully.

    (end)

    ---------------------------------------------------------------------------------------------------------------------------
    DDS Log
    --------------------------------------
    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.21.2
    Run by vibs at 20:36:05 on 2013-04-29
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.5630.3768 [GMT 5.5:30]
    .
    AV: AVG Internet Security 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: AVG Internet Security 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    FW: AVG Internet Security 2013 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
    C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files (x86)\My Connection\BackgroundService\ServiceManager.exe
    C:\Program Files (x86)\AVG\AVG2013\avgfws.exe
    C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
    C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
    C:\Windows\system32\CISVC.EXE
    C:\ProgramData\DatacardService\HWDeviceService64.exe
    C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
    C:\ProgramData\Reliance Netconnect+\OnlineUpdate\ouc.exe
    C:\Windows\SysWOW64\vmnat.exe
    C:\Windows\SysWOW64\vmnetdhcp.exe
    C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
    C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\spool\drivers\x64\3\E_IATIGGI.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\ProgramData\DatacardService\DCSHelper.exe
    C:\Program Files (x86)\My Connection\BackgroundService\ModemListener.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    C:\Program Files (x86)\AVG\AVG2013\avgui.exe
    C:\Program Files (x86)\My Connection\ModemApplication.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
    C:\Program Files (x86)\Orbitdownloader\orbitdm.exe
    C:\Program Files (x86)\Orbitdownloader\orbitnet.exe
    C:\Windows\system32\NOTEPAD.EXE
    C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    mWinlogon: Userinit = userinit.exe
    BHO: Octh Class: {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL
    BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
    TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
    uRun: [EPSON TX121 Series] C:\Windows\System32\spool\DRIVERS\x64\3\E_IATIGGI.EXE /FU "C:\Windows\TEMP\E_S9D38.tmp" /EF "HKCU"
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    mRun: [Alcatel Wave ModemListener] C:\Program Files (x86)\My Connection\BackgroundService\ModemListener.exe start
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
    mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
    IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    LSP: %windir%\system32\vsocklib.dll
    DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1366989215214
    TCP: Interfaces\{E03A5559-97BA-4CD2-986A-47B1C3C013CE} : NameServer = 10.169.30.244 10.170.30.245
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
    SSODL: WebCheck - <orphaned>
    x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-BHO: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
    x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
    x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-TB: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
    x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\
    FF - plugin: C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
    FF - plugin: C:\Users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
    FF - ExtSQL: 2013-04-21 00:58; wrc@avast.com; C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF - ExtSQL: 2013-04-26 18:13; {e001c731-5e37-4538-a5cb-8168736a2360}; C:\Users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-4-21 65336]
    R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]
    R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]
    R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-11-15 111968]
    R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]
    R0 vsock;vSockets Driver;C:\Windows\System32\drivers\vsock.sys [2013-4-23 70296]
    R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-4-21 1025808]
    R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-4-21 377920]
    R1 Avgfwfd;AVG network filter service;C:\Windows\System32\drivers\avgfwd6a.sys [2012-9-4 50296]
    R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]
    R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]
    R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]
    R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-5-14 759048]
    R2 Alcatel Wave Modem Device Helper;Alcatel Wave Modem Device Helper;C:\Program Files (x86)\My Connection\BackgroundService\ServiceManager.exe -start --> C:\Program Files (x86)\My Connection\BackgroundService\ServiceManager.exe -start [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-4-20 203776]
    R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-4-21 33400]
    R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-4-21 80816]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-4-21 45248]
    R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [2012-12-10 1342024]
    R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
    R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
    R2 HWDeviceService64.exe;HWDeviceService64.exe;C:\ProgramData\DatacardService\HWDeviceService64.exe [2011-3-14 346976]
    R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176]
    R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
    R3 huawei_enumerator;huawei_enumerator;C:\Windows\System32\drivers\ew_jubusenum.sys [2013-4-26 86016]
    R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;C:\Windows\System32\drivers\jrdusbser.sys [2013-4-21 120832]
    R3 Ph3xIB64;Philips 713x Inbox PCI TV Card;C:\Windows\System32\drivers\Ph3xIB64.sys [2009-6-11 1627520]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-1 187392]
    S2 Reliance Netconnect. RunOuc;Reliance Netconnect. OUC;C:\Program Files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe [2013-4-26 218624]
    S3 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-4-21 178624]
    S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\System32\drivers\ew_hwusbdev.sys [2013-4-26 117248]
    S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;C:\Windows\System32\drivers\netr7364.sys [2011-10-5 729152]
    S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-1 178824]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 27136]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-4-20 59392]
    .
    =============== Created Last 30 ================
    .
    2013-04-26 12:43:59 -------- d-----w- C:\Users\vibs\AppData\Roaming\QuickScan
    2013-04-26 12:00:46 -------- d-----w- C:\ProgramData\Reliance Netconnect
    2013-04-26 12:00:25 -------- d-----w- C:\ProgramData\Reliance Netconnect+
    2013-04-26 11:57:57 -------- d-----w- C:\ProgramData\DatacardService
    2013-04-24 13:38:24 866720 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
    2013-04-24 13:38:18 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2013-04-24 03:33:05 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
    2013-04-24 03:32:42 5073256 ----a-w- C:\Windows\System32\d3dx9_35.dll
    2013-04-24 03:32:42 3727720 ----a-w- C:\Windows\SysWow64\d3dx9_35.dll
    2013-04-24 03:29:51 -------- d-----w- C:\Program Files (x86)\Sony
    2013-04-24 03:29:47 -------- d-----w- C:\ProgramData\Sony Corporation
    2013-04-24 02:56:39 -------- d-----w- C:\ProgramData\UDL
    2013-04-24 02:55:43 -------- d-----w- C:\Program Files\Epson Software
    2013-04-24 02:53:50 -------- d-----w- C:\Program Files (x86)\Epson Software
    2013-04-24 02:52:56 -------- d-----w- C:\Users\vibs\AppData\Local\ABBYY
    2013-04-24 02:52:11 -------- d-----w- C:\ProgramData\ABBYY
    2013-04-24 02:52:11 -------- d-----w- C:\Program Files (x86)\Common Files\ABBYY
    2013-04-24 02:52:11 -------- d-----w- C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint
    2013-04-24 02:50:22 -------- d-----w- C:\Program Files (x86)\epson
    2013-04-23 10:40:04 -------- d-----w- C:\ProgramData\HitmanPro
    2013-04-23 10:37:25 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
    2013-04-23 10:37:25 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
    2013-04-23 10:32:50 -------- d-----w- C:\Users\vibs\AppData\Local\Programs
    2013-04-23 10:14:31 -------- d-----w- C:\Users\vibs\AppData\Roaming\Malwarebytes
    2013-04-23 10:14:14 -------- d-----w- C:\ProgramData\Malwarebytes
    2013-04-23 10:14:12 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2013-04-23 10:14:11 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-04-23 09:07:07 -------- d-----w- C:\Users\vibs\AppData\Local\VMware
    2013-04-23 09:06:30 70296 ----a-w- C:\Windows\System32\drivers\vsock.sys
    2013-04-23 09:06:30 67224 ----a-w- C:\Windows\System32\vsocklib.dll
    2013-04-23 09:06:30 63128 ----a-w- C:\Windows\SysWow64\vsocklib.dll
    2013-04-23 09:06:26 67664 ----a-w- C:\Windows\System32\drivers\vmx86.sys
    2013-04-23 09:06:25 33360 ----a-w- C:\Windows\System32\drivers\VMkbd.sys
    2013-04-23 09:06:24 31824 ----a-w- C:\Windows\System32\drivers\VMparport.sys
    2013-04-23 09:05:50 357456 ----a-w- C:\Windows\SysWow64\vmnetdhcp.exe
    2013-04-23 09:05:44 436304 ----a-w- C:\Windows\SysWow64\vmnat.exe
    2013-04-23 09:05:44 30800 ----a-w- C:\Windows\System32\drivers\vmnetuserif.sys
    2013-04-23 09:05:40 933968 ----a-w- C:\Windows\System32\vnetlib64.dll
    2013-04-23 09:05:33 52376 ----a-w- C:\Windows\System32\drivers\hcmon.sys
    2013-04-23 09:05:08 -------- d-----w- C:\Program Files\Common Files\VMware
    2013-04-23 09:04:52 -------- d-----w- C:\Program Files (x86)\VMware
    2013-04-23 09:04:52 -------- d-----w- C:\Program Files (x86)\Common Files\VMware
    2013-04-22 14:29:40 -------- d-----w- C:\Users\vibs\AppData\Local\ElevatedDiagnostics
    2013-04-22 14:17:12 -------- d-----w- C:\ProgramData\eMule
    2013-04-22 13:03:49 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
    2013-04-22 13:03:08 -------- d-----w- C:\ProgramData\regid.1991-06.com.microsoft
    2013-04-22 13:01:54 -------- d-----w- C:\Program Files\Microsoft SQL Server
    2013-04-22 12:57:03 -------- d-----w- C:\Program Files\Microsoft Analysis Services
    2013-04-22 12:57:03 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
    2013-04-22 12:56:28 -------- d-----w- C:\Users\vibs\AppData\Local\Microsoft Help
    2013-04-22 12:40:13 -------- d-----w- C:\Users\vibs\.VirtualBox
    2013-04-22 12:39:14 237840 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys
    2013-04-22 12:38:55 120080 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys
    2013-04-22 12:38:44 -------- d-----w- C:\Program Files\Oracle
    2013-04-22 03:31:10 26520 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugin-hang-ui.exe
    2013-04-22 01:44:23 -------- d-----w- C:\Users\vibs\AppData\Roaming\AVG2013
    2013-04-22 01:40:45 -------- d-----w- C:\Users\vibs\AppData\Roaming\TuneUp Software
    2013-04-22 01:40:00 -------- d-----w- C:\ProgramData\AVG2013
    2013-04-22 01:38:57 -------- d-----w- C:\Program Files (x86)\AVG
    2013-04-21 14:25:48 -------- d-----w- C:\Users\vibs\AppData\Local\Adobe
    2013-04-21 13:00:16 -------- d-----w- C:\Users\vibs\AppData\Local\Diagnostics
    2013-04-21 07:28:27 -------- d-----w- C:\Windows\Panther
    2013-04-21 07:26:27 -------- d-----w- C:\Users\vibs\Tracing
    2013-04-21 07:20:54 -------- d-----w- C:\Program Files (x86)\Microsoft
    2013-04-21 07:20:36 -------- d-----w- C:\Program Files (x86)\Windows Live SkyDrive
    2013-04-21 07:19:59 -------- d-----w- C:\Windows\PCHEALTH
    2013-04-21 07:12:37 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live
    2013-04-21 06:40:15 0 ----a-w- C:\Windows\ativpsrm.bin
    2013-04-21 04:42:39 -------- d-----w- C:\Program Files (x86)\OpenOffice.org 3
    2013-04-21 04:20:19 -------- d-----w- C:\Program Files\Microsoft Games
    2013-04-21 04:16:08 -------- d-----w- C:\Users\vibs\AppData\Local\Macromedia
    2013-04-21 03:36:37 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
    2013-04-21 03:22:08 605552 ----a-w- C:\Windows\System32\winload.exe
    2013-04-21 03:22:08 566208 ----a-w- C:\Windows\System32\winresume.efi
    2013-04-21 03:22:08 518672 ----a-w- C:\Windows\System32\winresume.exe
    2013-04-21 03:22:07 642944 ----a-w- C:\Windows\System32\winload.efi
    2013-04-21 03:22:07 20352 ----a-w- C:\Windows\System32\kdusb.dll
    2013-04-21 03:22:07 19328 ----a-w- C:\Windows\System32\kd1394.dll
    2013-04-21 03:22:07 17792 ----a-w- C:\Windows\System32\kdcom.dll
    2013-04-21 03:22:04 395776 ----a-w- C:\Windows\System32\webio.dll
    2013-04-21 03:22:04 314880 ----a-w- C:\Windows\SysWow64\webio.dll
    2013-04-21 03:22:02 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
    2013-04-21 03:20:41 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2013-04-21 03:20:41 331776 ----a-w- C:\Windows\System32\oleacc.dll
    2013-04-21 03:20:41 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
    2013-04-21 03:20:40 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2013-04-21 03:19:40 1732096 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
    2013-04-21 03:19:40 1367552 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19:39 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19:38 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
    2013-04-21 03:19:38 1393664 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
    2013-04-21 02:38:18 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-21 02:27:07 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
    2013-04-21 02:27:07 46080 ----a-w- C:\Windows\System32\atmlib.dll
    2013-04-21 02:27:07 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
    2013-04-21 02:27:06 367616 ----a-w- C:\Windows\System32\atmfd.dll
    2013-04-21 02:27:06 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll
    2013-04-21 02:27:06 100864 ----a-w- C:\Windows\System32\fontsub.dll
    2013-04-21 02:23:32 81408 ----a-w- C:\Windows\System32\imagehlp.dll
    2013-04-21 02:23:32 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
    2013-04-21 02:23:32 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
    2013-04-21 02:23:31 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
    2013-04-21 02:23:31 5120 ----a-w- C:\Windows\System32\wmi.dll
    2013-04-21 02:23:19 691592 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2013-04-21 02:18:31 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{48D77485-AF34-4E15-9342-CBF204416DF2}\mpengine.dll
    2013-04-21 02:18:26 282744 ------w- C:\Windows\System32\MpSigStub.exe
    2013-04-21 02:16:42 1913192 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2013-04-21 02:16:41 376688 ----a-w- C:\Windows\System32\drivers\netio.sys
    2013-04-21 02:16:41 288088 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
    2013-04-21 02:16:02 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2013-04-21 02:16:02 2048 ----a-w- C:\Windows\System32\tzres.dll
    2013-04-21 02:14:54 458704 ----a-w- C:\Windows\System32\drivers\cng.sys
    2013-04-21 02:13:59 613888 ----a-w- C:\Windows\System32\psisdecd.dll
    2013-04-21 02:12:47 723456 ----a-w- C:\Windows\System32\EncDec.dll
    2013-04-21 02:12:47 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
    2013-04-21 02:12:05 1464320 ----a-w- C:\Windows\System32\crypt32.dll
    2013-04-21 02:12:04 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll
    2013-04-21 02:12:03 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
    2013-04-21 02:12:03 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
    2013-04-21 02:12:03 140288 ----a-w- C:\Windows\System32\cryptnet.dll
    2013-04-21 02:12:03 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
    2013-04-21 02:10:13 956928 ----a-w- C:\Windows\System32\localspl.dll
    2013-04-21 02:10:02 634880 ----a-w- C:\Windows\System32\msvcrt.dll
    2013-04-21 02:10:01 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
    2013-04-21 02:10:00 59392 ----a-w- C:\Windows\System32\browcli.dll
    2013-04-21 02:10:00 41984 ----a-w- C:\Windows\SysWow64\browcli.dll
    2013-04-21 02:10:00 136704 ----a-w- C:\Windows\System32\browser.dll
    2013-04-21 02:09:45 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
    2013-04-21 02:08:55 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2013-04-21 02:08:53 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2013-04-21 02:08:51 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
    2013-04-21 02:08:51 43520 ----a-w- C:\Windows\System32\csrsrv.dll
    2013-04-21 02:08:51 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2013-04-21 02:08:51 112640 ----a-w- C:\Windows\System32\smss.exe
    2013-04-21 02:08:42 -------- d-----w- C:\Program Files\Common Files\EPSON
    2013-04-21 02:08:39 -------- d-----w- C:\ProgramData\EPSON
    2013-04-21 02:06:57 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2013-04-21 02:06:56 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2013-04-21 02:06:16 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
    2013-04-21 02:05:44 1731920 ----a-w- C:\Windows\System32\ntdll.dll
    2013-04-21 02:05:44 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll
    2013-04-21 02:05:33 77312 ----a-w- C:\Windows\System32\packager.dll
    2013-04-21 02:05:32 67072 ----a-w- C:\Windows\SysWow64\packager.dll
    2013-04-21 02:01:21 -------- d-----w- C:\Users\vibs\AppData\Local\Mozilla
    2013-04-20 19:38:54 2622464 ----a-w- C:\Windows\System32\wucltux.dll
    2013-04-20 19:38:48 99840 ----a-w- C:\Windows\System32\wudriver.dll
    2013-04-20 19:38:42 36864 ----a-w- C:\Windows\System32\wuapp.exe
    2013-04-20 19:38:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll
    2013-04-20 19:32:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
    2013-04-20 19:31:24 -------- d-----w- C:\Users\vibs\AppData\Roaming\ProgSense
    2013-04-20 19:31:14 -------- d-----w- C:\Users\vibs\AppData\Roaming\GrabPro
    2013-04-20 19:31:14 -------- d-----w- C:\downloads
    2013-04-20 19:31:11 -------- d-----w- C:\Program Files (x86)\Orbitdownloader
    2013-04-20 19:29:36 178624 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
    2013-04-20 19:29:33 65336 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
    2013-04-20 19:22:51 -------- d--h--w- C:\ProgramData\Common Files
    2013-04-20 19:22:51 -------- d-----w- C:\Users\vibs\AppData\Local\MFAData
    2013-04-20 19:22:51 -------- d-----w- C:\Users\vibs\AppData\Local\Avg2013
    2013-04-20 19:22:51 -------- d-----w- C:\ProgramData\MFAData
    2013-04-20 19:22:12 -------- d-----w- C:\Program Files (x86)\VideoLAN
    2013-04-20 19:21:49 788896 ----a-w- C:\Windows\SysWow64\deployJava1.dll
    2013-04-20 19:19:16 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2013-04-20 19:18:45 -------- d-sh--w- C:\Windows\Installer
    2013-04-20 19:10:37 120832 ----a-w- C:\Windows\System32\drivers\jrdusbser.sys
    2013-04-20 19:10:36 -------- d-----w- C:\Program Files (x86)\My Connection
    2013-04-20 18:52:53 -------- d-----w- C:\Windows\System32\SPReview
    2013-04-20 18:37:56 2560 ----a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
    2013-04-20 18:37:54 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
    2013-04-20 18:37:39 6144 ----a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
    2013-04-20 18:37:38 4608 ----a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
    2013-04-20 18:28:59 89088 ----a-w- C:\Windows\System32\amstream.dll
    2013-04-20 18:26:44 -------- d-----w- C:\Windows\System32\EventProviders
    .
    ==================== Find3M ====================
    .
    2013-04-21 02:44:34 92160 ----a-w- C:\Windows\System32\SetIEInstalledDate.exe
    2013-04-21 02:38:18 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-20 18:49:13 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
    2013-04-20 18:49:12 175616 ----a-w- C:\Windows\System32\msclmd.dll
    2013-03-15 13:44:04 131856 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp.sys
    2013-03-15 13:43:06 146704 ----a-w- C:\Windows\System32\drivers\VBoxNetFlt.sys
    2013-03-15 13:43:04 204048 ----a-w- C:\Windows\System32\VBoxNetFltNobj.dll
    2013-03-06 23:33:21 70992 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
    2013-03-06 23:33:21 1025808 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2013-03-06 23:33:20 80816 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2013-03-06 23:32:51 41664 ----a-w- C:\Windows\avastSS.scr
    2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys
    2013-02-25 20:57:48 62104 ----a-w- C:\Windows\System32\vmnetbridge.dll
    2013-02-25 20:57:48 48792 ----a-w- C:\Windows\System32\vnetinst.dll
    2013-02-25 20:57:48 45720 ----a-w- C:\Windows\System32\drivers\vmnetbridge.sys
    2013-02-25 20:57:48 24216 ----a-w- C:\Windows\System32\drivers\vmnet.sys
    2013-02-25 20:57:48 20120 ----a-w- C:\Windows\System32\drivers\vmnetadapter.sys
    2013-02-25 19:29:16 360528 ----a-w- C:\Windows\SysWow64\vmnc.dll
    2013-02-15 06:08:40 44032 ----a-w- C:\Windows\System32\tsgqec.dll
    2013-02-15 06:06:11 3717632 ----a-w- C:\Windows\System32\mstscax.dll
    2013-02-15 06:02:26 158720 ----a-w- C:\Windows\System32\aaclient.dll
    2013-02-15 04:37:10 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll
    2013-02-15 04:34:10 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll
    2013-02-15 03:25:51 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll
    2013-02-12 04:12:05 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys
    .
    ============= FINISH: 20:37:05.98 ===============
     
  2. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ================================

    [​IMG] I still need Attach.txt log from DDS.

