# email hacked



## maggie88ca (Nov 19, 2006)

Hi there,
A few days ago when I checked my email I had a bunch of returned emails that were undeliverable which alerted me to the fact that my email account had been hacked. Since then my computer has been running very slow and freezing. I think I have the email back up and working but I'm now sure how to fix any other damage that has occurred and how to prevent this from happening again in the future.

I can post a copy of one of the returned emails here if that helps.

Thanks.

I'm running windows 7 home premium 64-bit and have Norton 360 and Emsisoft anti malware.


----------



## maggie88ca (Nov 19, 2006)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:37:03 PM, on 07/04/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16521)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\Ken\Desktop\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\IPS\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coIEPlg.dll
O4 - HKLM\..\Run: [emsisoft anti-malware] "c:\program files (x86)\emsisoft anti-malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Emsisoft Anti-Malware 6.0 - Service (a2AntiMalware) - Emsisoft GmbH - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASUS Com Service (asComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
O23 - Service: ASUS HM Com Service (asHmComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Device Handle Service - ASUSTeK Computer Inc. - C:\Windows\SysWOW64\AsHookDevice.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Lexar Media, Inc. - C:\Windows\system32\LxrSII1s.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8305 bytes


----------



## maggie88ca (Nov 19, 2006)

DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 10.0.9200.16521
Run by Ken at 17:38:57 on 2013-04-07
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.4008.1648 [GMT -4:00]
.
AV: Emsisoft Anti-Malware *Enabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Emsisoft Anti-Malware *Enabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\SysWOW64\AsHookDevice.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\LxrSII1s.exe
C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Nero\Update\NASvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\Macromed\Flash\FlashUtil64_11_6_602_180_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\System32\MsSpellCheckingFacility.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\sppsvc.exe
C:\Users\Ken\Desktop\HijackThis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
uSearch Bar = Preserve
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ips\ipsbho.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [emsisoft anti-malware] "c:\program files (x86)\emsisoft anti-malware\a2guard.exe" /d=60
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
TCP: NameServer = 64.71.255.204 64.71.255.198 192.168.1.1
TCP: Interfaces\{62D71BE2-9D6B-4ED6-B6F2-EEADD29E9560} : DHCPNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
TCP: Interfaces\{6C2054CE-5C51-4ABE-BAAB-9440D076B6ED} : DHCPNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
TCP: Interfaces\{6C2054CE-5C51-4ABE-BAAB-9440D076B6ED}\25F6765627370353236343 : DHCPNameServer = 64.71.255.198
TCP: Interfaces\{6C2054CE-5C51-4ABE-BAAB-9440D076B6ED}\7586964756341647 : DHCPNameServer = 64.71.255.198
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
x64-RunOnce: [47_1636291575153] "C:\Users\Ken\AppData\Local\LOGMEI~1\LMIR0002.tmp_r.bat"
x64-RunOnce: [47_17266331575153] "C:\Users\Ken\AppData\Local\LOGMEI~1\LMIR0001.tmp_r.bat"
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 asahci64;asahci64;C:\Windows\System32\drivers\asahci64.sys [2011-1-30 36448]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1403000.024\symds64.sys [2013-2-26 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\1403000.024\symefa64.sys [2013-2-26 1139800]
R1 A2DDA;A2 Direct Disk Access Support Driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2012-1-23 26176]
R1 a2injectiondriver;a2injectiondriver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2012-1-23 44688]
R1 a2util;a-squared Malware-IDS utility driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [2012-1-23 17384]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130322.001\BHDrvx64.sys [2013-3-21 1387608]
R1 ccSet_N360;Norton 360 Settings Manager;C:\Windows\System32\drivers\N360x64\1403000.024\ccsetx64.sys [2013-2-26 168096]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130405.001\IDSviA64.sys [2013-4-5 513184]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1403000.024\ironx64.sys [2013-2-26 224416]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\1403000.024\symnets.sys [2013-2-26 432800]
R1 xlkfs;xlkfs;C:\Windows\System32\drivers\xlkfs.sys [2012-5-4 30456]
R2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2012-1-23 3089856]
R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2011-5-6 918144]
R2 asHmComSvc;ASUS HM Com Service;C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [2011-5-6 915584]
R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2011-5-6 586880]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 Device Handle Service;Device Handle Service;C:\Windows\SysWOW64\AsHookDevice.exe [2011-5-6 203392]
R2 LxrSII1d;Secure II Driver;C:\Windows\System32\drivers\LxrSII1d.sys [2013-2-16 63064]
R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccsvchst.exe [2013-2-26 144520]
R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2012-7-13 769432]
R2 RtNdPt60;Realtek NDIS Protocol Driver;C:\Windows\System32\drivers\RtNdPt60.sys [2011-5-6 32544]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-5-6 2656280]
R3 a2acc;a2acc;C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys [2012-1-23 66320]
R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-2-24 126952]
R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-2-24 389608]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-1-3 138912]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-5-6 317440]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\System32\drivers\netr28x.sys [2012-1-23 702976]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2012-12-1 102368]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-4-13 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-3-8 1492840]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);C:\Windows\System32\drivers\RtTeam60.sys [2011-5-6 48416]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);C:\Windows\System32\drivers\RtVlan60.sys [2011-5-6 29472]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2012-12-1 203104]
S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);C:\Windows\System32\drivers\RtTeam60.sys [2011-5-6 48416]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-2-15 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-23 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2013-04-07 18:05:49	--------	d-----w-	C:\Users\Ken\AppData\Local\{F705BDF4-82F2-46E1-9B88-1ECBDB9DDE7B}
2013-04-06 13:12:39	--------	d-----w-	C:\Users\Ken\AppData\Local\{DD8E8CCB-837B-4443-87DD-CE7E579EA83C}
2013-04-05 20:41:43	--------	d-----w-	C:\Users\Ken\AppData\Local\{3245EC7A-40B5-44F9-A06A-E60D16170801}
2013-04-05 07:34:37	--------	d-----w-	C:\Users\Ken\AppData\Local\{E57F4CAA-C799-4FDF-BF8E-94419047BA0F}
2013-04-04 18:53:54	--------	d-----w-	C:\Users\Ken\AppData\Local\{C5F9EABD-911F-4D9D-AEE1-AD41982BE540}
2013-04-04 07:57:30	--------	d-----w-	C:\Users\Ken\AppData\Local\{2879CEDE-1A5C-42A0-82DA-3C385CC22D76}
2013-04-03 18:38:47	--------	d-----w-	C:\Users\Ken\AppData\Local\{9B45AB6A-7796-42D3-8C9C-3FA7EA8B781E}
2013-04-03 00:17:02	--------	d-----w-	C:\Users\Ken\AppData\Local\{BB3A791D-1470-49B9-83B2-4D263620F8F9}
2013-04-02 08:10:06	--------	d-----w-	C:\Users\Ken\AppData\Local\{2AE64F72-81B9-4F5C-8B10-2B843913A09D}
2013-04-01 13:38:01	--------	d-----w-	C:\Users\Ken\AppData\Local\{86D366E3-9238-4291-9E41-829029E626FE}
2013-03-31 17:25:26	--------	d-----w-	C:\Users\Ken\AppData\Local\{E1E0364C-6CD3-4882-AFF2-79EFF438FE47}
2013-03-29 14:23:51	--------	d-----w-	C:\Users\Ken\AppData\Local\{514C2608-79EF-45D8-A558-42B3ADC798CD}
2013-03-29 00:00:52	--------	d-----w-	C:\Users\Ken\AppData\Local\{B79DB294-8112-4832-BA0D-CFEDFF2F165C}
2013-03-28 15:04:47	--------	d-----w-	C:\Users\Ken\AppData\Local\{B4A388EF-3730-43E0-B75C-B9CA1FEF3B27}
2013-03-28 03:11:38	--------	d-----w-	C:\Users\Ken\AppData\Local\{C3565FBB-64A7-4F61-B955-5D97252D87CA}
2013-03-27 13:54:25	--------	d-----w-	C:\Users\Ken\AppData\Local\{249ACE71-5FBE-4ACC-90EF-384B23E6ABCE}
2013-03-26 16:08:48	--------	d-----w-	C:\Users\Ken\AppData\Local\{915CDA60-EE7C-4584-8C2F-975A195E8AB3}
2013-03-26 03:22:51	--------	d-----w-	C:\Users\Ken\AppData\Local\{8D2080E1-414A-41A5-AD9C-CF10F1C12315}
2013-03-25 03:39:26	--------	d-----w-	C:\Users\Ken\AppData\Local\{11CD2941-A915-42DC-976D-A206D463967A}
2013-03-24 02:50:08	--------	d-----w-	C:\Users\Ken\AppData\Local\{07B59AB8-829C-469D-A463-E50F632EBFB3}
2013-03-23 03:23:57	--------	d-----w-	C:\Users\Ken\AppData\Local\{F233BAD6-8900-4216-8BCA-EA991E9A22D6}
2013-03-22 13:50:59	--------	d-----w-	C:\Users\Ken\AppData\Local\{E2FC3AF8-3CDC-4049-B430-F1B82079EF12}
2013-03-21 22:25:34	--------	d-----w-	C:\Users\Ken\AppData\Local\{C66E8DAF-73D6-4D6B-B7DD-8197C5A82FAD}
2013-03-21 08:54:26	--------	d-----w-	C:\Users\Ken\AppData\Local\{3A086907-32AF-4DAD-89EA-1E29DD48BB62}
2013-03-20 08:53:50	--------	d-----w-	C:\Users\Ken\AppData\Local\{A5BA27CA-9824-4E3B-8CF5-F7749342C7C2}
2013-03-19 14:54:06	--------	d-----w-	C:\Users\Ken\AppData\Local\{5109290C-9A3D-435A-A90B-5C603DF9517F}
2013-03-19 02:53:42	--------	d-----w-	C:\Users\Ken\AppData\Local\{3795D5E1-86A2-41E9-8EC6-7F66C149D5F0}
2013-03-18 12:48:52	--------	d-----w-	C:\Users\Ken\AppData\Local\{65541690-77AE-42DA-B9C0-5BBAEFCAD9A4}
2013-03-17 20:49:47	737072	----a-w-	C:\ProgramData\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2013-03-17 20:49:26	48648	----a-w-	C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-03-17 20:49:22	573776	----a-w-	C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-03-17 18:06:46	--------	d-----w-	C:\Users\Ken\AppData\Local\{BEB8A5C2-4666-4408-936C-7C470BE35738}
2013-03-16 13:28:21	--------	d-----w-	C:\Users\Ken\AppData\Local\{576C5373-BDE1-4157-BD8A-6A56AD0920AB}
2013-03-15 18:57:50	--------	d-----w-	C:\Users\Ken\AppData\Local\{D25AF336-8BF9-4AE7-A8EA-847E648AD39D}
2013-03-15 13:38:09	--------	d-----w-	C:\Users\Ken\AppData\Local\{8F9EC742-7E49-4125-A767-DC6B4EF922DE}
2013-03-14 22:49:27	--------	d-----w-	C:\Users\Ken\AppData\Local\{1B4B04AC-D6BA-41D1-BFC4-DC0DDE7F17EC}
2013-03-14 07:24:01	--------	d-----w-	C:\Users\Ken\AppData\Local\{74C3BC59-9C86-481F-B39C-AE5959F02C79}
2013-03-13 09:21:24	19968	----a-w-	C:\Windows\System32\drivers\usb8023x.sys
2013-03-13 09:21:24	19968	----a-w-	C:\Windows\System32\drivers\usb8023.sys
2013-03-13 09:15:52	--------	d-----w-	C:\Users\Ken\AppData\Local\{EF24428D-1B1F-4CB0-A4D5-1A56BFE4D8BE}
2013-03-12 17:38:15	--------	d-----w-	C:\Users\Ken\AppData\Local\{284C027F-51D6-4623-BD44-68B2C7AC3E3F}
2013-03-11 20:02:32	--------	d-----w-	C:\Users\Ken\AppData\Local\{E0897C35-E96B-4940-AC65-344C6F108C48}
2013-03-10 20:05:24	--------	d-----w-	C:\Users\Ken\AppData\Local\{1D29E761-8F0E-49D8-B329-F3B5E315068F}
2013-03-09 21:08:23	--------	d-----w-	C:\Users\Ken\AppData\Local\{11518430-CD08-4969-BF9D-8C440F23DF34}
2013-03-09 08:53:27	--------	d-----w-	C:\Users\Ken\AppData\Local\{CD60DD3A-1551-4632-945B-47E502991902}
.
==================== Find3M ====================
.
2013-04-02 08:09:14	73432	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-02 08:09:14	693976	----a-w-	C:\Windows\SysWow64\FlashPlayerApp.exe
2013-03-04 18:24:58	23552	----a-w-	C:\Windows\xlkfs.dll
2013-02-12 05:45:24	135168	----a-w-	C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45:22	350208	----a-w-	C:\Windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45:22	308736	----a-w-	C:\Windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45:22	111104	----a-w-	C:\Windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48:31	474112	----a-w-	C:\Windows\apppatch\AcSpecfc.dll
2013-02-12 04:48:26	2176512	----a-w-	C:\Windows\apppatch\AcGenral.dll
2013-01-31 03:18:18	432800	----a-w-	C:\Windows\System32\drivers\N360x64\1403000.024\symnets.sys
2013-01-31 03:18:06	1139800	----a-w-	C:\Windows\System32\drivers\N360x64\1403000.024\symefa64.sys
2013-01-29 01:45:19	796248	----a-w-	C:\Windows\System32\drivers\N360x64\1403000.024\srtsp64.sys
2013-01-29 01:45:19	36952	----a-w-	C:\Windows\System32\drivers\N360x64\1403000.024\srtspx64.sys
2013-01-22 02:15:33	493656	----a-w-	C:\Windows\System32\drivers\N360x64\1403000.024\symds64.sys
2013-01-13 21:17:03	9728	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-01-13 21:17:02	2560	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-01-13 21:16:42	10752	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-01-13 21:12:46	3584	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-01-13 21:11:21	4096	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-01-13 21:11:08	5632	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-01-13 21:11:07	5632	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-01-13 21:11:07	3072	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-01-13 21:11:07	3072	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-01-13 20:35:31	9728	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-01-13 20:35:31	2560	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-01-13 20:35:18	10752	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-01-13 20:32:07	3584	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-01-13 20:31:48	4096	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-01-13 20:31:41	5632	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-01-13 20:31:40	5632	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-01-13 20:31:40	3072	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
2013-01-13 20:31:40	3072	---ha-w-	C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-01-13 20:31:00	1247744	----a-w-	C:\Windows\SysWow64\DWrite.dll
2013-01-13 20:22:22	1988096	----a-w-	C:\Windows\SysWow64\d3d10warp.dll
2013-01-13 20:20:31	293376	----a-w-	C:\Windows\SysWow64\dxgi.dll
2013-01-13 20:09:00	249856	----a-w-	C:\Windows\SysWow64\d3d10_1core.dll
2013-01-13 20:08:43	220160	----a-w-	C:\Windows\SysWow64\d3d10core.dll
2013-01-13 20:08:35	1504768	----a-w-	C:\Windows\SysWow64\d3d11.dll
2013-01-13 19:59:04	1643520	----a-w-	C:\Windows\System32\DWrite.dll
2013-01-13 19:58:28	1175552	----a-w-	C:\Windows\System32\FntCache.dll
2013-01-13 19:54:01	604160	----a-w-	C:\Windows\SysWow64\d3d10level9.dll
2013-01-13 19:53:58	207872	----a-w-	C:\Windows\SysWow64\WindowsCodecsExt.dll
2013-01-13 19:53:14	187392	----a-w-	C:\Windows\SysWow64\UIAnimation.dll
2013-01-13 19:51:30	2565120	----a-w-	C:\Windows\System32\d3d10warp.dll
2013-01-13 19:49:17	363008	----a-w-	C:\Windows\System32\dxgi.dll
2013-01-13 19:48:47	161792	----a-w-	C:\Windows\SysWow64\d3d10_1.dll
2013-01-13 19:46:25	1080832	----a-w-	C:\Windows\SysWow64\d3d10.dll
2013-01-13 19:43:21	1230336	----a-w-	C:\Windows\SysWow64\WindowsCodecs.dll
2013-01-13 19:38:39	333312	----a-w-	C:\Windows\System32\d3d10_1core.dll
2013-01-13 19:38:32	1887232	----a-w-	C:\Windows\System32\d3d11.dll
2013-01-13 19:38:21	296960	----a-w-	C:\Windows\System32\d3d10core.dll
2013-01-13 19:37:57	3419136	----a-w-	C:\Windows\SysWow64\d2d1.dll
2013-01-13 19:25:04	245248	----a-w-	C:\Windows\System32\WindowsCodecsExt.dll
2013-01-13 19:24:33	648192	----a-w-	C:\Windows\System32\d3d10level9.dll
2013-01-13 19:24:30	221184	----a-w-	C:\Windows\System32\UIAnimation.dll
2013-01-13 19:20:42	194560	----a-w-	C:\Windows\System32\d3d10_1.dll
2013-01-13 19:20:04	1238528	----a-w-	C:\Windows\System32\d3d10.dll
2013-01-13 19:15:40	1424384	----a-w-	C:\Windows\System32\WindowsCodecs.dll
2013-01-13 19:10:36	3928064	----a-w-	C:\Windows\System32\d2d1.dll
2013-01-13 19:02:06	417792	----a-w-	C:\Windows\SysWow64\WMPhoto.dll
2013-01-13 18:34:58	364544	----a-w-	C:\Windows\SysWow64\XpsGdiConverter.dll
2013-01-13 18:32:43	465920	----a-w-	C:\Windows\System32\WMPhoto.dll
2013-01-13 18:09:52	522752	----a-w-	C:\Windows\System32\XpsGdiConverter.dll
2013-01-13 17:26:42	1158144	----a-w-	C:\Windows\SysWow64\XpsPrint.dll
2013-01-13 17:05:09	1682432	----a-w-	C:\Windows\System32\XpsPrint.dll
2013-01-09 00:49:39	108008	----a-w-	C:\Windows\System32\WindowsAccessBridge-64.dll
2013-01-09 00:49:37	959976	----a-w-	C:\Windows\System32\deployJava1.dll
2013-01-09 00:49:37	1081320	----a-w-	C:\Windows\System32\npdeployJava1.dll
.
============= FINISH: 17:39:40.83 ===============


----------



## maggie88ca (Nov 19, 2006)

NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 23/01/2012 9:43:43 AM
System Uptime: 05/04/2013 5:19:53 PM (48 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | CM6630_CM6730_CM6830.
Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz | LGA1155 | 3300/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 559 GiB total, 368.461 GiB free.
D: is FIXED (NTFS) - 824 GiB total, 467.137 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP123: 07/03/2013 12:00:01 AM - Scheduled Checkpoint
RP124: 13/03/2013 3:00:15 AM - Windows Update
RP125: 14/03/2013 3:00:15 AM - Windows Update
RP126: 22/03/2013 1:24:43 AM - Scheduled Checkpoint
RP127: 31/03/2013 1:56:17 PM - Scheduled Checkpoint
RP128: 02/04/2013 3:00:12 AM - Windows Update
RP129: 07/04/2013 5:17:48 PM - Installed HiJackThis
RP130: 07/04/2013 5:32:05 PM - Removed HiJackThis
.
==== Installed Programs ======================
.
64 Bit HP CIO Components Installer
Adobe Flash Player 11 ActiveX
Adobe Reader XI (11.0.02)
AI Manager
AI Suite II
Any Video Converter 3.5.8
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Asmedia ASM104x USB 3.0 Host Controller Driver
Asmedia ASM106x SATA Host Controller Driver
ASUS Backup Wizard
AsusVibe2.0
µTorrent
BlackBerry Device Manager 7.0
Bonjour
CCleaner
Connect
Contrôle ActiveX Windows Live Mesh pour connexions à distance
Control ActiveX de Windows Live Mesh para conexiones remotas
D3DX10
Easy File Locker 1.4
Emsisoft Anti-Malware
FileHippo.com Update Checker
Galerie de photos Windows Live
Galería fotográfica de Windows Live
Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)
ImagXpress
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
iTunes
Java 7 Update 10 (64-bit)
Java Auto Updater
Java(TM) 6 Update 33
Junk Mail filter update
Mesh Runtime
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft IntelliPoint 8.2
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB2758694)
MSXML 4.0 SP3 Parser (KB973685)
MSXML4SP2
Nero 9 Essentials
Nero Audio Pack 1
Nero Blu-ray Player
Nero Blu-ray Player Help (CHM)
Nero Core Components
Nero Kwik Media
Nero Kwik Media Help (CHM)
Nero Kwik Themes Basic
Nero SharedVideoCodecs
Nero Update
neroxml
Norton 360
Prerequisite installer
Ralink RT2860 Wireless LAN Card
Realtek Ethernet Controller Driver
Realtek Ethernet Diagnostic Utility
Realtek High Definition Audio Driver
Samsung Kies
SAMSUNG USB Driver for Mobile Phones
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Soap 3.0 Toolkit
UFile 2010
UFile 2011
UFile 2012
UFile Updater 2010
UFile Updater 2011
UFile Updater 2012
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Windows Live
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Fotogalerie
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
Windows Live Mesh ActiveX control for remote connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR 4.20 (64-bit)
Xvid MPEG-4 Video Codec
.
==== Event Viewer Messages From Past Week ========
.
05/04/2013 4:23:51 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
.
==== End Of File ===========================


----------



## maggie88ca (Nov 19, 2006)

just a polite 48 hour bump


----------



## maggie88ca (Nov 19, 2006)

This info seems like it would be helpful so I went ahead and collected it....

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz, Intel64 Family 6 Model 42 Stepping 7
Processor Count: 4
RAM: 4008 Mb
Graphics Card: Intel(R) HD Graphics Family, 1812 Mb
Hard Drives: C: Total - 572317 MB, Free - 448739 MB; D: Total - 843954 MB, Free - 488653 MB;
Motherboard: ASUSTeK Computer INC., CM6630_CM6730_CM6830.
Antivirus: Emsisoft Anti-Malware, Updated and Enabled


----------



## eddie5659 (Mar 19, 2001)

Hiya

Sorry for the wait, can you do these for me:

Download *Security Check* from *here*.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called *checkup.txt*; please post the contents of that document.

Please download Malwarebytes' Anti-Malware from *Here*

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediatly.*

*Download and scan with* *SUPERAntiSpyware* Free Edition for Home Users
Double-click *SUPERAntiSpyware.exe* and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "*Yes*". If not, update the definitions before scanning by selecting "*Check for Updates*". (_If you encounter any problems while downloading the updates, manually download and unzip them from here._)
Under "*Configuration and Preferences*", click the *Preferences* button.
Click the *Scanning Control* tab.
Under *Scanner Options* make sure the following are checked _(leave all others unchecked)_:
_Close browsers before scanning._
_Scan for tracking cookies._
_Terminate memory threats before quarantining._

Click the "*Home*" button to leave the control center screen.
On the right, under "*Complete Scan*", choose *Perform Complete Scan*.
Click *Scan your computer*.
On the left, select all *fixed drives*.
Click "*Start Complete Scan*" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "*Continue*".
Make sure everything has a checkmark next to it and click "*Next*".
A notification will appear that "_Quarantine and Removal is Complete_". Click "*Remove Threats*" and then click the "*Finish*" button to return to the main menu.
If asked if you want to reboot, click "*Yes*".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
_Click *View Scan Logs*.
[*]Under Scanner Logs, double-click *SUPERAntiSpyware Scan Log*.
[*]If there are several logs, click the current dated log and press *View log*. A text file will open in your default text editor.
[*]Please copy and paste the Scan Log results in your next reply._
_[*]Click *Close* to exit the program._
_








Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Please download *AdwCleaner* by Xplode onto your desktop.

Double click on *AdwCleaner.exe* to run the tool.
Click on *Search*.
A logfile will automatically open after the scan has finished.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[R1].txt* as well.

Please include the *MBAM log, SUPERAntiSpyware Scan Log, checkup.txt, JRT.txt and adwCleaner[R1].txt *in your next reply

eddie_


----------



## maggie88ca (Nov 19, 2006)

Done, done and done thanks again for your help.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.04.11.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16540
Ken :: KEN-PC [administrator]

11/04/2013 4:34:23 PM
mbam-log-2013-04-11 (16-34-23).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 207657
Time elapsed: 2 minute(s), 27 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connect (Trojan.PornDialer) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Ken\Downloads\iehv.zip (PUP.HistoryTool) -> Quarantined and deleted successfully.

(end)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/11/2013 at 06:21 PM

Application Version : 5.6.1014

Core Rules Database Version : 10251
Trace Rules Database Version: 8063

Scan type : Complete Scan
Total Scan Time : 01:28:31

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 565
Memory threats detected : 0
Registry items scanned : 71790
Registry threats detected : 0
File items scanned : 187266
File threats detected : 0

# AdwCleaner v2.200 - Logfile created 04/11/2013 at 18:35:01
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ken - KEN-PC
# Boot Mode : Normal
# Running from : C:\Users\Ken\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [958 octets] - [11/04/2013 18:35:01]

########## EOF - C:\AdwCleaner[R1].txt - [1017 octets] ##########

Results of screen317's Security Check version 0.99.62 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 9 
*``````````````Antivirus/Firewall Check:``````````````* 
Windows Firewall Enabled! 
Emsisoft Anti-Malware 
Norton 360 
Antivirus up to date! 
*`````````Anti-malware/Other Utilities Check:`````````* 
Java(TM) 6 Update 33 
*Java version out of Date!* 
Adobe Reader XI 
*````````Process Check: objlist.exe by Laurent````````* 
Norton ccSvcHst.exe 
Emsisoft Anti-Malware a2service.exe 
Emsisoft Anti-Malware a2guard.exe 
*`````````````````System Health check`````````````````* 
Total Fragmentation on Drive C: 2% 
*````````````````````End of Log``````````````````````*