    [​IMG] Your MBAM log says "No action taken".
    Re-run MBAM, fix all issues and post new log.

    [​IMG] You're running two AV programs, AVG and Avast.
    You must uninstall one of them.
    If AVG use AVG Remover: http://www.avg.com/us-en/utilities
     
  3. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    Here are the new logs
    -------------------------------------------------------------------------------------------------------------------------------------------------------
    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.05.02.03

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 10.0.9200.16540
    vibs :: VIBS-PC [administrator]

    5/2/2013 6:57:50 PM
    mbam-log-2013-05-02 (18-57-50).txt

    Scan type: Full scan (C:\|D:\|E:\|F:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra |

    Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 568864
    Time elapsed: 1 hour(s), 25 minute(s), 48 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 1
    D:\MMI\Sygic KEYGEN 2010 FOR V8.16\SygicKG_win.exe (Worm.AutoRun) -> Quarantined and deleted

    successfully.

    (end)
    ----------------------------------------------------------------------------------------------------------------------------------------------------
    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.21.2
    Run by vibs at 20:27:02 on 2013-05-02
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.5630.4376 [GMT 5.5:30]
    .
    AV: AVG Internet Security 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: AVG Internet Security 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    FW: AVG Internet Security 2013 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
    C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files (x86)\My Connection\BackgroundService\ServiceManager.exe
    C:\Program Files (x86)\AVG\AVG2013\avgfws.exe
    C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
    C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
    C:\Windows\system32\CISVC.EXE
    C:\ProgramData\DatacardService\HWDeviceService64.exe
    C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
    C:\ProgramData\Reliance Netconnect+\OnlineUpdate\ouc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\SysWOW64\vmnat.exe
    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
    C:\Windows\SysWOW64\vmnetdhcp.exe
    C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\ProgramData\DatacardService\DCSHelper.exe
    C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
    C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\spool\drivers\x64\3\E_IATIGGI.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\My Connection\BackgroundService\ModemListener.exe
    C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    C:\Program Files (x86)\AVG\AVG2013\avgui.exe
    C:\Program Files (x86)\My Connection\ModemApplication.exe
    C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
    C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    mWinlogon: Userinit = userinit.exe,
    BHO: Octh Class: {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL
    BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
    TB: Grab Pro: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll
    uRun: [EPSON TX121 Series] C:\Windows\System32\spool\DRIVERS\x64\3\E_IATIGGI.EXE /FU "C:\Windows\TEMP\E_S9D38.tmp" /EF "HKCU"
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    mRun: [Alcatel Wave ModemListener] C:\Program Files (x86)\My Connection\BackgroundService\ModemListener.exe start
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
    mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: &Download by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - C:\Program Files (x86)\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
    IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    LSP: %windir%\system32\vsocklib.dll
    DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1366989215214
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
    SSODL: WebCheck - <orphaned>
    x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-BHO: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
    x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
    x64-TB: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
    x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\
    FF - plugin: C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
    FF - plugin: C:\Users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
    FF - ExtSQL: 2013-04-26 18:13; {e001c731-5e37-4538-a5cb-8168736a2360}; C:\Users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
    FF - ExtSQL: 2013-05-01 11:08; {35379F86-8CCB-4724-AE33-4278DE266C70}; C:\Program Files (x86)\Orbitdownloader\addons\OneClickYouTubeDownloader
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]
    R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]
    R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-11-15 111968]
    R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]
    R0 vsock;vSockets Driver;C:\Windows\System32\drivers\vsock.sys [2013-4-23 70296]
    R1 Avgfwfd;AVG network filter service;C:\Windows\System32\drivers\avgfwd6a.sys [2012-9-4 50296]
    R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]
    R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]
    R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]
    R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-5-14 759048]
    R2 Alcatel Wave Modem Device Helper;Alcatel Wave Modem Device Helper;C:\Program Files (x86)\My Connection\BackgroundService\ServiceManager.exe -start --> C:\Program Files (x86)\My Connection\BackgroundService\ServiceManager.exe -start [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-4-20 203776]
    R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [2012-12-10 1342024]
    R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
    R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
    R2 HWDeviceService64.exe;HWDeviceService64.exe;C:\ProgramData\DatacardService\HWDeviceService64.exe [2011-3-14 346976]
    R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176]
    R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
    R3 huawei_enumerator;huawei_enumerator;C:\Windows\System32\drivers\ew_jubusenum.sys [2013-4-26 86016]
    R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;C:\Windows\System32\drivers\jrdusbser.sys [2013-4-21 120832]
    R3 Ph3xIB64;Philips 713x Inbox PCI TV Card;C:\Windows\System32\drivers\Ph3xIB64.sys [2009-6-11 1627520]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-1 187392]
    S2 Reliance Netconnect. RunOuc;Reliance Netconnect. OUC;C:\Program Files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe [2013-4-26 218624]
    S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\System32\drivers\ew_hwusbdev.sys [2013-4-26 117248]
    S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;C:\Windows\System32\drivers\netr7364.sys [2011-10-5 729152]
    S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-1 178824]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 27136]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-4-20 59392]
    .
    =============== Created Last 30 ================
    .
    2013-05-01 11:47:53 -------- d-----w- C:\Windows\System32\appmgmt
    2013-05-01 06:38:49 -------- d-s---w- C:\Windows\SysWow64\Microsoft
    2013-05-01 05:50:44 -------- d-----w- C:\Program Files\HitmanPro
    2013-04-26 12:43:59 -------- d-----w- C:\Users\vibs\AppData\Roaming\QuickScan
    2013-04-26 12:00:46 -------- d-----w- C:\ProgramData\Reliance Netconnect
    2013-04-26 12:00:25 -------- d-----w- C:\ProgramData\Reliance Netconnect+
    2013-04-26 11:57:57 -------- d-----w- C:\ProgramData\DatacardService
    2013-04-24 13:38:24 866720 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
    2013-04-24 13:38:18 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2013-04-24 03:33:05 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
    2013-04-24 03:32:42 5073256 ----a-w- C:\Windows\System32\d3dx9_35.dll
    2013-04-24 03:32:42 3727720 ----a-w- C:\Windows\SysWow64\d3dx9_35.dll
    2013-04-24 03:29:51 -------- d-----w- C:\Program Files (x86)\Sony
    2013-04-24 03:29:47 -------- d-----w- C:\ProgramData\Sony Corporation
    2013-04-24 02:56:39 -------- d-----w- C:\ProgramData\UDL
    2013-04-24 02:55:43 -------- d-----w- C:\Program Files\Epson Software
    2013-04-24 02:53:50 -------- d-----w- C:\Program Files (x86)\Epson Software
    2013-04-24 02:52:56 -------- d-----w- C:\Users\vibs\AppData\Local\ABBYY
    2013-04-24 02:52:11 -------- d-----w- C:\ProgramData\ABBYY
    2013-04-24 02:52:11 -------- d-----w- C:\Program Files (x86)\Common Files\ABBYY
    2013-04-24 02:52:11 -------- d-----w- C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint
    2013-04-24 02:50:22 -------- d-----w- C:\Program Files (x86)\epson
    2013-04-23 10:40:04 -------- d-----w- C:\ProgramData\HitmanPro
    2013-04-23 10:37:25 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
    2013-04-23 10:37:25 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
    2013-04-23 10:32:50 -------- d-----w- C:\Users\vibs\AppData\Local\Programs
    2013-04-23 10:14:31 -------- d-----w- C:\Users\vibs\AppData\Roaming\Malwarebytes
    2013-04-23 10:14:14 -------- d-----w- C:\ProgramData\Malwarebytes
    2013-04-23 10:14:12 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2013-04-23 10:14:11 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-04-23 09:07:07 -------- d-----w- C:\Users\vibs\AppData\Local\VMware
    2013-04-23 09:06:30 70296 ----a-w- C:\Windows\System32\drivers\vsock.sys
    2013-04-23 09:06:30 67224 ----a-w- C:\Windows\System32\vsocklib.dll
    2013-04-23 09:06:30 63128 ----a-w- C:\Windows\SysWow64\vsocklib.dll
    2013-04-23 09:06:26 67664 ----a-w- C:\Windows\System32\drivers\vmx86.sys
    2013-04-23 09:06:25 33360 ----a-w- C:\Windows\System32\drivers\VMkbd.sys
    2013-04-23 09:06:24 31824 ----a-w- C:\Windows\System32\drivers\VMparport.sys
    2013-04-23 09:05:50 357456 ----a-w- C:\Windows\SysWow64\vmnetdhcp.exe
    2013-04-23 09:05:44 436304 ----a-w- C:\Windows\SysWow64\vmnat.exe
    2013-04-23 09:05:44 30800 ----a-w- C:\Windows\System32\drivers\vmnetuserif.sys
    2013-04-23 09:05:40 933968 ----a-w- C:\Windows\System32\vnetlib64.dll
    2013-04-23 09:05:33 52376 ----a-w- C:\Windows\System32\drivers\hcmon.sys
    2013-04-23 09:05:08 -------- d-----w- C:\Program Files\Common Files\VMware
    2013-04-23 09:04:52 -------- d-----w- C:\Program Files (x86)\VMware
    2013-04-23 09:04:52 -------- d-----w- C:\Program Files (x86)\Common Files\VMware
    2013-04-22 14:29:40 -------- d-----w- C:\Users\vibs\AppData\Local\ElevatedDiagnostics
    2013-04-22 14:17:12 -------- d-----w- C:\ProgramData\eMule
    2013-04-22 13:03:49 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
    2013-04-22 13:03:08 -------- d-----w- C:\ProgramData\regid.1991-06.com.microsoft
    2013-04-22 13:01:54 -------- d-----w- C:\Program Files\Microsoft SQL Server
    2013-04-22 12:57:03 -------- d-----w- C:\Program Files\Microsoft Analysis Services
    2013-04-22 12:57:03 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
    2013-04-22 12:56:28 -------- d-----w- C:\Users\vibs\AppData\Local\Microsoft Help
    2013-04-22 12:40:13 -------- d-----w- C:\Users\vibs\.VirtualBox
    2013-04-22 12:39:14 237840 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys
    2013-04-22 12:38:55 120080 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys
    2013-04-22 03:31:10 26520 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugin-hang-ui.exe
    2013-04-22 01:44:23 -------- d-----w- C:\Users\vibs\AppData\Roaming\AVG2013
    2013-04-22 01:40:45 -------- d-----w- C:\Users\vibs\AppData\Roaming\TuneUp Software
    2013-04-22 01:40:00 -------- d-----w- C:\ProgramData\AVG2013
    2013-04-22 01:38:57 -------- d-----w- C:\Program Files (x86)\AVG
    2013-04-21 14:25:48 -------- d-----w- C:\Users\vibs\AppData\Local\Adobe
    2013-04-21 13:00:16 -------- d-----w- C:\Users\vibs\AppData\Local\Diagnostics
    2013-04-21 07:28:27 -------- d-----w- C:\Windows\Panther
    2013-04-21 07:26:27 -------- d-----w- C:\Users\vibs\Tracing
    2013-04-21 07:20:54 -------- d-----w- C:\Program Files (x86)\Microsoft
    2013-04-21 07:20:36 -------- d-----w- C:\Program Files (x86)\Windows Live SkyDrive
    2013-04-21 07:19:59 -------- d-----w- C:\Windows\PCHEALTH
    2013-04-21 07:12:37 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live
    2013-04-21 06:40:15 0 ----a-w- C:\Windows\ativpsrm.bin
    2013-04-21 04:42:39 -------- d-----w- C:\Program Files (x86)\OpenOffice.org 3
    2013-04-21 04:20:19 -------- d-----w- C:\Program Files\Microsoft Games
    2013-04-21 04:16:08 -------- d-----w- C:\Users\vibs\AppData\Local\Macromedia
    2013-04-21 03:36:37 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
    2013-04-21 03:22:08 605552 ----a-w- C:\Windows\System32\winload.exe
    2013-04-21 03:22:08 566208 ----a-w- C:\Windows\System32\winresume.efi
    2013-04-21 03:22:08 518672 ----a-w- C:\Windows\System32\winresume.exe
    2013-04-21 03:22:07 642944 ----a-w- C:\Windows\System32\winload.efi
    2013-04-21 03:22:07 20352 ----a-w- C:\Windows\System32\kdusb.dll
    2013-04-21 03:22:07 19328 ----a-w- C:\Windows\System32\kd1394.dll
    2013-04-21 03:22:07 17792 ----a-w- C:\Windows\System32\kdcom.dll
    2013-04-21 03:22:04 395776 ----a-w- C:\Windows\System32\webio.dll
    2013-04-21 03:22:04 314880 ----a-w- C:\Windows\SysWow64\webio.dll
    2013-04-21 03:22:02 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
    2013-04-21 03:20:41 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2013-04-21 03:20:41 331776 ----a-w- C:\Windows\System32\oleacc.dll
    2013-04-21 03:20:41 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
    2013-04-21 03:20:40 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2013-04-21 03:19:40 1732096 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
    2013-04-21 03:19:40 1367552 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19:39 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19:38 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
    2013-04-21 03:19:38 1393664 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
    2013-04-21 02:38:18 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-21 02:27:07 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
    2013-04-21 02:27:07 46080 ----a-w- C:\Windows\System32\atmlib.dll
    2013-04-21 02:27:07 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
    2013-04-21 02:27:06 367616 ----a-w- C:\Windows\System32\atmfd.dll
    2013-04-21 02:27:06 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll
    2013-04-21 02:27:06 100864 ----a-w- C:\Windows\System32\fontsub.dll
    2013-04-21 02:23:32 81408 ----a-w- C:\Windows\System32\imagehlp.dll
    2013-04-21 02:23:32 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
    2013-04-21 02:23:32 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
    2013-04-21 02:23:31 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
    2013-04-21 02:23:31 5120 ----a-w- C:\Windows\System32\wmi.dll
    2013-04-21 02:23:19 691592 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2013-04-21 02:18:31 9317456 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{48D77485-AF34-4E15-9342-CBF204416DF2}\mpengine.dll
    2013-04-21 02:18:26 282744 ------w- C:\Windows\System32\MpSigStub.exe
    2013-04-21 02:16:42 1913192 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2013-04-21 02:16:41 376688 ----a-w- C:\Windows\System32\drivers\netio.sys
    2013-04-21 02:16:41 288088 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
    2013-04-21 02:16:02 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2013-04-21 02:16:02 2048 ----a-w- C:\Windows\System32\tzres.dll
    2013-04-21 02:14:54 458704 ----a-w- C:\Windows\System32\drivers\cng.sys
    2013-04-21 02:13:59 613888 ----a-w- C:\Windows\System32\psisdecd.dll
    2013-04-21 02:12:47 723456 ----a-w- C:\Windows\System32\EncDec.dll
    2013-04-21 02:12:47 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
    2013-04-21 02:12:05 1464320 ----a-w- C:\Windows\System32\crypt32.dll
    2013-04-21 02:12:04 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll
    2013-04-21 02:12:03 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
    2013-04-21 02:12:03 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
    2013-04-21 02:12:03 140288 ----a-w- C:\Windows\System32\cryptnet.dll
    2013-04-21 02:12:03 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
    2013-04-21 02:10:13 956928 ----a-w- C:\Windows\System32\localspl.dll
    2013-04-21 02:10:02 634880 ----a-w- C:\Windows\System32\msvcrt.dll
    2013-04-21 02:10:01 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
    2013-04-21 02:10:00 59392 ----a-w- C:\Windows\System32\browcli.dll
    2013-04-21 02:10:00 41984 ----a-w- C:\Windows\SysWow64\browcli.dll
    2013-04-21 02:10:00 136704 ----a-w- C:\Windows\System32\browser.dll
    2013-04-21 02:09:45 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
    2013-04-21 02:08:55 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2013-04-21 02:08:53 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2013-04-21 02:08:51 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
    2013-04-21 02:08:51 43520 ----a-w- C:\Windows\System32\csrsrv.dll
    2013-04-21 02:08:51 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2013-04-21 02:08:51 112640 ----a-w- C:\Windows\System32\smss.exe
    2013-04-21 02:08:42 -------- d-----w- C:\Program Files\Common Files\EPSON
    2013-04-21 02:08:39 -------- d-----w- C:\ProgramData\EPSON
    2013-04-21 02:06:57 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2013-04-21 02:06:56 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2013-04-21 02:06:16 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
    2013-04-21 02:05:44 1731920 ----a-w- C:\Windows\System32\ntdll.dll
    2013-04-21 02:05:44 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll
    2013-04-21 02:05:33 77312 ----a-w- C:\Windows\System32\packager.dll
    2013-04-21 02:05:32 67072 ----a-w- C:\Windows\SysWow64\packager.dll
    2013-04-21 02:01:21 -------- d-----w- C:\Users\vibs\AppData\Local\Mozilla
    2013-04-20 19:38:54 2622464 ----a-w- C:\Windows\System32\wucltux.dll
    2013-04-20 19:38:48 99840 ----a-w- C:\Windows\System32\wudriver.dll
    2013-04-20 19:38:42 36864 ----a-w- C:\Windows\System32\wuapp.exe
    2013-04-20 19:38:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll
    2013-04-20 19:32:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
    2013-04-20 19:31:24 -------- d-----w- C:\Users\vibs\AppData\Roaming\ProgSense
    2013-04-20 19:31:14 -------- d-----w- C:\Users\vibs\AppData\Roaming\GrabPro
    2013-04-20 19:31:14 -------- d-----w- C:\downloads
    2013-04-20 19:31:11 -------- d-----w- C:\Program Files (x86)\Orbitdownloader
    2013-04-20 19:25:45 -------- d-----w- C:\Users\vibs\AppData\Local\Google
    2013-04-20 19:25:01 -------- d-----w- C:\ProgramData\AVAST Software
    2013-04-20 19:22:51 -------- d--h--w- C:\ProgramData\Common Files
    2013-04-20 19:22:51 -------- d-----w- C:\Users\vibs\AppData\Local\MFAData
    2013-04-20 19:22:51 -------- d-----w- C:\Users\vibs\AppData\Local\Avg2013
    2013-04-20 19:22:51 -------- d-----w- C:\ProgramData\MFAData
    2013-04-20 19:22:12 -------- d-----w- C:\Program Files (x86)\VideoLAN
    2013-04-20 19:21:49 788896 ----a-w- C:\Windows\SysWow64\deployJava1.dll
    2013-04-20 19:19:16 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2013-04-20 19:18:45 -------- d-sh--w- C:\Windows\Installer
    2013-04-20 19:10:37 120832 ----a-w- C:\Windows\System32\drivers\jrdusbser.sys
    2013-04-20 19:10:36 -------- d-----w- C:\Program Files (x86)\My Connection
    2013-04-20 18:52:53 -------- d-----w- C:\Windows\System32\SPReview
    2013-04-20 18:37:56 2560 ----a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
    2013-04-20 18:37:54 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
    2013-04-20 18:37:39 6144 ----a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
    2013-04-20 18:37:38 4608 ----a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
    2013-04-20 18:28:59 89088 ----a-w- C:\Windows\System32\amstream.dll
    2013-04-20 18:26:44 -------- d-----w- C:\Windows\System32\EventProviders
    .
    ==================== Find3M ====================
    .
    2013-04-21 02:44:34 92160 ----a-w- C:\Windows\System32\SetIEInstalledDate.exe
    2013-04-21 02:38:18 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-20 18:49:13 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
    2013-04-20 18:49:12 175616 ----a-w- C:\Windows\System32\msclmd.dll
    2013-03-15 13:44:04 131856 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp.sys
    2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys
    2013-02-25 20:57:48 62104 ----a-w- C:\Windows\System32\vmnetbridge.dll
    2013-02-25 20:57:48 48792 ----a-w- C:\Windows\System32\vnetinst.dll
    2013-02-25 20:57:48 45720 ----a-w- C:\Windows\System32\drivers\vmnetbridge.sys
    2013-02-25 20:57:48 24216 ----a-w- C:\Windows\System32\drivers\vmnet.sys
    2013-02-25 20:57:48 20120 ----a-w- C:\Windows\System32\drivers\vmnetadapter.sys
    2013-02-25 19:29:16 360528 ----a-w- C:\Windows\SysWow64\vmnc.dll
    2013-02-15 06:08:40 44032 ----a-w- C:\Windows\System32\tsgqec.dll
    2013-02-15 06:06:11 3717632 ----a-w- C:\Windows\System32\mstscax.dll
    2013-02-15 06:02:26 158720 ----a-w- C:\Windows\System32\aaclient.dll
    2013-02-15 04:37:10 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll
    2013-02-15 04:34:10 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll
    2013-02-15 03:25:51 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll
    2013-02-12 04:12:05 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys
    .
    ============= FINISH: 20:27:44.50 ===============
     

    Attached Files:

  4. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Please observe forum rules.
    All logs have to be pasted not attached.
    I expect you to paste Attach.txt into your next reply.

    Next....

    [​IMG] Download RogueKiller on the desktop
    • Close all the running programs
    • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
     
  5. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    DDS Attach file log
    --------------------------------------------------------------------------------------
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 4/20/2013 11:55:34 PM
    System Uptime: 5/2/2013 8:25:15 PM (0 hours ago)
    .
    Motherboard: | | RS780-SB700
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4800+ | Socket M2 | 2500/200mhz
    .
    ==== Disk Partitions =========================
    .
    A: is Removable
    C: is FIXED (NTFS) - 123 GiB total, 74.339 GiB free.
    D: is FIXED (NTFS) - 99 GiB total, 38.785 GiB free.
    E: is FIXED (NTFS) - 122 GiB total, 16.126 GiB free.
    F: is FIXED (NTFS) - 122 GiB total, 76.464 GiB free.
    G: is CDROM (UDF)
    H: is Removable
    I: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP29: 5/1/2013 12:08:32 PM - avast! Free Antivirus Setup
    RP30: 5/1/2013 5:17:24 PM - Removed Oracle VM VirtualBox 4.2.10
    .
    ==== Installed Programs ======================
    .
    ABBYY FineReader 9.0 Sprint
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.6)
    AVG 2013
    Epson Easy Photo Print 2
    Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
    Epson Event Manager
    EPSON Scan
    EPSON TX121 Series Manual
    EPSON TX121 Series Printer Uninstall
    HitmanPro 3.7
    Java 7 Update 21
    Java Auto Updater
    Junk Mail filter update
    Malwarebytes Anti-Malware version 1.75.0.1300
    Microsoft Access MUI (English) 2013
    Microsoft Access Setup Metadata MUI (English) 2013
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft DCF MUI (English) 2013
    Microsoft Excel MUI (English) 2013
    Microsoft Groove MUI (English) 2013
    Microsoft InfoPath MUI (English) 2013
    Microsoft Lync MUI (English) 2013
    Microsoft Office 32-bit Components 2013
    Microsoft Office OSM MUI (English) 2013
    Microsoft Office OSM UX MUI (English) 2013
    Microsoft Office Professional Plus 2013
    Microsoft Office Proofing (English) 2013
    Microsoft Office Proofing Tools 2013 - English
    Microsoft Office Proofing Tools 2013 - Español
    Microsoft Office Shared 32-bit MUI (English) 2013
    Microsoft Office Shared MUI (English) 2013
    Microsoft Office Shared Setup Metadata MUI (English) 2013
    Microsoft OneNote MUI (English) 2013
    Microsoft Outlook MUI (English) 2013
    Microsoft PowerPoint MUI (English) 2013
    Microsoft Publisher MUI (English) 2013
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Word MUI (English) 2013
    Mozilla Firefox 20.0.1 (x86 en-US)
    Mozilla Maintenance Service
    MSVCRT
    MSXML 4.0 SP3 Parser
    My Connection
    OpenOffice.org 3.4.1
    Orbit Downloader
    Outils de vérification linguistique 2013 de Microsoft Office - Français
    PMB
    Reliance Netconnect+
    Spybot - Search & Destroy
    VirtualCloneDrive
    Visual Studio 2010 x64 Redistributables
    VLC media player 2.0.4
    VMware Player
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    WinRAR 4.01 (32-bit)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    5/2/2013 8:26:03 PM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.
    5/2/2013 8:25:50 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Reliance Netconnect. OUC service to connect.
    5/2/2013 8:25:50 PM, Error: Service Control Manager [7000] - The Reliance Netconnect. OUC service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/1/2013 12:27:28 PM, Error: cdrom [11] - The driver detected a controller error on \Device\CdRom0.
    5/1/2013 11:06:48 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR3.
    5/1/2013 11:06:12 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avast! Antivirus service.
    4/30/2013 6:38:08 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
    4/30/2013 6:15:29 PM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.
    4/30/2013 6:15:29 PM, Error: Schannel [36874] - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
    4/29/2013 9:01:30 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    4/29/2013 9:01:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    4/29/2013 9:01:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    4/29/2013 9:01:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    4/29/2013 9:01:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    4/29/2013 9:01:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    4/29/2013 9:01:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswRdr aswSnx aswSP aswTdi Avgfwfd AVGIDSDriver Avgldx64 Avgtdia CSC DfsC discache ElbyCDIO NetBIOS NetBT nsiproxy Psched rdbss spldr tdx VBoxDrv VBoxUSBMon vwififlt Wanarpv6 WfpLwf ws2ifsl
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    4/29/2013 9:01:05 PM, Error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: A device attached to the system is not functioning.
    4/27/2013 9:07:25 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.
    4/26/2013 5:30:42 PM, Error: Service Control Manager [7030] - The Reliance Netconnect. OUC service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    4/26/2013 5:30:14 PM, Error: Service Control Manager [7030] - The HWDeviceService64.exe service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    .
    ==== End Of File ===========================
    Rogue Killer log...

    RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Website : http://tigzy.geekstogo.com/roguekiller.php
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : vibs [Admin rights]
    Mode : Remove -- Date : 05/03/2013 07:58:12
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 1 ¤¤¤
    [SUSP PATH] ouc.exe -- C:\ProgramData\Reliance Netconnect+\OnlineUpdate\ouc.exe [-] -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 5 ¤¤¤
    [DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{E03A5559-97BA-4CD2-986A-47B1C3C013CE} : NameServer (10.169.30.244 10.170.30.245) -> NOT REMOVED, USE DNSFIX
    [DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{E03A5559-97BA-4CD2-986A-47B1C3C013CE} : NameServer (10.169.30.244 10.170.30.245) -> NOT REMOVED, USE DNSFIX
    [HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> C:\Windows\system32\drivers\etc\hosts



    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD5002ABYS-02B1B0 ATA Device +++++
    --- User ---
    [MBR] 0c7861516ab5426927befbb4caab15ef
    [BSP] 65ae27fd417f28832d4f1c15ba8bf9d6 : Windows 7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 125937 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 257921024 | Size: 125000 Mo
    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 513921024 | Size: 125000 Mo
    3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 769921024 | Size: 101000 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    +++++ PhysicalDrive1: USBModem MMC Storage USB Device +++++
    --- User ---
    [MBR] a04c210ae49b69705d2d860cad01f44e
    [BSP] df4f83c1f72e36823a12b0dfc7617313 : Empty MBR Code
    Partition table:
    0 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 129 | Size: 1950 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    +++++ PhysicalDrive2: hp v165w USB Device +++++
    --- User ---
    [MBR] 0bfc983e0b28fe4ee4328820e0737b7a
    [BSP] 8165eb6b30de9a59065417011a3b2dfe : Windows 7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 7781 Mo
    1 - [XXXXXX] UNKNOWN (0x21) [VISIBLE] Offset (sectors): 15936480 | Size: 0 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    Finished : << RKreport[2]_D_05032013_02d0758.txt >>
    RKreport[1]_S_05032013_02d0756.txt ; RKreport[2]_D_05032013_02d0758.txt

    -----------------------------------------------------------------------------------------------------------------------------------------------
    Malwarebytes Anti-Rootkit
    No infection found, no log generated
     
  6. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    [​IMG] Create new restore point before proceeding with the next step....
    How to:
    - Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
    - Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
    - Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
    - XP: http://support.microsoft.com/kb/948247