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.8.3 (04.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Ken on 11/04/2013 at 18:25:48.31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Ken\appdata\local\conduit"
Successfully deleted: [Folder] "C:\Users\Ken\appdata\locallow\conduit"
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{00BDDAB7-C561-4D0E-991B-77A72659349F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{00E822E6-5272-4246-AA99-4418F00D08B6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0103D114-C5FB-4FA1-BDA5-4275883214FF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{018DD896-43A7-430A-831A-FA490A8827D3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{01EED072-C2AB-42DC-B059-DAA8327CD6DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{01F44EC1-D862-4111-8FB8-9D14CF1DB7A1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{02210A48-1982-47F9-AC6D-DC98B130A994}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{02F5AC6B-35F0-4A48-8134-F2170CF0B34E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0315865F-B57F-4BD6-A294-6927B1254E8F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{03307AA1-3B1A-4846-818F-1D886851A354}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0425AE33-637E-4515-9D34-1462F0481335}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0514D536-C45D-4AA7-BC7C-2DEFD852C2EA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{057C810F-0C12-4556-BF25-C1713BFCE571}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{05F45301-614C-4E91-B47C-612641BCD80E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{062C4A93-A6C5-450A-8825-C877B46D18F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0681DF6B-38F2-4EE3-BAA0-BA1AB232A430}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{069AB2AE-3815-46F7-BA69-B4F4D78E4CE5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{07578CC2-F3EC-486F-84A3-AEAF225B1C35}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0798F63E-6DE2-4D4B-B8AC-6BC3185C1907}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{07B2073B-57D6-4113-A466-F1187E1C54DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{07B59AB8-829C-469D-A463-E50F632EBFB3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0811480E-D76E-4E62-9CF6-BEBD6E526D88}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{083B87DF-5605-4384-AB50-35EAEA0CF078}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{087428BF-0DE2-4ACD-94E4-B045BE227836}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0881B677-E763-4A1D-9CAD-68CCB0F299E4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{09A4368A-F802-4FFE-BDBF-B230F29FC452}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0A19FAFF-0771-4368-91DC-BE02C621A560}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0A757731-117A-46C3-A239-1F4811C4BE4F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0A77638F-89B9-4B3C-8BBD-85738A980A73}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0A8BA31A-0BA3-42C7-AD93-4B89596A53DE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0B6F1FCE-E864-4445-8478-B5BA6889BF27}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0BA08DC3-CEEF-4E10-AE20-640F2050CE3D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0BBD6F6B-4D53-453C-B8A8-C16F1D8748AA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0C268EE7-6D73-4BC8-826E-20A621C997B2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0C6B4561-1C56-497F-AED0-A1BE8BA8D242}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0C7F0258-8F81-43A2-B3C5-0FC53855A2DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0CE31FD5-CC2B-4427-A9DB-C90DC5C4E7D9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0D310563-02DA-4802-9F4A-ED9A6DB16DB5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0D4A5045-2FFF-415E-A27C-9B06CF41522A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0D902E7F-16E6-4AAF-BACD-830E341DE3DC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0DA34580-61F5-4013-BB6E-AF872440D906}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0DB79AC4-2CC1-40C6-8513-F21969FE70AE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0E264E53-BC5B-4D26-81C7-E7CF8A75A4C2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0E646A40-D4DB-4F98-9980-31434A0BCE6E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0EB1E9E4-E3D8-4B45-B6A8-760671AAF4B7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0F15B775-E853-440E-8264-BD747DD83E33}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0F20F06C-2627-4B01-917A-4D0EE6C0D358}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0F80138A-57E2-4408-A419-E9DB6B65CA2B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{102CB2A8-5045-414D-BCF8-9AA4DD70D9F3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{110D9894-A6C4-4019-8149-F126F2458ADD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{11518430-CD08-4969-BF9D-8C440F23DF34}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{117228C3-6412-493C-B42B-9A1810E1D61C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{11C79FD3-910C-498F-BD64-7CF82FE88178}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{11CD2941-A915-42DC-976D-A206D463967A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{11E9D3B7-C5BD-4419-B286-F7A3191D0CED}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{11F50259-2DEF-4860-942E-E26391EAFAA5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{121E287E-BB50-4FC9-9DE1-673EA97A639E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{12D6D9BC-0D1A-4654-BF8D-49E68A818CFB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1320AE12-9524-4C2D-8541-801A7D799215}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{13451EF9-F510-4064-B259-8DAC666C3473}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{139B0B19-D0A9-4859-AA01-D46FBA567BFB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{13FE9B97-5FF0-4D69-AD81-D86763499AE2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1429BB08-1F2E-4045-BF75-DBFFD9D43B02}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{14CFB9AC-1BCB-44FE-BF57-81983A58E391}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{14E466DA-26BB-479A-8989-CD50B80D906F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{15472B0F-DF96-4E53-8BE1-32D6CB25EE0F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{15A87CC5-A437-47B8-A9CB-7427D06179DA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{15B21CD8-6309-4168-8874-5722B1A5D4FE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{15D4EAB7-7442-4110-8BE1-375806FFCC18}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1633A708-5D88-4054-820D-F3BD88DA7561}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{16810C1E-D707-4F2A-AF33-37A33F58F482}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{168CCDD5-9369-4E72-AD9A-4A2FC1AD5E99}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{169E5BE2-6B13-48F9-AA56-EAFF87DC7828}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{16F5B336-D5D9-4A1E-B01B-0E29617C7ED2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{17256FB0-E90B-4538-BF9B-40D0A7DC93DC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{17318E57-B601-4E11-B52D-FDB5BD432B7A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{175815F2-9572-43D8-B32E-24B6176E6F48}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{17A901F7-D0C0-4282-A064-180B2A0CC5B4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1832F852-7407-46C2-9352-8AF8DCAC5271}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1860279E-DB5C-4C2A-A55D-D31590112E14}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{188C3EA2-78FB-437E-9CA9-9FA98D5A7764}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1A217FF8-2551-44BA-9702-0530DB1E4B7F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1A5C7D6E-5712-4C05-91FC-EB7F8CCEA35C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1AC6A674-546F-4F23-B869-AF8EDC94D6B4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1B46AE48-C999-40C6-84D9-CA68D4D51561}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1B4B04AC-D6BA-41D1-BFC4-DC0DDE7F17EC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1B5A092C-2EF7-412E-9E61-DF0BE29381C1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1C4F966B-AE99-4BDE-8323-DE59F60528E2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1C5B5B85-92D1-4C22-8B9B-2E8555E00377}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1C5C9E5E-6262-4B68-B323-9EFE6B037C66}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1C84733E-FA91-4924-906C-E34259779366}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1CC0B2EC-B5B6-4412-A3B4-4D2A72052519}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1CE9397C-A05F-47F6-98F7-E4ABCED27A4B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1D29E761-8F0E-49D8-B329-F3B5E315068F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1DBA937E-9BB6-4CDD-B9C1-53F4BB5E561E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1E299465-0E04-4A2A-AC96-6C897102306D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1E6CD5BE-F95A-4C7B-88DC-96966D08A7B9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1EBCAAFF-F4EE-42BC-A125-9019E9B08651}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1EE12804-24A2-4C0C-AD17-B4E30B425FCC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1F256603-E2F0-4BB6-8DF5-4D56F400B05C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1F433098-2ECC-4B22-961C-FB3F04F24778}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1F84B9E5-1F69-4CD4-B5E9-CEF0C99A6CFB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1F92084E-0ECF-4B8C-9895-8444CCA54F9F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{1FFCC6FD-9D71-4AE7-936E-FF2E63695FF7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2006011A-16E1-4E5C-999D-67C9DEEDD46B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{204FAD83-0C6D-47FE-AA0D-93560050FEB1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{20643466-C4E2-406A-8E67-C33799624807}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{20BC5F30-C2C8-4D9C-9F63-AA3706255048}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{20CE3ED5-6869-4BD3-A324-74D6AA7D16F1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{20DE8FD0-5ED4-4094-96B4-F241A9AFB79C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{22117A01-86F2-49F5-A392-51711D649C59}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{226344E5-C948-4B41-B9B6-1C74EEED650D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2266129D-B5E3-400B-BC1D-CBB17CA8715E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{228331BD-27AB-42B1-A8DC-71929DF4F789}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{22D4EAC0-4488-42DB-BCB9-D959B528E9F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{235CA26D-D0EC-4F74-A3A4-199A4532D3A6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2385DD88-BFD3-4DFB-83C6-2C6256FF50A2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2387D3DF-B1D2-4389-BCDD-0FF924CF1955}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{249ACE71-5FBE-4ACC-90EF-384B23E6ABCE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{24DE2FBD-218D-4A72-8B2A-C26C63529ADC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{24FDB59E-D85B-4E9D-952A-4FDEBA2F2F62}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2508A9C9-606B-4E5F-BC9F-DA15BAB43CB1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2531D05C-6E37-48A0-AC35-337F4897DC52}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{25899773-DE1F-4442-9632-6430BDA36048}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{25FA8B76-6597-4B13-AB89-9D2DFAEFFA30}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{263726B4-5D8A-4DC2-9BC3-1825432D0253}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2668D6D9-56C3-45A4-A7A3-06C692D28116}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2678F5ED-340A-490D-928C-D4B7120D6DC4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2687D833-69DC-43E6-8877-1AAD0CF17CAE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{26B3FBA9-ECFF-4BDA-A049-605E4006F931}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{26B6FB68-8590-4D09-858F-FA82BD87FFBD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{27063F11-4DDE-4349-B1EB-7B8C5EAFBF67}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{270746E7-CA3E-43A8-8BC5-8007691F7D62}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2722B956-5834-4997-A6FC-10CA064BF266}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{284BEE69-61C7-4598-8CF8-7FD8783D1656}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{284C027F-51D6-4623-BD44-68B2C7AC3E3F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{28668643-746F-43BB-AEED-476E31657131}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2879CEDE-1A5C-42A0-82DA-3C385CC22D76}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{28AAB5DE-0C56-40C0-88E1-B65118DC209C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{28E6753D-62DD-4351-AEF1-3A4A50562D8A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{29A1EC5D-A75E-4562-AB91-7198BA63BDC8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{29C84C00-D558-459B-AC88-C935BF538BBD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{29D69A7E-390B-46A7-B68A-B05025231CEA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2A2DD8FE-5F6F-4879-9858-B70EA92EAEDF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2A4FCC11-09B6-479B-A946-C4AEA17F66DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2A89C209-DDED-47B1-8F18-5A3961781D66}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2A988B44-BB5B-41F9-AD36-43AEF28C405B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2A98F224-952D-4E29-AC6F-00B399A89D12}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2A9EA3C6-1977-4A38-83EB-8EC1BE2C0DB1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2AE64F72-81B9-4F5C-8B10-2B843913A09D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2B10163A-F406-4721-831D-E03CCAE240D1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2B53AC0A-216B-49B6-A638-BB7BC6D9877D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2B61B664-1264-4BC9-A4A8-50EC652DB39F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2BAD9E95-792D-405B-8A69-AB7DD1F74EEB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2C066316-4294-41F5-B8BA-C4AC0BEC936B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2C40644F-D6A4-42B8-9CBE-1BA3902045CC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2C710F83-ADA2-4E1D-AAF2-407C7E495E7B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2D1C30F2-30B0-4D95-9C22-301A93323B96}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2D466184-032C-4ED0-9676-F1736CFB710B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2D4E4272-B794-4043-9E26-40B82360F582}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2D5FD643-FED0-41BB-B9C0-139A65B7E0E2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2D8D948B-82D4-4DB6-ADBB-E063D6AA5857}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2D9B52FD-145E-4A7D-A307-DF6799993449}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2E202BFF-58D6-4B79-A72B-E3E837DC3A3E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2E3AA127-AE7F-48C9-82FB-6CD2BE1D3402}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2E4F73C1-4E36-45AC-A2FE-66187A26745D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2E786D77-AB54-44F4-A7B1-3997ED5E83A6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2E89498E-67B2-4B22-884D-99ABC9FEF15F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2E8DD3D2-1148-42D3-9CCF-0FCEFCED2328}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2F3EDFAA-9978-4AB4-AB21-0EB99EFDE03D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2F74E3B9-52D7-4ACC-9228-71E8E2CDA2F6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{30348BE6-C469-40E4-954E-C941EA817EE4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{31701AF5-DB0D-45ED-90E4-B3811ED8D22E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{319BD24B-308B-41C4-869C-F5A897C8E686}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{31E4E4CA-7304-4C80-8B29-4EAD351FA893}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3245EC7A-40B5-44F9-A06A-E60D16170801}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{324F75C4-6532-4FA9-82F1-956812BA2569}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{325921A2-486E-47DC-91CA-458FB5871109}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3272F12B-1AE4-426C-9DC4-5C1E1AD964AF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3290E2E6-983F-47A4-BDBB-3A56B5019CDE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{32CD8F7A-3F4D-4BA0-943E-35455A2497A0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{32F61141-FD0E-4E71-AF14-7BCE288EA6E2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{333E98E7-44D4-4DA7-86BE-70A0D0B66A72}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3389B08C-A726-4222-85BC-50CC6948036C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{33F6C1B0-7CC4-45EA-9916-B5F0B9D550F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3436742A-1E31-4FE4-A6D5-BB0F412FAC69}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3462165D-A025-468C-A494-3198407655D5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{34797C8C-C9F0-47CA-A36F-99A48FB3B1FD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{34DC1AFC-7980-46FF-8E21-AFE5D059235D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3518C360-4787-4B98-BD33-020B195E73DC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3546F1C9-6E4D-438E-A05B-ECD7A9B6F165}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{358533BB-26EA-43FA-B360-3CB025E23C04}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3595C896-5218-4559-84FF-E65F97BA085A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{35D54761-372A-42E9-8CBA-FAFC8192D0C2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{35E1DD28-B15E-4729-8873-72ECA8FF4D6D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{36747B76-13AD-4B20-B6C4-5E11650655A7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3696DDE6-56B2-4E0A-8E0E-DDA1C6F2476D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3711C741-B778-40CB-9F91-C5C7CD23F28C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{37442071-B664-4C1F-B653-49B99D62FD7F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{374B06CA-62C8-41E0-BBCB-FD56AFE0BA0C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3795D5E1-86A2-41E9-8EC6-7F66C149D5F0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{380BE3A2-4D67-451C-8A7F-460D47D8D55B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3833A4A0-D6F1-4D74-9C03-7E35CB72BE88}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{38AAF360-8710-4CD1-B95A-E37B504AA82A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{38BE2CEB-9C4D-4C0C-AB6F-8405D014A28E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{38C3C7B3-6E14-4A82-8A44-81A1E0B03440}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{38E9BE7C-719B-4033-BC53-8C559988D86F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3927B8BE-EE0F-4BCB-9A3B-821C46E284F5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{39517D69-DF9E-4C82-B776-0B2A60B665B1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{395341B7-8D87-4255-87BD-F1FD88BD7213}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{39648915-47D1-45D9-8FC6-3B0BC0B4916A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3A086907-32AF-4DAD-89EA-1E29DD48BB62}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3A08A770-E470-4B9B-85A5-811EED542E46}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3A15401F-B60C-48BB-B421-1B5A4B363D59}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3AA9F83A-C44C-416B-BD5E-6597157BCDD2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3ACCA7A7-E2DE-4FC3-8556-20616839007D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3ACD75B5-DBC6-40FF-87F5-6FFCEE2097D2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3BF85FEB-6AC9-4110-8E94-59E99F05E55E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3CCAAE24-419B-4A4F-BB5C-F54F94E74445}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3CF585AE-FC65-4E19-91F3-B8E31A7DE0F5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3D2038BC-A128-4948-BC3D-F0A4E3DBDB4A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3DDE04AB-A3A0-4F0A-85DC-65F2E98BE85F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3E523330-8F0B-426E-AB0E-0809C90A10FE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3E61285E-8600-449C-88E7-C911B30BACF3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3EC82D27-1965-4358-BF5A-5CE547AD19A6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3F1C1DC3-90B9-4B42-B1A6-96DB0973AD30}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3F4CB2E5-C110-495C-834E-7564B2186AED}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3FAD48F5-F887-43AA-A1AA-DADCEDACF9F9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4006A74D-2E93-4549-9459-D038C52AD87D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{40507478-8A8C-483C-9C17-F8994D89A321}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{40C01F1E-DA3D-48D0-BF69-B06187DB0976}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{40E03FB8-389D-49EA-8B9B-953814E8F529}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{40F2938D-7A58-4F9F-8229-A6574C0905DC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{41844FA1-0BC4-45E4-8764-DEF9A9AF438A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{419D3A97-3D27-4106-AECB-69A2A7E5C7D6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{41E809F4-0E22-4123-B485-98F6312CEE42}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{424FF408-238E-4BC0-AA07-09D5F2B20130}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{42C2D348-373F-4DEE-82B2-C5CDE5E0FFA0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{42C77F80-3AAD-4CD5-950D-83A1FDB5A958}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{43579B68-D534-4848-A09C-B2C1111719C4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{43611B85-C1E4-4639-8752-69FFAE351A10}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{43DB6EA6-350F-4F6C-A58E-804418F28D52}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{44257259-6D4E-4E83-8F0F-BB661224ED82}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{44295DFC-FB8F-46C2-8F9D-0A83A3BEE446}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4429B80D-6587-4615-9839-534AC3DE3405}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{445FC99D-9539-48D6-BAF8-BD491BD120F6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{448C3E31-897E-4BD5-8F82-78FFEFA5A81A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{44DBAC83-C590-439C-B1E4-4225DFE22F17}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{44F51185-01F6-42EE-A0E1-2FD89A77ED92}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{455A0733-A930-4C90-9434-AA6645DDD978}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4592583E-5836-4B4A-ADFD-B823111CE96D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4594B5EF-2000-4D8C-AD4A-C31F19A59FEB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{45C6CB8D-E7D3-48EC-9281-03E49967BCA5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{460FED5F-2561-473A-B130-97E041902F0D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{46AA98E2-C1E3-4298-B7A4-8A040143ADCB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{46B84AA7-5CF6-4E02-8746-EBD107A56B89}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4706F68B-2E14-4577-8D25-1D242A5F2334}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{47240C40-34EB-4DD2-B2A6-2DA25DDD485A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{47738683-AB63-42AD-80D7-FD1BA27C4E46}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{47C947D5-96C7-40C9-BBC5-A6E8FDEB321E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{47F49775-6D44-4EBC-B264-F555EA4CE402}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{47FC5D73-4917-4728-9097-3136DCCC8121}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{48712112-B878-45F5-B2D8-244453B35833}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4881FDC2-2343-46D4-87D7-D69726A5D393}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{491B87E1-9793-47CC-A920-F58BABDEDBD1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4926EAE8-173E-4C74-88CB-B37236AE078C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4953FA93-7237-4EEC-8B24-54AE5677F02D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{49820E53-2191-4DCF-B05D-E6765BEF03C4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{49913FEB-6F60-4CF1-A046-DA593B455A02}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{49956DC6-1437-4CEE-8F7E-AA116EE4E7FA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4A22684B-ED85-4C9F-9B93-BF41C2CF95BC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4A8703A4-F815-480D-8682-ECBD3CD33D66}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4ACB57B1-81A2-447E-A520-6B02B467CE5A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4ADB7848-650D-42BA-A31E-B0C87AE4A4F8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4ADDA275-92E0-48E6-97BF-71F38FC1A7A0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4BD91154-31B3-4D91-AE1D-21D00E989407}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4BDC8B72-43E4-458C-AEC5-E49B16B467D4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4C0D9AE4-BB4F-4264-A72F-6B4986962FDF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4C5A858C-F565-413D-BFEE-54E414F84C62}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4C628FF8-CEF4-4F5A-8A3D-C090E9DF1FDB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4C7EBBCD-F1FA-44A9-A539-06DB9353F8DE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4CB20068-4889-4FB8-B18B-BBD8BB16C349}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4CBB9C40-7BED-41E3-A5C8-079BA05DF524}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4CEFC3A7-D347-49C8-AA96-D9DB5C2FE12F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4D9D5539-F967-4B6A-AE86-58CFC6DE893A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4DE5D6D3-3EAB-47A1-9333-536078DBEDEB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4DE98FB6-7D7A-4F32-8761-1F4685460671}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4DEEC336-CDA3-4731-B6E9-7BB28C1764A9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4F8A62CE-8634-479B-9FF3-B46CB8EAA329}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4FE25C4F-88D2-467B-A877-77D814708CA2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5058021A-445D-45E4-8339-052F7DAC3747}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{507AE40A-1114-480C-A8F0-6C121F97CB5C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{50A97648-94FE-4814-A5A3-1A300D431BC7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{50EC79C2-B7F6-47F1-9544-38F05661F69E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5109290C-9A3D-435A-A90B-5C603DF9517F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{514C2608-79EF-45D8-A558-42B3ADC798CD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{518CEE7A-8C80-42D8-9AE9-FCA18C70CC1B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{51A97EF9-117B-4C8A-95A2-73F72B467C7F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{520F8406-9C5B-4DDB-9C88-D9ACA7BCF808}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5242FDE7-2989-47C3-B1C6-7F36F8296FD2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{52569374-FEFB-4887-8F35-5541D322570C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{52642BB9-C693-4EBD-9B51-C9C5ABB7BE36}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{527A36BC-8823-4D2F-8133-FB9A4B2A2D3E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{534DEB9B-C6B1-4D87-A522-E6DA0E59743C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5417D94E-3BFB-444B-9350-ECB20CD27C36}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5441F98D-91A5-4867-AA79-CCB3FCB5E5FC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{545EB19C-90B5-44F5-A361-661934E426B9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{546EBD2E-2953-4516-B8FC-FB23BD7C33B3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{54A2628E-E270-4845-8E70-E80104F7C3EB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5522AC0A-29CB-4BAE-AC59-042578AC9196}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{55396056-2F12-4440-BA06-CB2D0CED6E76}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{554B79D3-D142-46B9-A9D6-78B825C6879F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{55B4A473-32CC-4563-9F46-5A6A42FE2841}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{55C9167F-1BDF-4F84-B869-3A5371EEC018}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{55E900F9-F77E-456E-9622-7D92678AC52D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{56000AEB-39CA-4EE4-BBA9-931028B7D6D8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5602A479-27E4-4481-9594-61F95B850867}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{560C48BD-0B49-4D29-9B87-B922B13E14FB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{574EB081-F1B0-40BB-9344-B7B262263382}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{576C5373-BDE1-4157-BD8A-6A56AD0920AB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{578A6041-D16C-44ED-B5C8-161466842F31}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{57CF1D72-C641-4E22-B6F4-784F098D6938}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5845FB29-63CB-401B-9637-024596C9646C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{58559F77-C6F0-4DFE-869C-82CC448A1DC0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{596B959B-2B7E-4428-97CC-92C4E35202A3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{59885056-4A1F-44D7-9593-6C010B7502B9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5997E76F-9780-44D4-8AC6-118C6284137D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{59CF8843-2437-4E02-983C-35BD5A3B9528}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{59DB16A5-88AB-483F-8C7B-D625E1F5856F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{59E81A3E-AFF7-4AFB-9A38-41ECB6EA85ED}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5A3AFCE6-737F-441E-92DE-B049AB3946AA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5A3CD1BA-46DC-4F99-AB11-56FCC38D878E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5A777419-AD56-498A-A9F4-5F96B0AD812C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5B711214-3792-4881-A429-8A40619ED12B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5BB1E16E-CA8C-4721-80CC-29583660790A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5BBD9E41-3078-4402-BF3B-37095B67AF33}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C35FF6E-BC4B-4433-B4C3-33A833F71D2F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C3BE981-8E90-4B70-BD1A-DC8B562F1F19}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C5908DB-3417-46DD-B934-3BAB93F81EC5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C6C1D09-6C79-46AF-A9BF-8A39AC6322F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C7B0BAF-5751-4A7D-A15A-1C9C1A9FC4BE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C8A895B-2BA4-46B6-84FF-FC2D112D3941}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5C9BD89C-43A4-4228-BA7D-E9EB95F8EFA8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5D10FCDF-25FC-4183-AAA6-69D4428C77DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5D32D3D0-D426-4A57-A8E8-C1626FA38044}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5D4E068F-20E8-421B-A310-C7A922761280}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5DF42B39-B556-463E-ABD5-222A277F1C8F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5DF5C95B-F89C-4851-B34A-3E98C6FC2F07}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5E274AE6-759F-46A9-B30C-A90C40642E0D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5E80270C-24B1-4EF3-99CB-5C52C0715AEF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5F849DE7-1F53-4E1B-9F6E-6A1C84FF7E7A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5FEB0C16-C83C-4FDA-AA5C-4291C3BE01C4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5FEE9A31-8E0E-4B2A-B03C-2E50A5C63401}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{605D2923-5AAA-4694-A087-47C10AA351AF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{60621FAB-663D-4133-BB59-3CFC93135452}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{60A2B6A1-C909-4612-B625-10FE2530A310}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{60AEB6BA-69FE-466D-AC44-634B1137A5FF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6112F126-CA70-4F29-A02B-25F8583EA0CB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{61C043D4-5240-4F4A-B6A9-8660EBA8BBD1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{61E66BE4-2BAA-4A44-8C65-4EB835889720}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{621E3E64-D152-4A83-A066-EB8825073C3E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{624FCDBE-3EE9-498A-9FD7-1068AD97CF9E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6256BAB4-E11C-4D44-A906-DF21020AA3A9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{62AA8705-9BE0-4418-90E1-B04AA19BCBF7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{62E198D4-6A41-45FB-8B4F-833E49793EC1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{63A90D38-53D5-497D-A1F8-600D167E0555}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{63BB47C0-D74C-4009-BC8B-0382AB68B5F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{63C33EF8-BCBF-4B21-BECA-E72CDB78CF8B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{63C9B9B9-4827-4B61-95C3-2C396E81CB56}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6402DD56-868C-4B1D-B535-F93A94D5448E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{64131384-425C-4135-93F4-C9592E75EFF0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{64185117-4F5F-4510-878D-91F63D17CD1D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{64A958B2-FF27-42A6-9920-15D0A40E4EAC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{64AC8E78-66B3-4AE0-85AE-C68B2610E193}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{64B593B2-B2A0-4D05-9553-0CA4070693B9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{64F122D6-CF0A-49E2-92E8-45103058A371}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{651F3FB6-DA26-4868-A079-9F00973EB48D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{65541690-77AE-42DA-B9C0-5BBAEFCAD9A4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{65572377-23A5-4F5D-ACB1-8D516109C0DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{657DAB2D-443B-4B7B-853D-2430A0C8D17C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{65CAD7FC-6FC0-4324-AC51-F161525BF64F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{660915EA-8459-4C86-BCCB-EC5A02406CC6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6631079E-BF63-4198-8F67-6EBA78E5CA14}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{66AAA45F-97B2-4408-99F1-E6E0313EB3A8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6749DDE3-9804-4365-98EE-F5CD2F453DFF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{674AC34B-15C8-466B-88D3-B6E9D7BEB265}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6797E9E8-0A99-46D9-9763-A7C87C8DAE25}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{68593038-A34F-4832-85CF-8B2AD0F0CE42}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{692FC2D0-D728-4C2A-9E45-8D75040A198F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{696CFDA0-7218-4627-BDFD-5CACDB7CC6D7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{69E13141-9DB5-4F35-82C1-29948D04E13D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6A0AA96A-BD00-4C78-AC6E-B7603A1B0CCE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6A0FFC27-EB2B-48EC-B67B-AA651DC62C47}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6A26D493-282A-4451-83F6-2145A139CBFC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6AB2D292-11C5-459D-B864-A38F36D8026B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6BF3AC21-72C8-4D9F-AD5E-A6342D048108}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6C4AB54E-B344-49D1-BB09-7DE8724E1703}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6C9BC842-36BA-4E71-8394-AE158DE641BF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6CA6E370-A0DD-4D5E-8FCB-EA15F32EAC90}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6CF6C7B3-F6BF-405D-B238-CAF5570E0282}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6D087FF0-0A26-42D7-A156-E459CBDF652B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6D2FD042-3FF9-40B8-B112-11124821985E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6D8700E6-FE38-488B-B994-C504381F3394}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6D93951B-B123-4E60-9665-7B834A240C3A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6DA639DC-5F0D-4B39-863F-B91DF94FF68D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6DD2F19C-CA1F-46D0-80B2-D21EE11B721C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6E7BEFAD-A73E-4C95-A068-77EF1ACE49BB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6E806118-E278-4441-91AF-FB9EF2C6A3C9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6E91FE21-5D6A-4B92-860D-7D049B671F10}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6EBBD791-4001-420B-B995-05912ADEEC4D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6F1BC0FB-41A5-4384-8B2E-61EE277E9FD3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6F47E676-9CC3-4FD1-9816-FFFB40885F92}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6F90CB4C-920B-4698-A70C-4F331A40AF0D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{6FFA27B1-EBAD-4D15-A3CD-41A32169B903}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7028586C-7399-4D8B-B09E-9FBC84F8C94B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7052D397-C80B-4AD2-A81E-B93206A14D39}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7054634E-496C-4B42-9C6B-C3D2E9018F8E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7088F298-CE7A-444C-A12B-BF6E61A6FA8E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{70C54D15-4F54-4CB3-A4C0-705580FC12F2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{70CB11C0-F55B-4377-A6C0-C9E1281AC62E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{70E648C3-8372-4B39-8D50-351D886BD122}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7103915C-F06E-4F69-AA79-5DE54E52AF99}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{710D694F-50EA-4561-A5CF-AC99196BC705}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7177A9C6-B409-41B8-92FA-0F221E881B8E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{72020B75-C6FD-4B93-9D5A-26FB5B10858C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{723D14EB-B1F1-4375-ADB7-D1E08A057122}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7262E691-BFCA-4F0B-A832-70E70528CE60}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{726E000B-B123-4075-8362-6B06383D30EB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7289A1D2-0D45-48D3-93BF-FEF4ED656C72}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{72B3B5FD-82B0-412D-9E8A-8D246B43C67D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{731A904E-B233-46CD-914E-114DDC2D717E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7326D94D-F116-42ED-82F6-1788D8335F15}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7334EE1B-B97F-4361-8AEA-39E692222108}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{73AFF5FF-2AB8-42E6-970F-77BF8D27CE8F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{73B64452-3F5C-473D-A6E9-CE66C6D7CED5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{73C0CA4A-9153-4158-BACE-DABAAE5136BE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{73DD4E99-6984-4C64-ACEB-CF83823A5E1F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{73DD690F-854F-465C-A7A8-0F7B97647F69}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{741FC01B-A30D-4681-ADCE-771DBB7C860E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{74772905-3269-4F6F-864B-A205F16548E2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{74C3BC59-9C86-481F-B39C-AE5959F02C79}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{74DF3EE5-CB8A-4D14-8C90-4B74E25479A5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{74E532A1-71E1-4AC9-B8EA-5E89DD1D5AFA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7515441F-CC86-4814-983B-527196B2D2E4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7570DF6A-BBE6-4058-8C0F-58366B1F07AA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{75EA5210-B2AB-457C-9CE2-98B143EBC2F0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{75F37199-684D-4734-A127-8C536F1AD18C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{75FF061A-238F-49E1-A757-4F1C3E506E43}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{766CA8C1-5B37-429F-8309-F928FE349A9D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{76BB8B58-D7FF-43BF-A993-E3830ECE459A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{77566F05-B22D-4548-86E9-8E305C1EE1A3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{78F5074C-339C-4B57-94D7-AC78DF9CF5F9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{791E8B04-55EE-4B28-B94A-59D2341CB017}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{793D227A-A0EC-4469-A9A0-1126B5715883}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{798D4271-8BF3-40ED-AF19-91E3A37E0F54}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7999E7CE-FC24-4C03-A1FE-B78A1B7736DB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{79B9D9D0-9444-4114-86A7-4CFECEAD06A7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{79DC4BFF-58AC-4779-8EEB-21211F777D5B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{79EE47D9-37D2-4906-8621-33A27AF7489D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{79FFCA58-A76C-4CDE-B975-18AA2F930046}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7A457B64-5587-45E2-92AC-8372AB20AD45}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7A6C05D0-32A3-492C-9662-F4C1E97FDDA0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7AEF89B2-FCB9-495C-B6DA-F31581ED0CCF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7AFEA57E-6550-4137-8030-B22D747B501A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7B2A21C3-E830-402E-972E-3E09D8FC666B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7B2D6A8D-821D-49D1-9F65-4D9B96C08A68}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7B8C8629-0BD5-47A5-A1E6-95DDA31CE230}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7B974D98-98ED-4B55-AAC4-06AC30DC7007}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7BACD9C7-D6B2-46AD-B37F-3DFE3DB2C009}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7BDD6C8E-F3F4-4097-8D05-CF0D6A439C43}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7C3A8106-C9E7-4836-9F70-633933F403DD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7C9CE4D0-B927-4B46-BE19-15A117A84EA9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7CA1CCC1-B4E4-4C80-ABBE-8454E5A3FDF3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7CA74742-68D0-4A64-A32B-7FCE3A43C587}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7CEDE2A6-96CF-4036-BF61-13E947FAD08D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7D229A76-2C50-4BC3-B91C-6DCA470976DB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7D2FD7C2-4B70-4E2E-9001-696530D1DCFF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7D997F5F-812C-46BC-866D-AC23B1E5E34F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7D9F35FA-2ED4-4CD0-91B0-76CCBFABFC85}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7EF9959A-6CAF-4A99-887F-6CDD97787E96}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7EFFFA4A-99C6-4B3D-AF70-48E04F00B856}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7F1CA2DF-A6D0-41E5-B8B6-E2DE54F81D01}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7F406193-26A2-47E3-9483-8B64D941FF34}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7F95376A-9AE5-4820-AFFD-2AFEDC608F1B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7FB0FFDB-E07B-4D74-B4BD-2E1796DB4C9F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{7FB8795F-B083-472F-883F-A7D25164BF28}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{805D6A72-03D8-4ACF-B52D-C80559D76B05}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{80727474-847F-4B79-BB1F-B03B355795CC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{80EA4D67-B3BD-4C42-BD0E-0E8FAE267CB8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8140E34B-54F0-494A-8E51-959208EA8367}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{81BBC3F5-4932-4A7B-9700-59A617A7C416}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8252C173-7BE2-4D64-940C-D44F41049746}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8296CB9C-CA46-464D-B31D-F9B8A563169E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{835121FC-2EA7-4808-ACEE-08CA75C3047D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{83606E4D-95C0-4C27-818D-1FD1AC8AF964}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{83AD587C-5D91-47EB-82A7-E9311F62764E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{83D64C35-37BD-4BD6-AF9F-9244902CB329}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{83EC2601-B893-4E71-B6E7-75285913D551}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{84D4AFDC-B197-4129-B2F7-5ABB43020219}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{84E30C1A-0DA4-45FB-9351-E93D6381E2F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8504762D-41B3-4CF1-BEE4-446E3178B242}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{855AA98E-DE2C-4892-804B-31418717263E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8585DCE5-5F2D-4FC3-A6DB-041C2C28E985}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{85923842-693C-4601-88C0-BAF5DA9FE6CD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8627FCBD-B697-4598-B31B-360B785A83AE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{86394930-D6B5-41B6-9248-A8912E3E8CDE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{86921870-D26D-4026-97D0-30B343601788}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{86BE1D33-33BE-4BB7-B16F-C2C12EE6AF3E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{86D366E3-9238-4291-9E41-829029E626FE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{86D6C7FD-1AA7-4F30-961A-3EBB797195F9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{86F25EB4-BB2E-4F57-AA6D-7AEAE8EDE527}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8739F569-5735-48F1-B402-65DE9824CB10}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8750C0A5-6C24-4DEB-84B2-A81FA37CA2AF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8754E671-2230-4FD9-9772-37962DA90357}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{87C176E0-49C9-42C0-8C2D-1DDAB4F56D5E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{882408DD-AFFD-4147-BA65-D345B1776748}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{88753C22-6323-4FC4-8AB1-F3BD00F08099}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{88B6A615-F1C4-4AD1-B8E1-A2D74E4CD124}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{88D22149-2BDC-44A5-9461-AD7FDD6F8C1D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{894CF957-F205-4487-9D82-B1892D96BB9A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8956C730-DBBE-4696-A7AB-4DC7A47DB2AB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8987E8BB-398C-4857-A429-586BF7E82243}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{89BD31FA-610D-42B7-8C18-F1D07F6E0347}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8A5B9338-D89A-44F4-9D72-8444BD054904}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8A8ACFB8-D1F1-4E45-8724-BBD14DFDC7D0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8B6A183D-4BD8-45B4-A7FF-FB909E15BB93}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8B8B3BBC-E3DB-498D-AD27-2400761FD5D0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8B94AD43-D5EA-4BE5-A353-771AC8123D09}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8BA551E7-E810-4F52-A75A-3D9813DCEE03}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8BF3C96C-74C9-4E79-9D50-E9CA9FE04BEF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8C15E627-F718-4D11-8018-1C1B4604C8BD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8C63E93A-9561-4957-B678-51F59313B2F5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8C6CDC5B-D364-46D4-8AEF-137D832D20C4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8C8EE103-C40F-4C00-9228-73CD1217BB54}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8CAD2DA8-09D8-4F1B-946F-F47644CFF989}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8CE50EBF-E317-42A5-8C2A-3934A8C0AAFD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8CF579AF-C76A-4D3C-BA2B-66036CDAA659}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8CF8BD7B-07DA-424A-A5A0-1F409C82D01C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8CFD7834-2709-49AF-9509-443BC9A003AF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8CFFF675-8229-452F-A3CA-8B1E93B92F03}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8D2080E1-414A-41A5-AD9C-CF10F1C12315}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8D20F624-6A49-4173-A212-F5F2145AFB98}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8DC4BD6E-F421-43B1-BDAC-07887FA513A2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8DFA1748-35F7-4EC5-AB8D-CA34B7C0EE0F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8E75BFDC-53A0-47A2-A927-6EED9A8E193B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8E9949FC-5ADE-4911-B964-748CD3FC1F1A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8E9D620E-3BE6-43AE-A90C-E4EE268A69E1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8F478215-5355-495B-A3C2-88525D7E00DE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8F76E4AA-2C72-442D-B301-2756E1471F8B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8F7EE447-4DAA-4498-855D-DBB7DF3AACC2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8F9EC742-7E49-4125-A767-DC6B4EF922DE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8FADDE38-98A6-4D18-9CA8-E6ADF2C1F0A4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{903DB1A6-6B2B-4056-938C-4E03228958EE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{90CE3830-2EE3-45E1-8C3E-E5B75DF1348B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{910C5A35-60DB-436D-9914-F85C5DC35B98}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{915CDA60-EE7C-4584-8C2F-975A195E8AB3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{91745788-7884-40A3-A30F-B9D2A39C0475}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9187CB2E-CFD3-4A9B-815B-5C8D075A4173}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9254DAE4-B3EE-479B-96A0-010168392D4A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{94600836-6BD0-451A-8E26-04EBFBED7F32}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{948B31EF-C730-4AC0-9C99-280B73D718E5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{94961B45-FD76-472E-AB25-DF90F0307730}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{95E932B3-3510-49CE-BB3A-4BD1EE5EEABC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{95F08CE0-B566-49D4-9CC9-BDE2DD4D9D75}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{963A301D-23C1-4C0B-9F2B-DF8F1E44FD2F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{96AAF12C-58C8-4D1A-A158-1E98836E8584}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{96AB86A6-3E8D-4FC8-9406-2665544854E5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{96EC7658-AE8E-43F6-B12D-07B99D2E7925}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{97532775-1E56-47E0-B364-3B3154E9475A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{97CA1514-2FBC-47AE-B570-6497289534AC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{97D822AC-08CD-4F91-A6C0-65A684D92D15}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{98DBAE43-A034-48F7-8F5C-F89592E31FFB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{992C4B11-60E9-487E-9052-23B36305473E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{99603F12-CCC0-44C6-915E-8585A1E9140F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{997CF091-E9F9-4B7D-AD36-D2A64A50E6FE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9998D501-82B3-4C79-A922-23DB81F7F7A3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{99BD7F49-5ECA-4651-B1A8-910127A54C57}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{99EE7870-45E2-48AD-8E57-2339747BD55A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9A647D27-7B2A-4C75-9107-E24FE5E37161}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9A6A619A-72BD-4B9A-AE78-D0C200604C44}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9A73D60B-2E70-4E0A-B07F-03C86967C367}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9AAB20E1-B777-4C44-92FA-2A6C44A56A54}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9B45AB6A-7796-42D3-8C9C-3FA7EA8B781E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9B5DCB10-FE7D-472C-8B42-98F4C0DD2E40}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9BA4F6C0-F58A-4351-89DD-452EAA8F9E37}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9C2EEF57-5B2B-4F12-9E48-3CDC21DB8E51}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9C59C4DF-F9FA-49FD-BC9D-3879FDC01F58}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9CF6DB50-33CF-45D8-9790-22CA8F7BC3D8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9E08DC5B-9BF3-4C80-8AF7-32FA49D644BA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9E0DFA68-1B92-4840-9E80-6A47760D52EF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9E1101E6-7428-4955-8DB3-584C2BFAAD35}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9E1BC029-B06B-444B-91E6-2F66BA2B007D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9E9918F7-71FF-4F51-8D75-C3CDC30B684D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9EF80AF5-73E6-40DD-BF1E-C453FED64A0A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9FC4AD51-E47C-49D4-A793-7E18F2FF7EC7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9FC99CCE-4745-465E-8BBD-DA7AA0A315DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9FE6CC9A-764C-4D2E-814D-A1CF2DA76127}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9FF7ED46-2DB4-4693-A032-34A526BD3DB1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A06E05AE-7C26-4DC7-A209-51EA69E82F4A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A10A0554-6BFF-44FE-BE1F-15835BEC9A03}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A13A4C7A-57DA-4B20-80DA-83DA53CC0669}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A15CAC4E-3174-4AC7-BD6D-5D711CEA02E6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A182A875-8BE5-4DD6-AEAE-37944592F85B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A1A9D9A2-67D0-4006-ADE7-1426DEF0C991}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A1B751A4-BA8C-45B0-81AD-75EBDE918666}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A1C378E5-3B3D-4D94-B637-F0880AD4B450}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A1F5CD8E-4CA6-41FB-B944-C213C6D41714}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A1F72639-C93A-4B0F-ADB5-5E38A69AD4E0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A220D348-46AD-48E1-8A94-B2BF6683F9FC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A291B8EE-DA54-4672-922B-D915A3271122}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A38B425B-FAA5-4CD1-8A2C-56C28E82530D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A53FFD7C-D3EA-4A6E-93B9-6BA00378EE0E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A56615CA-0A43-4927-A0CB-863DEEDA56B0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A59FF5A6-9FA2-46C7-A222-F5A373FAF352}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A5BA27CA-9824-4E3B-8CF5-F7749342C7C2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A606BBBB-E6D8-4E5A-A2DD-655C73F41E19}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A6610BEA-BABF-4D62-88B7-F71A2DBFC506}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A6623B13-21C1-4F16-800B-49127BEFEF58}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A6845824-3DC2-4888-BBBC-B21EA9EB3502}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A70FDD29-2DDB-4464-A6E0-6E4540D17552}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A71F406D-C8F9-484B-8867-40D7B100486D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A73762C4-3755-4421-A974-6920795F9CCE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A764200C-59EE-4DC9-9D00-957A6E6C4B31}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A7DF4376-3057-453C-9322-88C3E9FD4252}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A89670B5-78A3-4430-837C-AD99BE29398F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A99371A9-09BF-42CF-B2A1-BA8E5706795B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A9FF24FC-7955-433E-BCD7-034371FDDAA1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AA2D3331-A023-4598-98FD-08C8788AC595}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AA562D31-FB49-41A0-A994-D2793C3EE807}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AADF4B32-6AFC-48EB-BA18-6A025963354E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AC5CBC99-906B-4C94-9993-98489AEE155F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AC705998-6607-4879-9730-7B8E4A00997D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AC9158F6-347D-4DD1-B451-EFBD0FA6A3F9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AC93A2E9-D712-43A4-9C5D-57B1A2EEB0D1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AC98474A-9B7B-4232-9014-DFFBAFC04A58}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AC9CB9E0-6DCD-49AF-ACFE-37AA40400CE1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AD5DBFCC-9578-4478-AC47-7E671F17907E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AD607AEE-39C9-4111-B608-DF45921D47D8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AD8294FD-DF8F-4C58-9207-54F56DF6E83C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{ADC45990-1FAB-44CE-BDAA-E0E3598DD5D9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{ADF1252E-63B2-417E-BF80-DE320EC14B88}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AEACB652-93DB-47FF-8470-4DDFC55FFF6E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AF1F144B-759C-409D-B9D3-5C0DDD4C3C43}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AF7BD70A-02BD-497F-A193-EBDF2421F1D4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AFBACC55-F4C7-4764-A1AE-8886B3395BAE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{AFED81AF-71D7-49C3-BE76-8B3174E03704}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B047A87A-DC29-4868-BE2D-BEDFA6D6B679}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B0642B2F-80A4-49EC-9BC8-666F3100D883}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B0891738-19B1-44D1-8093-678D6F0C86D0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B0AB876D-D3FB-474B-A1DF-91630FEF68F6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B0FC7CA1-0B7F-4841-B087-2CF8A126B667}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B12E6A4E-51D1-4199-8E87-4240D1A41DFC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B2342258-CA5A-4A7E-A62D-40ADCA148005}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B2DEC61C-E59A-43B5-BBFC-4F38693D2C1F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B2FADF10-097A-4E65-849B-0E8DD6A48A66}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B3432067-9537-4762-85AF-DC11935BA28C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B3AF6C61-53D1-4BC9-81BC-7CD324E77E23}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B4038EDE-3368-4445-9A64-15EC3F55A9B3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B43A191B-675E-4D10-B858-057D6C984D98}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B43E8ED0-64E0-4EF7-8552-30B4F124F4CC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B497A0B8-6A81-4DA5-9A91-399F1153C804}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B49FCDA9-3C60-4DF6-A071-A4EA0DEDA393}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B4A388EF-3730-43E0-B75C-B9CA1FEF3B27}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B4A87036-554D-47B9-839C-CD479D34C621}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B511D1D8-FD89-4B09-8A57-8C721F76654A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B5D0FE9E-9D8C-4047-88B5-F870C8FEE241}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B5DE9A5D-9B9D-402C-B468-3C455F2221C1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B62FCE19-7D41-4E4C-9EA1-689E4C81E68C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B63B4404-DA6B-469C-BDC0-904CB50E8FFA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B64DA68E-B5F9-4090-873D-490AF0F872AA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B6713E9B-10F3-4976-995F-7B1D301FE500}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B6A22086-FC6D-4B9C-BDE1-1DF7FA67AA27}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B6C6A8CF-9556-46A4-8F82-399775246063}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B70079E2-F926-4D79-BD1B-9FB54B8BBFE9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B716AFC3-6CB0-4C2E-A108-A82D9831F5FA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B725C915-8EB1-452C-8299-07D558B5414C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B73C67E4-6D1B-4B52-AC34-668A90EAEBB7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B76711BF-8068-4EC6-9A75-53EF33C6188C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B79DB294-8112-4832-BA0D-CFEDFF2F165C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B8009250-2735-4661-8908-5F4CA71F97F1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B826AF8C-7747-4488-8769-04E76E46E360}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B84BC052-9C57-470B-B951-07181F2E0DA9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B86E1151-1550-4E84-8876-153C43AAA3B6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B886844A-1CD1-48E3-A5DA-42960AF84B79}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B8A0B035-8319-4EAC-8123-2F6DAAF03C3E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B8D7A8A8-5B7F-4BDF-9B12-017AE9CC46BD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B8E834E9-CCEA-4D17-BA7D-FF7E49F814C3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B9456372-291A-4A18-B953-2916C92F5A92}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA075D38-A650-43FC-98FC-BDE03923AF47}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA18A665-3C3E-4714-916B-0C9B47959B71}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA390013-3C36-40BE-B25F-CE3DDC06D451}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA6CF44A-8960-48A1-A98E-CCFF1FD01674}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA6EB822-B615-41CA-812C-2A60B85BA355}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA81288F-BE50-4F87-9A95-E69AC8E46631}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BA92C782-DB8F-4332-84F4-A820F5CFB86E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BAB56C4C-7128-4B6F-95DA-C6501C1C3167}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BACAD46E-21FB-460F-9A92-1785C89E3D5E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BAD8553E-1368-408C-ADF2-0D816FBCB347}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BB35B019-A47E-4192-A327-0FD16430BE2A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BB3A791D-1470-49B9-83B2-4D263620F8F9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BC4C4E8F-0825-4039-8026-66AD3EE3DCAC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BC8B1F91-34BA-4123-B86F-B393166DA18F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BCE07DCC-4BEA-4E33-8D54-7A0011B11E3C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BE49D1D2-1D6D-44C0-B6CA-910A515B2F2F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BE4DF035-BB0E-43DB-9231-28B5630EA325}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BEB8A5C2-4666-4408-936C-7C470BE35738}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BEE6EE40-B7B9-41B1-8277-24544257E1B3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BF3B2617-4E18-49B6-A950-AE4A97BBC87F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BF588483-802A-4254-A91F-82C6E4042BFA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BFBD8A09-AA01-4D3F-8F4E-7402C14F4C25}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C000E391-B34A-414E-B36E-79362931BC7B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C02EC3EC-7E44-43B2-B402-B42430707AE6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C089F680-F4CB-4262-AA06-3F4DE2286EC7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C0D468F2-D4A4-413B-A8AB-01A10A7A7462}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C0F6B9C7-9012-4D9D-8A78-14002598F94C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C277E7AD-E53A-4E55-9A8C-817B69044187}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C3111F22-CEAC-4715-BFD8-84A1DA1A3874}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C31EFD81-C770-4555-AD4B-4C81A814904E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C3248C26-A1D9-4751-8CE5-AD8D854059F3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C353E08C-066A-4530-8670-580E16F336A6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C3565FBB-64A7-4F61-B955-5D97252D87CA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C386BA63-1B9C-41D2-8083-3E81960F820F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C3D0B6DC-5526-4335-A4C7-7ABFE6B74676}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C3DB466D-3141-48DB-A061-EEC1CC2CF5BB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C400DB94-D68F-4076-8C78-6F503D4B815D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C433BC64-18CD-4845-ACBB-3750D9A8F255}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C57B8021-A0EE-4C2D-A9C3-91BCE4E3824B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C5A77366-926B-4711-A556-0988392399E6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C5F9EABD-911F-4D9D-AEE1-AD41982BE540}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C63FD81B-8148-4C89-B921-DCA767CA0A6A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C66E8DAF-73D6-4D6B-B7DD-8197C5A82FAD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C67D0C44-C793-4F2A-A5C2-D71A42479AFE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C6B88E54-C612-4E2F-83F3-364BB469DDDF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C6C274B3-F01F-483B-82C1-9A7ACAE7760C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C6E42BEF-7D60-48A8-BDBE-05A395596AFE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C6F8BBCC-865E-4BBD-984C-A41F9683915D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C723BE86-336A-4F3A-B194-7B1B10890E72}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C753AA72-A07C-4BE7-ACA2-F1847C5646AB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C7F27217-BE92-4AB5-86F9-A09ECD2A09A6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C821BA16-E2DD-4C4D-BC6F-2CF70F3FC323}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C8223CC4-9D41-4AB8-B784-AD1AB7E20EA5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C852997C-E2F2-4B3B-B078-4A5C7944DF19}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C8BB606C-266C-40A1-BCD0-94BD6464EC6B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C8CD2E4A-07EC-4ABB-8577-AC8B5B9F7769}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C9EA8A14-4E90-43A9-ABF2-E6F44A1B9EE3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CA0291D7-81B8-484A-9293-8AB41D60D123}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CA0A6EE6-888A-4671-923D-57348B10C170}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CA3B6D04-F2B9-4170-ACF8-0E3A1047437A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CAB425A2-6BA9-410D-9760-38331654AB78}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CB2087A4-44B4-45B9-B973-7AADE6F632A0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CB347614-D75F-44B4-A4D2-02584F6605D1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CB80D5F3-6882-4502-A96E-EB346F16F38F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CBCDB577-4CA5-4984-BD8C-A8A7F6541E90}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CC36D2B1-A2FF-458E-AF66-EA76542D1AC1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CC41CE1F-6A52-41E9-BE14-0B8D5852FF2C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CC79C17B-1A85-4BDE-AD1C-1C2B765E907E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CCF2DD83-8E9B-486A-98A1-8D6F20886796}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CD047F80-AB67-4275-8665-B1BCF32DDC99}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CD3272AF-5606-4A29-BA35-454205BC953C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CD4A37E0-5C51-47EE-8CF5-E2E397FEE4B3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CD60DD3A-1551-4632-945B-47E502991902}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CDD07B36-6BF9-4ADA-ABE7-13541197F6B9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CDE839CC-C8A3-4564-8DE4-4786C9A3DF3B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CE01B7C2-02C3-4D48-AA2A-D9CDDFC43D3F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CE480B5E-43A7-4FB2-9E9D-BFF6C3E89A0C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CE6BD891-9E2E-4178-93C7-FBAF5BB0E742}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CE989D94-D4E3-4837-81D8-00B404CB1D13}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CEC435A1-1C47-4DB8-8323-3CD1D29C55E2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CF2044D1-7097-4EC2-9598-861DB94F80DA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CFE9096F-C42D-44FB-8643-DD03F1C71BA2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D03D8FF8-BC57-4A35-A500-B8907E01C4F5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D05E69AA-C0EB-45A0-9EC7-46FBB2FE29C4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D0EA1A9B-0835-4300-8DDD-02ECD7F1B501}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D0EDCE12-05B5-419B-BBAB-F43106D53CDB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D1641D31-189B-4D62-83D0-E138ED3E3E0D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D1C173FE-2811-43BC-AE55-EAA3DAC2D246}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D1D1EBBC-7A4B-42D4-B76D-4703CD7B7887}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D235431A-7747-4CD5-B48B-091EDCD67082}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D23D8766-1906-4098-BEB4-94493DA8F557}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D25AF336-8BF9-4AE7-A8EA-847E648AD39D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D2C78246-C3C5-4E4B-9A94-26B77AF0D131}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D2F179B8-991A-409F-AEAD-003894337091}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D33E9121-67B5-49A6-9B23-21E1F1424FF4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D3630257-F744-4007-A150-C1C14AC2119D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D3B73B72-08D9-496A-AE5F-F01FE9144B7E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D46E48F4-2275-4185-8483-CA760E33639D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D4BF8211-7EBC-4AC7-BC0F-280164C99504}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D4F6D3C0-6565-4F5C-95DC-50C5DD24C9D7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D4F94377-F0EB-4547-91F4-3EB9FB99607A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D54476B7-4315-41B0-8A25-9F5CA59CF46A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D5D08618-3014-4388-9CD9-F5C76C128E54}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D5E7F566-EC94-4164-97C4-6EF2A326CB52}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D6237878-C6F0-43A6-BD5F-5983FB10A478}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D6C8088B-8CFA-40B0-B00C-9BE27BBA521B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D73DB70D-1F9B-441F-B6D7-CB7C4765B417}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D752E51F-5263-4785-AB50-279128F1DB3D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D7BCF339-ACAA-4E87-9FE4-7F31001958DC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D7E5ED9D-68AA-4B83-8078-71C52C6D2649}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D89EE4EB-27F1-4DA4-9894-B0DE1D3021ED}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D8B00B6D-DEE1-4FF8-94C8-488B53D7418C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D92A8E48-3F06-43C0-ABFF-77540A4BE706}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D97B4540-3435-471A-814F-9C42F29F9A55}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D99CA9C4-DEC7-41DD-B872-8E999FC17A3A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D9BC24AF-0C30-4A72-835F-EBDDFA16391D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DA22AAA1-C7D0-41B9-A11A-1054A5C1DED7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DA6C1A83-2C15-4C6D-8505-93F717E7A8F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DB0AB576-1DB5-4B99-BFEA-37066D075DCD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DB21D675-F58F-4D94-8A95-FABC77F378E4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DB4F483D-C307-496C-A493-06C7E8A572B6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DB868EBD-93ED-49DA-89D3-F19C430A957D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DBC25672-7360-4600-88AC-BCB815F3079D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DC1FF15E-7D3C-4CCB-A3EC-C71294F88685}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DCA5E751-E191-4984-9A31-77B086AF938E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DD3FE3E5-C979-4062-9E3D-79DA5F713E38}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DD655EAB-7D70-4210-8DE3-2A511072C931}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DD7BF76D-4A76-4BCA-BC60-879D4C076C80}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DD8E8CCB-837B-4443-87DD-CE7E579EA83C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DDA76DA4-4217-4833-B8B0-5E1FC39B6826}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DE110764-5313-4D9F-8AEA-486F9B79C735}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DE20D463-7583-4EE8-9D86-6DEDE245B377}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DE2815F9-5D3B-4D9D-8781-EC09A332271A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DE2A7AA0-EFD7-4E64-9995-A302338B9BDB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DE426AB6-6D7B-48B9-8EF5-CF7CE5CFFC10}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DEB5AA7F-DC6B-4BB4-AE4C-5EEB75EFA2CA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DEF01F15-8D2B-4C64-9D00-335336AE2C01}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DF262E18-6EA2-4265-A3A8-EA64B05A1DD1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DF51DCAC-AD2F-40A7-91CA-DB82EE562A90}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DFAD1709-5666-4157-826C-6DD2E75E725A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{DFDA7E79-2E3A-4FB6-BF4C-C1BED17E616D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E0897C35-E96B-4940-AC65-344C6F108C48}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E0A4A1E0-7100-4067-A489-F7809B348DA3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E0A5907C-2081-4414-95AE-AC5D4EF721FE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E0BE504D-7858-48D7-B5FE-6E4BF171899C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E1C8BFC9-304D-43DD-95F3-8FC9BBCB3A63}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E1E0364C-6CD3-4882-AFF2-79EFF438FE47}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E2196D7E-D553-4B38-87C9-9A72AA5BA855}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E2D46077-4BDF-4674-95D3-83BCE038471C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E2FC3AF8-3CDC-4049-B430-F1B82079EF12}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E38DEE72-6055-4481-AF6A-E585573252A0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E3E05773-5A09-44E7-A8B2-D2A999E3DEAB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E3E32359-9BB2-4770-9435-27D2D6BE7874}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E3FD5354-DD56-4519-9618-44E6AF70869C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E40C32BF-4B15-4EEB-81A9-3BD755E01A1F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E427A1C4-07ED-4A30-A775-1FF3ED146029}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E4608EE3-2CA6-4F5D-84AC-73404D1303CA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E472E5BB-0271-4EC7-8942-129D2720FB2D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E4FE5B64-ED89-4F2D-AFE2-A79AC9259A0B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E531AB7A-A319-4576-9088-4C24E54A8FB7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E549AA2C-713D-4884-ABAE-E696701AB3E3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E55273B0-05E3-49D5-B3BD-9ACD0EC82865}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E57F1388-F947-41EB-B268-1E0C35E0AC3F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E57F4CAA-C799-4FDF-BF8E-94419047BA0F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E5F43B11-7E5C-41CD-B3F2-526B62F8B8BC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E6C3C259-AA72-4C87-B1FE-77B010DCD377}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E737CAE6-3C6C-4D1B-9265-90B0E934B939}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E7624CDD-6BB7-4FB9-BC72-1ECCC367653A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E79DA738-A04F-44DC-9F40-DC100648D81C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E7AF7654-DF5C-43F3-8814-B845859B1A05}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E91B8DBC-3D44-44E4-92F6-BB7BF4495D3B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E92F2755-2DA6-45DA-B6FD-F0F557974F07}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E96AAC5D-B0FC-4274-9E2D-58A3987EA0CB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E997D1B8-0042-460D-AE20-A2EE3E08DAF3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E9E2728C-CB91-495B-9265-A70D57021FB2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E9EBF756-D8DC-4B81-BDD6-B1FE8810F225}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EA0D4069-7433-4BBF-A1C4-FF3C670DA37C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EA21C822-1EE1-4D4E-AED4-A5A072229EF4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EA3A98EE-E004-4763-AFA8-1D64D1C7594F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EABB5537-C23E-4573-9EED-64A0FD9AFDD7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EAD439AB-73E7-43BC-8238-4E7457B79EDD}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EB132E22-7989-425A-B296-0AEAD224427E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EB9A5D72-54C4-4E20-A1A5-8F897D0B1437}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EBC195BF-47DF-40A9-9AC3-CD9E8CF0D528}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EBE33A4C-D27B-4961-A43D-159764111AEB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EC40DFD5-7809-4298-A444-73E0C50CDFAE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EC8C58D8-E3C1-4B61-8EDC-0B4AD25E3460}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EDBEC6B1-C962-4778-8418-28EC7AB7FF29}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EDD4A8DB-2E56-4C8A-B17F-C0B29AE782B7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EDE93C07-427C-4AEF-84A2-2D999E391508}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EDF33778-E6A1-4058-8185-144389D40465}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EE4BF4B8-88DB-47B6-8C55-0F610242BC02}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EE6B0160-8063-4355-BA24-D3749B941F39}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EEDD1696-AC90-445D-8E2B-D972ADB5ED5B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EF0DBC2C-A94A-4F2C-A580-98294162ED2A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EF24428D-1B1F-4CB0-A4D5-1A56BFE4D8BE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EFCA4370-5FB6-4CB3-9CEB-B646897B39BE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F06005F9-A809-426D-B634-F591EA9E3972}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F0CB0295-181F-4708-8281-25620716C475}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F11A1D18-0EEF-4B18-A0B0-6BF85B9540F3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F14988C2-90FC-4CD0-A9FA-BEA0A888EB7A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F1B61988-3A6E-42A2-BA68-77FDD2B21426}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F233BAD6-8900-4216-8BCA-EA991E9A22D6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F266EACD-2EB1-4F10-8026-DD3B25F8411E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F2956671-6F19-4D5A-B425-BC559E956574}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F2BF531A-1296-4D4E-96D7-393E1B5CF4F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F2E55AD8-7ADE-4AAE-9130-CD7E57D57698}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F35768A7-A878-4E4B-B9C4-51C5793B7734}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F3907C66-1B5A-4192-8459-BDEBA86AD476}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F39354BB-E4EB-4336-9E86-46D020A6D079}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F3AFE7FB-836A-42B2-AEE5-100664714765}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F3CB240C-3C31-4873-8297-16A428775420}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F439DB29-26E5-464C-AFB6-F226B7F3B6A4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F43B2B44-8A09-410D-BF68-4E9F3D5878D3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F4D296D4-F929-4983-A5F5-B27697CB908C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F56609F4-3C5C-4B5F-9F77-E50970704A3E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F580189F-2BB9-4C01-A991-509696C1D5EE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F60E3C4F-C8E9-4808-A5C4-8E3CFF65FFC1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F6453AB7-1754-4B2D-8630-F9B4D3232898}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F64BB00C-C691-4122-930B-D79D9187A5F0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F66C736F-03F4-4B69-AAA2-2474145B7B2E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F68AF120-452F-43C0-94FE-9055AE0F3979}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F69DE800-AC05-45B5-8E54-1BD56F5CB17E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F6C2BAB7-87A6-4C2B-819C-2A48EAA1EEA8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F6E4CD53-6C09-4D96-A5AD-237C0DDDF492}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F705BDF4-82F2-46E1-9B88-1ECBDB9DDE7B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F72AAF06-6CB3-4F89-B3B2-27EF1EE519E0}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F731329B-4E8D-4911-85E1-14A8FA807760}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F7530C41-05F4-49C3-8F71-FCBCB65F8D62}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F7C4ECE4-63DD-46E6-BC72-50071547F745}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F7ECCB7A-DF60-4D7D-8699-13B04E14C3BA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F802EA39-C5E1-4ADD-95FE-3507B77EAE19}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F809A9D4-2785-4DBF-8456-C8D7D6CA015C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F812AF13-0A3F-4A08-8888-574BA48BB3BA}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F8EA1C00-C58C-4172-AC4D-1A768621DFB9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F95E040F-203A-4085-BB54-45C9085B79A8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F998F5E8-DD64-40C7-BDA7-C2EAA5900B33}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{F9C01D7D-73E8-4F8D-BCB1-CA75EB70DD06}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FA0BE575-2263-4D0E-B94E-55D44022C92C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FA0FF8E0-0793-4470-8662-93EF67B7D7F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FA1FD456-DF8E-4B49-B0AA-DC096BCBBA80}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FA2B0C92-BB80-4A7F-8788-FA1DF70F3E91}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FA38785C-2290-48FA-8E2B-C195806B6207}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FBE21470-3BA9-4D4B-9362-7001F40A9AA4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FC4D4708-6197-4467-93E8-92E5342E13DF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FC8AC0B9-59B0-4396-91AC-781F282D1152}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FC986178-78E1-4982-9708-C703563067FE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FCCECCB9-E340-4AAA-9B75-AC84D45C4ED5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FCD694ED-7631-4749-BC6F-E35F4367B00B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FDBB0DB2-F32B-4699-BAE7-89544C78D3D6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FDE4DB4B-EEF4-47FD-A432-03035903E66D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FDF69BC3-2DEF-4F9D-A5E9-1B46E265FB78}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FE09541E-4860-4BAE-96D0-EFA078C4F3A4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FE46A1CE-AE04-408E-ACB9-25B9B846DAFF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FEADC3F7-755C-4077-B560-90574B93B390}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FEEF253B-A7C4-4327-B120-C4B9A28C8A59}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FF8AAA96-5A4F-4BF5-B5D5-5CDF9842EE5D}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FFCDDCA7-0DB6-4F00-9259-64C899D57744}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FFF72D58-FAC6-4E9E-B7C2-B296B07E1A19}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11/04/2013 at 18:37:29.11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