    [​IMG] Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  7. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    Hi, thanks for helping out. PFA ComboFix logs, what's the next step:
    ---------------------------------------------------------------------------------------------------
    ComboFix 13-05-01.03 - vibs 05/03/2013 9:01.1.2 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.5630.4263 [GMT 5.5:30]
    Running from: d:\desktop\ComboFix.exe
    AV: AVG Internet Security 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    FW: AVG Internet Security 2013 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
    SP: AVG Internet Security 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-04-03 to 2013-05-03 )))))))))))))))))))))))))))))))
    .
    .
    2013-05-03 03:40 . 2013-05-03 03:40 -------- d-----w- c:\users\Default\AppData\Local\temp
    2013-05-01 11:47 . 2013-05-01 11:47 -------- d-----w- c:\windows\system32\appmgmt
    2013-05-01 06:38 . 2013-05-01 06:38 -------- d-s---w- c:\windows\SysWow64\Microsoft
    2013-05-01 05:50 . 2013-05-01 05:50 -------- d-----w- c:\program files\HitmanPro
    2013-04-26 12:00 . 2013-04-26 12:00 -------- d-----w- c:\programdata\Reliance Netconnect
    2013-04-26 11:57 . 2013-04-26 12:01 -------- d-----w- c:\programdata\DatacardService
    2013-04-24 13:38 . 2013-04-24 13:38 -------- d-----w- c:\program files (x86)\Common Files\Java
    2013-04-24 13:38 . 2013-04-24 13:38 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
    2013-04-24 13:38 . 2013-04-24 13:38 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2013-04-24 13:38 . 2013-04-24 13:38 -------- d-----w- c:\program files (x86)\Java
    2013-04-24 03:33 . 2013-04-24 03:33 -------- d-----w- c:\program files (x86)\MSXML 4.0
    2013-04-24 03:32 . 2007-07-19 12:44 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
    2013-04-24 03:32 . 2007-07-19 12:44 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
    2013-04-24 03:32 . 2006-03-31 07:11 3927248 ----a-w- c:\windows\system32\d3dx9_30.dll
    2013-04-24 03:29 . 2013-04-24 03:29 -------- d-----w- c:\program files (x86)\Sony
    2013-04-24 03:29 . 2013-04-24 03:29 -------- d-----w- c:\programdata\Sony Corporation
    2013-04-24 02:56 . 2013-04-24 02:56 -------- d-----w- c:\programdata\UDL
    2013-04-24 02:55 . 2013-04-24 02:55 -------- d-----w- c:\program files\Epson Software
    2013-04-24 02:53 . 2013-04-24 02:56 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
    2013-04-24 02:53 . 2013-04-24 02:56 -------- d-----w- c:\program files (x86)\Epson Software
    2013-04-24 02:52 . 2013-04-24 02:53 -------- d-----w- c:\program files (x86)\ABBYY FineReader 9.0 Sprint
    2013-04-24 02:52 . 2013-04-24 02:52 -------- d-----w- c:\programdata\ABBYY
    2013-04-24 02:52 . 2013-04-24 02:52 -------- d-----w- c:\program files (x86)\Common Files\ABBYY
    2013-04-24 02:50 . 2013-04-24 02:53 -------- d-----w- c:\program files (x86)\epson
    2013-04-23 10:40 . 2013-04-23 11:06 -------- d-----w- c:\programdata\HitmanPro
    2013-04-23 10:37 . 2013-04-29 19:05 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2013-04-23 10:37 . 2013-04-23 10:37 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
    2013-04-23 10:14 . 2013-04-23 10:14 -------- d-----w- c:\programdata\Malwarebytes
    2013-04-23 10:14 . 2013-04-04 09:20 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-04-23 10:14 . 2013-04-23 10:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2013-04-23 09:06 . 2012-10-24 08:47 67224 ----a-w- c:\windows\system32\vsocklib.dll
    2013-04-23 09:06 . 2012-10-24 08:47 70296 ----a-w- c:\windows\system32\drivers\vsock.sys
    2013-04-23 09:06 . 2012-10-24 08:47 63128 ----a-w- c:\windows\SysWow64\vsocklib.dll
    2013-04-23 09:06 . 2013-02-25 20:58 67664 ----a-w- c:\windows\system32\drivers\vmx86.sys
    2013-04-23 09:06 . 2013-02-25 20:57 33360 ----a-w- c:\windows\system32\drivers\VMkbd.sys
    2013-04-23 09:06 . 2013-02-25 20:58 31824 ----a-w- c:\windows\system32\drivers\VMparport.sys
    2013-04-23 09:05 . 2013-02-25 20:58 357456 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
    2013-04-23 09:05 . 2013-02-25 20:58 436304 ----a-w- c:\windows\SysWow64\vmnat.exe
    2013-04-23 09:05 . 2013-02-25 20:58 30800 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
    2013-04-23 09:05 . 2013-02-25 20:59 933968 ----a-w- c:\windows\system32\vnetlib64.dll
    2013-04-23 09:05 . 2012-10-11 10:45 52376 ----a-w- c:\windows\system32\drivers\hcmon.sys
    2013-04-23 09:05 . 2013-04-23 09:05 -------- d-----w- c:\program files\Common Files\VMware
    2013-04-23 09:04 . 2013-05-03 03:42 -------- d-----w- c:\programdata\VMware
    2013-04-23 09:04 . 2013-04-23 09:04 -------- d-----w- c:\program files (x86)\VMware
    2013-04-23 09:04 . 2013-04-23 09:04 -------- d-----w- c:\program files (x86)\Common Files\VMware
    2013-04-22 14:17 . 2013-04-22 16:18 -------- d-----w- c:\programdata\eMule
    2013-04-22 13:04 . 2013-04-22 13:04 -------- d-----w- c:\program files\Common Files\DESIGNER
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\program files\Microsoft.NET
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\programdata\regid.1991-06.com.microsoft
    2013-04-22 13:01 . 2013-04-22 13:03 -------- d-----w- c:\program files\Microsoft SQL Server
    2013-04-22 12:57 . 2013-04-22 12:57 -------- d-----w- c:\program files\Microsoft Analysis Services
    2013-04-22 12:57 . 2013-04-22 12:57 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
    2013-04-22 12:56 . 2013-04-22 13:01 -------- d-----w- c:\program files\Microsoft Office
    2013-04-22 12:55 . 2013-04-23 04:07 -------- d-----w- c:\programdata\Microsoft Help
    2013-04-22 12:39 . 2013-03-15 13:44 237840 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
    2013-04-22 12:38 . 2013-03-15 13:43 120080 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
    2013-04-22 12:38 . 2013-05-01 11:47 -------- dc----w- c:\windows\system32\DRVSTORE
    2013-04-22 01:50 . 2013-04-22 01:50 -------- d-----w- c:\users\Default\AppData\Roaming\TuneUp Software
    2013-04-22 01:40 . 2013-04-22 01:41 -------- d-----w- c:\programdata\AVG2013
    2013-04-22 01:38 . 2013-04-22 01:38 -------- d-----w- c:\program files (x86)\AVG
    2013-04-21 07:28 . 2013-04-20 18:25 -------- d-----w- c:\windows\Panther
    2013-04-21 07:20 . 2013-04-21 07:20 -------- d-----w- c:\program files (x86)\Microsoft
    2013-04-21 07:20 . 2013-04-21 07:20 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive
    2013-04-21 07:20 . 2013-04-21 07:23 -------- d-----w- c:\program files (x86)\Windows Live
    2013-04-21 07:19 . 2013-04-21 07:19 -------- d-----w- c:\windows\PCHEALTH
    2013-04-21 07:12 . 2013-04-21 07:12 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
    2013-04-21 06:40 . 2013-04-21 06:40 0 ----a-w- c:\windows\ativpsrm.bin
    2013-04-21 04:42 . 2013-04-21 04:42 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
    2013-04-21 04:20 . 2013-04-21 04:20 -------- d-----w- c:\program files\Microsoft Games
    2013-04-21 03:36 . 2013-04-21 03:36 -------- d-----w- c:\program files (x86)\Elaborate Bytes
    2013-04-21 03:22 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
    2013-04-21 03:22 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
    2013-04-21 03:22 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
    2013-04-21 03:22 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
    2013-04-21 03:22 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
    2013-04-21 03:22 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
    2013-04-21 03:22 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
    2013-04-21 03:22 . 2011-11-17 06:35 395776 ----a-w- c:\windows\system32\webio.dll
    2013-04-21 03:22 . 2011-11-17 05:35 314880 ----a-w- c:\windows\SysWow64\webio.dll
    2013-04-21 03:22 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2013-04-21 03:20 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2013-04-21 03:20 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
    2013-04-21 03:20 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
    2013-04-21 03:20 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2013-04-21 03:19 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
    2013-04-21 03:19 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
    2013-04-21 03:19 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
    2013-04-21 02:51 . 2013-04-01 14:28 72702784 ----a-w- c:\windows\system32\MRT.exe
    2013-04-21 02:38 . 2013-04-21 02:38 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-21 02:27 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
    2013-04-21 02:27 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    2013-04-21 02:27 . 2010-09-30 06:47 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
    2013-04-21 02:27 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
    2013-04-21 02:27 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
    2013-04-21 02:27 . 2010-09-30 10:41 100864 ----a-w- c:\windows\system32\fontsub.dll
    2013-04-21 02:24 . 2013-04-21 02:24 -------- d-----w- c:\program files\Microsoft Silverlight
    2013-04-21 02:24 . 2013-04-21 02:24 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
    2013-04-21 02:23 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
    2013-04-21 02:23 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2013-04-21 02:23 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2013-04-21 02:23 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
    2013-04-21 02:23 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
    2013-04-21 02:23 . 2013-04-24 02:37 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2013-04-21 02:18 . 2013-04-17 01:01 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{48D77485-AF34-4E15-9342-CBF204416DF2}\mpengine.dll
    2013-04-21 02:18 . 2013-03-11 19:40 282744 ------w- c:\windows\system32\MpSigStub.exe
    2013-04-21 02:16 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2013-04-21 02:16 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
    2013-04-21 02:16 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
    2013-04-21 02:16 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll
    2013-04-21 02:16 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2013-04-21 02:14 . 2012-06-02 05:50 458704 ----a-w- c:\windows\system32\drivers\cng.sys
    2013-04-21 02:13 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
    2013-04-21 02:12 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
    2013-04-21 02:12 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2013-04-21 02:12 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
    2013-04-21 02:12 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
    2013-04-21 02:12 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
    2013-04-21 02:12 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
    2013-04-21 02:12 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
    2013-04-21 02:12 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
    2013-04-21 02:10 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
    2013-04-21 02:10 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-04-20 18:49 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2013-04-20 18:49 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2013-03-15 13:44 . 2013-03-15 13:44 131856 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
    2013-02-25 20:57 . 2013-02-25 20:57 62104 ----a-w- c:\windows\system32\vmnetbridge.dll
    2013-02-25 20:57 . 2013-02-25 20:57 48792 ----a-w- c:\windows\system32\vnetinst.dll
    2013-02-25 20:57 . 2013-02-25 20:57 45720 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
    2013-02-25 20:57 . 2013-02-25 20:57 24216 ----a-w- c:\windows\system32\drivers\vmnet.sys
    2013-02-25 20:57 . 2013-02-25 20:57 20120 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
    2013-02-25 19:29 . 2013-02-25 19:29 360528 ----a-w- c:\windows\SysWow64\vmnc.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
    @=""
    .
    R2 Alcatel Wave Modem Device Helper;Alcatel Wave Modem Device Helper;c:\program files (x86)\My Connection\BackgroundService\ServiceManager.exe [2011-06-20 49752]
    R2 Reliance Netconnect. RunOuc;Reliance Netconnect. OUC;c:\program files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe [2013-04-26 218624]
    R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2013-04-26 117248]
    R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys [2011-06-20 120832]
    R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [2011-10-05 729152]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-01 178824]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-19 59392]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2013-03-15 131856]
    R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
    S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-14 63328]
    S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-20 225120]
    S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-15 111968]
    S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-13 40800]
    S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2012-10-24 85104]
    S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2012-10-24 70296]
    S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [2012-09-04 50296]
    S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]
    S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-01 185696]
    S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-20 200032]
    S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-19 203776]
    S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2013\avgfws.exe [2012-12-10 1342024]
    S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
    S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
    S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2011-03-14 346976]
    S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176]
    S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
    S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2013-04-26 86016]
    S3 Ph3xIB64;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB64.sys [2009-06-10 1627520]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
    .
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
    FontCache
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office15\ONBttnIE.dll/105
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    FF - ProfilePath - c:\users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\
    FF - ExtSQL: 2013-04-26 18:13; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
    FF - ExtSQL: 2013-05-01 11:08; {35379F86-8CCB-4724-AE33-4278DE266C70}; c:\program files (x86)\Orbitdownloader\addons\OneClickYouTubeDownloader
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NETFramework]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\1394ohci]
    "ImagePath"="\SystemRoot\system32\drivers\1394ohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ABBYY.Licensing.FineReader.Sprint.9.0]
    "ImagePath"="\"c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe\" -service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI]
    "ImagePath"="system32\drivers\ACPI.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AcpiPmi]
    "ImagePath"="\SystemRoot\system32\drivers\acpipmi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeARMservice]
    "ImagePath"="\"c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adp94xx]
    "ImagePath"="\SystemRoot\system32\DRIVERS\adp94xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpahci]
    "ImagePath"="\SystemRoot\system32\DRIVERS\adpahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpu320]
    "ImagePath"="\SystemRoot\system32\DRIVERS\adpu320.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adsi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc]
    "ServiceDll"="%SystemRoot%\System32\aelupsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AFD]
    "ImagePath"="\SystemRoot\system32\drivers\afd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\agp440]
    "ImagePath"="\SystemRoot\system32\drivers\agp440.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Alcatel Wave Modem Device Helper]
    "ImagePath"="c:\program files (x86)\My Connection\BackgroundService\ServiceManager.exe -start"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ALG]
    "ImagePath"="%SystemRoot%\System32\alg.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\aliide]
    "ImagePath"="\SystemRoot\system32\drivers\aliide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AMD External Events Utility]
    "ImagePath"="%SystemRoot%\system32\atiesrxx.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdide]
    "ImagePath"="\SystemRoot\system32\drivers\amdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdK8]
    "ImagePath"="system32\DRIVERS\amdk8.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdkmdag]
    "ImagePath"="system32\DRIVERS\atikmdag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdkmdap]
    "ImagePath"="system32\DRIVERS\atikmpag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdPPM]
    "ImagePath"="\SystemRoot\system32\DRIVERS\amdppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsata]
    "ImagePath"="\SystemRoot\system32\drivers\amdsata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsbs]
    "ImagePath"="\SystemRoot\system32\DRIVERS\amdsbs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdxata]
    "ImagePath"="system32\drivers\amdxata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppID]
    "ImagePath"="\SystemRoot\system32\drivers\appid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc]
    "ServiceDll"="%SystemRoot%\System32\appidsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo]
    "ServiceDll"="%SystemRoot%\System32\appinfo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt]
    "ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arc]
    "ImagePath"="\SystemRoot\system32\DRIVERS\arc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arcsas]
    "ImagePath"="\SystemRoot\system32\DRIVERS\arcsas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AsyncMac]
    "ImagePath"="system32\DRIVERS\asyncmac.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\atapi]
    "ImagePath"="system32\drivers\atapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Atierecord]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\atikmdag]
    "ImagePath"="\SystemRoot\system32\drivers\atikmdag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgfwfd]
    "ImagePath"="system32\DRIVERS\avgfwd6a.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgfws]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgfws.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgidsagent.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    "ImagePath"="system32\DRIVERS\avgidsha.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    "ImagePath"="system32\DRIVERS\avgldx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "ImagePath"="system32\DRIVERS\avgloga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    "ImagePath"="system32\DRIVERS\avgmfx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
    "ImagePath"="system32\DRIVERS\avgrkx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
    "ImagePath"="system32\DRIVERS\avgtdia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV]
    "ServiceDll"="%SystemRoot%\System32\AxInstSV.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b06bdrv]
    "ImagePath"="\SystemRoot\system32\DRIVERS\bxvbda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b57nd60a]
    "ImagePath"="system32\DRIVERS\b57nd60a.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BattC]
    "MofImagePath"="system32\drivers\battc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC]
    "ServiceDll"="%SystemRoot%\System32\bdesvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Beep]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE]
    "ServiceDll"="%SystemRoot%\System32\bfe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS]
    "ServiceDll"="%systemroot%\system32\qmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\blbdrive]
    "ImagePath"="system32\DRIVERS\blbdrive.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bowser]
    "ImagePath"="system32\DRIVERS\bowser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltLo]
    "ImagePath"="\SystemRoot\system32\DRIVERS\BrFiltLo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltUp]
    "ImagePath"="\SystemRoot\system32\DRIVERS\BrFiltUp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BridgeMP]
    "ImagePath"="system32\DRIVERS\bridge.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Browser]
    "ServiceDll"="%SystemRoot%\System32\browser.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Brserid]
    "ImagePath"="\SystemRoot\System32\Drivers\Brserid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrSerWdm]
    "ImagePath"="\SystemRoot\System32\Drivers\BrSerWdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbMdm]
    "ImagePath"="\SystemRoot\System32\Drivers\BrUsbMdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbSer]
    "ImagePath"="\SystemRoot\System32\Drivers\BrUsbSer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHMODEM]
    "ImagePath"="\SystemRoot\system32\DRIVERS\bthmodem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHPORT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv]
    "ServiceDll"="%SystemRoot%\system32\bthserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdfs]
    "ImagePath"="system32\DRIVERS\cdfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdrom]
    "ImagePath"="system32\DRIVERS\cdrom.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\circlass]
    "ImagePath"="\SystemRoot\system32\DRIVERS\circlass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CISVC]
    "ImagePath"="%systemroot%\system32\CISVC.EXE"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CLFS]
    "ImagePath"="System32\CLFS.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_32]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_64]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CmBatt]
    "ImagePath"="\SystemRoot\system32\DRIVERS\CmBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdide]
    "ImagePath"="\SystemRoot\system32\drivers\cmdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CNG]
    "ImagePath"="System32\Drivers\cng.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Compbatt]
    "ImagePath"="\SystemRoot\system32\DRIVERS\compbatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CompositeBus]
    "ImagePath"="\SystemRoot\system32\drivers\CompositeBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\COMSysApp]
    "ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ContentFilter]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ContentIndex]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crcdisk]
    "ImagePath"="\SystemRoot\system32\DRIVERS\crcdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc]
    "ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CSC]
    "ImagePath"="system32\drivers\csc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CscService]
    "ServiceDll"="%SystemRoot%\System32\cscsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DCLocator]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\defragsvc]
    "ServiceDll"="%Systemroot%\System32\defragsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DfsC]
    "ImagePath"="System32\Drivers\dfsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dhcp]
    "ServiceDll"="%SystemRoot%\system32\dhcpcore.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\discache]
    "ImagePath"="System32\drivers\discache.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk]
    "ImagePath"="system32\DRIVERS\disk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dnscache]
    "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc]
    "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DPS]
    "ServiceDll"="%SystemRoot%\system32\dps.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\drmkaud]
    "ImagePath"="system32\drivers\drmkaud.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DXGKrnl]
    "ImagePath"="\SystemRoot\System32\drivers\dxgkrnl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost]
    "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ebdrv]
    "ImagePath"="\SystemRoot\system32\DRIVERS\evbda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS]
    "ImagePath"="%SystemRoot%\System32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehRecvr]
    "ImagePath"="%systemroot%\ehome\ehRecvr.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehSched]
    "ImagePath"="%systemroot%\ehome\ehsched.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ElbyCDIO]
    "ImagePath"="System32\Drivers\ElbyCDIO.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\elxstor]
    "ImagePath"="\SystemRoot\system32\DRIVERS\elxstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ErrDev]
    "ImagePath"="\SystemRoot\system32\drivers\errdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ESENT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog]
    "ServiceDll"="%SystemRoot%\System32\wevtsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem]
    "ServiceDll"="%systemroot%\system32\es.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ewusbmbb]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ew_hwusbdev]
    "ImagePath"="system32\DRIVERS\ew_hwusbdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\exfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fastfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fax]
    "ImagePath"="%systemroot%\system32\fxssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdc]
    "ImagePath"="system32\DRIVERS\fdc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost]
    "ServiceDll"="%SystemRoot%\system32\fdPHost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub]
    "ServiceDll"="%SystemRoot%\system32\fdrespub.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FileInfo]
    "ImagePath"="system32\drivers\fileinfo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Filetrace]
    "ImagePath"="system32\drivers\filetrace.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\flpydisk]
    "ImagePath"="system32\DRIVERS\flpydisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FltMgr]
    "ImagePath"="system32\drivers\fltmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache]
    "ServiceDll"="%SystemRoot%\system32\FntCache.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FsDepends]
    "ImagePath"="System32\drivers\FsDepends.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fs_Rec]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fvevol]
    "ImagePath"="System32\DRIVERS\fvevol.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gagp30kx]
    "ImagePath"="\SystemRoot\system32\DRIVERS\gagp30kx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc]
    "ServiceDll"="%SystemRoot%\System32\gpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hcmon]
    "ImagePath"="\??\c:\windows\system32\drivers\hcmon.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hcw85cir]
    "ImagePath"="\SystemRoot\system32\drivers\hcw85cir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HdAudAddService]
    "ImagePath"="\SystemRoot\system32\drivers\HdAudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus]
    "ImagePath"="\SystemRoot\system32\drivers\HDAudBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBatt]
    "ImagePath"="\SystemRoot\system32\DRIVERS\HidBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBth]
    "ImagePath"="\SystemRoot\system32\DRIVERS\hidbth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidIr]
    "ImagePath"="\SystemRoot\system32\DRIVERS\hidir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv]
    "ServiceDll"="%SystemRoot%\System32\hidserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidUsb]
    "ImagePath"="\SystemRoot\system32\drivers\hidusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc]
    "ServiceDLL"="%SystemRoot%\system32\kmsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener]
    "ServiceDll"="%SystemRoot%\system32\ListSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider]
    "ServiceDll"="%SystemRoot%\system32\provsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HpSAMD]
    "ImagePath"="\SystemRoot\system32\drivers\HpSAMD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HTTP]
    "ImagePath"="system32\drivers\HTTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\huawei_enumerator]
    "ImagePath"="system32\DRIVERS\ew_jubusenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\huawei_update]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwdatacard]
    "ImagePath"="system32\DRIVERS\ewusbmdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HWDeviceService64.exe]
    "ImagePath"="\"c:\programdata\DatacardService\HWDeviceService64.exe\" -/service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwpolicy]
    "ImagePath"="System32\drivers\hwpolicy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwusbdev]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\i8042prt]
    "ImagePath"="\SystemRoot\system32\drivers\i8042prt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iaStorV]
    "ImagePath"="\SystemRoot\system32\drivers\iaStorV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iirsp]
    "ImagePath"="\SystemRoot\system32\DRIVERS\iirsp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IKEEXT]
    "ServiceDll"="%SystemRoot%\System32\ikeext.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\inetaccs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelide]
    "ImagePath"="\SystemRoot\system32\drivers\intelide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm]
    "ImagePath"="\SystemRoot\system32\DRIVERS\intelppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum]
    "ServiceDll"="%SystemRoot%\system32\ipbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IpFilterDriver]
    "ImagePath"="system32\DRIVERS\ipfltdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc]
    "ServiceDll"="%SystemRoot%\System32\iphlpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPMIDRV]
    "ImagePath"="\SystemRoot\system32\drivers\IPMIDrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPNAT]
    "ImagePath"="System32\drivers\ipnat.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IRENUM]
    "ImagePath"="system32\drivers\irenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ISAPISearch]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\isapnp]
    "ImagePath"="\SystemRoot\system32\drivers\isapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iScsiPrt]
    "ImagePath"="\SystemRoot\system32\drivers\msiscsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\jrdusbser]
    "ImagePath"="system32\DRIVERS\jrdusbser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdclass]
    "ImagePath"="\SystemRoot\system32\drivers\kbdclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdhid]
    "ImagePath"="\SystemRoot\system32\drivers\kbdhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecDD]
    "ImagePath"="System32\Drivers\ksecdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecPkg]
    "ImagePath"="System32\Drivers\ksecpkg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ksthunk]
    "ImagePath"="\SystemRoot\system32\drivers\ksthunk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm]
    "ServiceDll"="%systemroot%\system32\msdtckrm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer]
    "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation]
    "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ldap]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio]
    "ImagePath"="system32\DRIVERS\lltdio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc]
    "ServiceDll"="%SystemRoot%\System32\lltdsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts]
    "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Lsa]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_FC]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_fc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_sas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS2]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_sas2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SCSI]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\luafv]
    "ImagePath"="\SystemRoot\system32\drivers\luafv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc]
    "ServiceDll"="%SystemRoot%\system32\Mcx2Svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\megasas]
    "ImagePath"="\SystemRoot\system32\DRIVERS\megasas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MegaSR]
    "ImagePath"="\SystemRoot\system32\DRIVERS\MegaSR.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MMCSS]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Modem]
    "ImagePath"="system32\drivers\modem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor]
    "ImagePath"="system32\DRIVERS\monitor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouclass]
    "ImagePath"="\SystemRoot\system32\drivers\mouclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouhid]
    "ImagePath"="system32\DRIVERS\mouhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mountmgr]
    "ImagePath"="System32\drivers\mountmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MozillaMaintenance]
    "ImagePath"="\"c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpio]
    "ImagePath"="\SystemRoot\system32\drivers\mpio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpsdrv]
    "ImagePath"="System32\drivers\mpsdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc]
    "ServiceDll"="%SystemRoot%\system32\mpssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MRxDAV]
    "ImagePath"="\SystemRoot\system32\drivers\mrxdav.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb]
    "ImagePath"="system32\DRIVERS\mrxsmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb10]
    "ImagePath"="system32\DRIVERS\mrxsmb10.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb20]
    "ImagePath"="system32\DRIVERS\mrxsmb20.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msahci]
    "ImagePath"="\SystemRoot\system32\drivers\msahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msdsm]
    "ImagePath"="\SystemRoot\system32\drivers\msdsm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC]
    "ImagePath"="%SystemRoot%\System32\msdtc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Msfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mshidkmdf]
    "ImagePath"="\SystemRoot\System32\drivers\mshidkmdf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msisadrv]
    "ImagePath"="system32\drivers\msisadrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI]
    "ServiceDll"="%systemroot%\system32\iscsiexe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msiserver]
    "ImagePath"="%systemroot%\system32\msiexec.exe /V"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSKSSRV]
    "ImagePath"="system32\drivers\MSKSSRV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPCLOCK]
    "ImagePath"="system32\drivers\MSPCLOCK.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPQM]
    "ImagePath"="system32\drivers\MSPQM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsRPC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSSCNTRS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios]
    "ImagePath"="\SystemRoot\system32\drivers\mssmbios.sys"
    .
     
  8. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSTEE]
    "ImagePath"="system32\drivers\MSTEE.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MTConfig]
    "ImagePath"="\SystemRoot\system32\DRIVERS\MTConfig.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mup]
    "ImagePath"="System32\Drivers\mup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent]
    "ServiceDLL"="%SystemRoot%\system32\qagentRT.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NativeWifiP]
    "ImagePath"="system32\DRIVERS\nwifi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS]
    "ImagePath"="system32\drivers\ndis.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisCap]
    "ImagePath"="system32\DRIVERS\ndiscap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisTapi]
    "ImagePath"="system32\DRIVERS\ndistapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio]
    "ImagePath"="system32\DRIVERS\ndisuio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisWan]
    "ImagePath"="system32\DRIVERS\ndiswan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS]
    "ImagePath"="system32\DRIVERS\netbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT]
    "ImagePath"="System32\DRIVERS\netbt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netman]
    "ServiceDll"="%SystemRoot%\System32\netman.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\netprofm]
    "ServiceDll"="%SystemRoot%\System32\netprofm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\netr7364]
    "ImagePath"="system32\DRIVERS\netr7364.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nfrd960]
    "ImagePath"="\SystemRoot\system32\DRIVERS\nfrd960.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NlaSvc]
    "ServiceDll"="%SystemRoot%\System32\nlasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Npfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsi]
    "ServiceDll"="%systemroot%\system32\nsisvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsiproxy]
    "ImagePath"="system32\drivers\nsiproxy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NTDS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ntfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Null]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvraid]
    "ImagePath"="\SystemRoot\system32\drivers\nvraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvstor]
    "ImagePath"="\SystemRoot\system32\drivers\nvstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nv_agp]
    "ImagePath"="\SystemRoot\system32\drivers\nv_agp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ohci1394]
    "ImagePath"="\SystemRoot\system32\drivers\ohci1394.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ose64]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\osppsvc]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Outlook]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc]
    "ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Parport]
    "ImagePath"="system32\DRIVERS\parport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr]
    "ImagePath"="System32\drivers\partmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PcaSvc]
    "ServiceDll"="%SystemRoot%\System32\pcasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pci]
    "ImagePath"="system32\drivers\pci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pciide]
    "ImagePath"="system32\drivers\pciide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcmcia]
    "ImagePath"="\SystemRoot\system32\DRIVERS\pcmcia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcw]
    "ImagePath"="System32\drivers\pcw.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PEAUTH]
    "ImagePath"="system32\drivers\peauth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc]
    "ServiceDll"="%SystemRoot%\system32\peerdistsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfDisk]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfHost]
    "ImagePath"="%SystemRoot%\SysWow64\perfhost.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfNet]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfOS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfProc]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ph3xIB64]
    "ImagePath"="system32\DRIVERS\Ph3xIB64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla]
    "ServiceDll"="%systemroot%\system32\pla.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PlugPlay]
    "ServiceDll"="%SystemRoot%\system32\umpnpmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PMBDeviceInfoProvider]
    "ImagePath"="\"c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg]
    "ServiceDll"="%SystemRoot%\system32\pnrpauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc]
    "ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent]
    "ServiceDll"="%SystemRoot%\System32\ipsecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PortProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Power]
    "ServiceDll"="%SystemRoot%\system32\umpo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PptpMiniport]
    "ImagePath"="system32\DRIVERS\raspptp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Processor]
    "ImagePath"="\SystemRoot\system32\DRIVERS\processr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProfSvc]
    "ServiceDll"="%systemroot%\system32\profsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Psched]
    "ImagePath"="system32\DRIVERS\pacer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql2300]
    "ImagePath"="\SystemRoot\system32\DRIVERS\ql2300.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql40xx]
    "ImagePath"="\SystemRoot\system32\DRIVERS\ql40xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE]
    "ServiceDll"="%windir%\system32\qwave.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVEdrv]
    "ImagePath"="\SystemRoot\system32\drivers\qwavedrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAcd]
    "ImagePath"="System32\DRIVERS\rasacd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAgileVpn]
    "ImagePath"="system32\DRIVERS\AgileVpn.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto]
    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Rasl2tp]
    "ImagePath"="system32\DRIVERS\rasl2tp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan]
    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe]
    "ImagePath"="system32\DRIVERS\raspppoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasSstp]
    "ImagePath"="system32\DRIVERS\rassstp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdbss]
    "ImagePath"="system32\DRIVERS\rdbss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdpbus]
    "ImagePath"="system32\DRIVERS\rdpbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPCDD]
    "ImagePath"="System32\DRIVERS\RDPCDD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDR]
    "ImagePath"="System32\drivers\rdpdr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPENCDD]
    "ImagePath"="system32\drivers\rdpencdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPREFMP]
    "ImagePath"="system32\drivers\rdprefmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPWD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdyboost]
    "ImagePath"="System32\drivers\rdyboost.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Reliance Netconnect. RunOuc]
    "ImagePath"="c:\program files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess]
    "ServiceDLL"="%SystemRoot%\System32\mprdim.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry]
    "ServiceDll"="%SystemRoot%\system32\regsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper]
    "ServiceDll"="%SystemRoot%\System32\RpcEpMap.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcLocator]
    "ImagePath"="%SystemRoot%\system32\locator.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr]
    "ImagePath"="system32\DRIVERS\rspndr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RTL8167]
    "ImagePath"="system32\DRIVERS\Rt64win7.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\s3cap]
    "ImagePath"="\SystemRoot\system32\drivers\vms3cap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SamSs]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sbp2port]
    "ImagePath"="\SystemRoot\system32\drivers\sbp2port.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SBSDWSCService]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr]
    "ServiceDll"="%SystemRoot%\System32\SCardSvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\scfilter]
    "ImagePath"="System32\DRIVERS\scfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule]
    "ServiceDll"="%systemroot%\system32\schedsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SDRSVC]
    "ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\secdrv]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon]
    "ServiceDll"="%windir%\system32\seclogon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SENS]
    "ServiceDll"="%SystemRoot%\system32\sens.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc]
    "ServiceDll"="%SystemRoot%\system32\sensrsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serenum]
    "ImagePath"="system32\DRIVERS\serenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serial]
    "ImagePath"="system32\DRIVERS\serial.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sermouse]
    "ImagePath"="\SystemRoot\system32\DRIVERS\sermouse.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv]
    "ServiceDLL"="%SystemRoot%\system32\sessenv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffdisk]
    "ImagePath"="\SystemRoot\system32\drivers\sffdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_mmc]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_mmc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_sd]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_sd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sfloppy]
    "ImagePath"="\SystemRoot\system32\DRIVERS\sfloppy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess]
    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ShellHWDetection]
    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid2]
    "ImagePath"="\SystemRoot\system32\DRIVERS\SiSRaid2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid4]
    "ImagePath"="\SystemRoot\system32\DRIVERS\sisraid4.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb]
    "ImagePath"="system32\DRIVERS\smb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SNMPTRAP]
    "ImagePath"="%SystemRoot%\System32\snmptrap.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\spldr]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Spooler]
    "ImagePath"="%SystemRoot%\System32\spoolsv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppsvc]
    "ImagePath"="%SystemRoot%\system32\sppsvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify]
    "ServiceDll"="%SystemRoot%\system32\sppuinotify.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv]
    "ImagePath"="System32\DRIVERS\srv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv2]
    "ImagePath"="System32\DRIVERS\srv2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srvnet]
    "ImagePath"="System32\DRIVERS\srvnet.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV]
    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc]
    "ServiceDll"="%SystemRoot%\system32\sstpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stexstor]
    "ImagePath"="\SystemRoot\system32\DRIVERS\stexstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stisvc]
    "ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\storflt]
    "ImagePath"="system32\drivers\vmstorfl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc]
    "ServiceDll"="%SystemRoot%\system32\storsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\storvsc]
    "ImagePath"="\SystemRoot\system32\drivers\storvsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swenum]
    "ImagePath"="\SystemRoot\system32\drivers\swenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swprv]
    "ServiceDll"="%Systemroot%\System32\swprv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SysMain]
    "ServiceDll"="%systemroot%\system32\sysmain.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService]
    "ServiceDll"="%SystemRoot%\System32\TabSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv]
    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS]
    "ServiceDll"="%SystemRoot%\System32\tbssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip]
    "ImagePath"="System32\drivers\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6]
    "ImagePath"="system32\DRIVERS\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6TUNNEL]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tcpipreg]
    "ImagePath"="System32\drivers\tcpipreg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIPTUNNEL]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDPIPE]
    "ImagePath"="system32\drivers\tdpipe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDTCP]
    "ImagePath"="system32\drivers\tdtcp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tdx]
    "ImagePath"="system32\DRIVERS\tdx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermDD]
    "ImagePath"="\SystemRoot\system32\drivers\termdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService]
    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Themes]
    "ServiceDll"="%SystemRoot%\system32\themeservice.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrkWks]
    "ServiceDll"="%SystemRoot%\System32\trkwks.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrustedInstaller]
    "ImagePath"="%SystemRoot%\servicing\TrustedInstaller.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TSDDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tssecsrv]
    "ImagePath"="System32\DRIVERS\tssecsrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TsUsbFlt]
    "ImagePath"="system32\drivers\tsusbflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tunnel]
    "ImagePath"="system32\DRIVERS\tunnel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uagp35]
    "ImagePath"="\SystemRoot\system32\DRIVERS\uagp35.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\udfs]
    "ImagePath"="system32\DRIVERS\udfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGatherer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGTHRSVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UI0Detect]
    "ImagePath"="%SystemRoot%\system32\UI0Detect.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uliagpkx]
    "ImagePath"="\SystemRoot\system32\drivers\uliagpkx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\umbus]
    "ImagePath"="\SystemRoot\system32\drivers\umbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmPass]
    "ImagePath"="\SystemRoot\system32\DRIVERS\umpass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService]
    "ServiceDll"="%SystemRoot%\System32\umrdp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost]
    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbccgp]
    "ImagePath"="system32\DRIVERS\usbccgp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbcir]
    "ImagePath"="\SystemRoot\system32\drivers\usbcir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbehci]
    "ImagePath"="system32\DRIVERS\usbehci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbhub]
    "ImagePath"="\SystemRoot\system32\drivers\usbhub.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbohci]
    "ImagePath"="system32\DRIVERS\usbohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbprint]
    "ImagePath"="system32\DRIVERS\usbprint.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbscan]
    "ImagePath"="system32\DRIVERS\usbscan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\USBSTOR]
    "ImagePath"="system32\DRIVERS\USBSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbuhci]
    "ImagePath"="\SystemRoot\system32\DRIVERS\usbuhci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UxSms]
    "ServiceDll"="%SystemRoot%\System32\uxsms.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxNetAdp]
    "ImagePath"="system32\DRIVERS\VBoxNetAdp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxNetFlt]
    "ImagePath"="system32\DRIVERS\VBoxNetFlt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VClone]
    "ImagePath"="system32\DRIVERS\VClone.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrvroot]
    "ImagePath"="system32\drivers\vdrvroot.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vds]
    "ImagePath"="%SystemRoot%\System32\vds.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vga]
    "ImagePath"="system32\DRIVERS\vgapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VgaSave]
    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vhdmp]
    "ImagePath"="\SystemRoot\system32\drivers\vhdmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\viaide]
    "ImagePath"="\SystemRoot\system32\drivers\viaide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMAuthdService]
    "ImagePath"="\"c:\program files (x86)\VMware\VMware Player\vmware-authd.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmbus]
    "ImagePath"="system32\drivers\vmbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMBusHID]
    "ImagePath"="\SystemRoot\system32\drivers\VMBusHID.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmci]
    "ImagePath"="system32\DRIVERS\vmci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmkbd]
    "ImagePath"="\??\c:\windows\system32\drivers\VMkbd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetAdapter]
    "ImagePath"="system32\DRIVERS\vmnetadapter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetBridge]
    "ImagePath"="system32\DRIVERS\vmnetbridge.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetDHCP]
    "ImagePath"="c:\windows\system32\vmnetdhcp.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetuserif]
    "ImagePath"="\??\c:\windows\system32\drivers\vmnetuserif.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMparport]
    "ImagePath"="\??\c:\windows\system32\drivers\VMparport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmusb]
    "ImagePath"="System32\Drivers\vmusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMUSBArbService]
    "ImagePath"="\"c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMware]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMware NAT Service]
    "ImagePath"="c:\windows\system32\vmnat.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmx86]
    "ImagePath"="\??\c:\windows\system32\drivers\vmx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgr]
    "ImagePath"="system32\drivers\volmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgrx]
    "ImagePath"="System32\drivers\volmgrx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volsnap]
    "ImagePath"="system32\drivers\volsnap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsmraid]
    "ImagePath"="\SystemRoot\system32\DRIVERS\vsmraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsock]
    "ImagePath"="system32\drivers\vsock.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS]
    "ImagePath"="%systemroot%\system32\vssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwifibus]
    "ImagePath"="system32\DRIVERS\vwifibus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwififlt]
    "ImagePath"="system32\DRIVERS\vwififlt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time]
    "ServiceDll"="%systemroot%\system32\w32time.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W3SVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WacomPen]
    "ImagePath"="\SystemRoot\system32\DRIVERS\wacompen.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WANARP]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wanarpv6]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wbengine]
    "ImagePath"="\"%systemroot%\system32\wbengine.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc]
    "ServiceDll"="%SystemRoot%\System32\wbiosrvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc]
    "ServiceDll"="%SystemRoot%\System32\wcncsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService]
    "ServiceDll"="%SystemRoot%\System32\WcsPlugInService.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wd]
    "ImagePath"="\SystemRoot\system32\DRIVERS\wd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wdf01000]
    "ImagePath"="system32\drivers\Wdf01000.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiServiceHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiSystemHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient]
    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc]
    "ServiceDll"="%SystemRoot%\system32\wecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport]
    "ServiceDll"="%SystemRoot%\System32\wercplsupport.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc]
    "ServiceDll"="%SystemRoot%\System32\WerSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WfpLwf]
    "ImagePath"="system32\DRIVERS\wfplwf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WIMMount]
    "ImagePath"="system32\drivers\wimmount.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend]
    "ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinHttpAutoProxySvc]
    "ServiceDll"="winhttp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt]
    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM]
    "ServiceDll"="%SystemRoot%\system32\WsmSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinUsb]
    "ImagePath"="system32\DRIVERS\WinUsb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc]
    "ServiceDll"="%SystemRoot%\System32\wlansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiAcpi]
    "ImagePath"="\SystemRoot\system32\drivers\wmiacpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiApRpl]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmiApSrv]
    "ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WMPNetworkSvc]
    "ImagePath"="\"%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc]
    "ServiceDll"="%SystemRoot%\System32\wpcsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPDBusEnum]
    "ServiceDll"="%SystemRoot%\system32\wpdbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ws2ifsl]
    "ImagePath"="\SystemRoot\system32\drivers\ws2ifsl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearch]
    "ImagePath"="%systemroot%\system32\SearchIndexer.exe /Embedding"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearchIdxPi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv]
    "ServiceDll"="%systemroot%\system32\wuaueng.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WudfPf]
    "ImagePath"="system32\drivers\WudfPf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WUDFRd]
    "ImagePath"="system32\DRIVERS\WUDFRd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc]
    "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc]
    "ServiceDll"="%SystemRoot%\System32\wwansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xmlprov]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{19BEC97F-157F-4DE6-B16E-BEB6A585535C}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{508F3EE6-E1C1-4E00-B7ED-2899B41A2402}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{6380F913-1BB6-4871-8EAF-7DEEAE49CCFF}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{6CA778AC-FDC6-4819-B2A9-444DC1226ECE}]
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
    @="?????????????????? v1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
    @="?????????????????? v2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\programdata\Reliance Netconnect+\OnlineUpdate\ouc.exe
    c:\windows\SysWOW64\vmnat.exe
    c:\windows\SysWOW64\vmnetdhcp.exe
    c:\program files (x86)\VMware\VMware Player\vmware-authd.exe
    .
    **************************************************************************
    .
    Completion time: 2013-05-03 09:29:55 - machine was rebooted
    ComboFix-quarantined-files.txt 2013-05-03 03:59
    .
    Pre-Run: 85,565,431,808 bytes free
    Post-Run: 85,606,268,928 bytes free
    .
    - - End Of File - - 57E27CB4E848D5E31DF411F357956B57
     
  9. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Looks good.

    How is computer doing?

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Delete.
    • Confirm each time with Ok.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  10. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    When I started my computer today, I was not able to connect to internet. I ran FSS, below are the logs:

    Farbar Service Scanner Version: 14-04-2013
    Ran by vibs (administrator) on 03-05-2013 at 21:34:25
    Running from "C:\Users\vibs\Desktop\Newfolder"
    Windows 7 Professional Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************
    Internet Services:
    ============
    Dhcp Service is not running. Checking service configuration:
    The start type of Dhcp service is OK.
    The ImagePath of Dhcp service is OK.
    The ServiceDll of Dhcp service is OK.
    afd Service is not running. Checking service configuration:
    Checking Start type: ATTENTION!=====> Unable to open afd registry key. The service key does not exist.
    Checking ImagePath: ATTENTION!=====> Unable to open afd registry key. The service key does not exist.
    Checking LEGACY_afd: ATTENTION!=====> Unable to open LEGACY_afd\0000 registry key. The key does not exist.

    Connection Status:
    ==============
    Localhost is accessible.
    There is no connection to network.
    Attempt to access Google IP returned error.
    Attempt to access Google.com returned error: Other errors
    Attempt to access Yahoo IP returned error.
    Attempt to access Yahoo.com returned error: Other errors

    Windows Firewall:
    =============
    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0

    System Restore:
    ============
    System Restore Disabled Policy:
    ========================

    Action Center:
    ============
    wscsvc Service is not running. Checking service configuration:
    Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
    Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
    Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

    Other Services:
    ==============

    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys
    [2013-04-21 07:44] - [2013-05-03 20:53] - 0022368 ____A (AVG Technologies CZ, s.r.o. ) 42B7E1AA0C7EC54652A50585793F1885
    ATTENTION!=====> C:\Windows\System32\drivers\afd.sys IS INFECTED AND SHOULD BE REPLACED.
    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll => MD5 is legit
    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit

    **** End of log ****

    What should be next step.
     
  11. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    We have couple of registry keys missing and one infected system file.

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box and paste it into the main textfield:
      Code:
      :filefind
      afd.sys
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
  12. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    SystemLook 30.07.11 by jpshortstuff
    Log created at 08:10 on 04/05/2013 by vibs
    Administrator - Elevation successful
    ========== filefind ==========
    Searching for "afd.sys"
    C:\b91131aa83465d552bbc\6f13ec7670259cb31be55d4c0d32dd9e\20bdbf785e5affa748\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys --a---- 499712 bytes [15:21 28/03/2011] [19:53 19/11/2010] D31DC7A16DEA4A9BAF179F3D6FBDB38C
    C:\Windows\System32\drivers\AFD.SYS --a---- 022368 bytes [02:14 21/04/2013] [20:53 03/05/2013] 42B7E1AA0C7EC54652A50585793F1885
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys --a---- 500224 bytes [23:21 13/07/2009] [23:21 13/07/2009] B9384E03479D2506BC924C16A3DB87BC
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16937_none_34154fcd77f3bbda\afd.sys --a---- 499200 bytes [02:14 21/04/2013] [03:59 28/12/2011] DB9D6C6B2CD95A9CA414D045B627422E
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.21115_none_34b263fe91032456\afd.sys --a---- 499200 bytes [02:14 21/04/2013] [04:01 28/12/2011] CCA39961E76B491DDF44B1E90FC8971D
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys --a---- 499712 bytes [18:29 20/04/2013] [19:53 19/11/2010] D31DC7A16DEA4A9BAF179F3D6FBDB38C
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys --a---- 498688 bytes [02:14 21/04/2013] [03:59 28/12/2011] 1C7857B62DE5994A75B054A9FD4C3825
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys --a---- 498176 bytes [02:14 21/04/2013] [04:01 28/12/2011] 36A14FD1A23F57046361733B792CA8DB
    -= EOF =-
     
  13. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Following steps involve registry editing. Please create new restore point before proceeding!!!
    How to:
    XP - http://support.microsoft.com/kb/948247
    Vista and Seven - http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
    Windows 8: http://www.vikitech.com/11302/system-restore-windows-8

    Download AFD.reg from here: http://download.bleepingcomputer.com/win-services/7/AFD.reg
    Double click on downloaded file and confirm the prompt.

    Download wscsvc.reg from here: http://download.bleepingcomputer.com/win-services/7/wscsvc.reg
    Double click on downloaded file and confirm the prompt.

    Next...

    1. Please open Notepad (Start>All Programs>Accessories>Notepad).

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    FCopy::
    C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16937_none_34154fcd77f3bbda\afd.sys | C:\Windows\System32\drivers\AFD.SYS
     
    ClearJavaCache::
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    Post new FSS log as well.
     