----------



## eddie5659 (Mar 19, 2001)

Your Java is out of date, so lets do that first:

*Upgrade Java* : (32 bits)

Download the latest version of *Java SE Runtime Environment (JRE) JRE 7 Update 17 *.
Under the JAVA Platform Standard Edition, click the "*Download JRE*" button to the right.
*Accept License Agreement.*".
Click on the link to download Windows Offline Installation 32 bit ( jre-7u17-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to *Start* > *Control Panel*, double-click on *Add/Remove *programs and remove all older versions of Java.
Check any item with Java Runtime Environment *(JRE or J2SE)* in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.(Vista or Win 7 users, right click on the * jre-7u9-windows-i586.exe* and select "Run as an Administrator.")
Don't install any of the toolbars that are offered.

After doing the above, for the remains of the Java, can you do this:

Open Java in the Control Panel and under the General tab, under Temporary Internet Files, click the Settings button. Then click on Delete Files.

Make sure both of these options are checked:


Applications and Applets
Trace and Log Files
OK out of all the screens. 

----------


Close all open programs and internet browsers.
Double click on *adwcleaner.exe* to run the tool.
Click on *Delete*.
Confirm each time with *Ok*.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[S1].txt* as well.

---------

Please download *aswMBR* ( 4.5MB ) to your desktop.

Double click the *aswMBR.exe* icon, and click *Run*.
When asked if you'd like to "download the latest Avast! virus definitions", click *Yes*.
Click the *Scan* button to start the scan.
On completion of the scan, click the *save log* button, save it to your *desktop*, then copy and paste it in your next reply.

-------------------------

*Delete any copies of Combofix that you have.*

Download ComboFix from one of these locations:

*Link 1*
*Link 2*

** IMPORTANT !!! As you download it rename it to username123.exe and save it to your Desktop *


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

Click on *this link* to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
*Remember to re-enable the protection again afterwards before connecting to the Internet.*

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.








Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:










Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the *C:\ComboFix.txt* in your next reply.

eddie


----------



## maggie88ca (Nov 19, 2006)

I'm running a 64 bit operating system, is the link you sent me for java update 32 bit? Or does it not matter?


----------



## maggie88ca (Nov 19, 2006)

# AdwCleaner v2.200 - Logfile created 04/14/2013 at 17:07:36
# Updated 02/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ken - KEN-PC
# Boot Mode : Normal
# Running from : C:\Users\Ken\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1084 octets] - [11/04/2013 18:35:01]
AdwCleaner[S1].txt - [1028 octets] - [14/04/2013 17:07:36]

########## EOF - C:\AdwCleaner[S1].txt - [1088 octets] ##########


----------



## maggie88ca (Nov 19, 2006)

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-14 17:14:13
-----------------------------
17:14:13.822 OS Version: Windows x64 6.1.7601 Service Pack 1
17:14:13.822 Number of processors: 4 586 0x2A07
17:14:13.822 ComputerName: KEN-PC UserName: Ken
17:14:22.137 Initialize success
17:19:53.094 AVAST engine defs: 13041400
17:24:46.674 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-8
17:24:46.674 Disk 0 Vendor: WDC_WD15EARX-22PASB0 51.0AB51 Size: 1430799MB BusType: 11
17:24:47.002 Disk 0 MBR read successfully
17:24:47.002 Disk 0 MBR scan
17:24:47.002 Disk 0 unknown MBR code
17:24:47.017 Disk 0 Partition 1 00 1B Hidd FAT32 NTFS 14524 MB offset 2048
17:24:47.064 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 572318 MB offset 29747200
17:24:47.251 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 843955 MB offset 1201854464
17:24:47.345 Disk 0 scanning C:\Windows\system32\drivers
17:25:23.178 Service scanning
17:26:21.960 Modules scanning
17:26:21.960 Disk 0 trace - called modules:
17:26:21.960 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll asahci64.sys 
17:26:21.976 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d6e060]
17:26:22.288 3 CLASSPNP.SYS[fffff88001b4343f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-8[0xfffffa80047ad060]
17:26:29.386 AVAST engine scan C:\Windows
17:26:50.508 AVAST engine scan C:\Windows\system32
17:29:30.820 AVAST engine scan C:\Windows\system32\drivers
17:29:45.016 AVAST engine scan C:\Users\Ken
17:41:09.604 AVAST engine scan C:\ProgramData
17:41:56.014 Scan finished successfully
18:23:34.198 Disk 0 MBR has been saved successfully to "C:\Users\Ken\Desktop\MBR.dat"
18:23:34.198 The log file has been saved successfully to "C:\Users\Ken\Desktop\aswMBR.txt"


----------



## maggie88ca (Nov 19, 2006)

ComboFix 13-04-14.01 - Ken 14/04/2013 18:40:18.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.4008.2042 [GMT -4:00]
Running from: c:\users\Ken\Desktop\username123.exe
AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\muzapp.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-03-14 to 2013-04-14 )))))))))))))))))))))))))))))))
.
.
2013-04-14 22:53 . 2013-04-14 22:53	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-04-14 22:28 . 2013-04-14 22:28	16712	----a-w-	c:\windows\system32\drivers\PROCEXP113.SYS
2013-04-14 21:23 . 2013-04-14 21:23	--------	d-----w-	c:\program files (x86)\Microsoft SkyDrive
2013-04-14 21:23 . 2013-04-14 21:23	--------	d-----r-	c:\users\Ken\SkyDrive
2013-04-14 21:23 . 2013-04-14 21:19	5659096	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b3a3641a1ce395502\skydrivesetup.exe
2013-04-14 21:22 . 2013-04-14 21:22	--------	d-----w-	c:\programdata\Microsoft SkyDrive
2013-04-14 21:19 . 2013-04-14 21:19	525656	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b9face951ce395504\DXSETUP.exe
2013-04-14 21:19 . 2013-04-14 21:19	94040	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b9face951ce395504\DSETUP.dll
2013-04-14 21:19 . 2013-04-14 21:19	1691480	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b9face951ce395504\dsetup32.dll
2013-04-14 21:19 . 2013-04-14 21:19	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b7272c421ce395503\DSETUP.dll
2013-04-14 21:19 . 2013-04-14 21:19	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b7272c421ce395503\DXSETUP.exe
2013-04-14 21:19 . 2013-04-14 21:19	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b7272c421ce395503\dsetup32.dll
2013-04-14 21:19 . 2013-04-14 21:19	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b184aa5c1ce395501\DSETUP.dll
2013-04-14 21:19 . 2013-04-14 21:19	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b184aa5c1ce395501\DXSETUP.exe
2013-04-14 21:19 . 2013-04-14 21:19	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b184aa5c1ce395501\dsetup32.dll
2013-04-11 22:25 . 2013-04-11 22:25	--------	d-----w-	c:\windows\ERUNT
2013-04-11 22:25 . 2013-04-11 22:25	--------	d-----w-	C:\JRT
2013-04-11 20:46 . 2013-04-11 20:46	--------	d-----w-	c:\program files\SUPERAntiSpyware
2013-04-11 20:37 . 2013-04-11 20:37	--------	d-----w-	c:\users\Ken\AppData\Roaming\SUPERAntiSpyware.com
2013-04-11 20:36 . 2013-04-11 20:36	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2013-04-11 20:33 . 2013-04-11 20:33	--------	d-----w-	c:\users\Ken\AppData\Roaming\Malwarebytes
2013-04-11 20:33 . 2013-04-11 20:33	--------	d-----w-	c:\programdata\Malwarebytes
2013-04-11 20:33 . 2013-04-11 20:33	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-11 20:33 . 2013-04-04 18:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-04-10 20:26 . 2013-02-19 11:42	2706432	----a-w-	c:\windows\system32\mshtml.tlb
2013-04-10 20:24 . 2012-05-04 11:00	366592	----a-w-	c:\windows\system32\qdvd.dll
2013-04-10 20:24 . 2012-05-04 09:59	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2013-04-10 20:24 . 2012-08-24 18:05	340992	----a-w-	c:\windows\system32\schannel.dll
2013-04-10 20:24 . 2012-08-24 18:13	154480	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2013-04-10 20:24 . 2012-08-24 18:09	458712	----a-w-	c:\windows\system32\drivers\cng.sys
2013-04-10 20:24 . 2012-08-24 18:03	1448448	----a-w-	c:\windows\system32\lsasrv.dll
2013-04-10 20:24 . 2012-08-24 16:57	247808	----a-w-	c:\windows\SysWow64\schannel.dll
2013-04-10 20:24 . 2012-08-24 16:57	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2013-04-10 20:24 . 2012-08-24 16:53	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2013-04-10 09:24 . 2013-03-01 03:36	3153408	----a-w-	c:\windows\system32\win32k.sys
2013-04-10 09:24 . 2013-03-02 06:04	1655656	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-10 09:24 . 2013-01-24 06:01	223752	----a-w-	c:\windows\system32\drivers\fvevol.sys
2013-04-10 09:24 . 2013-03-19 06:04	5550424	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-04-10 09:24 . 2013-03-19 05:04	3968856	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 09:24 . 2013-03-19 05:04	3913560	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 09:24 . 2013-03-19 05:46	43520	----a-w-	c:\windows\system32\csrsrv.dll
2013-04-10 09:24 . 2013-03-19 04:47	6656	----a-w-	c:\windows\SysWow64\apisetschema.dll
2013-04-10 09:24 . 2013-03-19 03:06	112640	----a-w-	c:\windows\system32\smss.exe
2013-04-09 21:03 . 2013-04-09 21:03	310688	----a-w-	c:\windows\system32\javaws.exe
2013-04-09 21:03 . 2013-04-09 21:03	108448	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2013-04-09 21:03 . 2013-04-09 21:03	188832	----a-w-	c:\windows\system32\javaw.exe
2013-04-09 21:03 . 2013-04-09 21:03	188320	----a-w-	c:\windows\system32\java.exe
2013-04-09 01:05 . 2013-04-09 01:05	--------	d-----w-	c:\programdata\ClubSanDisk
2013-04-08 23:33 . 2013-04-08 23:33	--------	d-----w-	c:\windows\system32\drivers\N360x64\1403010.016
2013-03-17 20:49 . 2013-03-17 20:49	737072	----a-w-	c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2013-03-17 20:49 . 2013-03-17 20:49	48648	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-03-17 20:49 . 2013-03-17 20:49	573776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-10 20:30 . 2012-01-23 15:37	72702784	----a-w-	c:\windows\system32\MRT.exe
2013-04-09 21:03 . 2012-04-21 10:16	963488	----a-w-	c:\windows\system32\deployJava1.dll
2013-04-09 21:03 . 2012-04-21 10:16	1085344	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-04-02 08:09 . 2012-04-06 15:19	693976	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-02 08:09 . 2012-01-31 17:15	73432	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-04 18:24 . 2008-07-17 08:43	23552	----a-w-	c:\windows\xlkfs.dll
2013-02-25 14:12 . 2013-02-25 14:12	334000	----a-w-	c:\windows\system32\RaCoInstx.dll
2013-02-25 14:12 . 2013-02-25 14:12	2426672	----a-w-	c:\windows\system32\drivers\netr28x.sys
2013-02-12 05:45 . 2013-03-13 05:01	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 05:01	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 05:01	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 05:01	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 05:01	474112	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 05:01	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-13 09:21	19968	----a-w-	c:\windows\system32\drivers\usb8023x.sys
2013-02-12 04:12 . 2013-03-13 09:21	19968	----a-w-	c:\windows\system32\drivers\usb8023.sys
2013-01-31 03:18 . 2013-02-27 01:21	432800	----a-w-	c:\windows\system32\drivers\N360x64\1403000.024\symnets.sys
2013-01-31 03:18 . 2013-02-27 01:21	1139800	----a-w-	c:\windows\system32\drivers\N360x64\1403000.024\symefa64.sys
2013-01-29 01:45 . 2013-02-27 01:21	796248	----a-w-	c:\windows\system32\drivers\N360x64\1403000.024\srtsp64.sys
2013-01-29 01:45 . 2013-02-27 01:21	36952	----a-w-	c:\windows\system32\drivers\N360x64\1403000.024\srtspx64.sys
2013-01-22 02:15 . 2013-02-27 01:21	493656	----a-w-	c:\windows\system32\drivers\N360x64\1403000.024\symds64.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-14 21:23	220632	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-14 21:23	220632	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-14 21:23	220632	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 5629312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2013-03-27 3363752]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-20 102368]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-01-14 29472]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 203104]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-23 1255736]
S0 asahci64;asahci64;c:\windows\system32\drivers\asahci64.sys [2011-01-30 36448]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1403000.024\SYMDS64.SYS [2013-01-22 493656]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1403000.024\SYMEFA64.SYS [2013-01-31 1139800]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2013-03-27 26176]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2012-06-18 44688]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2013-03-27 17384]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130322.001\BHDrvx64.sys [2013-03-22 1387608]
S1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\1403000.024\ccSetx64.sys [2012-11-16 168096]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130412.001\IDSvia64.sys [2012-12-28 513184]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1403000.024\Ironx64.SYS [2012-11-16 224416]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1403000.024\SYMNETS.SYS [2013-01-31 432800]
S1 xlkfs;xlkfs;c:\windows\system32\DRIVERS\xlkfs.sys [2012-05-05 30456]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]
S2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2013-03-27 3089856]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [2010-12-02 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 Device Handle Service;Device Handle Service;c:\windows\SysWOW64\AsHookDevice.exe [2009-12-23 203392]
S2 LxrSII1d;Secure II Driver;c:\windows\System32\Drivers\LxrSII1d.sys [2009-12-30 63064]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe [2012-12-24 144520]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2012-07-13 769432]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-01-14 32544]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2012-06-18 66320]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-02-24 126952]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-02-24 389608]
S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-12-30 138912]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-08-31 317440]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2013-02-25 2426672]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-14 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 45e9ad03-d86b-468e-9887-33a0ecb6d3cc.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2013-04-14 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 55fef781-c6af-4df9-859a-602f289731d9.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-14 21:23	244696	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-14 21:23	244696	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-14 21:23	244696	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\20.3.0.36\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-04-14 19:09:09
ComboFix-quarantined-files.txt 2013-04-14 23:09
.
Pre-Run: 468,640,489,472 bytes free
Post-Run: 468,189,118,464 bytes free
.
- - End Of File - - 2C9C87BADBF5DE055598D4F06D441BE0


----------



## maggie88ca (Nov 19, 2006)

There are the most recent logs you asked for I still haven't updated Java yet till you advise re 32 or 64 bit version?

Thanks again for all your help.


----------



## eddie5659 (Mar 19, 2001)

> I'm running a 64 bit operating system, is the link you sent me for java update 32 bit? Or does it not matter?


Its fine to use the 32-bit, in fact, Oracle actually recommend the 32-bit for 64-bit systems:

http://www.java.com/en/download/faq/java_win64bit.xml

----

Thanks for the logs, now we'll run the following and then see what needs to be done 

Download *RogueKiller* to your desktop


Quit all running programs 
For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe 
Wait until the Pre-scan has finished.
Click on Scan
If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe 
Click on Report and copy/paste the contents here.

---

Download *OTL* to your Desktop


Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Under the *Standard Registry* box change it to *All*

Please copy the text in the code box below and paste it in the *Custom Scans/Fixes* box in OTL:


```
netsvcs
activex
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%windir%\Installer\*.*
%windir%\system32\tasks\*.*
%windir%\system32\tasks\*.* /64
%systemroot%\Fonts\*.exe
%systemroot%\*. /mp /s
/md5start
consrv.dll
explorer.exe
winlogon.exe
regedit.exe
Userinit.exe
svchost.exe
services.exe
user32.dll
ATAPI.SYS
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\* \s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
CREATERESTOREPOINT
```

Click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.

*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.

Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time and post them in your topic


eddie


----------



## maggie88ca (Nov 19, 2006)

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Ken [Admin rights]
Mode : Scan -- Date : 04/15/2013 15:40:31
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD15EARX-22PASB0 ATA Device +++++
--- User ---
[MBR] 304d1614120c9b094a95217c6998487a
[BSP] b7f1af624ca415852c3eb9ae77b37bea : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0x1b) [HIDDEN!] Offset (sectors): 2048 | Size: 14524 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 29747200 | Size: 572318 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1201854464 | Size: 843955 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_04152013_02d1540.txt >>
RKreport[1]_S_04152013_02d1540.txt


----------



## maggie88ca (Nov 19, 2006)

OTL logfile created on: 15/04/2013 3:46:46 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ken\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.91 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 50.08% Memory free
7.83 Gb Paging File | 5.54 Gb Available in Paging File | 70.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 558.90 Gb Total Space | 435.49 Gb Free Space | 77.92% Space Free | Partition Type: NTFS
Drive D: | 824.17 Gb Total Space | 483.71 Gb Free Space | 58.69% Space Free | Partition Type: NTFS

Computer Name: KEN-PC | User Name: Ken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/04/15 15:42:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
PRC - [2013/03/27 14:00:20 | 003,363,752 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
PRC - [2013/03/27 14:00:20 | 003,089,856 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
PRC - [2012/12/23 23:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccsvchst.exe
PRC - [2012/12/18 15:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/13 17:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/02/01 17:20:48 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011/02/01 17:20:46 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011/01/11 20:21:14 | 001,214,080 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
PRC - [2010/12/20 15:18:48 | 001,425,536 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
PRC - [2010/12/01 22:15:14 | 000,915,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
PRC - [2010/11/27 01:50:04 | 002,931,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
PRC - [2010/11/03 05:30:14 | 000,918,144 | ---- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010/10/21 05:52:26 | 000,586,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2010/09/25 01:29:32 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
PRC - [2009/12/30 14:21:02 | 000,065,536 | ---- | M] (Lexar Media, Inc.) -- C:\Windows\SysWOW64\LxrSII1s.exe
PRC - [2009/12/23 17:59:22 | 000,203,392 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Windows\SysWOW64\AsHookDevice.exe

========== Modules (No Company Name) ==========

MOD - [2012/05/30 02:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\wincfi39.dll
MOD - [2011/03/11 23:53:12 | 001,257,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll
MOD - [2011/02/17 15:10:20 | 001,035,776 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll
MOD - [2011/01/20 16:09:34 | 000,964,096 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
MOD - [2011/01/13 20:47:34 | 000,881,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
MOD - [2011/01/12 14:53:30 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
MOD - [2011/01/07 20:39:36 | 001,246,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
MOD - [2011/01/06 14:38:48 | 001,027,072 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll
MOD - [2010/09/28 00:51:16 | 001,607,168 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
MOD - [2010/08/22 22:17:40 | 000,662,016 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMLib.dll
MOD - [2010/08/06 22:13:48 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
MOD - [2010/08/06 22:11:20 | 000,850,944 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
MOD - [2010/06/21 19:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
MOD - [2010/06/21 19:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
MOD - [2009/08/13 00:15:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2012/07/11 14:54:58 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV:*64bit:* - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/27 14:00:20 | 003,089,856 | ---- | M] (Emsisoft GmbH) [Auto | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)
SRV - [2012/12/23 23:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe -- (N360)
SRV - [2012/12/18 15:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/12/14 02:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012/07/13 17:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/02/01 17:20:48 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/01 17:20:46 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/12/01 22:15:14 | 000,915,584 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010/11/03 05:30:14 | 000,918,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010/10/21 05:52:26 | 000,586,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/12/30 14:21:02 | 000,065,536 | ---- | M] (Lexar Media, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\LxrSII1s.exe -- (LxrSII1s)
SRV - [2009/12/23 17:59:22 | 000,203,392 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysWOW64\AsHookDevice.exe -- (Device Handle Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/02/25 10:12:04 | 002,426,672 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:*64bit:* - [2013/02/12 00:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:*64bit:* - [2013/01/30 23:18:18 | 000,432,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\symnets.sys -- (SymNetS)
DRV:*64bit:* - [2013/01/30 23:18:06 | 001,139,800 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\symefa64.sys -- (SymEFA)
DRV:*64bit:* - [2013/01/28 21:45:19 | 000,796,248 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\srtsp64.sys -- (SRTSP)
DRV:*64bit:* - [2013/01/28 21:45:19 | 000,036,952 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\srtspx64.sys -- (SRTSPX)
DRV:*64bit:* - [2013/01/21 22:15:33 | 000,493,656 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\symds64.sys -- (SymDS)
DRV:*64bit:* - [2012/12/30 15:27:15 | 000,177,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:*64bit:* - [2012/12/14 02:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2012/11/15 22:22:01 | 000,224,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\ironx64.sys -- (SymIRON)
DRV:*64bit:* - [2012/11/15 22:18:04 | 000,168,096 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403000.024\ccsetx64.sys -- (ccSet_N360)
DRV:*64bit:* - [2012/09/20 00:35:36 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:*64bit:* - [2012/09/20 00:35:36 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:*64bit:* - [2012/08/23 10:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:*64bit:* - [2012/08/23 10:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:*64bit:* - [2012/08/23 10:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2012/05/04 23:47:24 | 000,030,456 | ---- | M] (XOSLAB.COM) [File_System | System | Running] -- C:\Windows\SysNative\drivers\xlkfs.sys -- (xlkfs)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2012/02/15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/08/01 16:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:*64bit:* - [2011/08/01 16:59:06 | 000,023,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:*64bit:* - [2011/07/25 18:44:46 | 000,074,752 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:*64bit:* - [2011/07/22 12:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:*64bit:* - [2011/07/20 15:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:*64bit:* - [2011/07/12 17:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:*64bit:* - [2011/06/10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2011/05/18 09:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:*64bit:* - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2011/02/24 11:30:50 | 000,389,608 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:*64bit:* - [2011/02/24 11:30:50 | 000,126,952 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:*64bit:* - [2011/01/30 17:58:40 | 000,036,448 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asahci64.sys -- (asahci64)
DRV:*64bit:* - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/10/19 20:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:*64bit:* - [2010/08/31 09:07:05 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:*64bit:* - [2010/01/14 08:27:46 | 000,032,544 | ---- | M] (Realtek ) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\RtNdPt60.sys -- (RtNdPt60)
DRV:*64bit:* - [2010/01/14 08:27:30 | 000,048,416 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (TEAM)
DRV:*64bit:* - [2010/01/14 08:27:30 | 000,048,416 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (RTTEAMPT)
DRV:*64bit:* - [2010/01/14 08:27:18 | 000,029,472 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (RTVLANPT)
DRV:*64bit:* - [2009/12/30 11:32:04 | 000,063,064 | ---- | M] (Lexar Media, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\LxrSII1d.sys -- (LxrSII1d)
DRV:*64bit:* - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:*64bit:* - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2013/03/27 14:00:23 | 000,026,176 | ---- | M] (Emsisoft GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys -- (A2DDA)
DRV - [2013/03/27 14:00:23 | 000,017,384 | ---- | M] (Emsisoft GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys -- (a2util)
DRV - [2013/03/21 21:52:21 | 001,387,608 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130322.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2013/01/16 02:33:08 | 002,087,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130415.003\ex64.sys -- (NAVEX15)
DRV - [2013/01/16 02:33:08 | 000,126,192 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130415.003\eng64.sys -- (NAVENG)
DRV - [2012/12/30 15:33:43 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012/12/30 15:33:43 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/12/28 17:39:26 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130412.001\IDSviA64.sys -- (IDSVia64)
DRV - [2012/06/18 11:37:53 | 000,066,320 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys -- (a2acc)
DRV - [2012/06/18 11:37:51 | 000,044,688 | ---- | M] (Emsisoft GmbH) [File_System | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys -- (a2injectiondriver)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008/01/04 17:34:48 | 000,011,832 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\AsInsHelp64.sys -- (ASInsHelp)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE:*64bit:* - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP08&src=IE-SearchBox

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:*64bit:* - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:*64bit:* - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:*64bit:* - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:*64bit:* - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn\ [2012/12/30 15:27:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn\ [2013/04/15 09:03:33 | 000,000,000 | ---D | M]

[2012/05/26 18:56:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions
[2012/05/26 18:56:01 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}

O1 HOSTS File: ([2013/04/14 18:54:05 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:*64bit:* - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:*64bit:* - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:*64bit:* - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:*64bit:* - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:*64bit:* - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files (x86)\emsisoft anti-malware\a2guard.exe (Emsisoft GmbH)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-2938170701-155988706-608106729-1000..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2938170701-155988706-608106729-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:*64bit:* - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.17.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{62D71BE2-9D6B-4ED6-B6F2-EEADD29E9560}: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C2054CE-5C51-4ABE-BAAB-9440D076B6ED}: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O18:*64bit:* - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\livecall - No CLSID value found
O18:*64bit:* - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\msnim - No CLSID value found
O18:*64bit:* - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Handler\wlmailhtml - No CLSID value found
O18:*64bit:* - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:*64bit:* - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:*64bit:* - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:*64bit:* - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30:*64bit:* - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corp.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

ActiveX:*64bit:* {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:*64bit:* {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:*64bit:* {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:*64bit:* {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:*64bit:* {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:*64bit:* {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:*64bit:* {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:*64bit:* {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:*64bit:* {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:*64bit:* {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:*64bit:* {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:*64bit:* {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:*64bit:* {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:*64bit:* {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -UserConfig
ActiveX:*64bit:* {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:*64bit:* {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:*64bit:* {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:*64bit:* {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:*64bit:* {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:*64bit:* {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:*64bit:* {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:*64bit:* >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - 
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AsusVibeLauncher.lnk - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe - ()
MsConfig:64bit - StartUpReg: *Adobe ARM* - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: *Adobe Reader Speed Launcher* - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: *APSDaemon* - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: *iTunesHelper* - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: *KiesAirMessage* - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe (Samsung Electronics)
MsConfig:64bit - StartUpReg: *KiesPreload* - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
MsConfig:64bit - StartUpReg: *KiesTrayAgent* - hkey= - key= - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
MsConfig:64bit - StartUpReg: *RIMBBLaunchAgent.exe* - hkey= - key= - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
MsConfig:64bit - StartUpReg: *RunAIShell* - hkey= - key= - C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe (ASUSTeK Computer Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/04/15 15:42:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
[2013/04/15 15:39:13 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\RK_Quarantine
[2013/04/15 15:36:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/04/15 15:35:52 | 000,262,560 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/04/15 15:35:41 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/04/15 15:35:41 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/04/15 15:35:41 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/15 15:29:19 | 031,521,184 | ---- | C] (Oracle Corporation) -- C:\Users\Ken\Desktop\jre-7u17-windows-i586.exe
[2013/04/15 14:51:01 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{EAF83D9E-D714-4081-AEB4-F0CE1A7D67A7}
[2013/04/14 19:25:22 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/04/14 18:38:29 | 000,000,000 | ---D | C] -- C:\username123
[2013/04/14 18:34:08 | 005,052,676 | R--- | C] (Swearware) -- C:\Users\Ken\Desktop\username123.exe
[2013/04/14 18:30:06 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/04/14 18:30:05 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/04/14 18:30:05 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/04/14 18:28:22 | 000,016,712 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Windows\SysNative\drivers\PROCEXP113.SYS
[2013/04/14 18:28:07 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/04/14 18:27:22 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/04/14 17:23:14 | 000,000,000 | R--D | C] -- C:\Users\Ken\SkyDrive
[2013/04/14 17:23:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SkyDrive
[2013/04/14 17:22:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2013/04/14 09:01:50 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{BC9194F0-511C-455E-81FB-A08157093F1C}
[2013/04/13 22:06:59 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{FF39293F-0748-42B6-944B-8D1293342A1A}
[2013/04/13 08:24:36 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{A516502F-480D-4DB6-B15D-1B339610DF21}
[2013/04/12 16:47:28 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{8EBDABE1-FAF3-452A-814F-5F1DAA53BA06}
[2013/04/12 03:17:39 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{2C58C7C9-D5BB-422D-9886-D8E1B182F9AF}
[2013/04/11 18:25:42 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/04/11 18:25:13 | 000,000,000 | ---D | C] -- C:\JRT
[2013/04/11 18:24:29 | 000,551,587 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Ken\Desktop\JRT.exe
[2013/04/11 16:46:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013/04/11 16:46:03 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/04/11 16:37:32 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Roaming\SUPERAntiSpyware.com
[2013/04/11 16:36:24 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2013/04/11 16:33:36 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Roaming\Malwarebytes
[2013/04/11 16:33:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/11 16:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/04/11 16:33:12 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/04/11 16:33:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/04/10 16:27:55 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2013/04/10 16:27:55 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbGD.sys
[2013/04/10 16:27:55 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2013/04/10 16:27:55 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2013/04/10 16:27:55 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2013/04/10 16:27:55 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2013/04/10 16:27:49 | 001,123,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe
[2013/04/10 16:27:49 | 001,048,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe
[2013/04/10 16:27:49 | 000,384,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprt.exe
[2013/04/10 16:27:49 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll
[2013/04/10 16:27:49 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll
[2013/04/10 16:27:49 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpudd.dll
[2013/04/10 16:27:49 | 000,228,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpendp_winip.dll
[2013/04/10 16:27:49 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpendp_winip.dll
[2013/04/10 16:27:49 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe
[2013/04/10 16:27:49 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsRdpWebAccess.dll
[2013/04/10 16:27:49 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsRdpWebAccess.dll
[2013/04/10 16:27:49 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2013/04/10 16:27:49 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2013/04/10 16:27:49 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2013/04/10 16:27:49 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprtPS.dll
[2013/04/10 16:27:49 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wksprtPS.dll
[2013/04/10 16:27:48 | 005,773,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2013/04/10 16:27:48 | 004,916,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2013/04/10 16:27:48 | 003,174,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2013/04/10 16:26:53 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/04/10 16:26:53 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/04/10 16:26:53 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/04/10 16:26:52 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/04/10 16:26:52 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/04/10 16:26:52 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/04/10 16:26:51 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/04/10 16:26:51 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/04/10 16:26:51 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/04/10 16:26:51 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/04/10 16:26:51 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/04/10 16:26:51 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/04/10 16:26:49 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/04/10 16:26:49 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/04/10 16:26:48 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/04/10 16:24:11 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2013/04/10 16:24:11 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2013/04/10 16:24:03 | 001,448,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2013/04/10 05:24:34 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013/04/10 05:24:33 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013/04/10 05:24:33 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013/04/10 05:24:32 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2013/04/10 05:24:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2013/04/10 05:24:32 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2013/04/09 17:03:22 | 000,310,688 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2013/04/09 17:03:16 | 000,188,832 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2013/04/09 17:03:16 | 000,188,320 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2013/04/09 17:03:16 | 000,108,448 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/04/08 21:05:45 | 000,000,000 | ---D | C] -- C:\ProgramData\ClubSanDisk
[2013/04/07 17:34:47 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Ken\Desktop\HijackThis.exe
[2013/04/07 12:48:33 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\Video
[2013/04/07 12:47:17 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\Music
[2013/04/07 12:47:02 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\LOST.DIR
[2013/04/07 12:46:55 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\DCIM
[2013/04/02 03:02:11 | 001,054,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013/04/02 03:02:11 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013/04/02 03:02:11 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013/04/02 03:02:10 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013/04/02 03:02:10 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013/04/02 03:02:10 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013/04/02 03:02:10 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013/04/02 03:02:10 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013/04/02 03:02:10 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013/04/02 03:02:10 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013/04/02 03:02:09 | 000,137,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013/04/02 03:02:09 | 000,125,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013/04/02 03:02:09 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013/04/02 03:02:09 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013/04/02 03:02:09 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013/04/02 03:02:09 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013/04/02 03:02:09 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013/04/02 03:02:08 | 001,441,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013/04/02 03:02:08 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013/04/02 03:02:08 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013/04/02 03:02:08 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013/04/02 03:02:08 | 000,629,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013/04/02 03:02:08 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013/04/02 03:02:08 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013/04/02 03:02:08 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013/04/02 03:02:08 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013/04/02 03:02:08 | 000,232,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013/04/02 03:02:08 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013/04/02 03:02:08 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013/04/02 03:02:08 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013/04/02 03:02:08 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013/04/02 03:02:08 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013/04/02 03:02:08 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013/04/02 03:02:07 | 001,509,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013/04/02 03:02:07 | 000,905,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013/04/02 03:02:07 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013/04/02 03:02:07 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013/04/02 03:02:07 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013/04/02 03:02:07 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013/04/02 03:02:07 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013/04/02 03:02:07 | 000,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013/04/02 03:02:07 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013/04/02 03:02:07 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013/04/02 03:02:07 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013/04/02 03:02:07 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013/04/02 03:02:07 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013/04/02 03:02:07 | 000,027,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013/04/02 03:02:07 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013/04/02 03:02:07 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013/04/02 03:02:06 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013/04/02 03:02:06 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013/04/02 03:02:06 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013/04/02 03:02:06 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

========== Files - Modified Within 30 Days ==========

[2013/04/15 15:42:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
[2013/04/15 15:38:30 | 000,816,128 | ---- | M] () -- C:\Users\Ken\Desktop\RogueKiller.exe
[2013/04/15 15:35:21 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/15 15:35:02 | 000,262,560 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013/04/15 15:35:01 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013/04/15 15:34:59 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013/04/15 15:34:53 | 000,861,088 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npdeployJava1.dll
[2013/04/15 15:34:52 | 000,782,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013/04/15 15:29:20 | 031,521,184 | ---- | M] (Oracle Corporation) -- C:\Users\Ken\Desktop\jre-7u17-windows-i586.exe
[2013/04/15 09:09:10 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/04/15 09:09:10 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/04/15 09:06:01 | 000,742,690 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/04/15 09:06:01 | 000,640,270 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/04/15 09:06:01 | 000,114,536 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/04/15 09:01:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/04/15 09:01:21 | 3152,257,024 | -HS- | M] () -- C:\hiberfil.sys
[2013/04/15 08:46:00 | 000,000,506 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 55fef781-c6af-4df9-859a-602f289731d9.job
[2013/04/15 02:00:00 | 000,000,506 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 45e9ad03-d86b-468e-9887-33a0ecb6d3cc.job
[2013/04/14 18:54:05 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/04/14 18:34:14 | 005,052,676 | R--- | M] (Swearware) -- C:\Users\Ken\Desktop\username123.exe
[2013/04/14 18:28:22 | 000,016,712 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Windows\SysNative\drivers\PROCEXP113.SYS
[2013/04/14 18:23:34 | 000,000,512 | ---- | M] () -- C:\Users\Ken\Desktop\MBR.dat
[2013/04/14 17:53:07 | 000,002,800 | ---- | M] () -- C:\{39340EFA-9C19-4108-ADCA-C1ACD12E8607}
[2013/04/11 18:26:45 | 000,613,083 | ---- | M] () -- C:\Users\Ken\Desktop\adwcleaner.exe
[2013/04/11 18:25:12 | 000,551,587 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Ken\Desktop\JRT.exe
[2013/04/11 16:46:06 | 000,001,812 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/04/11 16:33:15 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/11 16:29:08 | 000,890,815 | ---- | M] () -- C:\Users\Ken\Desktop\SecurityCheck.exe
[2013/04/11 03:17:09 | 000,277,608 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/09 17:03:12 | 000,108,448 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/04/09 17:03:10 | 001,085,344 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npdeployJava1.dll
[2013/04/09 17:03:10 | 000,963,488 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2013/04/09 17:03:10 | 000,310,688 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2013/04/09 17:03:10 | 000,188,832 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2013/04/09 17:03:10 | 000,188,320 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2013/04/09 17:01:15 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/04/09 15:27:19 | 000,000,990 | ---- | M] () -- C:\Windows\xlkfs.dat
[2013/04/09 15:27:19 | 000,000,078 | ---- | M] () -- C:\Windows\xlkfs.ini
[2013/04/07 17:44:21 | 000,377,856 | ---- | M] () -- C:\Users\Ken\Desktop\ppdbdq4w.exe
[2013/04/07 17:36:37 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Ken\Desktop\HijackThis.exe
[2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/04/03 04:21:26 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1403010.016\isolate.ini
[2013/04/02 04:09:14 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/04/02 04:09:14 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/04/02 03:02:11 | 001,054,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013/04/02 03:02:11 | 000,226,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013/04/02 03:02:11 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013/04/02 03:02:10 | 000,719,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013/04/02 03:02:10 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013/04/02 03:02:10 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013/04/02 03:02:10 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013/04/02 03:02:10 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013/04/02 03:02:10 | 000,079,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013/04/02 03:02:10 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013/04/02 03:02:09 | 000,137,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013/04/02 03:02:09 | 000,125,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013/04/02 03:02:09 | 000,117,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013/04/02 03:02:09 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013/04/02 03:02:09 | 000,073,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013/04/02 03:02:09 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013/04/02 03:02:09 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013/04/02 03:02:08 | 001,441,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013/04/02 03:02:08 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013/04/02 03:02:08 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013/04/02 03:02:08 | 000,762,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013/04/02 03:02:08 | 000,629,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013/04/02 03:02:08 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013/04/02 03:02:08 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013/04/02 03:02:08 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013/04/02 03:02:08 | 000,281,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013/04/02 03:02:08 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013/04/02 03:02:08 | 000,232,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013/04/02 03:02:08 | 000,216,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013/04/02 03:02:08 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013/04/02 03:02:08 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013/04/02 03:02:08 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013/04/02 03:02:08 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013/04/02 03:02:08 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/04/02 03:02:08 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013/04/02 03:02:08 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013/04/02 03:02:07 | 001,509,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013/04/02 03:02:07 | 000,905,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013/04/02 03:02:07 | 000,599,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013/04/02 03:02:07 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013/04/02 03:02:07 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013/04/02 03:02:07 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013/04/02 03:02:07 | 000,144,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013/04/02 03:02:07 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013/04/02 03:02:07 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013/04/02 03:02:07 | 000,102,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013/04/02 03:02:07 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013/04/02 03:02:07 | 000,062,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013/04/02 03:02:07 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013/04/02 03:02:07 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013/04/02 03:02:07 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013/04/02 03:02:07 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013/04/02 03:02:06 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013/04/02 03:02:06 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013/04/02 03:02:06 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013/03/24 20:27:15 | 000,048,901 | ---- | M] () -- C:\Users\Ken\Desktop\bacon.rtf
[2013/03/19 02:04:06 | 005,550,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013/03/19 01:46:56 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2013/03/19 01:04:13 | 003,968,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013/03/19 01:04:10 | 003,913,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013/03/19 00:47:50 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2013/03/18 23:06:33 | 000,112,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2013/03/17 16:45:23 | 000,001,001 | ---- | M] () -- C:\Users\Ken\Desktop\Easy File Locker.lnk

========== Files Created - No Company Name ==========

[2013/04/15 15:38:30 | 000,816,128 | ---- | C] () -- C:\Users\Ken\Desktop\RogueKiller.exe
[2013/04/14 18:30:06 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/04/14 18:30:06 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/04/14 18:30:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/04/14 18:30:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/04/14 18:30:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/04/14 18:23:34 | 000,000,512 | ---- | C] () -- C:\Users\Ken\Desktop\MBR.dat
[2013/04/14 17:53:07 | 000,002,800 | ---- | C] () -- C:\{39340EFA-9C19-4108-ADCA-C1ACD12E8607}
[2013/04/14 17:23:07 | 000,002,152 | ---- | C] () -- C:\Users\Ken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
[2013/04/11 18:26:41 | 000,613,083 | ---- | C] () -- C:\Users\Ken\Desktop\adwcleaner.exe
[2013/04/11 16:46:39 | 000,000,506 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 55fef781-c6af-4df9-859a-602f289731d9.job
[2013/04/11 16:46:37 | 000,000,506 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 45e9ad03-d86b-468e-9887-33a0ecb6d3cc.job
[2013/04/11 16:46:06 | 000,001,812 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/04/11 16:33:15 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/11 16:29:05 | 000,890,815 | ---- | C] () -- C:\Users\Ken\Desktop\SecurityCheck.exe
[2013/04/07 17:44:17 | 000,377,856 | ---- | C] () -- C:\Users\Ken\Desktop\ppdbdq4w.exe
[2013/04/02 03:02:08 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/04/02 03:02:08 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013/03/21 19:23:14 | 000,048,901 | ---- | C] () -- C:\Users\Ken\Desktop\bacon.rtf
[2013/03/17 16:45:19 | 005,043,391 | ---- | C] () -- C:\Users\Ken\Desktop\DAVE1873.JPG
[2013/02/21 15:02:40 | 000,000,215 | ---- | C] () -- C:\Users\Ken\AppData\Local\Lockdir6
[2013/02/21 15:02:40 | 000,000,051 | ---- | C] () -- C:\Users\Ken\AppData\Local\Lockdir6.lg
[2012/12/14 02:42:30 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2012/12/14 02:42:30 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012/12/14 02:42:28 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2012/10/29 13:09:28 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012/10/29 13:09:28 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012/10/29 13:09:28 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012/10/29 13:09:28 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012/10/29 13:09:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012/02/05 12:22:38 | 000,750,190 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/23 10:44:56 | 000,013,931 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2011/12/11 07:04:25 | 009,191,424 | ---- | C] () -- C:\Users\Ken\s-1-5-21-2305161544-3229008522-4247653988-1001.rrr
[2011/08/31 20:51:16 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011/08/31 20:51:16 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011/05/06 18:25:41 | 000,014,464 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys
[2011/05/06 18:25:06 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011/05/06 18:25:00 | 000,221,184 | ---- | C] () -- C:\Windows\SysWow64\drivers\ServiceHelp.dll
[2011/05/06 18:25:00 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011/05/06 18:25:00 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2011/05/06 18:14:07 | 000,012,795 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2011/05/06 18:14:01 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2011/05/06 18:14:01 | 000,007,058 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2011/05/06 18:14:01 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011/05/06 18:02:40 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011/01/16 02:01:22 | 405,012,479 | ---- | C] () -- C:\Users\Ken\THRSB_BY_CH69.iso

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 01:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/04/14 08:03:15 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\.minecraft
[2012/02/24 10:17:32 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\AnvSoft
[2012/12/01 09:03:51 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\Samsung
[2013/03/29 12:07:32 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\SoftGrid Client
[2012/02/05 12:23:21 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\TP
[2013/04/14 11:19:13 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\uTorrent
[2012/01/24 16:34:50 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*. >
[2013/04/14 19:25:22 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011/05/06 18:26:23 | 000,000,000 | ---D | M] -- C:\AsusVibeData
[2011/03/15 17:24:13 | 000,000,000 | ---D | M] -- C:\Boot
[2013/04/15 15:36:26 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012/01/23 10:47:57 | 000,000,000 | ---D | M] -- C:\Intel
[2013/04/11 18:25:23 | 000,000,000 | ---D | M] -- C:\JRT
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013/04/11 16:46:03 | 000,000,000 | R--D | M] -- C:\Program Files
[2013/04/14 17:23:14 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2013/04/14 17:22:55 | 000,000,000 | ---D | M] -- C:\ProgramData
[2013/04/14 19:09:37 | 000,000,000 | ---D | M] -- C:\Qoobox
[2012/01/23 10:42:35 | 000,000,000 | ---D | M] -- C:\Recovery
[2013/04/15 15:47:48 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2013/04/14 19:09:38 | 000,000,000 | ---D | M] -- C:\username123
[2012/01/23 10:43:44 | 000,000,000 | ---D | M] -- C:\Users
[2013/04/14 19:22:24 | 000,000,000 | ---D | M] -- C:\Windows