  14. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    ComboFix 13-05-01.03 - vibs 05/04/2013 10:16:23.3.2 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.5630.4136 [GMT 5.5:30]
    Running from: c:\users\vibs\Desktop\Newfolder\ComboFix.exe
    Command switches used :: c:\users\vibs\Desktop\Newfolder\CFScript.txt
    AV: AVG Internet Security 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    FW: AVG Internet Security 2013 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
    SP: AVG Internet Security 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    .
    --------------- FCopy ---------------
    .
    c:\windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16937_none_34154fcd77f3bbda\afd.sys --> c:\windows\System32\drivers\AFD.SYS
    .
    ((((((((((((((((((((((((( Files Created from 2013-04-04 to 2013-05-04 )))))))))))))))))))))))))))))))
    .
    .
    2013-05-04 04:52 . 2013-05-04 04:52 -------- d-----w- c:\users\Default\AppData\Local\temp
    2013-05-04 04:52 . 2013-05-04 04:52 -------- d-----w- c:\users\Administrator\AppData\Local\temp
    2013-05-01 11:47 . 2013-05-01 11:47 -------- d-----w- c:\windows\system32\appmgmt
    2013-05-01 06:38 . 2013-05-01 06:38 -------- d-s---w- c:\windows\SysWow64\Microsoft
    2013-05-01 05:50 . 2013-05-01 05:50 -------- d-----w- c:\program files\HitmanPro
    2013-04-26 12:00 . 2013-04-26 12:00 -------- d-----w- c:\programdata\Reliance Netconnect
    2013-04-26 11:57 . 2013-04-26 12:01 -------- d-----w- c:\programdata\DatacardService
    2013-04-24 13:38 . 2013-04-24 13:38 -------- d-----w- c:\program files (x86)\Common Files\Java
    2013-04-24 13:38 . 2013-04-24 13:38 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
    2013-04-24 13:38 . 2013-04-24 13:38 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2013-04-24 13:38 . 2013-04-24 13:38 -------- d-----w- c:\program files (x86)\Java
    2013-04-24 03:33 . 2013-04-24 03:33 -------- d-----w- c:\program files (x86)\MSXML 4.0
    2013-04-24 03:32 . 2007-07-19 12:44 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
    2013-04-24 03:32 . 2007-07-19 12:44 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
    2013-04-24 03:32 . 2006-03-31 07:11 3927248 ----a-w- c:\windows\system32\d3dx9_30.dll
    2013-04-24 03:29 . 2013-04-24 03:29 -------- d-----w- c:\program files (x86)\Sony
    2013-04-24 03:29 . 2013-04-24 03:29 -------- d-----w- c:\programdata\Sony Corporation
    2013-04-24 02:56 . 2013-04-24 02:56 -------- d-----w- c:\programdata\UDL
    2013-04-24 02:55 . 2013-04-24 02:55 -------- d-----w- c:\program files\Epson Software
    2013-04-24 02:53 . 2013-04-24 02:56 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
    2013-04-24 02:53 . 2013-04-24 02:56 -------- d-----w- c:\program files (x86)\Epson Software
    2013-04-24 02:52 . 2013-04-24 02:53 -------- d-----w- c:\program files (x86)\ABBYY FineReader 9.0 Sprint
    2013-04-24 02:52 . 2013-04-24 02:52 -------- d-----w- c:\programdata\ABBYY
    2013-04-24 02:52 . 2013-04-24 02:52 -------- d-----w- c:\program files (x86)\Common Files\ABBYY
    2013-04-24 02:50 . 2013-04-24 02:53 -------- d-----w- c:\program files (x86)\epson
    2013-04-23 10:40 . 2013-04-23 11:06 -------- d-----w- c:\programdata\HitmanPro
    2013-04-23 10:37 . 2013-04-29 19:05 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2013-04-23 10:37 . 2013-04-23 10:37 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
    2013-04-23 10:14 . 2013-04-23 10:14 -------- d-----w- c:\programdata\Malwarebytes
    2013-04-23 10:14 . 2013-04-04 09:20 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-04-23 10:14 . 2013-04-23 10:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2013-04-23 09:06 . 2012-10-24 08:47 67224 ----a-w- c:\windows\system32\vsocklib.dll
    2013-04-23 09:06 . 2012-10-24 08:47 70296 ----a-w- c:\windows\system32\drivers\vsock.sys
    2013-04-23 09:06 . 2012-10-24 08:47 63128 ----a-w- c:\windows\SysWow64\vsocklib.dll
    2013-04-23 09:06 . 2013-02-25 20:58 67664 ----a-w- c:\windows\system32\drivers\vmx86.sys
    2013-04-23 09:06 . 2013-02-25 20:57 33360 ----a-w- c:\windows\system32\drivers\VMkbd.sys
    2013-04-23 09:06 . 2013-02-25 20:58 31824 ----a-w- c:\windows\system32\drivers\VMparport.sys
    2013-04-23 09:05 . 2013-02-25 20:58 357456 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
    2013-04-23 09:05 . 2013-02-25 20:58 436304 ----a-w- c:\windows\SysWow64\vmnat.exe
    2013-04-23 09:05 . 2013-02-25 20:58 30800 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
    2013-04-23 09:05 . 2013-02-25 20:59 933968 ----a-w- c:\windows\system32\vnetlib64.dll
    2013-04-23 09:05 . 2012-10-11 10:45 52376 ----a-w- c:\windows\system32\drivers\hcmon.sys
    2013-04-23 09:05 . 2013-04-23 09:05 -------- d-----w- c:\program files\Common Files\VMware
    2013-04-23 09:04 . 2013-05-04 04:53 -------- d-----w- c:\programdata\VMware
    2013-04-23 09:04 . 2013-04-23 09:04 -------- d-----w- c:\program files (x86)\VMware
    2013-04-23 09:04 . 2013-04-23 09:04 -------- d-----w- c:\program files (x86)\Common Files\VMware
    2013-04-22 14:17 . 2013-04-22 16:18 -------- d-----w- c:\programdata\eMule
    2013-04-22 13:04 . 2013-04-22 13:04 -------- d-----w- c:\program files\Common Files\DESIGNER
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\program files\Microsoft.NET
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\programdata\regid.1991-06.com.microsoft
    2013-04-22 13:01 . 2013-04-22 13:03 -------- d-----w- c:\program files\Microsoft SQL Server
    2013-04-22 12:57 . 2013-04-22 12:57 -------- d-----w- c:\program files\Microsoft Analysis Services
    2013-04-22 12:57 . 2013-04-22 12:57 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
    2013-04-22 12:56 . 2013-04-22 13:01 -------- d-----w- c:\program files\Microsoft Office
    2013-04-22 12:55 . 2013-04-23 04:07 -------- d-----w- c:\programdata\Microsoft Help
    2013-04-22 12:39 . 2013-03-15 13:44 237840 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
    2013-04-22 12:38 . 2013-03-15 13:43 120080 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
    2013-04-22 12:38 . 2013-05-01 11:47 -------- dc----w- c:\windows\system32\DRVSTORE
    2013-04-22 01:50 . 2013-04-22 01:50 -------- d-----w- c:\users\Default\AppData\Roaming\TuneUp Software
    2013-04-22 01:40 . 2013-04-22 01:41 -------- d-----w- c:\programdata\AVG2013
    2013-04-22 01:38 . 2013-04-22 01:38 -------- d-----w- c:\program files (x86)\AVG
    2013-04-21 07:28 . 2013-04-20 18:25 -------- d-----w- c:\windows\Panther
    2013-04-21 07:20 . 2013-04-21 07:20 -------- d-----w- c:\program files (x86)\Microsoft
    2013-04-21 07:20 . 2013-04-21 07:20 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive
    2013-04-21 07:20 . 2013-04-21 07:23 -------- d-----w- c:\program files (x86)\Windows Live
    2013-04-21 07:19 . 2013-04-21 07:19 -------- d-----w- c:\windows\PCHEALTH
    2013-04-21 07:12 . 2013-04-21 07:12 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
    2013-04-21 06:40 . 2013-04-21 06:40 0 ----a-w- c:\windows\ativpsrm.bin
    2013-04-21 04:42 . 2013-04-21 04:42 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
    2013-04-21 04:20 . 2013-04-21 04:20 -------- d-----w- c:\program files\Microsoft Games
    2013-04-21 03:36 . 2013-04-21 03:36 -------- d-----w- c:\program files (x86)\Elaborate Bytes
    2013-04-21 03:22 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
    2013-04-21 03:22 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
    2013-04-21 03:22 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
    2013-04-21 03:22 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
    2013-04-21 03:22 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
    2013-04-21 03:22 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
    2013-04-21 03:22 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
    2013-04-21 03:22 . 2011-11-17 06:35 395776 ----a-w- c:\windows\system32\webio.dll
    2013-04-21 03:22 . 2011-11-17 05:35 314880 ----a-w- c:\windows\SysWow64\webio.dll
    2013-04-21 03:22 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2013-04-21 03:20 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2013-04-21 03:20 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
    2013-04-21 03:20 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
    2013-04-21 03:20 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2013-04-21 03:19 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
    2013-04-21 03:19 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
    2013-04-21 03:19 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
    2013-04-21 02:51 . 2013-04-01 14:28 72702784 ----a-w- c:\windows\system32\MRT.exe
    2013-04-21 02:38 . 2013-04-21 02:38 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-21 02:27 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
    2013-04-21 02:27 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    2013-04-21 02:27 . 2010-09-30 06:47 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
    2013-04-21 02:27 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
    2013-04-21 02:27 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
    2013-04-21 02:27 . 2010-09-30 10:41 100864 ----a-w- c:\windows\system32\fontsub.dll
    2013-04-21 02:24 . 2013-04-21 02:24 -------- d-----w- c:\program files\Microsoft Silverlight
    2013-04-21 02:24 . 2013-04-21 02:24 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
    2013-04-21 02:23 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
    2013-04-21 02:23 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2013-04-21 02:23 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2013-04-21 02:23 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
    2013-04-21 02:23 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
    2013-04-21 02:23 . 2013-04-24 02:37 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2013-04-21 02:18 . 2013-04-17 01:01 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{48D77485-AF34-4E15-9342-CBF204416DF2}\mpengine.dll
    2013-04-21 02:18 . 2013-03-11 19:40 282744 ------w- c:\windows\system32\MpSigStub.exe
    2013-04-21 02:16 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2013-04-21 02:16 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
    2013-04-21 02:16 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
    2013-04-21 02:16 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll
    2013-04-21 02:16 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2013-04-21 02:14 . 2012-06-02 05:50 458704 ----a-w- c:\windows\system32\drivers\cng.sys
    2013-04-21 02:13 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
    2013-04-21 02:12 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
    2013-04-21 02:12 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2013-04-21 02:12 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
    2013-04-21 02:12 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
    2013-04-21 02:12 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
    2013-04-21 02:12 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
    2013-04-21 02:12 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
    2013-04-21 02:12 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
    2013-04-21 02:10 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-05-03 15:23 . 2009-07-14 00:10 22368 ----a-w- c:\windows\system32\drivers\WS2IFSL.SYS
    2013-04-20 18:49 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2013-04-20 18:49 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2013-03-15 13:44 . 2013-03-15 13:44 131856 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
    2013-02-25 20:57 . 2013-02-25 20:57 62104 ----a-w- c:\windows\system32\vmnetbridge.dll
    2013-02-25 20:57 . 2013-02-25 20:57 48792 ----a-w- c:\windows\system32\vnetinst.dll
    2013-02-25 20:57 . 2013-02-25 20:57 45720 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
    2013-02-25 20:57 . 2013-02-25 20:57 24216 ----a-w- c:\windows\system32\drivers\vmnet.sys
    2013-02-25 20:57 . 2013-02-25 20:57 20120 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
    2013-02-25 19:29 . 2013-02-25 19:29 360528 ----a-w- c:\windows\SysWow64\vmnc.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
    @=""
    .
    R2 Alcatel Wave Modem Device Helper;Alcatel Wave Modem Device Helper;c:\program files (x86)\My Connection\BackgroundService\ServiceManager.exe [2011-06-20 49752]
    R2 Reliance Netconnect. RunOuc;Reliance Netconnect. OUC;c:\program files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe [2013-04-26 218624]
    R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2013-04-26 117248]
    R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys [2011-06-20 120832]
    R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [2011-10-05 729152]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-01 178824]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-19 59392]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2013-03-15 131856]
    R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
    S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-14 63328]
    S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-20 225120]
    S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-15 111968]
    S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-13 40800]
    S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2012-10-24 85104]
    S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2012-10-24 70296]
    S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [2012-09-04 50296]
    S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]
    S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-01 185696]
    S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-20 200032]
    S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-19 203776]
    S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2013\avgfws.exe [2012-12-10 1342024]
    S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
    S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
    S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2011-03-14 346976]
    S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176]
    S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
    S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2013-04-26 86016]
    S3 Ph3xIB64;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB64.sys [2009-06-10 1627520]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
    .
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
    FontCache
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office15\ONBttnIE.dll/105
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    FF - ProfilePath - c:\users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\
    FF - ExtSQL: 2013-04-26 18:13; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
    FF - ExtSQL: 2013-05-01 11:08; {35379F86-8CCB-4724-AE33-4278DE266C70}; c:\program files (x86)\Orbitdownloader\addons\OneClickYouTubeDownloader
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NETFramework]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\1394ohci]
    "ImagePath"="\SystemRoot\system32\drivers\1394ohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ABBYY.Licensing.FineReader.Sprint.9.0]
    "ImagePath"="\"c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe\" -service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI]
    "ImagePath"="system32\drivers\ACPI.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AcpiPmi]
    "ImagePath"="\SystemRoot\system32\drivers\acpipmi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeARMservice]
    "ImagePath"="\"c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adp94xx]
    "ImagePath"="\SystemRoot\system32\DRIVERS\adp94xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpahci]
    "ImagePath"="\SystemRoot\system32\DRIVERS\adpahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpu320]
    "ImagePath"="\SystemRoot\system32\DRIVERS\adpu320.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adsi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc]
    "ServiceDll"="%SystemRoot%\System32\aelupsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AFD]
    "ImagePath"="\SystemRoot\system32\drivers\afd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\agp440]
    "ImagePath"="\SystemRoot\system32\drivers\agp440.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Alcatel Wave Modem Device Helper]
    "ImagePath"="c:\program files (x86)\My Connection\BackgroundService\ServiceManager.exe -start"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ALG]
    "ImagePath"="%SystemRoot%\System32\alg.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\aliide]
    "ImagePath"="\SystemRoot\system32\drivers\aliide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AMD External Events Utility]
    "ImagePath"="%SystemRoot%\system32\atiesrxx.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdide]
    "ImagePath"="\SystemRoot\system32\drivers\amdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdK8]
    "ImagePath"="system32\DRIVERS\amdk8.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdkmdag]
    "ImagePath"="system32\DRIVERS\atikmdag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdkmdap]
    "ImagePath"="system32\DRIVERS\atikmpag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdPPM]
    "ImagePath"="\SystemRoot\system32\DRIVERS\amdppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsata]
    "ImagePath"="\SystemRoot\system32\drivers\amdsata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsbs]
    "ImagePath"="\SystemRoot\system32\DRIVERS\amdsbs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdxata]
    "ImagePath"="system32\drivers\amdxata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppID]
    "ImagePath"="\SystemRoot\system32\drivers\appid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc]
    "ServiceDll"="%SystemRoot%\System32\appidsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo]
    "ServiceDll"="%SystemRoot%\System32\appinfo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt]
    "ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arc]
    "ImagePath"="\SystemRoot\system32\DRIVERS\arc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arcsas]
    "ImagePath"="\SystemRoot\system32\DRIVERS\arcsas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AsyncMac]
    "ImagePath"="system32\DRIVERS\asyncmac.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\atapi]
    "ImagePath"="system32\drivers\atapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Atierecord]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\atikmdag]
    "ImagePath"="\SystemRoot\system32\drivers\atikmdag.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgfwfd]
    "ImagePath"="system32\DRIVERS\avgfwd6a.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgfws]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgfws.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgidsagent.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    "ImagePath"="system32\DRIVERS\avgidsha.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    "ImagePath"="system32\DRIVERS\avgldx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "ImagePath"="system32\DRIVERS\avgloga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    "ImagePath"="system32\DRIVERS\avgmfx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
    "ImagePath"="system32\DRIVERS\avgrkx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
    "ImagePath"="system32\DRIVERS\avgtdia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV]
    "ServiceDll"="%SystemRoot%\System32\AxInstSV.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b06bdrv]
    "ImagePath"="\SystemRoot\system32\DRIVERS\bxvbda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b57nd60a]
    "ImagePath"="system32\DRIVERS\b57nd60a.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BattC]
    "MofImagePath"="system32\drivers\battc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC]
    "ServiceDll"="%SystemRoot%\System32\bdesvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Beep]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE]
    "ServiceDll"="%SystemRoot%\System32\bfe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS]
    "ServiceDll"="%systemroot%\system32\qmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\blbdrive]
    "ImagePath"="system32\DRIVERS\blbdrive.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bowser]
    "ImagePath"="system32\DRIVERS\bowser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltLo]
    "ImagePath"="\SystemRoot\system32\DRIVERS\BrFiltLo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltUp]
    "ImagePath"="\SystemRoot\system32\DRIVERS\BrFiltUp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BridgeMP]
    "ImagePath"="system32\DRIVERS\bridge.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Browser]
    "ServiceDll"="%SystemRoot%\System32\browser.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Brserid]
    "ImagePath"="\SystemRoot\System32\Drivers\Brserid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrSerWdm]
    "ImagePath"="\SystemRoot\System32\Drivers\BrSerWdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbMdm]
    "ImagePath"="\SystemRoot\System32\Drivers\BrUsbMdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbSer]
    "ImagePath"="\SystemRoot\System32\Drivers\BrUsbSer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHMODEM]
    "ImagePath"="\SystemRoot\system32\DRIVERS\bthmodem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHPORT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv]
    "ServiceDll"="%SystemRoot%\system32\bthserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdfs]
    "ImagePath"="system32\DRIVERS\cdfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdrom]
    "ImagePath"="system32\DRIVERS\cdrom.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\circlass]
    "ImagePath"="\SystemRoot\system32\DRIVERS\circlass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CISVC]
    "ImagePath"="%systemroot%\system32\CISVC.EXE"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CLFS]
    "ImagePath"="System32\CLFS.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_32]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_64]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CmBatt]
    "ImagePath"="\SystemRoot\system32\DRIVERS\CmBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdide]
    "ImagePath"="\SystemRoot\system32\drivers\cmdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CNG]
    "ImagePath"="System32\Drivers\cng.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Compbatt]
    "ImagePath"="\SystemRoot\system32\DRIVERS\compbatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CompositeBus]
    "ImagePath"="\SystemRoot\system32\drivers\CompositeBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\COMSysApp]
    "ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ContentFilter]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ContentIndex]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crcdisk]
    "ImagePath"="\SystemRoot\system32\DRIVERS\crcdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc]
    "ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CSC]
    "ImagePath"="system32\drivers\csc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CscService]
    "ServiceDll"="%SystemRoot%\System32\cscsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DCLocator]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\defragsvc]
    "ServiceDll"="%Systemroot%\System32\defragsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DfsC]
    "ImagePath"="System32\Drivers\dfsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dhcp]
    "ServiceDll"="%SystemRoot%\system32\dhcpcore.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\discache]
    "ImagePath"="System32\drivers\discache.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk]
    "ImagePath"="system32\DRIVERS\disk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dnscache]
    "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc]
    "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DPS]
    "ServiceDll"="%SystemRoot%\system32\dps.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\drmkaud]
    "ImagePath"="system32\drivers\drmkaud.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DXGKrnl]
    "ImagePath"="\SystemRoot\System32\drivers\dxgkrnl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost]
    "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ebdrv]
    "ImagePath"="\SystemRoot\system32\DRIVERS\evbda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS]
    "ImagePath"="%SystemRoot%\System32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehRecvr]
    "ImagePath"="%systemroot%\ehome\ehRecvr.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehSched]
    "ImagePath"="%systemroot%\ehome\ehsched.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ElbyCDIO]
    "ImagePath"="System32\Drivers\ElbyCDIO.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\elxstor]
    "ImagePath"="\SystemRoot\system32\DRIVERS\elxstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ErrDev]
    "ImagePath"="\SystemRoot\system32\drivers\errdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ESENT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog]
    "ServiceDll"="%SystemRoot%\System32\wevtsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem]
    "ServiceDll"="%systemroot%\system32\es.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ewusbmbb]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ew_hwusbdev]
    "ImagePath"="system32\DRIVERS\ew_hwusbdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\exfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fastfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fax]
    "ImagePath"="%systemroot%\system32\fxssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdc]
    "ImagePath"="system32\DRIVERS\fdc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost]
    "ServiceDll"="%SystemRoot%\system32\fdPHost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub]
    "ServiceDll"="%SystemRoot%\system32\fdrespub.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FileInfo]
    "ImagePath"="system32\drivers\fileinfo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Filetrace]
    "ImagePath"="system32\drivers\filetrace.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\flpydisk]
    "ImagePath"="system32\DRIVERS\flpydisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FltMgr]
    "ImagePath"="system32\drivers\fltmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache]
    "ServiceDll"="%SystemRoot%\system32\FntCache.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FsDepends]
    "ImagePath"="System32\drivers\FsDepends.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fs_Rec]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fvevol]
    "ImagePath"="System32\DRIVERS\fvevol.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gagp30kx]
    "ImagePath"="\SystemRoot\system32\DRIVERS\gagp30kx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc]
    "ServiceDll"="%SystemRoot%\System32\gpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hcmon]
    "ImagePath"="\??\c:\windows\system32\drivers\hcmon.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hcw85cir]
    "ImagePath"="\SystemRoot\system32\drivers\hcw85cir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HdAudAddService]
    "ImagePath"="\SystemRoot\system32\drivers\HdAudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus]
    "ImagePath"="\SystemRoot\system32\drivers\HDAudBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBatt]
    "ImagePath"="\SystemRoot\system32\DRIVERS\HidBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBth]
    "ImagePath"="\SystemRoot\system32\DRIVERS\hidbth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidIr]
    "ImagePath"="\SystemRoot\system32\DRIVERS\hidir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv]
    "ServiceDll"="%SystemRoot%\System32\hidserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidUsb]
    "ImagePath"="\SystemRoot\system32\drivers\hidusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc]
    "ServiceDLL"="%SystemRoot%\system32\kmsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener]
    "ServiceDll"="%SystemRoot%\system32\ListSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider]
    "ServiceDll"="%SystemRoot%\system32\provsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HpSAMD]
    "ImagePath"="\SystemRoot\system32\drivers\HpSAMD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HTTP]
    "ImagePath"="system32\drivers\HTTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\huawei_enumerator]
    "ImagePath"="system32\DRIVERS\ew_jubusenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\huawei_update]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwdatacard]
    "ImagePath"="system32\DRIVERS\ewusbmdm.sys"
     