< %PROGRAMFILES%\*.exe >

< %LOCALAPPDATA%\*.exe >

< %windir%\Installer\*.* >
[2009/08/04 04:54:12 | 001,411,584 | ---- | M] () -- C:\Windows\Installer\111a8c7.msi
[2009/08/04 04:53:34 | 000,035,840 | ---- | M] () -- C:\Windows\Installer\111a8d8.msi
[2011/01/24 18:16:02 | 000,014,336 | R--- | M] () -- C:\Windows\Installer\12afc8d2.msp
[2011/08/22 00:14:54 | 020,647,936 | R--- | M] () -- C:\Windows\Installer\12afc8fb.msp
[2011/05/06 18:32:15 | 000,039,936 | R--- | M] () -- C:\Windows\Installer\15c77.msp
[2011/05/06 18:32:20 | 004,680,704 | ---- | M] () -- C:\Windows\Installer\15cab.msi
[2011/05/06 18:32:20 | 000,147,968 | ---- | M] () -- C:\Windows\Installer\15caf.msi
[2011/05/06 18:32:21 | 000,136,704 | R--- | M] () -- C:\Windows\Installer\15cb8.msp
[2011/05/06 18:32:22 | 001,139,712 | R--- | M] () -- C:\Windows\Installer\15cc8.msp
[2011/05/06 18:32:24 | 004,427,776 | R--- | M] () -- C:\Windows\Installer\15cdf.msp
[2011/05/06 18:32:26 | 002,932,736 | R--- | M] () -- C:\Windows\Installer\15cf7.msp
[2011/05/06 18:32:26 | 002,343,936 | ---- | M] () -- C:\Windows\Installer\15cfb.msi
[2011/05/06 18:32:28 | 003,314,688 | R--- | M] () -- C:\Windows\Installer\15d1b.msp
[2011/05/06 18:32:32 | 000,629,760 | R--- | M] () -- C:\Windows\Installer\15d45.msp
[2011/05/06 18:32:33 | 000,468,992 | R--- | M] () -- C:\Windows\Installer\15d53.msp
[2011/05/06 18:32:34 | 000,629,760 | R--- | M] () -- C:\Windows\Installer\15d73.msp
[2011/05/06 18:32:35 | 000,470,016 | R--- | M] () -- C:\Windows\Installer\15d81.msp
[2011/05/06 18:32:37 | 000,630,784 | R--- | M] () -- C:\Windows\Installer\15da6.msp
[2011/05/06 18:32:42 | 000,469,504 | R--- | M] () -- C:\Windows\Installer\15db4.msp
[2011/05/06 18:32:46 | 000,629,248 | R--- | M] () -- C:\Windows\Installer\15dd9.msp
[2011/05/06 18:32:47 | 000,468,992 | R--- | M] () -- C:\Windows\Installer\15de7.msp
[2011/05/06 18:32:52 | 003,664,384 | ---- | M] () -- C:\Windows\Installer\15e00.msi
[2011/05/06 18:32:52 | 003,734,016 | ---- | M] () -- C:\Windows\Installer\15e04.msi
[2011/05/06 18:32:54 | 005,870,080 | R--- | M] () -- C:\Windows\Installer\15e1f.msp
[2011/05/06 18:32:56 | 002,958,336 | R--- | M] () -- C:\Windows\Installer\15e3d.msp
[2011/05/06 18:32:57 | 000,665,088 | R--- | M] () -- C:\Windows\Installer\15e47.msp
[2011/05/06 18:32:58 | 000,515,072 | R--- | M] () -- C:\Windows\Installer\15e50.msp
[2011/05/06 18:33:00 | 000,666,112 | R--- | M] () -- C:\Windows\Installer\15e5a.msp
[2011/05/06 18:33:01 | 000,516,608 | R--- | M] () -- C:\Windows\Installer\15e63.msp
[2011/05/06 18:33:02 | 000,665,600 | R--- | M] () -- C:\Windows\Installer\15e6d.msp
[2011/05/06 18:33:03 | 000,515,584 | R--- | M] () -- C:\Windows\Installer\15e76.msp
[2011/05/06 18:33:04 | 000,664,576 | R--- | M] () -- C:\Windows\Installer\15e80.msp
[2011/05/06 18:33:05 | 000,514,048 | R--- | M] () -- C:\Windows\Installer\15e89.msp
[2011/05/06 18:33:05 | 001,819,136 | ---- | M] () -- C:\Windows\Installer\15e8e.msi
[2011/05/06 18:33:08 | 014,617,088 | R--- | M] () -- C:\Windows\Installer\15ebe.msp
[2011/05/06 18:33:11 | 003,733,504 | R--- | M] () -- C:\Windows\Installer\15ecc.msp
[2011/05/06 18:33:12 | 002,148,352 | R--- | M] () -- C:\Windows\Installer\15edc.msp
[2011/05/06 18:33:12 | 000,065,024 | R--- | M] () -- C:\Windows\Installer\15ee6.msp
[2011/05/06 18:33:14 | 002,150,912 | R--- | M] () -- C:\Windows\Installer\15ef6.msp
[2011/05/06 18:33:15 | 000,062,464 | R--- | M] () -- C:\Windows\Installer\15f00.msp
[2011/05/06 18:33:21 | 002,148,864 | R--- | M] () -- C:\Windows\Installer\15f10.msp
[2011/05/06 18:33:22 | 000,061,440 | R--- | M] () -- C:\Windows\Installer\15f1a.msp
[2011/05/06 18:33:24 | 002,147,328 | R--- | M] () -- C:\Windows\Installer\15f2a.msp
[2011/05/06 18:33:25 | 000,064,512 | R--- | M] () -- C:\Windows\Installer\15f34.msp
[2011/05/06 18:33:26 | 000,205,312 | R--- | M] () -- C:\Windows\Installer\15f42.msp
[2011/05/06 18:33:26 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\15f4b.msp
[2011/05/06 18:33:27 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\15f54.msp
[2011/05/06 18:33:27 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\15f5d.msp
[2011/05/06 18:33:28 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\15f66.msp
[2011/05/06 18:33:42 | 000,624,640 | R--- | M] () -- C:\Windows\Installer\15feb.msp
[2011/05/06 18:33:43 | 000,468,480 | R--- | M] () -- C:\Windows\Installer\15ff9.msp
[2011/05/06 18:33:47 | 000,636,928 | R--- | M] () -- C:\Windows\Installer\16017.msp
[2011/05/06 18:33:48 | 000,510,976 | R--- | M] () -- C:\Windows\Installer\16020.msp
[2011/05/06 18:33:49 | 002,144,256 | R--- | M] () -- C:\Windows\Installer\16030.msp
[2011/05/06 18:33:50 | 000,060,416 | R--- | M] () -- C:\Windows\Installer\1603a.msp
[2011/05/06 18:33:50 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\16044.msp
[2013/04/15 15:33:56 | 000,883,712 | ---- | M] () -- C:\Windows\Installer\1687a2b.msi
[2013/04/15 15:36:03 | 000,179,200 | ---- | M] () -- C:\Windows\Installer\1687a3d.msi
[2010/11/24 09:56:12 | 001,150,464 | R--- | M] () -- C:\Windows\Installer\1736738a.msp
[2010/11/24 10:41:20 | 002,408,960 | R--- | M] () -- C:\Windows\Installer\1736738b.msp
[2012/12/01 08:54:06 | 079,293,952 | ---- | M] () -- C:\Windows\Installer\17367390.msi
[2012/12/18 16:41:27 | 017,502,208 | R--- | M] () -- C:\Windows\Installer\18dee86.msp
[2012/12/11 10:58:45 | 001,028,096 | ---- | M] () -- C:\Windows\Installer\19b9c9b8.msi
[2013/03/04 19:38:16 | 032,366,080 | ---- | M] () -- C:\Windows\Installer\19b9c9df.msi
[2011/11/22 00:42:40 | 033,189,888 | R--- | M] () -- C:\Windows\Installer\1c77a233.msp
[2012/01/22 10:20:42 | 001,707,520 | R--- | M] () -- C:\Windows\Installer\1d214694.msp
[2012/06/25 17:02:18 | 002,460,672 | ---- | M] () -- C:\Windows\Installer\1fa1759.msi
[2012/12/27 09:52:40 | 036,622,336 | ---- | M] () -- C:\Windows\Installer\2019e012.msi
[2012/03/27 15:18:52 | 009,737,728 | R--- | M] () -- C:\Windows\Installer\219c9290.msp
[2013/03/13 16:06:18 | 013,238,272 | R--- | M] () -- C:\Windows\Installer\255ff19.msp
[2011/08/01 16:59:06 | 002,081,792 | ---- | M] () -- C:\Windows\Installer\273c8a.msi
[2011/08/01 16:59:06 | 001,978,368 | ---- | M] () -- C:\Windows\Installer\273c91.msi
[2012/09/06 11:16:24 | 025,810,944 | R--- | M] () -- C:\Windows\Installer\27872716.msp
[2012/09/10 10:35:36 | 015,580,672 | R--- | M] () -- C:\Windows\Installer\2787272c.msp
[2012/03/15 14:26:06 | 004,212,736 | R--- | M] () -- C:\Windows\Installer\2aadffa.msp
[2012/04/22 22:46:00 | 001,187,328 | R--- | M] () -- C:\Windows\Installer\2aae005.msp
[2012/01/12 03:01:16 | 021,030,912 | R--- | M] () -- C:\Windows\Installer\3130586d.msp
[2011/10/26 17:36:14 | 002,829,312 | R--- | M] () -- C:\Windows\Installer\31305878.msp
[2009/07/22 01:01:04 | 000,251,904 | ---- | M] () -- C:\Windows\Installer\381bc1.msi
[2012/12/06 17:56:22 | 003,725,312 | R--- | M] () -- C:\Windows\Installer\44eb8aa8.msp
[2012/02/28 11:22:09 | 025,814,016 | ---- | M] () -- C:\Windows\Installer\4b2e0a0.msi
[2011/04/28 10:57:38 | 002,721,280 | R--- | M] () -- C:\Windows\Installer\4dbfffc.msp
[2011/05/19 00:06:22 | 038,672,896 | R--- | M] () -- C:\Windows\Installer\4dc0020.msp
[2011/04/13 12:48:16 | 035,326,464 | R--- | M] () -- C:\Windows\Installer\4dc002a.msp
[2011/12/26 07:24:12 | 008,835,072 | R--- | M] () -- C:\Windows\Installer\4dc0034.msp
[2011/07/11 18:33:14 | 023,254,016 | R--- | M] () -- C:\Windows\Installer\4dc0048.msp
[2011/04/06 23:12:06 | 194,340,864 | R--- | M] () -- C:\Windows\Installer\4dc0068.msp
[2011/04/16 01:14:54 | 003,186,176 | ---- | M] () -- C:\Windows\Installer\53069.msi
[2011/12/08 15:42:40 | 000,856,576 | ---- | M] () -- C:\Windows\Installer\58cdb97.msi
[2005/06/27 14:25:29 | 001,571,328 | ---- | M] () -- C:\Windows\Installer\58cdb9d.msi
[2006/02/08 00:47:08 | 001,761,280 | ---- | M] () -- C:\Windows\Installer\58cdba3.msi
[2010/12/08 17:29:46 | 022,420,480 | ---- | M] () -- C:\Windows\Installer\58cdba9.msi
[2010/12/08 17:29:46 | 000,840,704 | ---- | M] () -- C:\Windows\Installer\58cdbaf.msi
[2012/02/03 14:55:54 | 010,565,120 | R--- | M] () -- C:\Windows\Installer\58cdbeb.msp
[2012/11/08 13:28:40 | 002,472,960 | ---- | M] () -- C:\Windows\Installer\58d340e.msi
[2012/10/10 05:44:54 | 012,961,280 | R--- | M] () -- C:\Windows\Installer\58d342d.msp
[2012/06/14 05:22:36 | 020,403,200 | ---- | M] () -- C:\Windows\Installer\590c220.msi
[2012/06/14 05:22:40 | 011,071,488 | ---- | M] () -- C:\Windows\Installer\590c254.msi
[2012/06/14 05:23:03 | 052,033,024 | ---- | M] () -- C:\Windows\Installer\590ce25.msi
[2011/05/06 18:19:33 | 004,260,352 | ---- | M] () -- C:\Windows\Installer\594b7.msi
[2010/03/31 01:07:15 | 002,376,704 | ---- | M] () -- C:\Windows\Installer\594c3.msi
[2013/04/09 17:02:00 | 000,907,776 | ---- | M] () -- C:\Windows\Installer\5b4187.msi
[2012/06/16 13:23:15 | 012,949,504 | ---- | M] () -- C:\Windows\Installer\6f2ff.msi
[2012/01/24 16:39:48 | 008,822,784 | ---- | M] () -- C:\Windows\Installer\7094f4b.msi
[2012/01/24 16:39:52 | 000,039,936 | R--- | M] () -- C:\Windows\Installer\7094f5e.msp
[2012/01/24 16:39:53 | 000,136,704 | R--- | M] () -- C:\Windows\Installer\7094f8b.msp
[2012/01/24 16:39:54 | 001,139,200 | R--- | M] () -- C:\Windows\Installer\7094f9c.msp
[2012/01/24 16:39:57 | 000,715,264 | R--- | M] () -- C:\Windows\Installer\7094fa9.msp
[2012/01/24 16:40:02 | 004,425,728 | R--- | M] () -- C:\Windows\Installer\7094fbd.msp
[2012/01/24 16:40:04 | 002,933,248 | R--- | M] () -- C:\Windows\Installer\7094fd6.msp
[2012/01/24 16:40:05 | 003,313,152 | R--- | M] () -- C:\Windows\Installer\7094ffa.msp
[2012/01/24 16:40:09 | 000,029,696 | R--- | M] () -- C:\Windows\Installer\709502a.msp
[2012/01/24 16:40:11 | 000,630,272 | R--- | M] () -- C:\Windows\Installer\7095038.msp
[2012/01/24 16:40:12 | 000,468,992 | R--- | M] () -- C:\Windows\Installer\7095047.msp
[2012/01/24 16:40:16 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\7095068.msp
[2012/01/24 16:40:19 | 000,631,296 | R--- | M] () -- C:\Windows\Installer\7095075.msp
[2012/01/24 16:40:20 | 000,469,504 | R--- | M] () -- C:\Windows\Installer\7095084.msp
[2012/01/24 16:40:24 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\70950a5.msp
[2012/01/24 16:40:28 | 000,630,784 | R--- | M] () -- C:\Windows\Installer\70950b2.msp
[2012/01/24 16:40:31 | 000,470,016 | R--- | M] () -- C:\Windows\Installer\70950c1.msp
[2012/01/24 16:40:35 | 000,030,208 | R--- | M] () -- C:\Windows\Installer\70950e2.msp
[2012/01/24 16:40:37 | 000,630,784 | R--- | M] () -- C:\Windows\Installer\70950ef.msp
[2012/01/24 16:40:42 | 000,469,504 | R--- | M] () -- C:\Windows\Installer\70950fe.msp
[2012/01/24 16:40:47 | 005,872,128 | R--- | M] () -- C:\Windows\Installer\7095130.msp
[2012/01/25 21:00:17 | 002,956,288 | R--- | M] () -- C:\Windows\Installer\709514f.msp
[2012/01/25 21:00:19 | 000,664,064 | R--- | M] () -- C:\Windows\Installer\709515a.msp
[2012/01/25 21:00:20 | 000,512,512 | R--- | M] () -- C:\Windows\Installer\7095164.msp
[2012/01/25 21:00:21 | 000,665,088 | R--- | M] () -- C:\Windows\Installer\709516f.msp
[2012/01/25 21:00:22 | 000,515,072 | R--- | M] () -- C:\Windows\Installer\7095179.msp
[2012/01/25 21:00:26 | 000,666,112 | R--- | M] () -- C:\Windows\Installer\7095184.msp
[2012/01/25 21:00:29 | 000,516,608 | R--- | M] () -- C:\Windows\Installer\709518e.msp
[2012/01/25 21:00:30 | 000,665,088 | R--- | M] () -- C:\Windows\Installer\7095199.msp
[2012/01/25 21:00:32 | 000,515,072 | R--- | M] () -- C:\Windows\Installer\70951a3.msp
[2012/01/25 21:00:35 | 014,623,744 | R--- | M] () -- C:\Windows\Installer\70951db.msp
[2012/01/25 21:00:37 | 003,731,968 | R--- | M] () -- C:\Windows\Installer\70951ec.msp
[2012/01/25 21:00:39 | 002,146,816 | R--- | M] () -- C:\Windows\Installer\70951fd.msp
[2012/01/25 21:00:40 | 000,064,512 | R--- | M] () -- C:\Windows\Installer\7095208.msp
[2012/01/25 21:00:43 | 002,149,888 | R--- | M] () -- C:\Windows\Installer\7095219.msp
[2012/01/25 21:00:43 | 000,061,440 | R--- | M] () -- C:\Windows\Installer\7095224.msp
[2012/01/25 21:00:46 | 002,151,424 | R--- | M] () -- C:\Windows\Installer\7095235.msp
[2012/01/25 21:00:46 | 000,062,464 | R--- | M] () -- C:\Windows\Installer\7095240.msp
[2012/01/25 21:00:49 | 002,148,864 | R--- | M] () -- C:\Windows\Installer\7095251.msp
[2012/01/25 21:00:51 | 000,065,024 | R--- | M] () -- C:\Windows\Installer\709525c.msp
[2012/01/25 21:00:53 | 000,205,824 | R--- | M] () -- C:\Windows\Installer\709526e.msp
[2012/01/25 21:00:56 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\7095278.msp
[2012/01/25 21:00:59 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\7095282.msp
[2012/01/25 21:01:00 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\709528c.msp
[2012/01/25 21:01:03 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\7095296.msp
[2012/01/25 21:01:18 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\709530c.msp
[2012/01/25 21:01:18 | 000,626,688 | R--- | M] () -- C:\Windows\Installer\7095319.msp
[2012/01/25 21:01:20 | 000,468,480 | R--- | M] () -- C:\Windows\Installer\7095328.msp
[2012/01/25 21:01:21 | 000,636,416 | R--- | M] () -- C:\Windows\Installer\7095348.msp
[2012/01/25 21:01:22 | 000,509,952 | R--- | M] () -- C:\Windows\Installer\7095352.msp
[2012/01/25 21:01:25 | 002,146,816 | R--- | M] () -- C:\Windows\Installer\7095363.msp
[2012/01/25 21:01:29 | 000,060,416 | R--- | M] () -- C:\Windows\Installer\709536e.msp
[2012/01/25 21:01:32 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\7095379.msp
[2013/02/14 09:58:46 | 005,850,624 | R--- | M] () -- C:\Windows\Installer\784ad5f.msp
[2013/03/13 03:01:14 | 053,209,600 | R--- | M] () -- C:\Windows\Installer\784ad6f.msp
[2011/04/16 09:44:26 | 002,770,944 | ---- | M] () -- C:\Windows\Installer\7ca7dcb.msi
[2012/04/13 16:52:36 | 000,026,112 | ---- | M] () -- C:\Windows\Installer\80db90e.msi
[2011/05/06 18:32:16 | 000,074,240 | ---- | M] () -- C:\Windows\Installer\80db919.msi
[2012/04/13 16:52:39 | 000,039,936 | R--- | M] () -- C:\Windows\Installer\80db91e.msp
[2012/04/13 16:52:39 | 009,553,408 | ---- | M] () -- C:\Windows\Installer\80db92e.msi
[2011/05/06 18:32:21 | 000,429,056 | ---- | M] () -- C:\Windows\Installer\80db948.msi
[2012/04/13 16:52:40 | 000,136,704 | R--- | M] () -- C:\Windows\Installer\80db94d.msp
[2011/05/06 18:32:21 | 004,004,864 | ---- | M] () -- C:\Windows\Installer\80db952.msi
[2012/04/13 16:52:41 | 001,139,712 | R--- | M] () -- C:\Windows\Installer\80db95e.msp
[2011/05/06 18:32:22 | 002,310,656 | ---- | M] () -- C:\Windows\Installer\80db963.msi
[2012/04/13 16:52:41 | 000,715,264 | R--- | M] () -- C:\Windows\Installer\80db96b.msp
[2011/05/06 18:32:24 | 009,433,088 | ---- | M] () -- C:\Windows\Installer\80db970.msi
[2012/04/13 16:52:42 | 004,426,240 | R--- | M] () -- C:\Windows\Installer\80db97f.msp
[2011/05/06 18:32:25 | 007,710,720 | ---- | M] () -- C:\Windows\Installer\80db984.msi
[2012/04/13 16:52:43 | 002,932,224 | R--- | M] () -- C:\Windows\Installer\80db998.msp
[2011/05/06 18:32:27 | 008,332,288 | ---- | M] () -- C:\Windows\Installer\80db9a0.msi
[2012/04/13 16:52:45 | 003,312,128 | R--- | M] () -- C:\Windows\Installer\80db9bc.msp
[2012/01/24 16:40:07 | 022,647,296 | ---- | M] () -- C:\Windows\Installer\80db9c3.msi
[2012/04/13 16:52:46 | 005,535,744 | R--- | M] () -- C:\Windows\Installer\80db9d6.msp
[2011/05/06 18:32:46 | 000,069,120 | ---- | M] () -- C:\Windows\Installer\80db9dc.msi
[2012/04/13 16:52:47 | 000,029,696 | R--- | M] () -- C:\Windows\Installer\80db9e2.msp
[2011/05/06 18:32:46 | 001,524,736 | ---- | M] () -- C:\Windows\Installer\80db9e7.msi
[2012/04/13 16:52:47 | 000,630,272 | R--- | M] () -- C:\Windows\Installer\80db9f0.msp
[2011/05/06 18:32:47 | 001,073,664 | ---- | M] () -- C:\Windows\Installer\80db9f5.msi
[2012/04/13 16:52:48 | 000,468,992 | R--- | M] () -- C:\Windows\Installer\80db9ff.msp
[2012/01/24 16:40:14 | 005,864,960 | ---- | M] () -- C:\Windows\Installer\80dba09.msi
[2012/04/13 16:52:49 | 004,302,336 | R--- | M] () -- C:\Windows\Installer\80dba13.msp
[2011/05/06 18:32:36 | 000,071,680 | ---- | M] () -- C:\Windows\Installer\80dba19.msi
[2012/04/13 16:52:50 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\80dba1f.msp
[2011/05/06 18:32:37 | 001,530,880 | ---- | M] () -- C:\Windows\Installer\80dba24.msi
[2012/04/13 16:52:51 | 000,631,296 | R--- | M] () -- C:\Windows\Installer\80dba2c.msp
[2011/05/06 18:32:41 | 001,077,248 | ---- | M] () -- C:\Windows\Installer\80dba31.msi
[2012/04/13 16:52:51 | 000,469,504 | R--- | M] () -- C:\Windows\Installer\80dba3b.msp
[2012/01/24 16:40:21 | 006,704,640 | ---- | M] () -- C:\Windows\Installer\80dba45.msi
[2012/04/13 16:52:53 | 005,127,680 | R--- | M] () -- C:\Windows\Installer\80dba4f.msp
[2011/05/06 18:32:34 | 000,071,168 | ---- | M] () -- C:\Windows\Installer\80dba55.msi
[2012/04/13 16:52:53 | 000,030,208 | R--- | M] () -- C:\Windows\Installer\80dba5b.msp
[2011/05/06 18:32:34 | 001,509,888 | ---- | M] () -- C:\Windows\Installer\80dba60.msi
[2012/04/13 16:52:54 | 000,630,784 | R--- | M] () -- C:\Windows\Installer\80dba68.msp
[2011/05/06 18:32:34 | 001,077,760 | ---- | M] () -- C:\Windows\Installer\80dba6d.msi
[2012/04/13 16:52:55 | 000,470,016 | R--- | M] () -- C:\Windows\Installer\80dba77.msp
[2012/01/24 16:40:34 | 006,713,856 | ---- | M] () -- C:\Windows\Installer\80dba81.msi
[2012/04/13 16:52:56 | 005,129,728 | R--- | M] () -- C:\Windows\Installer\80dba8b.msp
[2011/05/06 18:32:31 | 000,071,680 | ---- | M] () -- C:\Windows\Installer\80dba91.msi
[2012/04/13 16:52:57 | 000,030,208 | R--- | M] () -- C:\Windows\Installer\80dba97.msp
[2011/05/06 18:32:31 | 001,523,200 | ---- | M] () -- C:\Windows\Installer\80dba9c.msi
[2012/04/13 16:52:57 | 000,630,784 | R--- | M] () -- C:\Windows\Installer\80dbaa4.msp
[2011/05/06 18:32:32 | 001,076,224 | ---- | M] () -- C:\Windows\Installer\80dbaa9.msi
[2012/04/13 16:52:58 | 000,469,504 | R--- | M] () -- C:\Windows\Installer\80dbab3.msp
[2012/01/24 16:40:41 | 006,697,984 | ---- | M] () -- C:\Windows\Installer\80dbabd.msi
[2012/04/13 16:52:59 | 005,126,656 | R--- | M] () -- C:\Windows\Installer\80dbac7.msp
[2011/05/06 18:32:53 | 013,850,624 | ---- | M] () -- C:\Windows\Installer\80dbacd.msi
[2012/04/13 16:53:01 | 005,868,544 | R--- | M] () -- C:\Windows\Installer\80dbae4.msp
[2011/05/06 18:32:55 | 008,313,856 | ---- | M] () -- C:\Windows\Installer\80dbae9.msi
[2012/04/13 16:53:03 | 002,957,312 | R--- | M] () -- C:\Windows\Installer\80dbb03.msp
[2011/05/06 18:33:03 | 005,416,448 | ---- | M] () -- C:\Windows\Installer\80dbb08.msi
[2012/04/13 16:53:09 | 000,665,088 | R--- | M] () -- C:\Windows\Installer\80dbb0e.msp
[2011/05/06 18:33:04 | 006,219,776 | ---- | M] () -- C:\Windows\Installer\80dbb13.msi
[2012/04/13 16:53:13 | 000,513,024 | R--- | M] () -- C:\Windows\Installer\80dbb18.msp
[2011/05/06 18:33:02 | 005,652,992 | ---- | M] () -- C:\Windows\Installer\80dbb1e.msi
[2012/04/13 16:53:18 | 000,665,600 | R--- | M] () -- C:\Windows\Installer\80dbb23.msp
[2011/05/06 18:33:02 | 006,484,480 | ---- | M] () -- C:\Windows\Installer\80dbb28.msi
[2012/04/13 16:53:19 | 000,515,584 | R--- | M] () -- C:\Windows\Installer\80dbb2d.msp
[2011/05/06 18:32:59 | 008,424,448 | ---- | M] () -- C:\Windows\Installer\80dbb33.msi
[2012/04/13 16:53:23 | 000,666,624 | R--- | M] () -- C:\Windows\Installer\80dbb38.msp
[2011/05/06 18:33:00 | 009,250,816 | ---- | M] () -- C:\Windows\Installer\80dbb3d.msi
[2012/04/13 16:53:24 | 000,516,096 | R--- | M] () -- C:\Windows\Installer\80dbb42.msp
[2011/05/06 18:32:56 | 005,947,392 | ---- | M] () -- C:\Windows\Installer\80dbb48.msi
[2012/04/13 16:53:25 | 000,665,600 | R--- | M] () -- C:\Windows\Installer\80dbb4d.msp
[2011/05/06 18:32:58 | 006,767,616 | ---- | M] () -- C:\Windows\Installer\80dbb52.msi
[2012/04/13 16:53:28 | 000,514,560 | R--- | M] () -- C:\Windows\Installer\80dbb57.msp
[2011/05/06 18:33:07 | 034,193,408 | ---- | M] () -- C:\Windows\Installer\80dbb63.msi
[2012/04/13 16:53:31 | 014,624,256 | R--- | M] () -- C:\Windows\Installer\80dbb8e.msp
[2011/05/06 18:33:10 | 011,846,656 | ---- | M] () -- C:\Windows\Installer\80dbb96.msi
[2012/04/13 16:53:33 | 003,734,016 | R--- | M] () -- C:\Windows\Installer\80dbb9f.msp
[2011/05/06 18:33:23 | 004,278,272 | ---- | M] () -- C:\Windows\Installer\80dbba5.msi
[2012/04/13 16:53:41 | 002,146,816 | R--- | M] () -- C:\Windows\Installer\80dbbb0.msp
[2011/05/06 18:33:25 | 000,166,912 | ---- | M] () -- C:\Windows\Installer\80dbbb6.msi
[2012/04/13 16:53:43 | 000,064,512 | R--- | M] () -- C:\Windows\Installer\80dbbbb.msp
[2011/05/06 18:33:19 | 004,293,632 | ---- | M] () -- C:\Windows\Installer\80dbbc1.msi
[2012/04/13 16:53:51 | 002,149,888 | R--- | M] () -- C:\Windows\Installer\80dbbcc.msp
[2011/05/06 18:33:22 | 000,168,960 | ---- | M] () -- C:\Windows\Installer\80dbbd2.msi
[2012/04/13 16:53:52 | 000,061,440 | R--- | M] () -- C:\Windows\Installer\80dbbd7.msp
[2011/05/06 18:33:13 | 004,297,216 | ---- | M] () -- C:\Windows\Installer\80dbbdd.msi
[2012/04/13 16:53:53 | 002,150,400 | R--- | M] () -- C:\Windows\Installer\80dbbe8.msp
[2011/05/06 18:33:14 | 000,174,080 | ---- | M] () -- C:\Windows\Installer\80dbbee.msi
[2012/04/13 16:53:54 | 000,062,464 | R--- | M] () -- C:\Windows\Installer\80dbbf3.msp
[2011/05/06 18:33:12 | 004,283,392 | ---- | M] () -- C:\Windows\Installer\80dbbf9.msi
[2012/04/13 16:53:56 | 002,148,864 | R--- | M] () -- C:\Windows\Installer\80dbc04.msp
[2011/05/06 18:33:12 | 000,170,496 | ---- | M] () -- C:\Windows\Installer\80dbc0a.msi
[2012/04/13 16:53:58 | 000,065,024 | R--- | M] () -- C:\Windows\Installer\80dbc0f.msp
[2011/05/06 18:33:25 | 000,775,168 | ---- | M] () -- C:\Windows\Installer\80dbc18.msi
[2012/04/13 16:53:59 | 000,205,824 | R--- | M] () -- C:\Windows\Installer\80dbc21.msp
[2011/05/06 18:33:28 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\80dbc26.msi
[2012/04/13 16:54:01 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\80dbc2b.msp
[2011/05/06 18:33:27 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\80dbc30.msi
[2012/04/13 16:54:01 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\80dbc35.msp
[2011/05/06 18:33:27 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\80dbc3a.msi
[2012/04/13 16:54:02 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\80dbc3f.msp
[2011/05/06 18:33:26 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\80dbc44.msi
[2012/04/13 16:54:02 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\80dbc49.msp
[2012/04/13 16:54:20 | 000,071,168 | ---- | M] () -- C:\Windows\Installer\80dbcde.msi
[2012/04/13 16:54:21 | 000,074,240 | ---- | M] () -- C:\Windows\Installer\80dbceb.msi
[2012/04/13 16:54:22 | 000,074,240 | ---- | M] () -- C:\Windows\Installer\80dbcf8.msi
[2012/04/13 16:54:23 | 000,072,704 | ---- | M] () -- C:\Windows\Installer\80dbd05.msi
[2011/05/06 18:33:41 | 000,067,072 | ---- | M] () -- C:\Windows\Installer\80dbd12.msi
[2012/04/13 16:54:27 | 000,029,184 | R--- | M] () -- C:\Windows\Installer\80dbd18.msp
[2011/05/06 18:33:42 | 001,492,992 | ---- | M] () -- C:\Windows\Installer\80dbd1d.msi
[2012/04/13 16:54:29 | 000,625,664 | R--- | M] () -- C:\Windows\Installer\80dbd25.msp
[2011/05/06 18:33:42 | 001,070,592 | ---- | M] () -- C:\Windows\Installer\80dbd2a.msi
[2012/04/13 16:54:31 | 000,468,480 | R--- | M] () -- C:\Windows\Installer\80dbd34.msp
[2012/01/25 21:01:19 | 006,661,632 | ---- | M] () -- C:\Windows\Installer\80dbd3e.msi
[2012/04/13 16:54:33 | 005,124,096 | R--- | M] () -- C:\Windows\Installer\80dbd48.msp
[2011/05/06 18:33:46 | 003,410,944 | ---- | M] () -- C:\Windows\Installer\80dbd4e.msi
[2012/04/13 16:54:34 | 000,635,904 | R--- | M] () -- C:\Windows\Installer\80dbd53.msp
[2011/05/06 18:33:48 | 004,175,360 | ---- | M] () -- C:\Windows\Installer\80dbd58.msi
[2012/04/13 16:54:37 | 000,509,952 | R--- | M] () -- C:\Windows\Installer\80dbd5d.msp
[2011/05/06 18:33:48 | 004,250,112 | ---- | M] () -- C:\Windows\Installer\80dbd63.msi
[2012/04/13 16:54:42 | 002,146,304 | R--- | M] () -- C:\Windows\Installer\80dbd6e.msp
[2011/05/06 18:33:49 | 000,153,600 | ---- | M] () -- C:\Windows\Installer\80dbd74.msi
[2012/04/13 16:54:43 | 000,060,416 | R--- | M] () -- C:\Windows\Installer\80dbd79.msp
[2011/05/06 18:33:50 | 000,029,696 | ---- | M] () -- C:\Windows\Installer\80dbd7f.msi
[2012/04/13 16:54:45 | 000,023,552 | R--- | M] () -- C:\Windows\Installer\80dbd84.msp
[2012/04/13 16:54:46 | 000,065,536 | ---- | M] () -- C:\Windows\Installer\80dbd93.msi
[2010/03/18 17:41:24 | 001,901,056 | ---- | M] () -- C:\Windows\Installer\8179c.msi
[2012/09/23 23:47:27 | 002,385,920 | ---- | M] () -- C:\Windows\Installer\9d0cd42.msi
[2012/04/11 04:55:34 | 000,041,472 | ---- | M] () -- C:\Windows\Installer\a7aa31e.msi
[2012/05/16 03:00:46 | 053,217,792 | R--- | M] () -- C:\Windows\Installer\a7aa328.msp
[2009/04/13 17:42:18 | 001,850,368 | ---- | M] () -- C:\Windows\Installer\af94.msi
[2009/09/17 08:38:00 | 000,359,936 | ---- | M] () -- C:\Windows\Installer\af9a.msi
[2009/07/21 03:11:12 | 002,459,648 | ---- | M] () -- C:\Windows\Installer\afa0.msi
[2009/07/21 04:29:14 | 006,057,984 | ---- | M] () -- C:\Windows\Installer\afa6.msi
[2012/03/09 18:12:59 | 009,229,824 | R--- | M] () -- C:\Windows\Installer\b218335.msp
[2010/09/17 04:33:10 | 003,136,512 | ---- | M] () -- C:\Windows\Installer\cd28.msi
[2012/03/06 20:39:10 | 002,682,368 | ---- | M] () -- C:\Windows\Installer\ce6d85.msi
[2012/03/06 20:42:54 | 002,323,456 | ---- | M] () -- C:\Windows\Installer\ce6d95.msi
[2012/01/23 10:44:01 | 004,886,528 | ---- | M] () -- C:\Windows\Installer\d55e.msi
[2013/02/15 18:35:46 | 001,519,616 | R--- | M] () -- C:\Windows\Installer\f2288.msp
[2010/03/30 14:18:13 | 033,000,960 | ---- | M] () -- C:\Windows\Installer\f54ab63.msi
[2009/07/12 03:35:00 | 002,736,640 | ---- | M] () -- C:\Windows\Installer\fb0f35b.msi
[2013/02/02 19:56:34 | 018,784,768 | ---- | M] () -- C:\Windows\Installer\fb0f360.msi
[2013/02/02 19:56:48 | 002,599,936 | ---- | M] () -- C:\Windows\Installer\fb0f368.msi
[2013/02/02 19:56:47 | 001,066,496 | ---- | M] () -- C:\Windows\Installer\fb0f371.msi
[2013/02/02 19:56:53 | 003,486,720 | ---- | M] () -- C:\Windows\Installer\fb0f37a.msi
[2013/02/02 19:56:38 | 001,163,264 | ---- | M] () -- C:\Windows\Installer\fb0f383.msi
[2013/02/02 19:56:38 | 001,150,464 | ---- | M] () -- C:\Windows\Installer\fb0f38c.msi
[2013/02/02 19:56:38 | 001,070,080 | ---- | M] () -- C:\Windows\Installer\fb0f395.msi
[2013/02/02 19:56:40 | 003,048,960 | ---- | M] () -- C:\Windows\Installer\fb0f39e.msi
[2013/02/02 19:56:39 | 001,003,520 | ---- | M] () -- C:\Windows\Installer\fb0f3a7.msi
[2013/02/02 19:56:38 | 001,198,592 | ---- | M] () -- C:\Windows\Installer\fb0f3af.msi
[2013/02/02 19:56:52 | 000,964,096 | ---- | M] () -- C:\Windows\Installer\fb0f3b8.msi
[2011/12/15 14:54:16 | 039,732,736 | R--- | M] () -- C:\Windows\Installer\fedbb5.msp
[2012/01/19 14:20:42 | 011,997,696 | R--- | M] () -- C:\Windows\Installer\fedbc4.msp
[2012/04/13 16:55:10 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}.SchedServiceConfig.rmi
[2011/05/06 18:34:36 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}.SchedServiceConfig.rmi
[2012/06/14 05:23:59 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}.SchedServiceConfig.rmi
[2012/05/27 10:03:58 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}.SchedServiceConfig.rmi
[2012/01/25 21:02:44 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}.SchedServiceConfig.rmi
[2011/05/06 18:33:58 | 000,000,000 | ---- | M] () -- C:\Windows\Installer\wix{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}.SchedServiceConfig.rmi

< %windir%\system32\tasks\*.* >

< %windir%\system32\tasks\*.* /64 >
[2012/11/29 19:55:25 | 000,002,768 | ---- | M] () -- C:\Windows\SysNative\tasks\CCleanerSkipUAC
[2012/01/23 11:35:00 | 000,003,040 | ---- | M] () -- C:\Windows\SysNative\tasks\Microsoft_Hardware_Launch_IPoint_exe
[2013/03/05 18:12:32 | 000,003,206 | ---- | M] () -- C:\Windows\SysNative\tasks\Norton WSC Integration
[2013/04/11 16:46:37 | 000,003,572 | ---- | M] () -- C:\Windows\SysNative\tasks\SUPERAntiSpyware Scheduled Task 45e9ad03-d86b-468e-9887-33a0ecb6d3cc
[2013/04/11 16:46:39 | 000,003,498 | ---- | M] () -- C:\Windows\SysNative\tasks\SUPERAntiSpyware Scheduled Task 55fef781-c6af-4df9-859a-602f289731d9

< %systemroot%\Fonts\*.exe >

< %systemroot%\*. /mp /s >

< MD5 for: ATAPI.SYS >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\erdnt\cache64\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\erdnt\cache86\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 23:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 23:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: REGEDIT.EXE >
[2009/07/13 21:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\erdnt\cache86\regedit.exe
[2009/07/13 21:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009/07/13 21:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009/07/13 21:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009/07/13 21:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe

< MD5 for: SERVICES.EXE >
[2009/07/13 21:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\erdnt\cache64\services.exe
[2009/07/13 21:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe
[2009/07/13 21:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\erdnt\cache86\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\erdnt\cache64\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USER32.DLL >
[2010/11/20 23:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\erdnt\cache86\user32.dll
[2010/11/20 23:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010/11/20 23:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010/11/20 23:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\erdnt\cache64\user32.dll
[2010/11/20 23:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010/11/20 23:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

< MD5 for: USERINIT.EXE >
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache86\userinit.exe
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\erdnt\cache64\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\erdnt\cache64\winlogon.exe
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >
[2009/07/14 01:08:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 01:08:49 | 000,032,550 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2013/04/11 16:46:37 | 000,000,506 | ---- | C] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 45e9ad03-d86b-468e-9887-33a0ecb6d3cc.job
[2013/04/11 16:46:39 | 000,000,506 | ---- | C] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 55fef781-c6af-4df9-859a-602f289731d9.job

< %Temp%\smtmp\* \s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

========== Alternate Data Streams ==========

@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:BF3D62E7
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP3A96964
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP287FACF

< End of report >


----------



## maggie88ca (Nov 19, 2006)

....