  15. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HWDeviceService64.exe]
    "ImagePath"="\"c:\programdata\DatacardService\HWDeviceService64.exe\" -/service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwpolicy]
    "ImagePath"="System32\drivers\hwpolicy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwusbdev]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\i8042prt]
    "ImagePath"="\SystemRoot\system32\drivers\i8042prt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iaStorV]
    "ImagePath"="\SystemRoot\system32\drivers\iaStorV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iirsp]
    "ImagePath"="\SystemRoot\system32\DRIVERS\iirsp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IKEEXT]
    "ServiceDll"="%SystemRoot%\System32\ikeext.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\inetaccs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelide]
    "ImagePath"="\SystemRoot\system32\drivers\intelide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm]
    "ImagePath"="\SystemRoot\system32\DRIVERS\intelppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum]
    "ServiceDll"="%SystemRoot%\system32\ipbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IpFilterDriver]
    "ImagePath"="system32\DRIVERS\ipfltdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc]
    "ServiceDll"="%SystemRoot%\System32\iphlpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPMIDRV]
    "ImagePath"="\SystemRoot\system32\drivers\IPMIDrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPNAT]
    "ImagePath"="System32\drivers\ipnat.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IRENUM]
    "ImagePath"="system32\drivers\irenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ISAPISearch]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\isapnp]
    "ImagePath"="\SystemRoot\system32\drivers\isapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iScsiPrt]
    "ImagePath"="\SystemRoot\system32\drivers\msiscsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\jrdusbser]
    "ImagePath"="system32\DRIVERS\jrdusbser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdclass]
    "ImagePath"="\SystemRoot\system32\drivers\kbdclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdhid]
    "ImagePath"="\SystemRoot\system32\drivers\kbdhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecDD]
    "ImagePath"="System32\Drivers\ksecdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecPkg]
    "ImagePath"="System32\Drivers\ksecpkg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ksthunk]
    "ImagePath"="\SystemRoot\system32\drivers\ksthunk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm]
    "ServiceDll"="%systemroot%\system32\msdtckrm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer]
    "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation]
    "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ldap]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio]
    "ImagePath"="system32\DRIVERS\lltdio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc]
    "ServiceDll"="%SystemRoot%\System32\lltdsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts]
    "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Lsa]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_FC]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_fc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_sas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS2]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_sas2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SCSI]
    "ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\luafv]
    "ImagePath"="\SystemRoot\system32\drivers\luafv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc]
    "ServiceDll"="%SystemRoot%\system32\Mcx2Svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\megasas]
    "ImagePath"="\SystemRoot\system32\DRIVERS\megasas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MegaSR]
    "ImagePath"="\SystemRoot\system32\DRIVERS\MegaSR.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MMCSS]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Modem]
    "ImagePath"="system32\drivers\modem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor]
    "ImagePath"="system32\DRIVERS\monitor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouclass]
    "ImagePath"="\SystemRoot\system32\drivers\mouclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouhid]
    "ImagePath"="system32\DRIVERS\mouhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mountmgr]
    "ImagePath"="System32\drivers\mountmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MozillaMaintenance]
    "ImagePath"="\"c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpio]
    "ImagePath"="\SystemRoot\system32\drivers\mpio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpsdrv]
    "ImagePath"="System32\drivers\mpsdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc]
    "ServiceDll"="%SystemRoot%\system32\mpssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MRxDAV]
    "ImagePath"="\SystemRoot\system32\drivers\mrxdav.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb]
    "ImagePath"="system32\DRIVERS\mrxsmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb10]
    "ImagePath"="system32\DRIVERS\mrxsmb10.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb20]
    "ImagePath"="system32\DRIVERS\mrxsmb20.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msahci]
    "ImagePath"="\SystemRoot\system32\drivers\msahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msdsm]
    "ImagePath"="\SystemRoot\system32\drivers\msdsm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC]
    "ImagePath"="%SystemRoot%\System32\msdtc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Msfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mshidkmdf]
    "ImagePath"="\SystemRoot\System32\drivers\mshidkmdf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msisadrv]
    "ImagePath"="system32\drivers\msisadrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI]
    "ServiceDll"="%systemroot%\system32\iscsiexe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msiserver]
    "ImagePath"="%systemroot%\system32\msiexec.exe /V"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSKSSRV]
    "ImagePath"="system32\drivers\MSKSSRV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPCLOCK]
    "ImagePath"="system32\drivers\MSPCLOCK.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPQM]
    "ImagePath"="system32\drivers\MSPQM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsRPC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSSCNTRS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios]
    "ImagePath"="\SystemRoot\system32\drivers\mssmbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSTEE]
    "ImagePath"="system32\drivers\MSTEE.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MTConfig]
    "ImagePath"="\SystemRoot\system32\DRIVERS\MTConfig.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mup]
    "ImagePath"="System32\Drivers\mup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent]
    "ServiceDLL"="%SystemRoot%\system32\qagentRT.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NativeWifiP]
    "ImagePath"="system32\DRIVERS\nwifi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS]
    "ImagePath"="system32\drivers\ndis.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisCap]
    "ImagePath"="system32\DRIVERS\ndiscap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisTapi]
    "ImagePath"="system32\DRIVERS\ndistapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio]
    "ImagePath"="system32\DRIVERS\ndisuio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisWan]
    "ImagePath"="system32\DRIVERS\ndiswan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS]
    "ImagePath"="system32\DRIVERS\netbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT]
    "ImagePath"="System32\DRIVERS\netbt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netman]
    "ServiceDll"="%SystemRoot%\System32\netman.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\netprofm]
    "ServiceDll"="%SystemRoot%\System32\netprofm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\netr7364]
    "ImagePath"="system32\DRIVERS\netr7364.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nfrd960]
    "ImagePath"="\SystemRoot\system32\DRIVERS\nfrd960.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NlaSvc]
    "ServiceDll"="%SystemRoot%\System32\nlasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Npfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsi]
    "ServiceDll"="%systemroot%\system32\nsisvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsiproxy]
    "ImagePath"="system32\drivers\nsiproxy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NTDS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ntfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Null]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvraid]
    "ImagePath"="\SystemRoot\system32\drivers\nvraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvstor]
    "ImagePath"="\SystemRoot\system32\drivers\nvstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nv_agp]
    "ImagePath"="\SystemRoot\system32\drivers\nv_agp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ohci1394]
    "ImagePath"="\SystemRoot\system32\drivers\ohci1394.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ose64]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\osppsvc]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Outlook]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc]
    "ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Parport]
    "ImagePath"="system32\DRIVERS\parport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr]
    "ImagePath"="System32\drivers\partmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PcaSvc]
    "ServiceDll"="%SystemRoot%\System32\pcasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pci]
    "ImagePath"="system32\drivers\pci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pciide]
    "ImagePath"="system32\drivers\pciide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcmcia]
    "ImagePath"="\SystemRoot\system32\DRIVERS\pcmcia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcw]
    "ImagePath"="System32\drivers\pcw.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PEAUTH]
    "ImagePath"="system32\drivers\peauth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc]
    "ServiceDll"="%SystemRoot%\system32\peerdistsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfDisk]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfHost]
    "ImagePath"="%SystemRoot%\SysWow64\perfhost.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfNet]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfOS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfProc]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ph3xIB64]
    "ImagePath"="system32\DRIVERS\Ph3xIB64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla]
    "ServiceDll"="%systemroot%\system32\pla.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PlugPlay]
    "ServiceDll"="%SystemRoot%\system32\umpnpmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PMBDeviceInfoProvider]
    "ImagePath"="\"c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg]
    "ServiceDll"="%SystemRoot%\system32\pnrpauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc]
    "ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent]
    "ServiceDll"="%SystemRoot%\System32\ipsecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PortProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Power]
    "ServiceDll"="%SystemRoot%\system32\umpo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PptpMiniport]
    "ImagePath"="system32\DRIVERS\raspptp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Processor]
    "ImagePath"="\SystemRoot\system32\DRIVERS\processr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProfSvc]
    "ServiceDll"="%systemroot%\system32\profsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Psched]
    "ImagePath"="system32\DRIVERS\pacer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql2300]
    "ImagePath"="\SystemRoot\system32\DRIVERS\ql2300.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql40xx]
    "ImagePath"="\SystemRoot\system32\DRIVERS\ql40xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE]
    "ServiceDll"="%windir%\system32\qwave.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVEdrv]
    "ImagePath"="\SystemRoot\system32\drivers\qwavedrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAcd]
    "ImagePath"="System32\DRIVERS\rasacd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAgileVpn]
    "ImagePath"="system32\DRIVERS\AgileVpn.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto]
    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Rasl2tp]
    "ImagePath"="system32\DRIVERS\rasl2tp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan]
    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe]
    "ImagePath"="system32\DRIVERS\raspppoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasSstp]
    "ImagePath"="system32\DRIVERS\rassstp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdbss]
    "ImagePath"="system32\DRIVERS\rdbss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdpbus]
    "ImagePath"="system32\DRIVERS\rdpbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPCDD]
    "ImagePath"="System32\DRIVERS\RDPCDD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDR]
    "ImagePath"="System32\drivers\rdpdr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPENCDD]
    "ImagePath"="system32\drivers\rdpencdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPREFMP]
    "ImagePath"="system32\drivers\rdprefmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPWD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdyboost]
    "ImagePath"="System32\drivers\rdyboost.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Reliance Netconnect. RunOuc]
    "ImagePath"="c:\program files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess]
    "ServiceDLL"="%SystemRoot%\System32\mprdim.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry]
    "ServiceDll"="%SystemRoot%\system32\regsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper]
    "ServiceDll"="%SystemRoot%\System32\RpcEpMap.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcLocator]
    "ImagePath"="%SystemRoot%\system32\locator.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr]
    "ImagePath"="system32\DRIVERS\rspndr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RTL8167]
    "ImagePath"="system32\DRIVERS\Rt64win7.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\s3cap]
    "ImagePath"="\SystemRoot\system32\drivers\vms3cap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SamSs]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sbp2port]
    "ImagePath"="\SystemRoot\system32\drivers\sbp2port.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SBSDWSCService]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr]
    "ServiceDll"="%SystemRoot%\System32\SCardSvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\scfilter]
    "ImagePath"="System32\DRIVERS\scfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule]
    "ServiceDll"="%systemroot%\system32\schedsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SDRSVC]
    "ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\secdrv]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon]
    "ServiceDll"="%windir%\system32\seclogon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SENS]
    "ServiceDll"="%SystemRoot%\system32\sens.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc]
    "ServiceDll"="%SystemRoot%\system32\sensrsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serenum]
    "ImagePath"="system32\DRIVERS\serenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serial]
    "ImagePath"="system32\DRIVERS\serial.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sermouse]
    "ImagePath"="\SystemRoot\system32\DRIVERS\sermouse.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv]
    "ServiceDLL"="%SystemRoot%\system32\sessenv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffdisk]
    "ImagePath"="\SystemRoot\system32\drivers\sffdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_mmc]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_mmc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_sd]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_sd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sfloppy]
    "ImagePath"="\SystemRoot\system32\DRIVERS\sfloppy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess]
    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ShellHWDetection]
    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid2]
    "ImagePath"="\SystemRoot\system32\DRIVERS\SiSRaid2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid4]
    "ImagePath"="\SystemRoot\system32\DRIVERS\sisraid4.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb]
    "ImagePath"="system32\DRIVERS\smb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SNMPTRAP]
    "ImagePath"="%SystemRoot%\System32\snmptrap.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\spldr]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Spooler]
    "ImagePath"="%SystemRoot%\System32\spoolsv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppsvc]
    "ImagePath"="%SystemRoot%\system32\sppsvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify]
    "ServiceDll"="%SystemRoot%\system32\sppuinotify.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv]
    "ImagePath"="System32\DRIVERS\srv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv2]
    "ImagePath"="System32\DRIVERS\srv2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srvnet]
    "ImagePath"="System32\DRIVERS\srvnet.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV]
    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc]
    "ServiceDll"="%SystemRoot%\system32\sstpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stexstor]
    "ImagePath"="\SystemRoot\system32\DRIVERS\stexstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stisvc]
    "ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\storflt]
    "ImagePath"="system32\drivers\vmstorfl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc]
    "ServiceDll"="%SystemRoot%\system32\storsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\storvsc]
    "ImagePath"="\SystemRoot\system32\drivers\storvsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swenum]
    "ImagePath"="\SystemRoot\system32\drivers\swenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swprv]
    "ServiceDll"="%Systemroot%\System32\swprv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SysMain]
    "ServiceDll"="%systemroot%\system32\sysmain.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService]
    "ServiceDll"="%SystemRoot%\System32\TabSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv]
    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS]
    "ServiceDll"="%SystemRoot%\System32\tbssvc.dll"
     
  16. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip]
    "ImagePath"="System32\drivers\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6]
    "ImagePath"="system32\DRIVERS\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6TUNNEL]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tcpipreg]
    "ImagePath"="System32\drivers\tcpipreg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIPTUNNEL]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDPIPE]
    "ImagePath"="system32\drivers\tdpipe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDTCP]
    "ImagePath"="system32\drivers\tdtcp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tdx]
    "ImagePath"="system32\DRIVERS\tdx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermDD]
    "ImagePath"="\SystemRoot\system32\drivers\termdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService]
    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Themes]
    "ServiceDll"="%SystemRoot%\system32\themeservice.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrkWks]
    "ServiceDll"="%SystemRoot%\System32\trkwks.dll"
    --
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrustedInstaller]
    "ImagePath"="%SystemRoot%\servicing\TrustedInstaller.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TSDDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tssecsrv]
    "ImagePath"="System32\DRIVERS\tssecsrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TsUsbFlt]
    "ImagePath"="system32\drivers\tsusbflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tunnel]
    "ImagePath"="system32\DRIVERS\tunnel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uagp35]
    "ImagePath"="\SystemRoot\system32\DRIVERS\uagp35.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\udfs]
    "ImagePath"="system32\DRIVERS\udfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGatherer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGTHRSVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UI0Detect]
    "ImagePath"="%SystemRoot%\system32\UI0Detect.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uliagpkx]
    "ImagePath"="\SystemRoot\system32\drivers\uliagpkx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\umbus]
    "ImagePath"="\SystemRoot\system32\drivers\umbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmPass]
    "ImagePath"="\SystemRoot\system32\DRIVERS\umpass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService]
    "ServiceDll"="%SystemRoot%\System32\umrdp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost]
    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbccgp]
    "ImagePath"="system32\DRIVERS\usbccgp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbcir]
    "ImagePath"="\SystemRoot\system32\drivers\usbcir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbehci]
    "ImagePath"="system32\DRIVERS\usbehci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbhub]
    "ImagePath"="\SystemRoot\system32\drivers\usbhub.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbohci]
    "ImagePath"="system32\DRIVERS\usbohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbprint]
    "ImagePath"="system32\DRIVERS\usbprint.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbscan]
    "ImagePath"="system32\DRIVERS\usbscan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\USBSTOR]
    "ImagePath"="system32\DRIVERS\USBSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbuhci]
    "ImagePath"="\SystemRoot\system32\DRIVERS\usbuhci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UxSms]
    "ServiceDll"="%SystemRoot%\System32\uxsms.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxNetAdp]
    "ImagePath"="system32\DRIVERS\VBoxNetAdp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VBoxNetFlt]
    "ImagePath"="system32\DRIVERS\VBoxNetFlt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VClone]
    "ImagePath"="system32\DRIVERS\VClone.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrvroot]
    "ImagePath"="system32\drivers\vdrvroot.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vds]
    "ImagePath"="%SystemRoot%\System32\vds.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vga]
    "ImagePath"="system32\DRIVERS\vgapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VgaSave]
    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vhdmp]
    "ImagePath"="\SystemRoot\system32\drivers\vhdmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\viaide]
    "ImagePath"="\SystemRoot\system32\drivers\viaide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMAuthdService]
    "ImagePath"="\"c:\program files (x86)\VMware\VMware Player\vmware-authd.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmbus]
    "ImagePath"="system32\drivers\vmbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMBusHID]
    "ImagePath"="\SystemRoot\system32\drivers\VMBusHID.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmci]
    "ImagePath"="system32\DRIVERS\vmci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmkbd]
    "ImagePath"="\??\c:\windows\system32\drivers\VMkbd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetAdapter]
    "ImagePath"="system32\DRIVERS\vmnetadapter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetBridge]
    "ImagePath"="system32\DRIVERS\vmnetbridge.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetDHCP]
    "ImagePath"="c:\windows\system32\vmnetdhcp.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMnetuserif]
    "ImagePath"="\??\c:\windows\system32\drivers\vmnetuserif.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMparport]
    "ImagePath"="\??\c:\windows\system32\drivers\VMparport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmusb]
    "ImagePath"="System32\Drivers\vmusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMUSBArbService]
    "ImagePath"="\"c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMware]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMware NAT Service]
    "ImagePath"="c:\windows\system32\vmnat.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmx86]
    "ImagePath"="\??\c:\windows\system32\drivers\vmx86.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgr]
    "ImagePath"="system32\drivers\volmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgrx]
    "ImagePath"="System32\drivers\volmgrx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volsnap]
    "ImagePath"="system32\drivers\volsnap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsmraid]
    "ImagePath"="\SystemRoot\system32\DRIVERS\vsmraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsock]
    "ImagePath"="system32\drivers\vsock.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS]
    "ImagePath"="%systemroot%\system32\vssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwifibus]
    "ImagePath"="system32\DRIVERS\vwifibus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwififlt]
    "ImagePath"="system32\DRIVERS\vwififlt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time]
    "ServiceDll"="%systemroot%\system32\w32time.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W3SVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WacomPen]
    "ImagePath"="\SystemRoot\system32\DRIVERS\wacompen.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WANARP]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wanarpv6]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wbengine]
    "ImagePath"="\"%systemroot%\system32\wbengine.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc]
    "ServiceDll"="%SystemRoot%\System32\wbiosrvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc]
    "ServiceDll"="%SystemRoot%\System32\wcncsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService]
    "ServiceDll"="%SystemRoot%\System32\WcsPlugInService.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wd]
    "ImagePath"="\SystemRoot\system32\DRIVERS\wd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wdf01000]
    "ImagePath"="system32\drivers\Wdf01000.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiServiceHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiSystemHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient]
    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc]
    "ServiceDll"="%SystemRoot%\system32\wecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport]
    "ServiceDll"="%SystemRoot%\System32\wercplsupport.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc]
    "ServiceDll"="%SystemRoot%\System32\WerSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WfpLwf]
    "ImagePath"="system32\DRIVERS\wfplwf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WIMMount]
    "ImagePath"="system32\drivers\wimmount.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend]
    "ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinHttpAutoProxySvc]
    "ServiceDll"="winhttp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt]
    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM]
    "ServiceDll"="%SystemRoot%\system32\WsmSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinUsb]
    "ImagePath"="system32\DRIVERS\WinUsb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc]
    "ServiceDll"="%SystemRoot%\System32\wlansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiAcpi]
    "ImagePath"="\SystemRoot\system32\drivers\wmiacpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiApRpl]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmiApSrv]
    "ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WMPNetworkSvc]
    "ImagePath"="\"%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc]
    "ServiceDll"="%SystemRoot%\System32\wpcsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPDBusEnum]
    "ServiceDll"="%SystemRoot%\system32\wpdbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ws2ifsl]
    "ImagePath"="\SystemRoot\system32\drivers\ws2ifsl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearch]
    "ImagePath"="%systemroot%\system32\SearchIndexer.exe /Embedding"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearchIdxPi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv]
    "ServiceDll"="%systemroot%\system32\wuaueng.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WudfPf]
    "ImagePath"="system32\drivers\WudfPf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WUDFRd]
    "ImagePath"="system32\DRIVERS\WUDFRd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc]
    "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc]
    "ServiceDll"="%SystemRoot%\System32\wwansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xmlprov]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{19BEC97F-157F-4DE6-B16E-BEB6A585535C}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{508F3EE6-E1C1-4E00-B7ED-2899B41A2402}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{6380F913-1BB6-4871-8EAF-7DEEAE49CCFF}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{6CA778AC-FDC6-4819-B2A9-444DC1226ECE}]
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
    @="?????????????????? v1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
    @="?????????????????? v2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\programdata\Reliance Netconnect+\OnlineUpdate\ouc.exe
    c:\windows\SysWOW64\vmnat.exe
    c:\windows\SysWOW64\vmnetdhcp.exe
    .
    **************************************************************************
    .
    Completion time: 2013-05-04 10:42:57 - machine was rebooted
    ComboFix-quarantined-files.txt 2013-05-04 05:12
    ComboFix2.txt 2013-05-03 04:00
    .
    Pre-Run: 85,502,296,064 bytes free
    Post-Run: 85,450,276,864 bytes free
    .
    - - End Of File - - 7EA170BC87E2B4AC063A3280E33B73F9
     
  17. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    ==============================================================================
    Farbar Service Scanner Version: 14-04-2013
    Ran by vibs (administrator) on 04-05-2013 at 11:01:19
    Running from "C:\Users\vibs\Desktop\Newfolder"
    Windows 7 Professional Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************
    Internet Services:
    ============
    Dhcp Service is not running. Checking service configuration:
    The start type of Dhcp service is OK.
    The ImagePath of Dhcp service is OK.
    The ServiceDll of Dhcp service is OK.
    afd Service is not running. Checking service configuration:
    Checking Start type: ATTENTION!=====> Unable to open afd registry key. The service key does not exist.
    Checking ImagePath: ATTENTION!=====> Unable to open afd registry key. The service key does not exist.
    Checking LEGACY_afd: ATTENTION!=====> Unable to open LEGACY_afd\0000 registry key. The key does not exist.