----------



## maggie88ca (Nov 19, 2006)

OTL Extras logfile created on: 15/04/2013 3:46:46 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ken\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.91 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 50.08% Memory free
7.83 Gb Paging File | 5.54 Gb Available in Paging File | 70.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 558.90 Gb Total Space | 435.49 Gb Free Space | 77.92% Space Free | Partition Type: NTFS
Drive D: | 824.17 Gb Total Space | 483.71 Gb Free Space | 58.69% Space Free | Partition Type: NTFS

Computer Name: KEN-PC | User Name: Ken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

*64bit:* [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{041D9098-24B6-4023-B721-92D8F395F5EA}" = lport=445 | protocol=6 | dir=in | app=system | 
"{0D224296-370F-478C-9DC1-41DE0FC8EB2B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{19529955-D21F-4D06-BDBF-FA197F778560}" = rport=138 | protocol=17 | dir=out | app=system | 
"{261A54B4-EC44-438F-8BFF-09214A57AAF5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{50916C10-5850-4C05-A2A2-B02E70103EC8}" = rport=445 | protocol=6 | dir=out | app=system | 
"{607EA609-B5FA-4E0E-81B4-4D6376F22381}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{62442660-8A6E-4C81-8C9A-CB553F70A439}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 
"{6BD5A228-DF05-4212-A58E-71AB754272B6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{705E17BA-8918-4F0B-B683-A9F3F19A9D12}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{984CF89F-7D0B-49A8-A8A9-C08FDFA6E3D0}" = lport=139 | protocol=6 | dir=in | app=system | 
"{A8B5FE6E-D251-4423-87C2-1551F5C57B2B}" = rport=139 | protocol=6 | dir=out | app=system | 
"{CE93E017-DF57-430B-8163-7C908DE7F79F}" = lport=137 | protocol=17 | dir=in | app=system | 
"{D9597AD6-D603-4095-80AB-D4163713372C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{FDD4EB57-D9C7-45C6-B640-DCFA02D43553}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{26C0A041-28D3-4D72-9525-7FD15C3A0314}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{31D52B01-C00F-4ED3-B3ED-75E398B721A1}" = protocol=17 | dir=in | app=c:\program files (x86)\nero\km\kwikmedia.exe | 
"{4F4A1332-8EB2-400C-8933-3888FC830C97}" = protocol=6 | dir=in | app=c:\program files (x86)\nero\km\kwikmedia.exe | 
"{526BDEA8-D860-4997-9ADA-B8FCCACF929B}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{6705F595-C66E-4067-859F-543871DF81A7}" = protocol=58 | dir=in | [email protected],-28545 | 
"{771AF65C-F260-4F29-8C82-7FA88E6D70A0}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{7C07CEF1-E196-49ED-B36A-CF1DEA5EB9CF}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{8001DDC7-CF04-47E9-B7C4-93FE2F7A5A57}" = protocol=58 | dir=in | app=system | 
"{8878D6AC-92A6-4392-8212-9F9B3F8850A1}" = protocol=58 | dir=out | [email protected],-503 | 
"{A7D69E54-504D-462F-AE56-E5693E15F55B}" = dir=in | app=c:\users\ken\appdata\local\microsoft\skydrive\skydrive.exe | 
"{C499A330-60D9-45D9-8C32-80CDD3B41A66}" = protocol=1 | dir=in | [email protected],-28543 | 
"{EE9851C9-F4D9-472B-B21A-042CDC9B40AF}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{F2B9C939-80D4-46F8-9C4A-1CC09339A8B8}" = protocol=1 | dir=out | [email protected],-28544 | 
"{F836AD3E-AF0E-4419-B182-247BE31F6570}" = protocol=58 | dir=out | [email protected],-28546 | 
"{FEDE2720-249B-4DB4-81AD-BDF5731A261B}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{02A5BD31-16AC-45DF-BE9F-A3167BC4AFB2}" = Windows Live Family Safety
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{2128559D-BBCD-4744-87F0-7C0CD5CFB464}" = Windows Live Family Safety
"{26A24AE4-039D-4CA4-87B4-2F86417017FF}" = Java 7 Update 17 (64-bit)
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{9301985B-D116-4A93-A93D-94580084FF86}" = 64 Bit HP CIO Components Installer
"{944E73EF-857E-4F71-9DC4-CD059D7ADDEF}" = Windows Live Family Safety
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{BFBE6E95-5724-47EC-85A0-74D436AD938F}" = Windows Live Family Safety
"{C61D639C-3A1B-4654-901F-08927C804321}" = Windows Live Family Safety
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"WinRAR archiver" = WinRAR 4.20 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052A1E34-A54B-458C-A4E3-24C3E054754A}" = Nero Kwik Media
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{122b2972-c0d8-49d2-be0b-ef76ee9fc69f}" = Nero 9 Essentials
"{124C9BD0-8C52-40AB-8238-0605703B1C28}" = ASUS Backup Wizard
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1B6F5E51-575E-4693-BCA2-7543570D076D}" = Nero Kwik Themes Basic
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F16820E-D0E7-4636-939E-45CBFEFB06E1}" = Nero Kwik Media Help (CHM)
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2432E589-6256-4513-B0BF-EFA8E325D5F0}" = Nero SharedVideoCodecs
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2C464EC1-2B0C-4490-9CAC-D4562DD8377A}" = Soap 3.0 Toolkit
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34D3688E-A737-44C5-9E2A-FF73618728E1}" = AI Suite II
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3AAB08A3-F129-4BD5-B409-AE674F93759D}" = Prerequisite installer
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{4229F016-3A60-439E-B626-DE4BD457469F}" = BlackBerry Device Manager 7.0
"{451BB54C-8B23-4455-8BDC-14FC7D43E056}" = MSXML4SP2
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AF95DE2-B54D-4C3F-9494-FD3B558E2C2D}" = AI Manager
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{585D96E5-1A6A-410C-8F5F-F606CA1CCE1C}" = UFile 2010
"{5B79E730-D897-4B8F-A1AD-7BB2D1F22B96}" = Nero Blu-ray Player Help (CHM)
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}" = Asmedia ASM106x SATA Host Controller Driver
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{7087457A-98F4-4F77-967D-0685C8F18308}" = UFile Updater 2011
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7236672F-6430-439E-9B27-27EDEAF1D676}" = Realtek Ethernet Diagnostic Utility
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7C8626FA-408B-4A90-9EDC-9D128ABD61F8}" = UFile 2011
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}" = Ralink RT2860 Wireless LAN Card
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A2FE691E-3F8E-4E30-AA7D-FF17AC77EA87}" = Nero Blu-ray Player
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7A0BF2E-31CC-49E3-9913-52C503EB969D}" = Nero Audio Pack 1
"{A859FA27-05AF-4295-BF2C-A9D3A5A707EE}" = UFile Updater 2010
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.02)
"{AF54F043-62F9-47AB-A2B2-795CD1EA4C56}" = UFile 2012
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1" = Emsisoft Anti-Malware
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C88F0D8E-3F3E-4E90-B8AA-EA24FACCFF3C}" = Nero Kwik Media
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{EBD3E558-C070-474B-9CC5-CBCA7147EB25}" = UFile Updater 2012
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Any Video Converter_is1" = Any Video Converter 3.5.8
"Asus Vibe2.0" = AsusVibe2.0
"BlackBerry_HandheldManager" = BlackBerry Device Manager 7.0
"Easy File Locker" = Easy File Locker 1.4
"FileHippo.com" = FileHippo.com Update Checker
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"N360" = Norton 360
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"uTorrent" = µTorrent
"WinLiveSuite" = Windows Live Essentials
"xvid" = Xvid MPEG-4 Video Codec

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"SkyDriveSetup.exe" = Microsoft SkyDrive

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/04/2013 6:55:28 PM | Computer Name = Ken-PC | Source = WinMgmt | ID = 10
Description =

Error - 11/04/2013 7:01:09 PM | Computer Name = Ken-PC | Source = VSS | ID = 8194
Description =

Error - 13/04/2013 11:45:06 AM | Computer Name = Ken-PC | Source = WinMgmt | ID = 10
Description =

Error - 14/04/2013 5:10:57 PM | Computer Name = Ken-PC | Source = WinMgmt | ID = 10
Description =

Error - 14/04/2013 5:20:53 PM | Computer Name = Ken-PC | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = Application or service 'Windows Search' could not be shut down.

Error - 14/04/2013 7:24:07 PM | Computer Name = Ken-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/04/2013 9:02:53 AM | Computer Name = Ken-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 11/04/2013 6:55:53 PM | Computer Name = Ken-PC | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk2\DR2.

Error - 11/04/2013 6:55:53 PM | Computer Name = Ken-PC | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk2\DR2.

Error - 11/04/2013 6:55:54 PM | Computer Name = Ken-PC | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk2\DR2.

Error - 11/04/2013 6:55:54 PM | Computer Name = Ken-PC | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk2\DR2.

Error - 13/04/2013 11:43:44 AM | Computer Name = Ken-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 11:41:44 AM on ?13/?04/?2013 was unexpected.

Error - 14/04/2013 5:10:50 PM | Computer Name = Ken-PC | Source = DCOM | ID = 10010
Description =

Error - 14/04/2013 6:45:43 PM | Computer Name = Ken-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 14/04/2013 6:49:52 PM | Computer Name = Ken-PC | Source = Application Popup | ID = 1060
Description = \??\C:\username123\catchme.sys has been blocked from loading due to
incompatibility with this system. Please contact your software vendor for a compatible
version of the driver.

Error - 14/04/2013 6:54:16 PM | Computer Name = Ken-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 15/04/2013 9:01:31 AM | Computer Name = Ken-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 8:59:23 AM on ?15/?04/?2013 was unexpected.

< End of report >


----------



## maggie88ca (Nov 19, 2006)

Most recent logs added. I'm not sure if I downloaded the java properly.


----------



## maggie88ca (Nov 19, 2006)

I know we haven't really started the repair part of all this but I just wanted to update you on what's going on. So far I don't think anymore emails are being sent out but the computer is still not running poorly. It freezes and I can't even restart it all I can do is unplug it and plug it back in when it freezes.

Thanks again for your help.


----------



## eddie5659 (Mar 19, 2001)

Hi

Thanks for the logs 

Also, thanks for the feedback on the issue so far, every little helps 

---

*P2P Warning!*


*IMPORTANT* I notice there are signs of one or more *P2P (Person to Person) File Sharing Programs* on your computer.

* µTorrent*

Please note that as long as you are using any form of *Peer-to-Peer networking* and *downloading files* from non-documented sources, you can expect infestations of malware to occur 
Once upon a time, P2P file sharing was fairly safe. That is no longer true. You may continue to use P2P sharing at your own risk; however, please keep in mind that this practice may be the source of your current malware infestation

I'd like you to read the *Guidelines for P2P Programs* where we explain why it's not a good idea to have them.

Please read these short reports on the dangers of peer-2-peer programs and file sharing.

Cyber Education Letter
File sharing infects 500,000 computers 
USAToday

I would recommend that you uninstall the above, however that choice is up to you. If you choose to remove these programs, you can do so via *Control Panel >> Add or Remove Programs*.

*If you decide to keep the program in spite of the risks involved, do not use it until I have finished cleaning your computer and have given you the all clear.*

----------------------------
Now that's out of the way, lets get started 

One thing I will ask, do you have an external drive? If so, if you unplug it, do you get the same issues?

Also, do you use Outlook for your email or a web-based site, like hotmail, gmail etc?

It looks like Java has installed properly, but you still have the old one. Also, you have a toolbar which can be classed as adware. Uninstalling won't cause any problems to the program. However, its up to you if you wish to uninstall it 

So, for the Java, uninstall in Programs and Features in the Control Panel:

*Java(TM) 6 Update 33*

The other is this:

*uTorrentControl2 Community Toolbar*

Its not showing in your AddRemove Program list, but if you do want to remove this, we can do it after this reply 

----

Then, after the removal of the Java, run the following fix:

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following 

```
:OTL
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Value error.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:BF3D62E7
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:D3A96964
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:D287FACF
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 10.17.2)
:Files
ipconfig /flushdns /c
:Commands 
[purity] 
[CREATERESTOREPOINT] 
[Reboot]
```

Then click the *Run Fix* button at the top 
Click OK.
OTL may ask to reboot the machine. Please do so if asked.

The report should appear in Notepad after the reboot. Copy/Paste the report in your next reply.

----

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:

```
:file
C:\Windows\SysNative\drivers\N360x64\1403000.024\ccsetx64.sys
C:\Users\Ken\Desktop\ppdbdq4w.exe
:filefind
*npBrowserPlugin.dll
*conduit*
:folderfind
*conduit*
:regfind
conduit
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*

eddie


----------



## maggie88ca (Nov 19, 2006)

I do have an external drive but it is always unplugged unless I add something to it so I don't think it has much to do with the problems. I use windows live mail 2011 and that's the one that was hacked I found out because I got a bunch of scrambled emails that came back unable to deliver and one I my password was changed and I had to reset it.


----------



## maggie88ca (Nov 19, 2006)

I uninstalled the Java(TM) 6 Update 33 and I would like to remove the uTorrentControl2 Community Toolbar so if you could tell me how that would be great.


----------



## maggie88ca (Nov 19, 2006)

The first time I ran OTL after the reboot there was no log so I ran it again and left out the word reboot from the code and it produced this log....

========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-2938170701-155988706-608106729-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Unable to delete ADS C:\ProgramData\TEMP:BF3D62E7 .
Unable to delete ADS C:\ProgramData\TEMP3A96964 .
Unable to delete ADS C:\ProgramData\TEMP287FACF .
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Ken\Desktop\cmd.bat deleted successfully.
C:\Users\Ken\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 04172013_180852


----------



## maggie88ca (Nov 19, 2006)

I will not use utorrent until we are all done. Here is the systemlook log....

SystemLook 30.07.11 by jpshortstuff
Log created at 18:14 on 17/04/2013 by Ken
Administrator - Elevation successful

========== file ==========

C:\Windows\SysNative\drivers\N360x64\1403000.024\ccsetx64.sys - Unable to find/read file.

C:\Users\Ken\Desktop\ppdbdq4w.exe - File found and opened.
MD5: 60BF4AE8CC40B0E3E28613657ED2EED8
Created at 21:44 on 07/04/2013
Modified at 21:44 on 07/04/2013
Size: 377856 bytes
Attributes: --a----
FileVersion: 2, 1, 19163

========== filefind ==========

Searching for "*npBrowserPlugin.dll"
C:\Program Files (x86)\Common Files\Nero\BrowserPlugin\npBrowserPlugin.dll	--a---- 37784 bytes	[04:23 25/10/2012]	[04:23 25/10/2012] D7C5F74795C2979696FA93E5AF2ED18D

Searching for "*conduit*"
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll	--a---- 1206120 bytes	[17:44 20/01/2012]	[17:44 20/01/2012] 976934130CD5C5DBD2DC977B298DF525
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\com.yahoo.go.sync.client.resources\PhoneConduit.plist	--a---- 11408 bytes	[18:33 20/01/2012]	[18:33 20/01/2012] AB18CD2A656AE753C30E6276EC3DA0C2
C:\Users\Ken\AppData\LocalLow\uTorrentControl2\CacheIcons\http___storage_conduit_com_53_307_CT3072253_images_634514692184142958_20PX_png.png	------- 569 bytes	[00:40 27/05/2012]	[00:40 27/05/2012] ABB24B70540C2E4242527A0D6A5F50BD
C:\Users\Ken\AppData\LocalLow\uTorrentControl2\CacheIcons\http___storage_conduit_com_53_307_CT3072253_Images_634520779497696087_png.png	------- 484 bytes	[00:40 27/05/2012]	[00:40 27/05/2012] 68B6C1DE4F0DD79D4793FEC7BD91B04A
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\ConduitAutoCompleteSearch.xpt	------- 166 bytes	[22:56 26/05/2012]	[04:39 18/04/2012] 806EA6CC4DCBF88A20AA3331BCDC9918
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\searchplugin\conduit.xml	------- 935 bytes	[22:56 26/05/2012]	[04:39 18/04/2012] 9680591A24B87500B3F9FD45ACD250E8

========== folderfind ==========

Searching for "*conduit*"
No folders found.

========== regfind ==========

Searching for "conduit"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966]
"FAEB67A6F1D637247AB9AD48012A5EB6"="C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966\FAEB67A6F1D637247AB9AD48012A5EB6]
"File"="iSyncConduit.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB1E579405BE28F46B2E7AAE9534B564]
"FAEB67A6F1D637247AB9AD48012A5EB6"="C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\com.yahoo.go.sync.client.resources\PhoneConduit.plist"

-= EOF =-


----------



## maggie88ca (Nov 19, 2006)

There are desktop.ini files and 1 ZbThumbnail.info on the desktop that are all faded out like they don't belong there, can I delete them?

Thanks again for all your help.


----------



## eddie5659 (Mar 19, 2001)

> There are desktop.ini files and 1 ZbThumbnail.info on the desktop that are all faded out like they don't belong there, can I delete them?


It looks like your settings are still set to show System Files. Go to Windows Explorer and at the top select Tools | Folder Options.

Click on the View tab, and tick the box that says *Hide Protected Operating System Files*. Apply and OK.

Okay, to uninstall the toolbar, do this:

Internet Explorer:

1. Click the Start button and then select Settings > Control Panel > Add/Remove Programs.
2. In the list of programs, find the toolbar, select it, and click Change/Remove.

Firefox:

1. In your browser menu, select Tools > Add-ons.
2. Make sure the Extensions tab is selected.
3. Select the toolbar.
4. Click the Uninstall button.

Then, we'll remove the remains:

Do this fix using OTL, as you did before:

Run OTL 

Under the *Custom Scans/Fixes* box at the bottom, paste in the following 