    Connection Status:
    ==============
    Localhost is accessible.
    There is no connection to network.
    Attempt to access Google IP returned error.
    Attempt to access Google.com returned error: Other errors
    Attempt to access Yahoo IP returned error.
    Attempt to access Yahoo.com returned error: Other errors

    Windows Firewall:
    =============
    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0

    System Restore:
    ============
    System Restore Disabled Policy:
    ========================

    Action Center:
    ============
    Other Services:
    ==============

    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys
    [2013-04-21 07:44] - [2013-05-04 10:52] - 0022368 ____A (AVG Technologies CZ, s.r.o. ) 42B7E1AA0C7EC54652A50585793F1885
    ATTENTION!=====> C:\Windows\System32\drivers\afd.sys IS INFECTED AND SHOULD BE REPLACED.
    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll => MD5 is legit
    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit

    **** End of log ****
     
  18. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Did you uninstall AVG prior to running Combofix?
     
  19. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    Not the second time.
    should I re-run Combofix after uninstalling AVG.
     
  20. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Uninstall AVG and keep it off for now.

    Re-run Combofix with the very same script as in my reply #13.
    Leave registry fixes alone for now.

    Post new Combofix log.

    Post new FSS log (after running Combofix).
     
  21. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    ComboFix 13-05-04.01 - vibs 05/05/2013 8:55.6.2 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.5630.4481 [GMT 5.5:30]
    Running from: c:\users\vibs\Desktop\Newfolder\ComboFix.exe
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-04-05 to 2013-05-05 )))))))))))))))))))))))))))))))
    .
    .
    2013-05-05 03:32 . 2013-05-05 03:32 -------- d-----w- c:\users\Default\AppData\Local\temp
    2013-05-05 03:32 . 2013-05-05 03:32 -------- d-----w- c:\users\Administrator\AppData\Local\temp
    2013-05-01 11:47 . 2013-05-01 11:47 -------- d-----w- c:\windows\system32\appmgmt
    2013-05-01 06:38 . 2013-05-01 06:38 -------- d-s---w- c:\windows\SysWow64\Microsoft
    2013-05-01 05:50 . 2013-05-01 05:50 -------- d-----w- c:\program files\HitmanPro
    2013-04-26 12:00 . 2013-04-26 12:00 -------- d-----w- c:\programdata\Reliance Netconnect
    2013-04-26 11:57 . 2013-04-26 12:01 -------- d-----w- c:\programdata\DatacardService
    2013-04-24 13:38 . 2013-04-24 13:38 -------- d-----w- c:\program files (x86)\Common Files\Java
    2013-04-24 13:38 . 2013-04-24 13:38 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
    2013-04-24 13:38 . 2013-04-24 13:38 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2013-04-24 13:38 . 2013-04-24 13:38 -------- d-----w- c:\program files (x86)\Java
    2013-04-24 03:33 . 2013-04-24 03:33 -------- d-----w- c:\program files (x86)\MSXML 4.0
    2013-04-24 03:32 . 2007-07-19 12:44 5073256 ----a-w- c:\windows\system32\d3dx9_35.dll
    2013-04-24 03:32 . 2007-07-19 12:44 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll
    2013-04-24 03:32 . 2006-03-31 07:11 3927248 ----a-w- c:\windows\system32\d3dx9_30.dll
    2013-04-24 03:29 . 2013-04-24 03:29 -------- d-----w- c:\program files (x86)\Sony
    2013-04-24 03:29 . 2013-04-24 03:29 -------- d-----w- c:\programdata\Sony Corporation
    2013-04-24 02:56 . 2013-04-24 02:56 -------- d-----w- c:\programdata\UDL
    2013-04-24 02:55 . 2013-04-24 02:55 -------- d-----w- c:\program files\Epson Software
    2013-04-24 02:53 . 2013-04-24 02:56 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
    2013-04-24 02:53 . 2013-04-24 02:56 -------- d-----w- c:\program files (x86)\Epson Software
    2013-04-24 02:52 . 2013-04-24 02:53 -------- d-----w- c:\program files (x86)\ABBYY FineReader 9.0 Sprint
    2013-04-24 02:52 . 2013-04-24 02:52 -------- d-----w- c:\programdata\ABBYY
    2013-04-24 02:52 . 2013-04-24 02:52 -------- d-----w- c:\program files (x86)\Common Files\ABBYY
    2013-04-24 02:50 . 2013-04-24 02:53 -------- d-----w- c:\program files (x86)\epson
    2013-04-23 10:40 . 2013-04-23 11:06 -------- d-----w- c:\programdata\HitmanPro
    2013-04-23 10:37 . 2013-04-29 19:05 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2013-04-23 10:37 . 2013-04-23 10:37 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
    2013-04-23 10:14 . 2013-04-23 10:14 -------- d-----w- c:\programdata\Malwarebytes
    2013-04-23 10:14 . 2013-04-04 09:20 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-04-23 10:14 . 2013-04-23 10:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2013-04-23 09:06 . 2012-10-24 08:47 67224 ----a-w- c:\windows\system32\vsocklib.dll
    2013-04-23 09:06 . 2012-10-24 08:47 70296 ----a-w- c:\windows\system32\drivers\vsock.sys
    2013-04-23 09:06 . 2012-10-24 08:47 63128 ----a-w- c:\windows\SysWow64\vsocklib.dll
    2013-04-23 09:06 . 2013-02-25 20:58 67664 ----a-w- c:\windows\system32\drivers\vmx86.sys
    2013-04-23 09:06 . 2013-02-25 20:57 33360 ----a-w- c:\windows\system32\drivers\VMkbd.sys
    2013-04-23 09:06 . 2013-02-25 20:58 31824 ----a-w- c:\windows\system32\drivers\VMparport.sys
    2013-04-23 09:05 . 2013-02-25 20:58 357456 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
    2013-04-23 09:05 . 2013-02-25 20:58 436304 ----a-w- c:\windows\SysWow64\vmnat.exe
    2013-04-23 09:05 . 2013-02-25 20:58 30800 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
    2013-04-23 09:05 . 2013-02-25 20:59 933968 ----a-w- c:\windows\system32\vnetlib64.dll
    2013-04-23 09:05 . 2012-10-11 10:45 52376 ----a-w- c:\windows\system32\drivers\hcmon.sys
    2013-04-23 09:05 . 2013-04-23 09:05 -------- d-----w- c:\program files\Common Files\VMware
    2013-04-23 09:04 . 2013-05-05 03:19 -------- d-----w- c:\programdata\VMware
    2013-04-23 09:04 . 2013-04-23 09:04 -------- d-----w- c:\program files (x86)\VMware
    2013-04-23 09:04 . 2013-04-23 09:04 -------- d-----w- c:\program files (x86)\Common Files\VMware
    2013-04-22 14:17 . 2013-04-22 16:18 -------- d-----w- c:\programdata\eMule
    2013-04-22 13:04 . 2013-04-22 13:04 -------- d-----w- c:\program files\Common Files\DESIGNER
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\program files\Microsoft.NET
    2013-04-22 13:03 . 2013-04-22 13:03 -------- d-----w- c:\programdata\regid.1991-06.com.microsoft
    2013-04-22 13:01 . 2013-04-22 13:03 -------- d-----w- c:\program files\Microsoft SQL Server
    2013-04-22 12:57 . 2013-04-22 12:57 -------- d-----w- c:\program files\Microsoft Analysis Services
    2013-04-22 12:57 . 2013-04-22 12:57 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
    2013-04-22 12:56 . 2013-04-22 13:01 -------- d-----w- c:\program files\Microsoft Office
    2013-04-22 12:55 . 2013-04-23 04:07 -------- d-----w- c:\programdata\Microsoft Help
    2013-04-22 12:39 . 2013-03-15 13:44 237840 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
    2013-04-22 12:38 . 2013-03-15 13:43 120080 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
    2013-04-22 12:38 . 2013-05-01 11:47 -------- dc----w- c:\windows\system32\DRVSTORE
    2013-04-22 01:50 . 2013-04-22 01:50 -------- d-----w- c:\users\Default\AppData\Roaming\TuneUp Software
    2013-04-21 07:28 . 2013-04-20 18:25 -------- d-----w- c:\windows\Panther
    2013-04-21 07:20 . 2013-04-21 07:20 -------- d-----w- c:\program files (x86)\Microsoft
    2013-04-21 07:20 . 2013-04-21 07:20 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive
    2013-04-21 07:20 . 2013-04-21 07:23 -------- d-----w- c:\program files (x86)\Windows Live
    2013-04-21 07:19 . 2013-04-21 07:19 -------- d-----w- c:\windows\PCHEALTH
    2013-04-21 07:12 . 2013-04-21 07:12 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
    2013-04-21 06:40 . 2013-04-21 06:40 0 ----a-w- c:\windows\ativpsrm.bin
    2013-04-21 04:42 . 2013-04-21 04:42 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
    2013-04-21 04:20 . 2013-04-21 04:20 -------- d-----w- c:\program files\Microsoft Games
    2013-04-21 03:36 . 2013-04-21 03:36 -------- d-----w- c:\program files (x86)\Elaborate Bytes
    2013-04-21 03:22 . 2011-02-05 17:06 605552 ----a-w- c:\windows\system32\winload.exe
    2013-04-21 03:22 . 2011-02-05 17:06 566208 ----a-w- c:\windows\system32\winresume.efi
    2013-04-21 03:22 . 2011-02-05 17:06 518672 ----a-w- c:\windows\system32\winresume.exe
    2013-04-21 03:22 . 2011-02-05 17:10 642944 ----a-w- c:\windows\system32\winload.efi
    2013-04-21 03:22 . 2011-02-05 17:10 20352 ----a-w- c:\windows\system32\kdusb.dll
    2013-04-21 03:22 . 2011-02-05 17:10 19328 ----a-w- c:\windows\system32\kd1394.dll
    2013-04-21 03:22 . 2011-02-05 17:10 17792 ----a-w- c:\windows\system32\kdcom.dll
    2013-04-21 03:22 . 2011-11-17 06:35 395776 ----a-w- c:\windows\system32\webio.dll
    2013-04-21 03:22 . 2011-11-17 05:35 314880 ----a-w- c:\windows\SysWow64\webio.dll
    2013-04-21 03:22 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2013-04-21 03:20 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2013-04-21 03:20 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
    2013-04-21 03:20 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
    2013-04-21 03:20 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2013-04-21 03:19 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
    2013-04-21 03:19 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2013-04-21 03:19 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
    2013-04-21 03:19 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
    2013-04-21 02:51 . 2013-04-01 14:28 72702784 ----a-w- c:\windows\system32\MRT.exe
    2013-04-21 02:38 . 2013-04-21 02:38 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    2013-04-21 02:27 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
    2013-04-21 02:27 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    2013-04-21 02:27 . 2010-09-30 06:47 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
    2013-04-21 02:27 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
    2013-04-21 02:27 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
    2013-04-21 02:27 . 2010-09-30 10:41 100864 ----a-w- c:\windows\system32\fontsub.dll
    2013-04-21 02:24 . 2013-04-21 02:24 -------- d-----w- c:\program files\Microsoft Silverlight
    2013-04-21 02:24 . 2013-04-21 02:24 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
    2013-04-21 02:23 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
    2013-04-21 02:23 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2013-04-21 02:23 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2013-04-21 02:23 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
    2013-04-21 02:23 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
    2013-04-21 02:23 . 2013-04-24 02:37 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2013-04-21 02:18 . 2013-04-17 01:01 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{48D77485-AF34-4E15-9342-CBF204416DF2}\mpengine.dll
    2013-04-21 02:18 . 2013-03-11 19:40 282744 ------w- c:\windows\system32\MpSigStub.exe
    2013-04-21 02:16 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2013-04-21 02:16 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
    2013-04-21 02:16 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys
    2013-04-21 02:16 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll
    2013-04-21 02:16 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2013-04-21 02:14 . 2012-06-02 05:50 458704 ----a-w- c:\windows\system32\drivers\cng.sys
    2013-04-21 02:13 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
    2013-04-21 02:12 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
    2013-04-21 02:12 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2013-04-21 02:12 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
    2013-04-21 02:12 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
    2013-04-21 02:12 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
    2013-04-21 02:12 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
    2013-04-21 02:12 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
    2013-04-21 02:12 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
    2013-04-21 02:10 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
    2013-04-21 02:10 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
    2013-04-21 02:10 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-05-04 05:22 . 2009-07-14 00:10 22368 ----a-w- c:\windows\system32\drivers\WS2IFSL.SYS
    2013-04-20 18:49 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2013-04-20 18:49 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2013-03-15 13:44 . 2013-03-15 13:44 131856 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
    2013-02-25 20:57 . 2013-02-25 20:57 62104 ----a-w- c:\windows\system32\vmnetbridge.dll
    2013-02-25 20:57 . 2013-02-25 20:57 48792 ----a-w- c:\windows\system32\vnetinst.dll
    2013-02-25 20:57 . 2013-02-25 20:57 45720 ----a-w- c:\windows\system32\drivers\vmnetbridge.sys
    2013-02-25 20:57 . 2013-02-25 20:57 24216 ----a-w- c:\windows\system32\drivers\vmnet.sys
    2013-02-25 20:57 . 2013-02-25 20:57 20120 ----a-w- c:\windows\system32\drivers\vmnetadapter.sys
    2013-02-25 19:29 . 2013-02-25 19:29 360528 ----a-w- c:\windows\SysWow64\vmnc.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 15:08 1720976 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Alcatel Wave ModemListener"="c:\program files (x86)\My Connection\BackgroundService\ModemListener.exe" [2011-06-20 102400]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
    "VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
    "EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
    "PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
    @=""
    .
    R2 Alcatel Wave Modem Device Helper;Alcatel Wave Modem Device Helper;c:\program files (x86)\My Connection\BackgroundService\ServiceManager.exe [2011-06-20 49752]
    R2 Reliance Netconnect. RunOuc;Reliance Netconnect. OUC;c:\program files (x86)\Reliance Netconnect+\UpdateDog\ouc.exe [2013-04-26 218624]
    R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2013-04-26 117248]
    R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys [2011-06-20 120832]
    R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [2011-10-05 729152]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-01 178824]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-19 59392]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2013-03-15 131856]
    R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
    S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2012-10-24 85104]
    S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2012-10-24 70296]
    S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-19 203776]
    S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2011-03-14 346976]
    S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-26 398176]
    S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
    S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2013-04-26 86016]
    S3 Ph3xIB64;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB64.sys [2009-06-10 1627520]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - AFD
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 15:07 2322576 ----a-w- c:\progra~1\MICROS~3\Office15\GROOVEEX.DLL
    .
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
    FontCache
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: &Download by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - c:\program files (x86)\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office15\ONBttnIE.dll/105
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    FF - ProfilePath - c:\users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\
    FF - ExtSQL: 2013-04-26 18:13; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\vibs\AppData\Roaming\Mozilla\Firefox\Profiles\f04almya.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
    FF - ExtSQL: 2013-05-01 11:08; {35379F86-8CCB-4724-AE33-4278DE266C70}; c:\program files (x86)\Orbitdownloader\addons\OneClickYouTubeDownloader
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
    @="?????????????????? v1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
    @="?????????????????? v2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2013-05-05 09:12:47
    ComboFix-quarantined-files.txt 2013-05-05 03:42
    ComboFix2.txt 2013-05-05 03:14
    ComboFix3.txt 2013-05-04 05:13
    ComboFix4.txt 2013-05-03 04:00
    .
    Pre-Run: 85,363,945,472 bytes free
    Post-Run: 85,302,943,744 bytes free
    .
    - - End Of File - - F2AD6EEA7F886FFE13A3D17EE6C34DE4
     
  22. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    Farbar Service Scanner Version: 14-04-2013
    Ran by vibs (administrator) on 05-05-2013 at 09:20:55
    Running from "C:\Users\vibs\Desktop\Newfolder"
    Windows 7 Professional Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************
    Internet Services:
    ============
    Connection Status:
    ==============
    Localhost is accessible.
    There is no connection to network.
    Attempt to access Google IP returned error.
    Attempt to access Google.com returned error: Other errors
    Attempt to access Yahoo IP returned error.
    Attempt to access Yahoo.com returned error: Other errors

    Windows Firewall:
    =============
    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0

    System Restore:
    ============
    System Restore Disabled Policy:
    ========================

    Action Center:
    ============
    Windows Update:
    ============
    Windows Autoupdate Disabled Policy:
    ============================

    Other Services:
    ==============

    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys => MD5 is legit
    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll => MD5 is legit
    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\wuaueng.dll => MD5 is legit
    C:\Windows\System32\qmgr.dll => MD5 is legit
    C:\Windows\System32\es.dll => MD5 is legit
    C:\Windows\System32\cryptsvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit

    **** End of log ****
     
  23. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    FSS log looks good but I assume you're having some issues with internet connection?
     
  24. Vaibhav Gupta

    Vaibhav Gupta TS Rookie Topic Starter Posts: 27

    Should I re-install AVG and test connection to internet
     
  25. Broni

    Broni Malware Annihilator Posts: 52,884   +344

    Test connection first.
    Make sure Windows firewall is on.
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...