```
:Files
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
C:\Users\Ken\AppData\LocalLow\uTorrentControl2\CacheIcons\http___storage_conduit_com_53_307_CT3072253_images_634514692184142958_20PX_png.png
C:\Users\Ken\AppData\LocalLow\uTorrentControl2\CacheIcons\http___storage_conduit_com_53_307_CT3072253_Images_634520779497696087_png.png
:Commands 
[purity] 
[CREATERESTOREPOINT]
```

Then click the *Run Fix* button at the top 
Click OK.
OTL may ask to reboot the machine. Please do so if asked.

The report should appear in Notepad. Copy/Paste the report in your next reply.

---------

Then, run the following tool:

Download *CKScanner* from *here*

*Important :* Save it to your desktop. 

Doubleclick CKScanner.exe and click *Search For Files*. 
After a very short time, when the cursor hourglass disappears, click *Save List To File*. 
A message box will verify that the file is saved. 
Double-click the *CKFiles.txt* icon on your desktop and copy/paste the contents in your next reply.

eddie


----------



## maggie88ca (Nov 19, 2006)

When I go to add/remove programs the toolbar uTorrentControl2 Community Toolbar is not in the list so I can't remove it that way. Would it help if I uninstalled utorrent completely and then reinstalled it if I need it?

Here is the CKfiles.txt...

CKScanner 2.1 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.RP.11.AXAAIH
----- EOF -----


----------



## eddie5659 (Mar 19, 2001)

If its not there, then just run the OTL fix as bove, as this will remove the toolbar. You can try uninstalling utorrent, then when installing again, when it gives the option for the toolbar, say no. But, if it doesn't, then just do the OTL fix instead


----------



## maggie88ca (Nov 19, 2006)

OK here is the latest OTL log....


========== FILES ==========
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\searchplugin folder moved successfully.
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\modules folder moved successfully.
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\META-INF folder moved successfully.
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\defaults folder moved successfully.
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components folder moved successfully.
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\chrome folder moved successfully.
C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03} folder moved successfully.
C:\Users\Ken\AppData\LocalLow\uTorrentControl2\CacheIcons\http___storage_conduit_com_53_307_CT3072253_images_634514692184142958_20PX_png.png moved successfully.
C:\Users\Ken\AppData\LocalLow\uTorrentControl2\CacheIcons\http___storage_conduit_com_53_307_CT3072253_Images_634520779497696087_png.png moved successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 04212013_223104


----------



## eddie5659 (Mar 19, 2001)

Excellent, the toolbar should now have gone 

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open *notepad* and copy/paste the text in the quotebox below into it:



> RegLock::
> [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
> [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
> [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
> ...


Save this as *CFScript.txt*, in the same location as ComboFix.exe










Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt* which I will require in your next reply.

eddie


----------



## maggie88ca (Nov 19, 2006)

Here is the latest combofix log.....

ComboFix 13-04-25.01 - Ken 25/04/2013 0:56.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.4008.1991 [GMT -4:00]
Running from: c:\users\Ken\Desktop\username123.exe
Command switches used :: c:\users\Ken\Desktop\CFScript.txt
AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: Norton 360 *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Infected copy of c:\windows\SysWow64\userinit.exe was found and disinfected 
Restored copy from - c:\username12330429u\HarddiskVolumeShadowCopy9_!Windows!SysWOW64!userinit.exe 
.
.
((((((((((((((((((((((((( Files Created from 2013-03-25 to 2013-04-25 )))))))))))))))))))))))))))))))
.
.
2013-04-25 05:08 . 2013-04-25 05:08	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-04-24 06:40 . 2013-04-12 14:45	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-17 21:13 . 2013-04-17 21:13	--------	d-----w-	C:\_OTL
2013-04-15 19:36 . 2013-04-15 19:36	--------	d-----w-	c:\program files (x86)\Common Files\Java
2013-04-15 19:35 . 2013-04-15 19:35	95648	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-14 22:38 . 2013-04-14 23:09	--------	d-----w-	C:\username123
2013-04-14 21:23 . 2013-04-14 21:23	--------	d-----w-	c:\program files (x86)\Microsoft SkyDrive
2013-04-14 21:23 . 2013-04-14 21:23	--------	d-----r-	c:\users\Ken\SkyDrive
2013-04-14 21:23 . 2013-04-14 21:19	5659096	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b3a3641a1ce395502\skydrivesetup.exe
2013-04-14 21:22 . 2013-04-14 21:22	--------	d-----w-	c:\programdata\Microsoft SkyDrive
2013-04-14 21:19 . 2013-04-14 21:19	525656	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b9face951ce395504\DXSETUP.exe
2013-04-14 21:19 . 2013-04-14 21:19	94040	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b9face951ce395504\DSETUP.dll
2013-04-14 21:19 . 2013-04-14 21:19	1691480	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b9face951ce395504\dsetup32.dll
2013-04-14 21:19 . 2013-04-14 21:19	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b7272c421ce395503\DSETUP.dll
2013-04-14 21:19 . 2013-04-14 21:19	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b7272c421ce395503\DXSETUP.exe
2013-04-14 21:19 . 2013-04-14 21:19	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b7272c421ce395503\dsetup32.dll
2013-04-14 21:19 . 2013-04-14 21:19	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b184aa5c1ce395501\DSETUP.dll
2013-04-14 21:19 . 2013-04-14 21:19	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b184aa5c1ce395501\DXSETUP.exe
2013-04-14 21:19 . 2013-04-14 21:19	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\b184aa5c1ce395501\dsetup32.dll
2013-04-11 22:25 . 2013-04-11 22:25	--------	d-----w-	c:\windows\ERUNT
2013-04-11 22:25 . 2013-04-11 22:25	--------	d-----w-	C:\JRT
2013-04-11 20:46 . 2013-04-11 20:46	--------	d-----w-	c:\program files\SUPERAntiSpyware
2013-04-11 20:37 . 2013-04-11 20:37	--------	d-----w-	c:\users\Ken\AppData\Roaming\SUPERAntiSpyware.com
2013-04-11 20:36 . 2013-04-11 20:36	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2013-04-11 20:33 . 2013-04-11 20:33	--------	d-----w-	c:\users\Ken\AppData\Roaming\Malwarebytes
2013-04-11 20:33 . 2013-04-11 20:33	--------	d-----w-	c:\programdata\Malwarebytes
2013-04-11 20:33 . 2013-04-11 20:33	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-04-11 20:33 . 2013-04-04 18:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-04-10 20:26 . 2013-02-19 11:42	2706432	----a-w-	c:\windows\system32\mshtml.tlb
2013-04-10 20:24 . 2012-05-04 11:00	366592	----a-w-	c:\windows\system32\qdvd.dll
2013-04-10 20:24 . 2012-05-04 09:59	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2013-04-10 20:24 . 2012-08-24 18:05	340992	----a-w-	c:\windows\system32\schannel.dll
2013-04-10 20:24 . 2012-08-24 18:13	154480	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2013-04-10 20:24 . 2012-08-24 18:09	458712	----a-w-	c:\windows\system32\drivers\cng.sys
2013-04-10 20:24 . 2012-08-24 18:03	1448448	----a-w-	c:\windows\system32\lsasrv.dll
2013-04-10 20:24 . 2012-08-24 16:57	247808	----a-w-	c:\windows\SysWow64\schannel.dll
2013-04-10 20:24 . 2012-08-24 16:57	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2013-04-10 20:24 . 2012-08-24 16:53	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2013-04-10 09:24 . 2013-03-01 03:36	3153408	----a-w-	c:\windows\system32\win32k.sys
2013-04-10 09:24 . 2013-01-24 06:01	223752	----a-w-	c:\windows\system32\drivers\fvevol.sys
2013-04-10 09:24 . 2013-03-19 06:04	5550424	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-04-10 09:24 . 2013-03-19 05:04	3968856	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 09:24 . 2013-03-19 05:04	3913560	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 09:24 . 2013-03-19 05:46	43520	----a-w-	c:\windows\system32\csrsrv.dll
2013-04-10 09:24 . 2013-03-19 04:47	6656	----a-w-	c:\windows\SysWow64\apisetschema.dll
2013-04-10 09:24 . 2013-03-19 03:06	112640	----a-w-	c:\windows\system32\smss.exe
2013-04-09 21:03 . 2013-04-09 21:03	310688	----a-w-	c:\windows\system32\javaws.exe
2013-04-09 21:03 . 2013-04-09 21:03	108448	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2013-04-09 21:03 . 2013-04-09 21:03	188832	----a-w-	c:\windows\system32\javaw.exe
2013-04-09 21:03 . 2013-04-09 21:03	188320	----a-w-	c:\windows\system32\java.exe
2013-04-09 01:05 . 2013-04-09 01:05	--------	d-----w-	c:\programdata\ClubSanDisk
2013-04-08 23:33 . 2013-04-16 20:49	--------	d-----w-	c:\windows\system32\drivers\N360x64\1403010.016
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-16 21:00 . 2012-04-06 15:19	691592	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-16 21:00 . 2012-01-31 17:15	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-15 19:34 . 2012-06-16 17:25	861088	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2013-04-15 19:34 . 2012-03-21 01:27	782240	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-04-10 20:30 . 2012-01-23 15:37	72702784	----a-w-	c:\windows\system32\MRT.exe
2013-04-09 21:03 . 2012-04-21 10:16	963488	----a-w-	c:\windows\system32\deployJava1.dll
2013-04-09 21:03 . 2012-04-21 10:16	1085344	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-03-17 20:49 . 2013-03-17 20:49	737072	----a-w-	c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2013-03-17 20:49 . 2013-03-17 20:49	48648	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2013-03-17 20:49 . 2013-03-17 20:49	573776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-03-04 18:24 . 2008-07-17 08:43	23552	----a-w-	c:\windows\xlkfs.dll
2013-02-25 14:12 . 2013-02-25 14:12	334000	----a-w-	c:\windows\system32\RaCoInstx.dll
2013-02-25 14:12 . 2013-02-25 14:12	2426672	----a-w-	c:\windows\system32\drivers\netr28x.sys
2013-02-12 05:45 . 2013-03-13 05:01	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 05:01	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 05:01	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 05:01	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 05:01	474112	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 05:01	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-13 09:21	19968	----a-w-	c:\windows\system32\drivers\usb8023x.sys
2013-02-12 04:12 . 2013-03-13 09:21	19968	----a-w-	c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-14 21:23	220632	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-14 21:23	220632	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-14 21:23	220632	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 5629312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2013-03-27 3363752]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-20 102368]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-01-14 29472]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 203104]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-23 1255736]
S0 asahci64;asahci64;c:\windows\system32\drivers\asahci64.sys [2011-01-30 36448]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1403010.016\SYMDS64.SYS [2013-01-22 493656]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1403010.016\SYMEFA64.SYS [2013-01-31 1139800]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2013-03-27 26176]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2012-06-18 44688]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2013-03-27 17384]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-04-12 1390680]
S1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\1403010.016\ccSetx64.sys [2012-11-16 168096]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130424.001\IDSvia64.sys [2012-12-28 513184]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1403010.016\Ironx64.SYS [2012-11-16 224416]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1403010.016\SYMNETS.SYS [2013-01-31 432800]
S1 xlkfs;xlkfs;c:\windows\system32\DRIVERS\xlkfs.sys [2012-05-05 30456]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]
S2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2013-03-27 3089856]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [2010-12-02 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 Device Handle Service;Device Handle Service;c:\windows\SysWOW64\AsHookDevice.exe [2009-12-23 203392]
S2 LxrSII1d;Secure II Driver;c:\windows\System32\Drivers\LxrSII1d.sys [2009-12-30 63064]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe [2012-12-24 144520]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2012-07-13 769432]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-01-14 32544]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2012-06-18 66320]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-02-24 126952]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-02-24 389608]
S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-12-30 138912]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-08-31 317440]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2013-02-25 2426672]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-24 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 45e9ad03-d86b-468e-9887-33a0ecb6d3cc.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2013-04-25 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 55fef781-c6af-4df9-859a-602f289731d9.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-14 21:23	244696	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-14 21:23	244696	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-14 21:23	244696	----a-w-	c:\users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\20.3.1.22\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\LxrSII1s.exe
c:\program files (x86)\ASUS\AI Suite II\AsRoutineController.exe
c:\program files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
c:\program files (x86)\ASUS\AI Suite II\AI Suite II.exe
c:\program files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2013-04-25 01:15:06 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-25 05:15
ComboFix2.txt 2013-04-14 23:09
.
Pre-Run: 469,084,930,048 bytes free
Post-Run: 469,134,143,488 bytes free
.
- - End Of File - - 1696CA9294F9CE65B657D7D7B4E1CA95


----------



## eddie5659 (Mar 19, 2001)

Okay, as you may have seen, an infected file has been replaced with a good one. Its strange, as the initial scan showed that file to be fine.

So, because of that, lets run some other tools.

The first one will produce a lengthy log, so posting over a few replies is fine 

------------

Please download the latest version of TDSSKiller from *here* and save it to your *Desktop*.

Doubleclick on *TDSSKiller.exe* to run the application, then click on *Change parameters.*








Put a checkmark beside *loaded modules*.








A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on *Change parameters* in TDSSKiller.
Check all boxes then click OK.








Click the *Start Scan* button.








The scan should take no longer than 2 minutes.
If a *suspicious object* is detected, the default action will be *Skip*, click on *Continue*.








 If *malicious objects* are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure *Cure* (default) is selected, then click *Continue* > *Reboot now to finish the cleaning process.*








*Note*: If *Cure* is not available, please choose *Skip* instead, do not choose *Delete* unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "*TDSSKiller.[Version]_[Date]_[Time]_log.txt*". Please copy and paste the contents of that file here.

-----------------

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror which will download a randomly named file
Zipped Mirror - Unzip the file to its own folder such as C:\gmer 
Disconnect from the Internet and close all running programs
Temporarily disable any real-time active protection
It is very important you do not use your computer while GMER is running
Double-click on the randomly named GMER







icon
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan
If you receive a warning about rootkit activity and are asked to fully scan your system click NO
Please check in the Quick scan box
Please uncheck the following:

IAT/EAT
Show All <<< Important









Click Scan
If you see a rootkit warning window click OK
When the scan is finished, Save the results to your desktop as gmer.log
Click Copy then paste the results in your reply
Exit GMER and be sure to re-enable your Antivirus, Firewall and any other security programs you had disabled

Note:

If you encounter any problems, try running GMER in Safe Mode
If GMER crashes or keeps resulting in a Blue Screen of Death, uncheck Devices on the right side before scanning

eddie


----------



## maggie88ca (Nov 19, 2006)

TDSSkiller log.....

21:45:12.0095 3752 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
21:45:12.0673 3752 ============================================================
21:45:12.0673 3752 Current date / time: 2013/04/25 21:45:12.0673
21:45:12.0673 3752 SystemInfo:
21:45:12.0673 3752 
21:45:12.0673 3752 OS Version: 6.1.7601 ServicePack: 1.0
21:45:12.0673 3752 Product type: Workstation
21:45:12.0673 3752 ComputerName: KEN-PC
21:45:12.0673 3752 UserName: Ken
21:45:12.0673 3752 Windows directory: C:\Windows
21:45:12.0673 3752 System windows directory: C:\Windows
21:45:12.0673 3752 Running under WOW64
21:45:12.0673 3752 Processor architecture: Intel x64
21:45:12.0673 3752 Number of processors: 4
21:45:12.0673 3752 Page size: 0x1000
21:45:12.0673 3752 Boot type: Normal boot
21:45:12.0673 3752 ============================================================
21:45:17.0056 3752 BG loaded
21:45:18.0959 3752 Drive \Device\Harddisk0\DR0 - Size: 0x15D50F66000 (1397.27 Gb), SectorSize: 0x200, Cylinders: 0x2C881, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:45:18.0975 3752 ============================================================
21:45:18.0975 3752 \Device\Harddisk0\DR0:
21:45:18.0975 3752 MBR partitions:
21:45:18.0975 3752 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1C5E800, BlocksNum 0x45DCF000
21:45:18.0975 3752 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x47A2D800, BlocksNum 0x67059800
21:45:18.0975 3752 ============================================================
21:45:19.0100 3752 C: <-> \Device\Harddisk0\DR0\Partition1
21:45:22.0198 3752 D: <-> \Device\Harddisk0\DR0\Partition2
21:45:22.0198 3752 ============================================================
21:45:22.0198 3752 Initialize success
21:45:22.0198 3752 ============================================================
21:46:44.0984 3376 ============================================================
21:46:44.0984 3376 Scan started
21:46:44.0984 3376 Mode: Manual; SigCheck; TDLFS; 
21:46:44.0984 3376 ============================================================
21:46:46.0997 3376 ================ Scan system memory ========================
21:46:46.0997 3376 System memory - ok
21:46:46.0997 3376 ================ Scan services =============================
21:46:47.0090 3376 [ 581D88B25C4D4121824FED2CA38E562F ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
21:46:47.0137 3376 !SASCORE - ok
21:46:47.0262 3376 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
21:46:47.0293 3376 1394ohci - ok
21:46:47.0355 3376 [ 2D6434E957F7CFA0035C20890F77BBC6 ] a2acc C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys
21:46:47.0387 3376 a2acc - ok
21:46:47.0449 3376 [ A7F08A73F2668FCD2B51A66751FA7FF3 ] a2AntiMalware C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
21:46:47.0496 3376 a2AntiMalware - ok
21:46:47.0511 3376 [ D27A8B7BB0E15DFBFC6B4E774EE17AD9 ] A2DDA C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys
21:46:47.0511 3376 A2DDA - ok
21:46:47.0527 3376 [ 3D55CE53128C81E06CD6B024C3B9FAC3 ] a2injectiondriver C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys
21:46:47.0527 3376 a2injectiondriver - ok
21:46:47.0543 3376 [ 0932B29AA1B9372FFE6D3AF8BA2ABA3A ] a2util C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys
21:46:47.0543 3376 a2util - ok
21:46:47.0574 3376 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
21:46:47.0574 3376 ACPI - ok
21:46:47.0605 3376 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
21:46:47.0652 3376 AcpiPmi - ok
21:46:47.0699 3376 [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:46:47.0699 3376 AdobeARMservice - ok
21:46:47.0745 3376 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
21:46:47.0761 3376 adp94xx - ok
21:46:47.0792 3376 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys
21:46:47.0808 3376 adpahci - ok
21:46:47.0808 3376 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
21:46:47.0823 3376 adpu320 - ok
21:46:47.0839 3376 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
21:46:47.0870 3376 AeLookupSvc - ok
21:46:47.0886 3376 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
21:46:47.0917 3376 AFD - ok
21:46:47.0933 3376 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
21:46:47.0933 3376 agp440 - ok
21:46:47.0948 3376 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
21:46:47.0964 3376 ALG - ok
21:46:47.0964 3376 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
21:46:47.0979 3376 aliide - ok
21:46:47.0995 3376 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
21:46:48.0011 3376 amdide - ok
21:46:48.0026 3376 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
21:46:48.0042 3376 AmdK8 - ok
21:46:48.0042 3376 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
21:46:48.0042 3376 AmdPPM - ok
21:46:48.0057 3376 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
21:46:48.0073 3376 amdsata - ok
21:46:48.0089 3376 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
21:46:48.0089 3376 amdsbs - ok
21:46:48.0104 3376 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
21:46:48.0120 3376 amdxata - ok
21:46:48.0120 3376  [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
21:46:48.0182 3376 AppID - ok
21:46:48.0198 3376 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
21:46:48.0229 3376 AppIDSvc - ok
21:46:48.0229 3376 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
21:46:48.0276 3376 Appinfo - ok
21:46:48.0307 3376 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:46:48.0307 3376 Apple Mobile Device - ok
21:46:48.0338 3376 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys
21:46:48.0354 3376 arc - ok
21:46:48.0354 3376 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys
21:46:48.0354 3376 arcsas - ok
21:46:48.0401 3376 [ C2E04941AE03F1203A064BCBB319965A ] asahci64 C:\Windows\system32\drivers\asahci64.sys
21:46:48.0416 3376 asahci64 - ok
21:46:48.0447 3376 [ FB03A917C1294D3E6D671F24722E1BA3 ] asComSvc C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
21:46:48.0463 3376 asComSvc - ok
21:46:48.0479 3376 [ A63173897EA1A73A75D0E65036DE5B15 ] asHmComSvc C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
21:46:48.0494 3376 asHmComSvc - ok
21:46:48.0572 3376 [ EDAA17CE771C696655B6585F7CAD2100 ] ASInsHelp C:\Windows\SysWow64\drivers\AsInsHelp64.sys
21:46:48.0588 3376 ASInsHelp - ok
21:46:48.0588 3376 [ FEF9DD9EA587F8886ADE43C1BEFBDAFE ] AsIO C:\Windows\syswow64\drivers\AsIO.sys
21:46:48.0603 3376 AsIO - ok
21:46:48.0619 3376 [ 954950D11ADA98AC1B7EE3C770E4622C ] asmthub3 C:\Windows\system32\DRIVERS\asmthub3.sys
21:46:48.0650 3376 asmthub3 - ok
21:46:48.0681 3376 [ 01DBB05DB1DB95803E3C9F2B49AFE79C ] asmtxhci C:\Windows\system32\DRIVERS\asmtxhci.sys
21:46:48.0697 3376 asmtxhci - ok
21:46:48.0759 3376 [ 5C31DFB196CB3A488A041881634D86D2 ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
21:46:48.0759 3376 AsSysCtrlService - ok
21:46:48.0775 3376 [ 1392B92179B07B672720763D9B1028A5 ] AsUpIO C:\Windows\syswow64\drivers\AsUpIO.sys
21:46:48.0775 3376 AsUpIO - ok
21:46:48.0791 3376 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
21:46:48.0837 3376 AsyncMac - ok
21:46:48.0837 3376 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
21:46:48.0853 3376 atapi - ok
21:46:48.0869 3376 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
21:46:48.0900 3376 AudioEndpointBuilder - ok
21:46:48.0915 3376 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
21:46:48.0947 3376 AudioSrv - ok
21:46:48.0978 3376 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
21:46:48.0993 3376 AxInstSV - ok
21:46:49.0009 3376 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
21:46:49.0025 3376 b06bdrv - ok
21:46:49.0025 3376 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
21:46:49.0040 3376 b57nd60a - ok
21:46:49.0056 3376 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
21:46:49.0071 3376 BDESVC - ok
21:46:49.0087 3376 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
21:46:49.0118 3376 Beep - ok
21:46:49.0149 3376 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
21:46:49.0181 3376 BFE - ok
21:46:49.0290 3376 [ 7B56A40EAAACF1867FF178501D3EA185 ] BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx64.sys
21:46:49.0305 3376 BHDrvx64 - ok
21:46:49.0352 3376 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll
21:46:49.0383 3376 BITS - ok
21:46:49.0415 3376 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
21:46:49.0430 3376 blbdrive - ok
21:46:49.0477 3376 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
21:46:49.0493 3376 Bonjour Service - ok
21:46:49.0493 3376 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
21:46:49.0524 3376 bowser - ok
21:46:49.0524 3376 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
21:46:49.0555 3376 BrFiltLo - ok
21:46:49.0555 3376 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
21:46:49.0555 3376 BrFiltUp - ok
21:46:49.0586 3376 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
21:46:49.0602 3376 BridgeMP - ok
21:46:49.0633 3376 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
21:46:49.0649 3376 Browser - ok
21:46:49.0664 3376 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
21:46:49.0711 3376 Brserid - ok
21:46:49.0727 3376 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
21:46:49.0742 3376 BrSerWdm - ok
21:46:49.0758 3376 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
21:46:49.0758 3376 BrUsbMdm - ok
21:46:49.0773 3376 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
21:46:49.0773 3376 BrUsbSer - ok
21:46:49.0789 3376 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
21:46:49.0789 3376 BTHMODEM - ok
21:46:49.0820 3376 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
21:46:49.0836 3376 bthserv - ok
21:46:49.0851 3376 catchme - ok
21:46:49.0929 3376 [ 248C952C82DF1E23775432774CBB20F1 ] ccSet_N360 C:\Windows\system32\drivers\N360x64\1403010.016\ccSetx64.sys
21:46:49.0929 3376 ccSet_N360 - ok
21:46:49.0945 3376 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
21:46:49.0976 3376 cdfs - ok
21:46:50.0007 3376 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
21:46:50.0023 3376 cdrom - ok
21:46:50.0039 3376 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
21:46:50.0070 3376 CertPropSvc - ok
21:46:50.0070 3376 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys
21:46:50.0085 3376 circlass - ok
21:46:50.0101 3376 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
21:46:50.0117 3376 CLFS - ok
21:46:50.0179 3376 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:46:50.0195 3376 clr_optimization_v2.0.50727_32 - ok
21:46:50.0241 3376 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:46:50.0241 3376 clr_optimization_v2.0.50727_64 - ok
21:46:50.0288 3376 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:46:50.0335 3376 clr_optimization_v4.0.30319_32 - ok
21:46:50.0366 3376 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:46:50.0382 3376 clr_optimization_v4.0.30319_64 - ok
21:46:50.0382 3376 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
21:46:50.0397 3376 CmBatt - ok
21:46:50.0397 3376 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
21:46:50.0413 3376 cmdide - ok
21:46:50.0429 3376 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\Windows\system32\Drivers\cng.sys
21:46:50.0460 3376 CNG - ok
21:46:50.0460 3376 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
21:46:50.0460 3376 Compbatt - ok
21:46:50.0491 3376 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
21:46:50.0491 3376 CompositeBus - ok
21:46:50.0507 3376 COMSysApp - ok
21:46:50.0538 3376 [ 815F3180B5117E42E422188E9CCC89C6 ] cphs C:\Windows\SysWow64\IntelCpHeciSvc.exe
21:46:50.0538 3376 cphs - ok
21:46:50.0553 3376 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
21:46:50.0553 3376 crcdisk - ok
21:46:50.0585 3376 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
21:46:50.0600 3376 CryptSvc - ok
21:46:50.0663 3376 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
21:46:50.0678 3376 cvhsvc - ok
21:46:50.0725 3376 [ 7AF9DAC504FBD047CBC3E64AE52C92BF ] dc3d C:\Windows\system32\DRIVERS\dc3d.sys
21:46:50.0741 3376 dc3d - ok
21:46:50.0772 3376 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
21:46:50.0803 3376 DcomLaunch - ok
21:46:50.0834 3376 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
21:46:50.0897 3376 defragsvc - ok
21:46:50.0912 3376 [ 0A403702CB00432AC818523CD416BF67 ] Device Handle Service C:\Windows\SysWOW64\AsHookDevice.exe
21:46:50.0912 3376 Device Handle Service - ok
21:46:50.0928 3376 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
21:46:50.0959 3376 DfsC - ok
21:46:50.0975 3376 [ B9430166FEB246F6070A62B3554932C9 ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys
21:46:50.0990 3376 dg_ssudbus - ok
21:46:51.0021 3376 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
21:46:51.0037 3376 Dhcp - ok
21:46:51.0053 3376 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
21:46:51.0084 3376 discache - ok
21:46:51.0099 3376 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys
21:46:51.0115 3376 Disk - ok
21:46:51.0131 3376 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
21:46:51.0146 3376 Dnscache - ok
21:46:51.0177 3376 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
21:46:51.0209 3376 dot3svc - ok
21:46:51.0224 3376 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
21:46:51.0255 3376 DPS - ok
21:46:51.0287 3376 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
21:46:51.0302 3376 drmkaud - ok
21:46:51.0333 3376 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
21:46:51.0349 3376 DXGKrnl - ok
21:46:51.0349 3376 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
21:46:51.0380 3376 EapHost - ok
21:46:51.0443 3376 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys
21:46:51.0521 3376 ebdrv - ok
21:46:51.0567 3376 [ 4353FF94D47A0A9D52B89ECCF0CDB013 ] eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
21:46:51.0567 3376 eeCtrl - ok
21:46:51.0599 3376 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
21:46:51.0614 3376 EFS - ok
21:46:51.0677 3376 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
21:46:51.0708 3376 ehRecvr - ok
21:46:51.0708 3376 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
21:46:51.0723 3376 ehSched - ok
21:46:51.0739 3376 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys
21:46:51.0755 3376 elxstor - ok
21:46:51.0801 3376 [ C5BCCB378D0A896304A3E71BE7215983 ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
21:46:51.0817 3376 EraserUtilRebootDrv - ok
21:46:51.0817 3376 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
21:46:51.0848 3376 ErrDev - ok
21:46:51.0864 3376 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
21:46:51.0895 3376 EventSystem - ok
21:46:51.0895 3376 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
21:46:51.0926 3376 exfat - ok
21:46:51.0942 3376 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
21:46:51.0973 3376 fastfat - ok
21:46:52.0004 3376 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
21:46:52.0020 3376 Fax - ok
21:46:52.0035 3376 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys
21:46:52.0051 3376 fdc - ok
21:46:52.0067 3376 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
21:46:52.0082 3376 fdPHost - ok
21:46:52.0098 3376 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
21:46:52.0129 3376 FDResPub - ok
21:46:52.0145 3376 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
21:46:52.0160 3376 FileInfo - ok
21:46:52.0160 3376 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
21:46:52.0191 3376 Filetrace - ok
21:46:52.0207 3376 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
21:46:52.0223 3376 flpydisk - ok
21:46:52.0238 3376 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
21:46:52.0238 3376 FltMgr - ok
21:46:52.0285 3376 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\Windows\system32\FntCache.dll
21:46:52.0316 3376 FontCache - ok
21:46:52.0363 3376 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:46:52.0379 3376 FontCache3.0.0.0 - ok
21:46:52.0379 3376 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
21:46:52.0394 3376 FsDepends - ok
21:46:52.0425 3376 [ 07DA62C960DDCCC2D35836AEAB4FC578 ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys
21:46:52.0425 3376 fssfltr - ok
21:46:52.0503 3376 [ 28DDEEEC44E988657B732CF404D504CB ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
21:46:52.0519 3376 fsssvc - ok
21:46:52.0550 3376 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
21:46:52.0550 3376 Fs_Rec - ok
21:46:52.0581 3376 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
21:46:52.0597 3376 fvevol - ok
21:46:52.0597 3376 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
21:46:52.0613 3376 gagp30kx - ok
21:46:52.0644 3376 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:46:52.0659 3376 GEARAspiWDM - ok
21:46:52.0675 3376 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
21:46:52.0706 3376 gpsvc - ok
21:46:52.0722 3376 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
21:46:52.0753 3376 hcw85cir - ok
21:46:52.0784 3376 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
21:46:52.0815 3376 HdAudAddService - ok
21:46:52.0831 3376 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
21:46:52.0862 3376 HDAudBus - ok
21:46:52.0862 3376 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
21:46:52.0878 3376 HidBatt - ok
21:46:52.0893 3376 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys
21:46:52.0909 3376 HidBth - ok
21:46:52.0925 3376 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys
21:46:52.0940 3376 HidIr - ok
21:46:52.0956 3376 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll
21:46:52.0987 3376 hidserv - ok
21:46:53.0003 3376 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
21:46:53.0018 3376 HidUsb - ok
21:46:53.0034 3376 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
21:46:53.0065 3376 hkmsvc - ok
21:46:53.0081 3376 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
21:46:53.0096 3376 HomeGroupListener - ok
21:46:53.0127 3376 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
21:46:53.0143 3376 HomeGroupProvider - ok
21:46:53.0143 3376 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
21:46:53.0143 3376 HpSAMD - ok
21:46:53.0174 3376 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
21:46:53.0205 3376 HTTP - ok
21:46:53.0221 3376 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
21:46:53.0237 3376 hwpolicy - ok
21:46:53.0252 3376 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
21:46:53.0268 3376 i8042prt - ok
21:46:53.0283 3376 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
21:46:53.0299 3376 iaStorV - ok
21:46:53.0330 3376 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:46:53.0346 3376 idsvc - ok
21:46:53.0471 3376 [ A48928D4CCA6F8B731989DB08CF2C0AB ] IDSVia64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130425.001\IDSvia64.sys
21:46:53.0471 3376 IDSVia64 - ok
21:46:53.0580 3376 [ 348214F96642FD4FEF630DE021BA3540 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
21:46:53.0658 3376 igfx - ok
21:46:53.0673 3376 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys
21:46:53.0689 3376 iirsp - ok
21:46:53.0705 3376 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
21:46:53.0736 3376 IKEEXT - ok
21:46:53.0814 3376 [ 589B94A9B73A0E819FF873743A480834 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
21:46:53.0845 3376 IntcAzAudAddService - ok
21:46:53.0892 3376 [ 4429B91B0FE91F9BE8E24E93CC960368 ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
21:46:53.0907 3376 IntcDAud - ok
21:46:53.0923 3376 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
21:46:53.0923 3376 intelide - ok
21:46:53.0954 3376 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
21:46:53.0970 3376 intelppm - ok
21:46:53.0985 3376 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
21:46:54.0017 3376 IPBusEnum - ok
21:46:54.0017 3376 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:46:54.0095 3376 IpFilterDriver - ok
21:46:54.0110 3376 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
21:46:54.0126 3376 iphlpsvc - ok
21:46:54.0126 3376 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
21:46:54.0141 3376 IPMIDRV - ok
21:46:54.0157 3376 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
21:46:54.0188 3376 IPNAT - ok
21:46:54.0266 3376 [ A9AB99EE7D39725EAFEC82732D2B3271 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
21:46:54.0282 3376 iPod Service - ok
21:46:54.0282 3376 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
21:46:54.0297 3376 IRENUM - ok
21:46:54.0313 3376 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
21:46:54.0329 3376 isapnp - ok
21:46:54.0344 3376 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
21:46:54.0360 3376 iScsiPrt - ok
21:46:54.0375 3376 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
21:46:54.0391 3376 kbdclass - ok
21:46:54.0422 3376 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
21:46:54.0438 3376 kbdhid - ok
21:46:54.0438 3376 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
21:46:54.0453 3376 KeyIso - ok
21:46:54.0469 3376 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
21:46:54.0469 3376 KSecDD - ok
21:46:54.0500 3376 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
21:46:54.0500 3376 KSecPkg - ok
21:46:54.0516 3376 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
21:46:54.0563 3376 ksthunk - ok
21:46:54.0578 3376 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
21:46:54.0625 3376 KtmRm - ok
21:46:54.0641 3376 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll
21:46:54.0687 3376 LanmanServer - ok
21:46:54.0703 3376 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
21:46:54.0734 3376 LanmanWorkstation - ok
21:46:54.0750 3376 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
21:46:54.0781 3376 lltdio - ok
21:46:54.0797 3376 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
21:46:54.0859 3376 lltdsvc - ok
21:46:54.0875 3376 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
21:46:54.0906 3376 lmhosts - ok
21:46:54.0953 3376 [ 98B16E756243BEA9410E32025B19C06F ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:46:54.0968 3376 LMS - ok
21:46:54.0984 3376 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
21:46:54.0999 3376 LSI_FC - ok
21:46:54.0999 3376 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
21:46:55.0015 3376 LSI_SAS - ok
21:46:55.0031 3376 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
21:46:55.0031 3376 LSI_SAS2 - ok
21:46:55.0046 3376 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
21:46:55.0062 3376 LSI_SCSI - ok
21:46:55.0077 3376 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
21:46:55.0109 3376 luafv - ok
21:46:55.0140 3376 [ 9DB17B1DD76CF0FD0BB3DA5F1DA078C2 ] LxrSII1d C:\Windows\System32\Drivers\LxrSII1d.sys
21:46:55.0155 3376 LxrSII1d - ok
21:46:55.0171 3376 LxrSII1s - ok
21:46:55.0187 3376 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
21:46:55.0202 3376 Mcx2Svc - ok
21:46:55.0202 3376 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys
21:46:55.0202 3376 megasas - ok
21:46:55.0218 3376 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
21:46:55.0233 3376 MegaSR - ok
21:46:55.0249 3376 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\drivers\HECIx64.sys
21:46:55.0265 3376 MEIx64 - ok
21:46:55.0280 3376 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
21:46:55.0296 3376 MMCSS - ok
21:46:55.0311 3376 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
21:46:55.0343 3376 Modem - ok
21:46:55.0358 3376 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
21:46:55.0358 3376 monitor - ok
21:46:55.0374 3376 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
21:46:55.0389 3376 mouclass - ok
21:46:55.0405 3376 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
21:46:55.0405 3376 mouhid - ok
21:46:55.0421 3376 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
21:46:55.0436 3376 mountmgr - ok
21:46:55.0436 3376 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
21:46:55.0452 3376 mpio - ok
21:46:55.0467 3376 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
21:46:55.0499 3376 mpsdrv - ok
21:46:55.0514 3376 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
21:46:55.0545 3376 MpsSvc - ok
21:46:55.0577 3376 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
21:46:55.0592 3376 MRxDAV - ok
21:46:55.0623 3376 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
21:46:55.0655 3376 mrxsmb - ok
21:46:55.0670 3376 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:46:55.0686 3376 mrxsmb10 - ok
21:46:55.0701 3376 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:46:55.0701 3376 mrxsmb20 - ok
21:46:55.0717 3376 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
21:46:55.0733 3376 msahci - ok
21:46:55.0733 3376 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
21:46:55.0748 3376 msdsm - ok
21:46:55.0764 3376 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
21:46:55.0779 3376 MSDTC - ok
21:46:55.0779 3376 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
21:46:55.0811 3376 Msfs - ok
21:46:55.0826 3376 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
21:46:55.0857 3376 mshidkmdf - ok
21:46:55.0873 3376 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
21:46:55.0889 3376 msisadrv - ok
21:46:55.0904 3376 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
21:46:55.0935 3376 MSiSCSI - ok
21:46:55.0935 3376 msiserver - ok
21:46:55.0951 3376 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
21:46:55.0982 3376 MSKSSRV - ok
21:46:55.0982 3376 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
21:46:56.0045 3376 MSPCLOCK - ok
21:46:56.0060 3376 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
21:46:56.0091 3376 MSPQM - ok
21:46:56.0107 3376 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
21:46:56.0123 3376 MsRPC - ok
21:46:56.0123 3376 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
21:46:56.0138 3376 mssmbios - ok
21:46:56.0138 3376 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
21:46:56.0154 3376 MSTEE - ok
21:46:56.0154 3376 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
21:46:56.0169 3376 MTConfig - ok
21:46:56.0185 3376 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
21:46:56.0185 3376 Mup - ok
21:46:56.0247 3376 [ 241BD3019FB31E812A51B31B06906335 ] N360 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe
21:46:56.0263 3376 N360 - ok
21:46:56.0294 3376 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
21:46:56.0325 3376 napagent - ok
21:46:56.0357 3376 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
21:46:56.0372 3376 NativeWifiP - ok
21:46:56.0450 3376 [ E0E4A1F81A7D69C595A8A9DDAD084C19 ] NAUpdate C:\Program Files (x86)\Nero\Update\NASvc.exe
21:46:56.0466 3376 NAUpdate - ok
21:46:56.0544 3376 [ 88A2F45CE66B904285978D6BB13AFEB2 ] NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130425.009\ENG64.SYS
21:46:56.0544 3376 NAVENG - ok
21:46:56.0606 3376 [ D2A545DA3A90BBFA40E020C23F1B7A48 ] NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130425.009\EX64.SYS
21:46:56.0653 3376 NAVEX15 - ok
21:46:56.0700 3376 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
21:46:56.0715 3376 NDIS - ok
21:46:56.0731 3376 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
21:46:56.0762 3376 NdisCap - ok
21:46:56.0793 3376 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
21:46:56.0809 3376 NdisTapi - ok
21:46:56.0825 3376 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
21:46:56.0840 3376 Ndisuio - ok
21:46:56.0840 3376 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
21:46:56.0871 3376 NdisWan - ok
21:46:56.0887 3376 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
21:46:56.0918 3376 NDProxy - ok
21:46:56.0949 3376 [ DC6530A291D4BDF6DF399F1F128E7F8F ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
21:46:56.0949 3376 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
21:46:56.0949 3376 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
21:46:56.0965 3376 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
21:46:56.0981 3376 NetBIOS - ok
21:46:56.0996 3376 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
21:46:57.0043 3376 NetBT - ok
21:46:57.0043 3376 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
21:46:57.0059 3376 Netlogon - ok
21:46:57.0105 3376 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
21:46:57.0137 3376 Netman - ok
21:46:57.0152 3376 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
21:46:57.0183 3376 netprofm - ok
21:46:57.0246 3376 [ 8CE69B2C4934A1C0321F4C8E9C6C4A41 ] netr28x C:\Windows\system32\DRIVERS\netr28x.sys
21:46:57.0277 3376 netr28x - ok
21:46:57.0293 3376 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:46:57.0308 3376 NetTcpPortSharing - ok
21:46:57.0324 3376 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
21:46:57.0339 3376 nfrd960 - ok
21:46:57.0355 3376 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
21:46:57.0371 3376 NlaSvc - ok
21:46:57.0371 3376 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
21:46:57.0402 3376 Npfs - ok
21:46:57.0417 3376 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
21:46:57.0433 3376 nsi - ok
21:46:57.0449 3376 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
21:46:57.0480 3376 nsiproxy - ok
21:46:57.0542 3376 [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
21:46:57.0573 3376 Ntfs - ok
21:46:57.0605 3376 [ 317020D31F1696334679B9D0416EB62E ] NuidFltr C:\Windows\system32\DRIVERS\NuidFltr.sys
21:46:57.0605 3376 NuidFltr - ok
21:46:57.0620 3376 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
21:46:57.0651 3376  Null - ok
21:46:57.0667 3376 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
21:46:57.0667 3376 nvraid - ok
21:46:57.0698 3376 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
21:46:57.0714 3376 nvstor - ok
21:46:57.0745 3376 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
21:46:57.0745 3376 nv_agp - ok
21:46:57.0761 3376 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
21:46:57.0776 3376 ohci1394 - ok
21:46:57.0839 3376 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:46:57.0839 3376 ose - ok
21:46:57.0963 3376 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:46:58.0073 3376 osppsvc - ok
21:46:58.0104 3376 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
21:46:58.0104 3376 p2pimsvc - ok
21:46:58.0135 3376 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
21:46:58.0151 3376 p2psvc - ok
21:46:58.0166 3376 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys
21:46:58.0166 3376 Parport - ok
21:46:58.0197 3376 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
21:46:58.0213 3376 partmgr - ok
21:46:58.0213 3376 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
21:46:58.0229 3376 PcaSvc - ok
21:46:58.0260 3376 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
21:46:58.0260 3376 pci - ok
21:46:58.0275 3376 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
21:46:58.0275 3376 pciide - ok
21:46:58.0307 3376 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
21:46:58.0322 3376 pcmcia - ok
21:46:58.0322 3376 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
21:46:58.0338 3376 pcw - ok
21:46:58.0353 3376 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
21:46:58.0400 3376 PEAUTH - ok
21:46:58.0463 3376 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
21:46:58.0463 3376 PerfHost - ok
21:46:58.0509 3376 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
21:46:58.0556 3376 pla - ok
21:46:58.0587 3376 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
21:46:58.0587 3376 PlugPlay - ok
21:46:58.0619 3376 [ 71F62C51DFDFBC04C83C5C64B2B8058E ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
21:46:58.0619 3376 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
21:46:58.0619 3376 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
21:46:58.0634 3376 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
21:46:58.0650 3376 PNRPAutoReg - ok
21:46:58.0665 3376 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
21:46:58.0665 3376 PNRPsvc - ok
21:46:58.0697 3376 [ 4F0878FD62D5F7444C5F1C4C66D9D293 ] Point64 C:\Windows\system32\DRIVERS\point64.sys
21:46:58.0697 3376 Point64 - ok
21:46:58.0728 3376 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
21:46:58.0759 3376 PolicyAgent - ok
21:46:58.0790 3376 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
21:46:58.0837 3376 Power - ok
21:46:58.0853 3376 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
21:46:58.0884 3376 PptpMiniport - ok
21:46:58.0899 3376 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys
21:46:58.0899 3376 Processor - ok
21:46:58.0931 3376 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
21:46:58.0946 3376 ProfSvc - ok
21:46:58.0962 3376 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
21:46:58.0962 3376 ProtectedStorage - ok
21:46:58.0977 3376 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
21:46:59.0009 3376 Psched - ok
21:46:59.0040 3376 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
21:46:59.0071 3376 ql2300 - ok
21:46:59.0071 3376 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
21:46:59.0087 3376 ql40xx - ok
21:46:59.0102 3376 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
21:46:59.0118 3376 QWAVE - ok
21:46:59.0118 3376 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
21:46:59.0133 3376 QWAVEdrv - ok
21:46:59.0149 3376 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
21:46:59.0165 3376 RasAcd - ok
21:46:59.0180 3376 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
21:46:59.0227 3376 RasAgileVpn - ok
21:46:59.0243 3376 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
21:46:59.0258 3376 RasAuto - ok
21:46:59.0289 3376 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
21:46:59.0336 3376 Rasl2tp - ok
21:46:59.0352 3376 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
21:46:59.0383 3376 RasMan - ok
21:46:59.0399 3376 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
21:46:59.0430 3376 RasPppoe - ok
21:46:59.0445 3376 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
21:46:59.0477 3376 RasSstp - ok
21:46:59.0492 3376 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
21:46:59.0523 3376 rdbss - ok
21:46:59.0539 3376 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\drivers\rdpbus.sys
21:46:59.0555 3376 rdpbus - ok
21:46:59.0570 3376 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
21:46:59.0601 3376 RDPCDD - ok
21:46:59.0617 3376 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
21:46:59.0648 3376 RDPENCDD - ok
21:46:59.0664 3376 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
21:46:59.0679 3376 RDPREFMP - ok
21:46:59.0757 3376 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
21:46:59.0773 3376 RdpVideoMiniport - ok
21:46:59.0789 3376 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
21:46:59.0820 3376 RDPWD - ok
21:46:59.0835 3376 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
21:46:59.0835 3376 rdyboost - ok
21:46:59.0851 3376 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
21:46:59.0882 3376 RemoteAccess - ok
21:46:59.0913 3376 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
21:46:59.0945 3376 RemoteRegistry - ok
21:46:59.0991 3376 [ AD42432D22940B4215177BE113E4919C ] RimUsb C:\Windows\system32\Drivers\RimUsb_AMD64.sys
21:46:59.0991 3376 RimUsb - ok
21:47:00.0007 3376 [ 4AAFFFA67AC4DFA3D9985D78573887E2 ] RimVSerPort C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys
21:47:00.0023 3376 RimVSerPort - ok
21:47:00.0038 3376 [ 388D3DD1A6457280F3BADBA9F3ACD6B1 ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys
21:47:00.0069 3376 ROOTMODEM - ok
21:47:00.0085 3376 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
21:47:00.0116 3376 RpcEptMapper - ok
21:47:00.0132 3376 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
21:47:00.0132 3376 RpcLocator - ok
21:47:00.0147 3376 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\System32\rpcss.dll
21:47:00.0179 3376 RpcSs - ok
21:47:00.0194 3376 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
21:47:00.0225 3376 rspndr - ok
21:47:00.0257 3376 [ EE082E06A82FF630351D1E0EBBD3D8D0 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
21:47:00.0272 3376 RTL8167 - ok
21:47:00.0288 3376 [ E16B7C030A05EF649B18FAB0A93D871F ] RtNdPt60 C:\Windows\system32\DRIVERS\RtNdPt60.sys
21:47:00.0288 3376 RtNdPt60 - ok
21:47:00.0303 3376 [ 1DE78F5008120CD79B34C12394DCD493 ] RTTEAMPT C:\Windows\system32\DRIVERS\RtTeam60.sys
21:47:00.0303 3376 RTTEAMPT - ok
21:47:00.0319 3376 [ B1018AA1B5735F5FA89FD4DADF4BEA7A ] RTVLANPT C:\Windows\system32\DRIVERS\RtVlan60.sys
21:47:00.0319 3376 RTVLANPT - ok
21:47:00.0335 3376 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
21:47:00.0350 3376 SamSs - ok
21:47:00.0381 3376 [ 3289766038DB2CB14D07DC84392138D5 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
21:47:00.0397 3376 SASDIFSV - ok
21:47:00.0428 3376 [ 58A38E75F3316A83C23DF6173D41F2B5 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
21:47:00.0444 3376 SASKUTIL - ok
21:47:00.0459 3376 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
21:47:00.0459 3376 sbp2port - ok
21:47:00.0475 3376 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
21:47:00.0506 3376 SCardSvr - ok
21:47:00.0522 3376 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
21:47:00.0537 3376 scfilter - ok
21:47:00.0569 3376 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
21:47:00.0600 3376 Schedule - ok
21:47:00.0615 3376 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
21:47:00.0647 3376 SCPolicySvc - ok
21:47:00.0647 3376 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
21:47:00.0662 3376 SDRSVC - ok
21:47:00.0678 3376 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
21:47:00.0709 3376 secdrv - ok
21:47:00.0725 3376 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
21:47:00.0771 3376 seclogon - ok
21:47:00.0787 3376 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll
21:47:00.0818 3376 SENS - ok
21:47:00.0834 3376 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
21:47:00.0849 3376 SensrSvc - ok
21:47:00.0849 3376 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\drivers\serenum.sys
21:47:00.0865 3376 Serenum - ok
21:47:00.0881 3376 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\drivers\serial.sys
21:47:00.0912 3376 Serial - ok
21:47:00.0927 3376 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys
21:47:00.0943 3376 sermouse - ok
21:47:00.0959 3376 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
21:47:00.0990 3376 SessionEnv - ok
21:47:00.0990 3376 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
21:47:01.0005 3376 sffdisk - ok
21:47:01.0021 3376 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
21:47:01.0021 3376 sffp_mmc - ok
21:47:01.0037 3376 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
21:47:01.0052 3376 sffp_sd - ok
21:47:01.0068 3376 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
21:47:01.0068 3376 sfloppy - ok
21:47:01.0115 3376 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys
21:47:01.0115 3376 Sftfs - ok
21:47:01.0161 3376 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
21:47:01.0177 3376 sftlist - ok
21:47:01.0193 3376 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys
21:47:01.0193 3376 Sftplay - ok
21:47:01.0208 3376 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys
21:47:01.0208 3376 Sftredir - ok
21:47:01.0224 3376 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys
21:47:01.0239 3376 Sftvol - ok
21:47:01.0239 3376 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
21:47:01.0255 3376 sftvsa - ok
21:47:01.0286 3376 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
21:47:01.0317 3376 SharedAccess - ok
21:47:01.0333 3376 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
21:47:01.0380 3376 ShellHWDetection - ok
21:47:01.0380 3376 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
21:47:01.0395 3376 SiSRaid2 - ok
21:47:01.0395 3376 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
21:47:01.0411 3376 SiSRaid4 - ok
21:47:01.0411 3376 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
21:47:01.0458 3376 Smb - ok
21:47:01.0489 3376 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
21:47:01.0505 3376 SNMPTRAP - ok
21:47:01.0520 3376 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
21:47:01.0520 3376 spldr - ok
21:47:01.0551 3376 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
21:47:01.0567 3376 Spooler - ok
21:47:01.0629 3376 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
21:47:01.0676 3376 sppsvc - ok
21:47:01.0707 3376 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
21:47:01.0739 3376 sppuinotify - ok
21:47:01.0801 3376 [ 378A0748DE5ADF90BF9DB897DA8564E6 ] SRTSP C:\Windows\System32\Drivers\N360x64\1403010.016\SRTSP64.SYS
21:47:01.0817 3376 SRTSP - ok
21:47:01.0832 3376 [ 0E76CEF892C45734F7AED09FDDF35D4D ] SRTSPX C:\Windows\system32\drivers\N360x64\1403010.016\SRTSPX64.SYS
21:47:01.0848 3376 SRTSPX - ok
21:47:01.0863 3376 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
21:47:01.0879 3376 srv - ok
21:47:01.0895 3376 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
21:47:01.0926 3376 srv2 - ok
21:47:01.0941 3376 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
21:47:01.0941 3376 srvnet - ok
21:47:01.0973 3376 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
21:47:02.0004 3376 SSDPSRV - ok
21:47:02.0019 3376 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
21:47:02.0051 3376 SstpSvc - ok
21:47:02.0082 3376 [ C692C94FE55CAD0633440236022C27B3 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys
21:47:02.0082 3376 ssudmdm - ok
21:47:02.0097 3376 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys
21:47:02.0113 3376 stexstor - ok
21:47:02.0144 3376 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
21:47:02.0160 3376 stisvc - ok
21:47:02.0175 3376 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
21:47:02.0191 3376 swenum - ok
21:47:02.0207 3376 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
21:47:02.0253 3376 swprv - ok
21:47:02.0269 3376 [ E174C8BC572E93AEEE1036DEDAC5F225 ] SymDS C:\Windows\system32\drivers\N360x64\1403010.016\SYMDS64.SYS
21:47:02.0285 3376 SymDS - ok
21:47:02.0300 3376 [ 599872BAD7CFB45C7CE47CDED4B726D8 ] SymEFA C:\Windows\system32\drivers\N360x64\1403010.016\SYMEFA64.SYS
21:47:02.0331 3376 SymEFA - ok
21:47:02.0363 3376 [ F5D6D3B7468C46EA2DDC1D19D2A6DA0F ] SymEvent C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
21:47:02.0378 3376 SymEvent - ok
21:47:02.0394 3376 [ ADF37F1A715D6C56C8E065FD8569A9A4 ] SymIRON C:\Windows\system32\drivers\N360x64\1403010.016\Ironx64.SYS
21:47:02.0409 3376 SymIRON - ok
21:47:02.0425 3376 [ 1605EBD8CB86AFC4430116065995279A ] SymNetS C:\Windows\System32\Drivers\N360x64\1403010.016\SYMNETS.SYS
21:47:02.0441 3376 SymNetS - ok
21:47:02.0487 3376 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
21:47:02.0519 3376 SysMain - ok
21:47:02.0534 3376 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
21:47:02.0550 3376 TabletInputService - ok
21:47:02.0565 3376 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
21:47:02.0597 3376 TapiSrv - ok
21:47:02.0612 3376 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
21:47:02.0628 3376 TBS - ok
21:47:02.0690 3376 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
21:47:02.0737 3376 Tcpip - ok
21:47:02.0753 3376 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
21:47:02.0784 3376 TCPIP6 - ok
21:47:02.0815 3376 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
21:47:02.0815 3376 tcpipreg - ok
21:47:02.0831 3376 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
21:47:02.0862 3376 TDPIPE - ok
21:47:02.0877 3376 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
21:47:02.0893 3376 TDTCP - ok
21:47:02.0909 3376 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
21:47:02.0924 3376 tdx - ok
21:47:02.0940 3376 [ 1DE78F5008120CD79B34C12394DCD493 ] TEAM C:\Windows\system32\DRIVERS\RtTeam60.sys
21:47:02.0940 3376 TEAM - ok
21:47:02.0971 3376 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
21:47:02.0971 3376 TermDD - ok
21:47:02.0987 3376 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
21:47:03.0033 3376 TermService - ok
21:47:03.0033 3376 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
21:47:03.0049 3376 Themes - ok
21:47:03.0080 3376 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
21:47:03.0096 3376 THREADORDER - ok
21:47:03.0111 3376 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
21:47:03.0143 3376 TrkWks - ok
21:47:03.0189 3376 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
21:47:03.0221 3376 TrustedInstaller - ok
21:47:03.0221 3376 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
21:47:03.0252 3376 tssecsrv - ok
21:47:03.0267 3376 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
21:47:03.0283 3376 TsUsbFlt - ok
21:47:03.0299 3376 [ AD64450A4ABE076F5CB34CC08EEACB07 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
21:47:03.0314 3376 TsUsbGD - ok
21:47:03.0330 3376 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
21:47:03.0361 3376 tunnel - ok
21:47:03.0392 3376 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
21:47:03.0392 3376 uagp35 - ok
21:47:03.0408 3376 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
21:47:03.0455 3376 udfs - ok
21:47:03.0470 3376 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
21:47:03.0486 3376 UI0Detect - ok
21:47:03.0517 3376 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
21:47:03.0517 3376 uliagpkx - ok
21:47:03.0548 3376 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
21:47:03.0564 3376 umbus - ok
21:47:03.0579 3376 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys
21:47:03.0595 3376 UmPass - ok
21:47:03.0907 3376 [ 7A78ED1088890114DFDE2C4AB038D6B6 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:47:03.0938 3376 UNS - ok
21:47:04.0079 3376 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
21:47:04.0110 3376 upnphost - ok
21:47:04.0157 3376 [ FB251567F41BC61988B26731DEC19E4B ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
21:47:04.0172 3376 USBAAPL64 - ok
21:47:04.0188 3376 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
21:47:04.0219 3376 usbccgp - ok
21:47:04.0281 3376 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
21:47:04.0344 3376 usbcir - ok
21:47:04.0359 3376 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
21:47:04.0375 3376 usbehci - ok
21:47:04.0422 3376 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
21:47:04.0515 3376 usbhub - ok
21:47:04.0531 3376 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
21:47:04.0593 3376 usbohci - ok
21:47:04.0937 3376 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
21:47:04.0952 3376 usbprint - ok
21:47:04.0983 3376 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:47:05.0030 3376 USBSTOR - ok
21:47:05.0093 3376 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
21:47:05.0280 3376 usbuhci - ok
21:47:05.0405 3376 [ 7B28E2FBE75115660FAB31079C0A9F29 ] usb_rndisx C:\Windows\system32\drivers\usb8023x.sys
21:47:05.0576 3376 usb_rndisx - ok
21:47:05.0826 3376 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
21:47:05.0873 3376 UxSms - ok
21:47:05.0904 3376 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
21:47:05.0919 3376 VaultSvc - ok
21:47:05.0935 3376 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot  C:\Windows\system32\drivers\vdrvroot.sys
21:47:05.0951 3376 vdrvroot - ok
21:47:06.0029 3376 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
21:47:06.0091 3376 vds - ok
21:47:06.0200 3376 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
21:47:06.0216 3376 vga - ok
21:47:06.0231 3376 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
21:47:06.0309 3376 VgaSave - ok
21:47:06.0341 3376 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
21:47:06.0356 3376 vhdmp - ok
21:47:06.0356 3376 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
21:47:06.0356 3376 viaide - ok
21:47:06.0372 3376 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
21:47:06.0465 3376 volmgr - ok
21:47:06.0637 3376 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
21:47:06.0637 3376 volmgrx - ok
21:47:06.0699 3376 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
21:47:06.0715 3376 volsnap - ok
21:47:06.0777 3376 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
21:47:06.0949 3376 vsmraid - ok
21:47:07.0058 3376 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
21:47:07.0105 3376 VSS - ok
21:47:07.0214 3376 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
21:47:07.0464 3376 vwifibus - ok
21:47:07.0698 3376 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
21:47:07.0791 3376 vwififlt - ok
21:47:07.0869 3376 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
21:47:07.0994 3376 W32Time - ok
21:47:08.0025 3376 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys
21:47:08.0088 3376 WacomPen - ok
21:47:08.0103 3376 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
21:47:08.0135 3376 WANARP - ok
21:47:08.0181 3376 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
21:47:08.0197 3376 Wanarpv6 - ok
21:47:08.0415 3376 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
21:47:08.0447 3376 WatAdminSvc - ok
21:47:08.0649 3376 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
21:47:08.0915 3376 wbengine - ok
21:47:08.0946 3376 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
21:47:08.0961 3376 WbioSrvc - ok
21:47:09.0024 3376 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
21:47:09.0039 3376 wcncsvc - ok
21:47:09.0055 3376 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
21:47:09.0071 3376 WcsPlugInService - ok
21:47:09.0102 3376 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys
21:47:09.0117 3376 Wd - ok
21:47:09.0336 3376 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
21:47:09.0367 3376 Wdf01000 - ok
21:47:09.0539 3376 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
21:47:09.0897 3376 WdiServiceHost - ok
21:47:09.0897 3376 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
21:47:09.0913 3376 WdiSystemHost - ok
21:47:10.0007 3376 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
21:47:10.0069 3376 WebClient - ok
21:47:10.0116 3376 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
21:47:10.0147 3376 Wecsvc - ok
21:47:10.0178 3376 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
21:47:10.0225 3376 wercplsupport - ok
21:47:10.0272 3376 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
21:47:10.0303 3376 WerSvc - ok
21:47:10.0350 3376 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
21:47:10.0381 3376 WfpLwf - ok
21:47:10.0412 3376 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
21:47:10.0412 3376 WIMMount - ok
21:47:10.0490 3376 WinDefend - ok
21:47:10.0506 3376 WinHttpAutoProxySvc - ok
21:47:10.0615 3376 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
21:47:10.0646 3376 Winmgmt - ok
21:47:10.0958 3376 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
21:47:11.0036 3376 WinRM - ok
21:47:11.0146 3376 [ FE88B288356E7B47B74B13372ADD906D ] winusb C:\Windows\system32\DRIVERS\WinUSB.SYS
21:47:11.0192 3376 winusb - ok
21:47:11.0598 3376 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
21:47:11.0629 3376 Wlansvc - ok
21:47:12.0690 3376 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:47:12.0799 3376 wlidsvc - ok
21:47:12.0955 3376 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
21:47:13.0096 3376 WmiAcpi - ok
21:47:13.0158 3376 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
21:47:13.0220 3376 wmiApSrv - ok
21:47:13.0298 3376 WMPNetworkSvc - ok
21:47:13.0345 3376 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
21:47:13.0376 3376 WPCSvc - ok
21:47:13.0408 3376 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
21:47:13.0423 3376 WPDBusEnum - ok
21:47:13.0454 3376 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
21:47:13.0486 3376 ws2ifsl - ok
21:47:13.0579 3376 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll
21:47:13.0798 3376 wscsvc - ok
21:47:13.0798 3376 WSearch - ok
21:47:14.0250 3376 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
21:47:14.0515 3376 wuauserv - ok
21:47:14.0999 3376 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
21:47:15.0077 3376 WudfPf - ok
21:47:15.0264 3376 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
21:47:15.0342 3376 WUDFRd - ok
21:47:15.0841 3376 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
21:47:15.0888 3376 wudfsvc - ok
21:47:16.0075 3376 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
21:47:16.0465 3376 WwanSvc - ok
21:47:16.0855 3376 [ 2AAAEC16CCEAD338EC101723C9EED8F8 ] xlkfs C:\Windows\system32\DRIVERS\xlkfs.sys
21:47:16.0871 3376 xlkfs - ok
21:47:16.0871 3376 ================ Scan global ===============================
21:47:16.0933 3376 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
21:47:17.0027 3376 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:47:17.0027 3376 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:47:17.0323 3376 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
21:47:17.0479 3376 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
21:47:17.0526 3376 [Global] - ok
21:47:17.0526 3376 ================ Scan MBR ==================================
21:47:17.0744 3376 [ 4976D4A7A40B83FC7F06EE4BDD84EB9B ] \Device\Harddisk0\DR0
21:47:22.0187 3376 \Device\Harddisk0\DR0 - ok
21:47:22.0187 3376 ================ Scan VBR ==================================
21:47:22.0280 3376 [ A712D729DD36A439BC5360C0BA67AA9F ] \Device\Harddisk0\DR0\Partition1
21:47:22.0343 3376 \Device\Harddisk0\DR0\Partition1 - ok
21:47:22.0739 3376 [ C6495450A227ECE802E592DC4875092F ] \Device\Harddisk0\DR0\Partition2
21:47:22.0739 3376 \Device\Harddisk0\DR0\Partition2 - ok
21:47:22.0739 3376 ================ Scan active images ========================
21:47:22.0739 3376 [ 3E588B60EC061686BA05D33574A344C6 ] C:\Windows\System32\drivers\crashdmp.sys
21:47:22.0739 3376 C:\Windows\System32\drivers\crashdmp.sys - ok
21:47:22.0739 3376 [ C2E04941AE03F1203A064BCBB319965A ] C:\Windows\System32\drivers\asahci64.sys
21:47:22.0739 3376 C:\Windows\System32\drivers\asahci64.sys - ok
21:47:22.0739 3376 [ 839B5FE3D48E9F35B22C21A3D5103F6C ] C:\Windows\System32\drivers\Dumpata.sys
21:47:22.0739 3376 C:\Windows\System32\drivers\Dumpata.sys - ok
21:47:22.0754 3376 [ 814DB88F2641691575A455CF25354098 ] C:\Windows\System32\drivers\dumpfve.sys
21:47:22.0754 3376 C:\Windows\System32\drivers\dumpfve.sys - ok
21:47:22.0754 3376 [ F036CE71586E93D94DAB220D7BDF4416 ] C:\Windows\System32\drivers\cdrom.sys
21:47:22.0754 3376 C:\Windows\System32\drivers\cdrom.sys - ok
21:47:22.0754 3376 [ 248C952C82DF1E23775432774CBB20F1 ] C:\Windows\System32\drivers\N360x64\1403010.016\ccsetx64.sys
21:47:22.0754 3376 C:\Windows\System32\drivers\N360x64\1403010.016\ccsetx64.sys - ok
21:47:22.0754 3376 [ 2AAAEC16CCEAD338EC101723C9EED8F8 ] C:\Windows\System32\drivers\xlkfs.sys
21:47:22.0754 3376 C:\Windows\System32\drivers\xlkfs.sys - ok
21:47:22.0754 3376 [ ADF37F1A715D6C56C8E065FD8569A9A4 ] C:\Windows\System32\drivers\N360x64\1403010.016\ironx64.sys
21:47:22.0754 3376 C:\Windows\System32\drivers\N360x64\1403010.016\ironx64.sys - ok
21:47:22.0754 3376 [ 3D55CE53128C81E06CD6B024C3B9FAC3 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys
21:47:22.0754 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys - ok
21:47:22.0770 3376 [ 16A47CE2DECC9B099349A5F840654746 ] C:\Windows\System32\drivers\beep.sys
21:47:22.0770 3376 C:\Windows\System32\drivers\beep.sys - ok
21:47:22.0770 3376 [ 9899284589F75FA8724FF3D16AED75C1 ] C:\Windows\System32\drivers\null.sys
21:47:22.0770 3376 C:\Windows\System32\drivers\null.sys - ok
21:47:22.0770 3376 [ 53E92A310193CB3C03BEA963DE7D9CFC ] C:\Windows\System32\drivers\vga.sys
21:47:22.0770 3376 C:\Windows\System32\drivers\vga.sys - ok
21:47:22.0770 3376 [ E7353D59C9842BC7299FAEB7E7E09340 ] C:\Windows\System32\drivers\videoprt.sys
21:47:22.0770 3376 C:\Windows\System32\drivers\videoprt.sys - ok
21:47:22.0770 3376 [ FC438D1430B28618E2D0C7C332A710AD ] C:\Windows\System32\drivers\watchdog.sys
21:47:22.0770 3376 C:\Windows\System32\drivers\watchdog.sys - ok
21:47:22.0786 3376 [ CEA6CC257FC9B7715F1C2B4849286D24 ] C:\Windows\System32\drivers\RDPCDD.sys
21:47:22.0786 3376 C:\Windows\System32\drivers\RDPCDD.sys - ok
21:47:22.0786 3376 [ BB5971A4F00659529A5C44831AF22365 ] C:\Windows\System32\drivers\RDPENCDD.sys
21:47:22.0786 3376 C:\Windows\System32\drivers\RDPENCDD.sys - ok
21:47:22.0786 3376 [ 216F3FA57533D98E1F74DED70113177A ] C:\Windows\System32\drivers\RDPREFMP.sys
21:47:22.0786 3376 C:\Windows\System32\drivers\RDPREFMP.sys - ok
21:47:22.0786 3376 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] C:\Windows\System32\drivers\msfs.sys
21:47:22.0786 3376 C:\Windows\System32\drivers\msfs.sys - ok
21:47:22.0786 3376 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] C:\Windows\System32\drivers\npfs.sys
21:47:22.0786 3376 C:\Windows\System32\drivers\npfs.sys - ok
21:47:22.0786 3376 [ 6F020A220388ECA0AB6062DC27BD16B6 ] C:\Windows\System32\drivers\tdi.sys
21:47:22.0786 3376 C:\Windows\System32\drivers\tdi.sys - ok
21:47:22.0801 3376 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] C:\Windows\System32\drivers\tdx.sys
21:47:22.0801 3376 C:\Windows\System32\drivers\tdx.sys - ok
21:47:22.0801 3376 [ 1C7857B62DE5994A75B054A9FD4C3825 ] C:\Windows\System32\drivers\afd.sys
21:47:22.0801 3376 C:\Windows\System32\drivers\afd.sys - ok
21:47:22.0801 3376 [ 09594D1089C523423B32A4229263F068 ] C:\Windows\System32\drivers\netbt.sys
21:47:22.0801 3376 C:\Windows\System32\drivers\netbt.sys - ok
21:47:22.0801 3376 [ 6BCC1D7D2FD2453957C5479A32364E52 ] C:\Windows\System32\drivers\ws2ifsl.sys
21:47:22.0801 3376 C:\Windows\System32\drivers\ws2ifsl.sys - ok
21:47:22.0801 3376 [ 0557CF5A2556BD58E26384169D72438D ] C:\Windows\System32\drivers\pacer.sys
21:47:22.0801 3376 C:\Windows\System32\drivers\pacer.sys - ok
21:47:22.0817 3376 [ 611B23304BF067451A9FDEE01FBDD725 ] C:\Windows\System32\drivers\wfplwf.sys
21:47:22.0817 3376 C:\Windows\System32\drivers\wfplwf.sys - ok
21:47:22.0817 3376 [ 86743D9F5D2B1048062B14B1D84501C4 ] C:\Windows\System32\drivers\netbios.sys
21:47:22.0817 3376 C:\Windows\System32\drivers\netbios.sys - ok
21:47:22.0817 3376 [ 6A3D66263414FF0D6FA754C646612F3F ] C:\Windows\System32\drivers\vwififlt.sys
21:47:22.0817 3376 C:\Windows\System32\drivers\vwififlt.sys - ok
21:47:22.0817 3376 [ 356AFD78A6ED4457169241AC3965230C ] C:\Windows\System32\drivers\wanarp.sys
21:47:22.0817 3376 C:\Windows\System32\drivers\wanarp.sys - ok
21:47:22.0817 3376 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] C:\Windows\System32\drivers\termdd.sys
21:47:22.0817 3376 C:\Windows\System32\drivers\termdd.sys - ok
21:47:22.0832 3376 [ 1605EBD8CB86AFC4430116065995279A ] C:\Windows\System32\drivers\N360x64\1403010.016\symnets.sys
21:47:22.0832 3376 C:\Windows\System32\drivers\N360x64\1403010.016\symnets.sys - ok
21:47:22.0832 3376 [ F5D6D3B7468C46EA2DDC1D19D2A6DA0F ] C:\Windows\System32\drivers\SYMEVENT64x86.SYS
21:47:22.0832 3376 C:\Windows\System32\drivers\SYMEVENT64x86.SYS - ok
21:47:22.0832 3376 [ 3289766038DB2CB14D07DC84392138D5 ] C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys
21:47:22.0832 3376 C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys - ok
21:47:22.0832 3376 [ 58A38E75F3316A83C23DF6173D41F2B5 ] C:\Program Files\SUPERAntiSpyware\saskutil64.sys
21:47:22.0832 3376 C:\Program Files\SUPERAntiSpyware\saskutil64.sys - ok
21:47:22.0832 3376 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] C:\Windows\System32\drivers\mssmbios.sys
21:47:22.0832 3376 C:\Windows\System32\drivers\mssmbios.sys - ok
21:47:22.0848 3376 [ 0E76CEF892C45734F7AED09FDDF35D4D ] C:\Windows\System32\drivers\N360x64\1403010.016\srtspx64.sys
21:47:22.0848 3376 C:\Windows\System32\drivers\N360x64\1403010.016\srtspx64.sys - ok
21:47:22.0848 3376 [ E7F5AE18AF4168178A642A9247C63001 ] C:\Windows\System32\drivers\nsiproxy.sys
21:47:22.0848 3376 C:\Windows\System32\drivers\nsiproxy.sys - ok
21:47:22.0848 3376 [ 77F665941019A1594D887A74F301FA2F ] C:\Windows\System32\drivers\rdbss.sys
21:47:22.0848 3376 C:\Windows\System32\drivers\rdbss.sys - ok
21:47:22.0848 3376 [ A48928D4CCA6F8B731989DB08CF2C0AB ] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130425.001\IDSviA64.sys
21:47:22.0848 3376 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130425.001\IDSviA64.sys - ok
21:47:22.0848 3376 [ 4353FF94D47A0A9D52B89ECCF0CDB013 ] C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
21:47:22.0848 3376 C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys - ok
21:47:22.0848 3376 [ C5BCCB378D0A896304A3E71BE7215983 ] C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
21:47:22.0848 3376 C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys - ok
21:47:22.0864 3376 [ 13096B05847EC78F0977F2C0F79E9AB3 ] C:\Windows\System32\drivers\discache.sys
21:47:22.0864 3376 C:\Windows\System32\drivers\discache.sys - ok
21:47:22.0864 3376 [ 61583EE3C3A17003C4ACD0475646B4D3 ] C:\Windows\System32\drivers\blbdrive.sys
21:47:22.0864 3376 C:\Windows\System32\drivers\blbdrive.sys - ok
21:47:22.0864 3376 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] C:\Windows\System32\drivers\dfsc.sys
21:47:22.0864 3376 C:\Windows\System32\drivers\dfsc.sys - ok
21:47:22.0864 3376 [ 7B56A40EAAACF1867FF178501D3EA185 ] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx64.sys
21:47:22.0864 3376 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx64.sys - ok
21:47:22.0864 3376 [ D27A8B7BB0E15DFBFC6B4E774EE17AD9 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys
21:47:22.0864 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys - ok
21:47:22.0879 3376 [ 0932B29AA1B9372FFE6D3AF8BA2ABA3A ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys
21:47:22.0879 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys - ok
21:47:22.0879 3376 [ FEF9DD9EA587F8886ADE43C1BEFBDAFE ] C:\Windows\SysWOW64\drivers\AsIO.sys
21:47:22.0879 3376 C:\Windows\SysWOW64\drivers\AsIO.sys - ok
21:47:22.0879 3376 [ 1392B92179B07B672720763D9B1028A5 ] C:\Windows\SysWOW64\drivers\AsUpIO.sys
21:47:22.0879 3376 C:\Windows\SysWOW64\drivers\AsUpIO.sys - ok
21:47:22.0879 3376 [ 3566A8DAAFA27AF944F5D705EAA64894 ] C:\Windows\System32\drivers\tunnel.sys
21:47:22.0879 3376 C:\Windows\System32\drivers\tunnel.sys - ok
21:47:22.0879 3376 [ 348214F96642FD4FEF630DE021BA3540 ] C:\Windows\System32\drivers\igdkmd64.sys
21:47:22.0879 3376 C:\Windows\System32\drivers\igdkmd64.sys - ok
21:47:22.0895 3376 [ F5BEE30450E18E6B83A5012C100616FD ] C:\Windows\System32\drivers\dxgkrnl.sys
21:47:22.0895 3376 C:\Windows\System32\drivers\dxgkrnl.sys - ok
21:47:22.0895 3376 [ 9CD68BDDF322535C02ADC8331013D13D ] C:\Windows\System32\drivers\dxgmms1.sys
21:47:22.0895 3376 C:\Windows\System32\drivers\dxgmms1.sys - ok
21:47:22.0895 3376 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] C:\Windows\System32\drivers\HECIx64.sys
21:47:22.0895 3376 C:\Windows\System32\drivers\HECIx64.sys - ok
21:47:22.0895 3376 [ AE259C75F9A0B057B6BF9E9695632B09 ] C:\Windows\System32\drivers\usbport.sys
21:47:22.0895 3376 C:\Windows\System32\drivers\usbport.sys - ok
21:47:22.0895 3376 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] C:\Windows\System32\drivers\hdaudbus.sys
21:47:22.0895 3376 C:\Windows\System32\drivers\hdaudbus.sys - ok
21:47:22.0895 3376 [ C025055FE7B87701EB042095DF1A2D7B ] C:\Windows\System32\drivers\usbehci.sys
21:47:22.0895 3376 C:\Windows\System32\drivers\usbehci.sys - ok
21:47:22.0910 3376 [ 8CE69B2C4934A1C0321F4C8E9C6C4A41 ] C:\Windows\System32\drivers\netr28x.sys
21:47:22.0910 3376 C:\Windows\System32\drivers\netr28x.sys - ok
21:47:22.0910 3376 [ 01DBB05DB1DB95803E3C9F2B49AFE79C ] C:\Windows\System32\drivers\asmtxhci.sys
21:47:22.0910 3376 C:\Windows\System32\drivers\asmtxhci.sys - ok
21:47:22.0910 3376 [ EE082E06A82FF630351D1E0EBBD3D8D0 ] C:\Windows\System32\drivers\Rt64win7.sys
21:47:22.0910 3376 C:\Windows\System32\drivers\Rt64win7.sys - ok
21:47:22.0910 3376 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] C:\Windows\System32\drivers\vwifibus.sys
21:47:22.0910 3376 C:\Windows\System32\drivers\vwifibus.sys - ok
21:47:22.0910 3376 [ 7ECFF9B22276B73F43A99A15A6094E90 ] C:\Windows\System32\drivers\agilevpn.sys
21:47:22.0910 3376 C:\Windows\System32\drivers\agilevpn.sys - ok
21:47:22.0926 3376 [ 03EDB043586CCEBA243D689BDDA370A8 ] C:\Windows\System32\drivers\CompositeBus.sys
21:47:22.0926 3376 C:\Windows\System32\drivers\CompositeBus.sys - ok
21:47:22.0926 3376 [ E403AACF8C7BB11375122D2464560311 ] C:\Windows\System32\drivers\GEARAspiWDM.sys
21:47:22.0926 3376 C:\Windows\System32\drivers\GEARAspiWDM.sys - ok
21:47:22.0926 3376 [ ADA036632C664CAA754079041CF1F8C1 ] C:\Windows\System32\drivers\intelppm.sys
21:47:22.0926 3376 C:\Windows\System32\drivers\intelppm.sys - ok
21:47:22.0926 3376 [ 800BA92F7010378B09F9ED9270F07137 ] C:\Windows\System32\drivers\modem.sys
21:47:22.0926 3376 C:\Windows\System32\drivers\modem.sys - ok
21:47:22.0926 3376 [ 30639C932D9FEF22B31268FE25A1B6E5 ] C:\Windows\System32\drivers\ndistapi.sys
21:47:22.0926 3376 C:\Windows\System32\drivers\ndistapi.sys - ok
21:47:22.0942 3376 [ 53F7305169863F0A2BDDC49E116C2E11 ] C:\Windows\System32\drivers\ndiswan.sys
21:47:22.0942 3376 C:\Windows\System32\drivers\ndiswan.sys - ok
21:47:22.0942 3376 [ 471815800AE33E6F1C32FB1B97C490CA ] C:\Windows\System32\drivers\rasl2tp.sys
21:47:22.0942 3376 C:\Windows\System32\drivers\rasl2tp.sys - ok
21:47:22.0942 3376 [ 388D3DD1A6457280F3BADBA9F3ACD6B1 ] C:\Windows\System32\drivers\rootmdm.sys
21:47:22.0942 3376 C:\Windows\System32\drivers\rootmdm.sys - ok
21:47:22.0942 3376 [ F6FF8944478594D0E414D3F048F0D778 ] C:\Windows\System32\drivers\wmiacpi.sys
21:47:22.0942 3376 C:\Windows\System32\drivers\wmiacpi.sys - ok
21:47:22.0942 3376 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] C:\Windows\System32\drivers\raspppoe.sys
21:47:22.0942 3376 C:\Windows\System32\drivers\raspppoe.sys - ok
21:47:22.0942 3376 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] C:\Windows\System32\drivers\raspptp.sys
21:47:22.0942 3376 C:\Windows\System32\drivers\raspptp.sys - ok
21:47:22.0957 3376 [ E8B1E447B008D07FF47D016C2B0EEECB ] C:\Windows\System32\drivers\rassstp.sys
21:47:22.0957 3376 C:\Windows\System32\drivers\rassstp.sys - ok
21:47:22.0957 3376 [ 4AAFFFA67AC4DFA3D9985D78573887E2 ] C:\Windows\System32\drivers\RimSerial_AMD64.sys
21:47:22.0957 3376 C:\Windows\System32\drivers\RimSerial_AMD64.sys - ok
21:47:22.0957 3376 [ CF95B85FF8D128385ABD411C8CA74DED ] C:\Windows\System32\ntdll.dll
21:47:22.0957 3376 C:\Windows\System32\ntdll.dll - ok
21:47:22.0957 3376 [ F0371DE302FFFF8F086661611BE60848 ] C:\Windows\System32\smss.exe
21:47:22.0957 3376 C:\Windows\System32\smss.exe - ok
21:47:22.0957 3376 [ 3B536A8BEC3B4F23FFDFD78B11A2AB93 ] C:\Windows\System32\autochk.exe
21:47:22.0957 3376 C:\Windows\System32\autochk.exe - ok
21:47:22.0973 3376 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] C:\Windows\System32\drivers\kbdclass.sys
21:47:22.0973 3376 C:\Windows\System32\drivers\kbdclass.sys - ok
21:47:22.0973 3376 [ 7D27EA49F3C1F687D357E77A470AEA99 ] C:\Windows\System32\drivers\mouclass.sys
21:47:22.0973 3376 C:\Windows\System32\drivers\mouclass.sys - ok
21:47:22.0973 3376 [ 24FBF5CC5C04150073C315A7C83521EE ] C:\Windows\System32\drivers\ks.sys
21:47:22.0973 3376 C:\Windows\System32\drivers\ks.sys - ok
21:47:22.0973 3376 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] C:\Windows\System32\drivers\swenum.sys
21:47:22.0973 3376 C:\Windows\System32\drivers\swenum.sys - ok
21:47:22.0973 3376 [ DC54A574663A895C8763AF0FA1FF7561 ] C:\Windows\System32\drivers\umbus.sys
21:47:22.0973 3376 C:\Windows\System32\drivers\umbus.sys - ok
21:47:22.0973 3376 [ 1084AA52CCC324EA54C7121FA24C2221 ] C:\Windows\System32\gdi32.dll
21:47:22.0973 3376 C:\Windows\System32\gdi32.dll - ok
21:47:22.0988 3376 [ 287C6C9410B111B68B52CA298F7B8C24 ] C:\Windows\System32\drivers\usbhub.sys
21:47:22.0988 3376 C:\Windows\System32\drivers\usbhub.sys - ok
21:47:22.0988 3376 [ 6C60B5ACA7442EFB794082CDACFC001C ] C:\Windows\System32\ole32.dll
21:47:22.0988 3376 C:\Windows\System32\ole32.dll - ok
21:47:22.0988 3376 [ 83404DCBCE4925B6A5A77C5170F46D86 ] C:\Windows\System32\sechost.dll
21:47:22.0988 3376 C:\Windows\System32\sechost.dll - ok
21:47:22.0988 3376 [ 29812E9971077BE3F8B9DC225CF9D454 ] C:\Windows\System32\urlmon.dll
21:47:22.0988 3376 C:\Windows\System32\urlmon.dll - ok
21:47:22.0988 3376 [ C06B32165E23A72A898B7A89679AD754 ] C:\Windows\System32\oleaut32.dll
21:47:22.0988 3376 C:\Windows\System32\oleaut32.dll - ok
21:47:23.0004 3376 [ F7CE0C81C545364020ED8203CF0A633E ] C:\Windows\System32\difxapi.dll
21:47:23.0004 3376 C:\Windows\System32\difxapi.dll - ok
21:47:23.0004 3376 [ A1BE6A720D02E37F72E9CD89AE9CB3CF ] C:\Windows\System32\imagehlp.dll
21:47:23.0004 3376 C:\Windows\System32\imagehlp.dll - ok
21:47:23.0004 3376 [ AA2C08CE85653B1A0D2E4AB407FA176C ] C:\Windows\System32\imm32.dll
21:47:23.0004 3376 C:\Windows\System32\imm32.dll - ok
21:47:23.0004 3376 [ C431EAF5CAA1C82CAC2534A2EAB348A3 ] C:\Windows\System32\msctf.dll
21:47:23.0004 3376 C:\Windows\System32\msctf.dll - ok
21:47:23.0020 3376 [ 753C0848AE7872A3F59663078A517293 ] C:\Windows\System32\wininet.dll
21:47:23.0020 3376 C:\Windows\System32\wininet.dll - ok
21:47:23.0020 3376 [ 9835E63E09F824D22B689D2BB789BAB9 ] C:\Windows\System32\comdlg32.dll
21:47:23.0020 3376 C:\Windows\System32\comdlg32.dll - ok
21:47:23.0020 3376 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] C:\Windows\System32\drivers\ndproxy.sys
21:47:23.0020 3376 C:\Windows\System32\drivers\ndproxy.sys - ok
21:47:23.0035 3376 [ 85F1FE2D5EDBFD26066F5ABB9504A69C ] C:\Windows\System32\iertutil.dll
21:47:23.0035 3376 C:\Windows\System32\iertutil.dll - ok
21:47:23.0035 3376 [ 044FE45FFD6AD40E3BBBE60B7F41BABE ] C:\Windows\System32\nsi.dll
21:47:23.0035 3376 C:\Windows\System32\nsi.dll - ok
21:47:23.0035 3376 [ 21D26064AEDB4988F785BB4A3A2C051E ] C:\Windows\System32\drivers\drmk.sys
21:47:23.0035 3376 C:\Windows\System32\drivers\drmk.sys - ok
21:47:23.0035 3376 [ 32E11315B5126921FFD9074840EF13D3 ] C:\Windows\System32\drivers\portcls.sys
21:47:23.0035 3376 C:\Windows\System32\drivers\portcls.sys - ok
21:47:23.0035 3376 [ 589B94A9B73A0E819FF873743A480834 ] C:\Windows\System32\drivers\RTKVHD64.sys
21:47:23.0035 3376 C:\Windows\System32\drivers\RTKVHD64.sys - ok
21:47:23.0051 3376 [ FE70103391A64039A921DBFFF9C7AB1B ] C:\Windows\System32\user32.dll
21:47:23.0051 3376 C:\Windows\System32\user32.dll - ok
21:47:23.0051 3376 [ 25983DE69B57142039AC8D95E71CD9C9 ] C:\Windows\System32\clbcatq.dll
21:47:23.0051 3376 C:\Windows\System32\clbcatq.dll - ok
21:47:23.0051 3376 [ 6869281E78CB31A43E969F06B57347C4 ] C:\Windows\System32\drivers\ksthunk.sys
21:47:23.0051 3376 C:\Windows\System32\drivers\ksthunk.sys - ok
21:47:23.0051 3376 [ D202223587518B13D72D68937B7E3F70 ] C:\Windows\System32\lpk.dll
21:47:23.0051 3376 C:\Windows\System32\lpk.dll - ok
21:47:23.0066 3376 [ C391FC68282A000CDF953F8B6B55D2EF ] C:\Windows\System32\msvcrt.dll
21:47:23.0066 3376 C:\Windows\System32\msvcrt.dll - ok
21:47:23.0066 3376 [ EAF32CB8C1F810E4715B4DFBE785C7FF ] C:\Windows\System32\shlwapi.dll
21:47:23.0066 3376 C:\Windows\System32\shlwapi.dll - ok
21:47:23.0066 3376 [ 4E4FFB09D895AA000DD56D1404F69A7E ] C:\Windows\System32\Wldap32.dll
21:47:23.0066 3376 C:\Windows\System32\Wldap32.dll - ok
21:47:23.0066 3376 [ 5D8E6C95156ED1F79A63D1EADE6F9ED5 ] C:\Windows\System32\setupapi.dll
21:47:23.0066 3376 C:\Windows\System32\setupapi.dll - ok
21:47:23.0066 3376 [ 6DF46D2BD74E3DA1B45F08F10D172732 ] C:\Windows\System32\advapi32.dll
21:47:23.0066 3376 C:\Windows\System32\advapi32.dll - ok
21:47:23.0082 3376 [ 65C113214F7B05820F6D8A65B1485196 ] C:\Windows\System32\kernel32.dll
21:47:23.0082 3376 C:\Windows\System32\kernel32.dll - ok
21:47:23.0082 3376 [ 28C0B5024F5C5A438E78B188CFC81B7F ] C:\Windows\System32\normaliz.dll
21:47:23.0082 3376 C:\Windows\System32\normaliz.dll - ok
21:47:23.0082 3376 [ 4BBFA57F594F7E8A8EDC8F377184C3F0 ] C:\Windows\System32\ws2_32.dll
21:47:23.0082 3376 C:\Windows\System32\ws2_32.dll - ok
21:47:23.0082 3376 [ D87E1E59C73C1F98D5DED5B3850C40F5 ] C:\Windows\System32\psapi.dll
21:47:23.0082 3376 C:\Windows\System32\psapi.dll - ok
21:47:23.0098 3376 [ C6689007B3A749C49A5438DCF36E0CE4 ] C:\Windows\System32\shell32.dll
21:47:23.0098 3376 C:\Windows\System32\shell32.dll - ok
21:47:23.0098 3376 [ 0611473C1AD9E2D991CD9482068417F7 ] C:\Windows\System32\rpcrt4.dll
21:47:23.0098 3376 C:\Windows\System32\rpcrt4.dll - ok
21:47:23.0098 3376 [ DBF99FD9CAF75CA66D042BD8D050FF71 ] C:\Windows\System32\usp10.dll
21:47:23.0098 3376 C:\Windows\System32\usp10.dll - ok
21:47:23.0098 3376 [ 64A4AB126E24FD3F58EBE64852773DB5 ] C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
21:47:23.0098 3376 C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll - ok
21:47:23.0098 3376 [ AFC3DB5C6EB8CA8017DDB81D6C0AD02A ] C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
21:47:23.0098 3376 C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll - ok
21:47:23.0113 3376 [ 72723D3E4781BADC62C3180C137E7B23 ] C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
21:47:23.0113 3376 C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll - ok
21:47:23.0113 3376 [ 12EE6FE9268CEE6D90FDCCBF89236C65 ] C:\Windows\System32\crypt32.dll
21:47:23.0113 3376 C:\Windows\System32\crypt32.dll - ok
21:47:23.0113 3376 [ 06FEC9E8117103BB1141A560E98077DA ] C:\Windows\System32\devobj.dll
21:47:23.0113 3376 C:\Windows\System32\devobj.dll - ok
21:47:23.0113 3376 [ 1F56F209585F350A5666E3CC7931FD67 ] C:\Windows\System32\KernelBase.dll
21:47:23.0113 3376 C:\Windows\System32\KernelBase.dll - ok
21:47:23.0113 3376 [ 9094039A00485F71C4DE64BF51F64C46 ] C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
21:47:23.0113 3376 C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll - ok
21:47:23.0129 3376 [ 2477A28081BDAEE622CF045ACF8EE124 ] C:\Windows\System32\cfgmgr32.dll
21:47:23.0129 3376 C:\Windows\System32\cfgmgr32.dll - ok
21:47:23.0129 3376 [ F49E92B50CED5C9F1725D3C0329FD933 ] C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
21:47:23.0129 3376 C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll - ok
21:47:23.0129 3376 [ 0E6FBF19D9DFBB77316C23DF91F8A101 ] C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
21:47:23.0129 3376 C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll - ok
21:47:23.0129 3376 [ AA06902362B1422D7A7DA7061E07C624 ] C:\Windows\System32\wintrust.dll
21:47:23.0129 3376 C:\Windows\System32\wintrust.dll - ok
21:47:23.0144 3376 [ 14DFDEAF4E589ED3F1FF187A86B9408C ] C:\Windows\System32\comctl32.dll
21:47:23.0144 3376 C:\Windows\System32\comctl32.dll - ok
21:47:23.0144 3376 [ 884415BD4269C02EAF8E2613BF85500D ] C:\Windows\System32\msasn1.dll
21:47:23.0144 3376 C:\Windows\System32\msasn1.dll - ok
21:47:23.0144 3376 [ 9C278785347BCC991F8EA2999D90F58D ] C:\Windows\SysWOW64\normaliz.dll
21:47:23.0144 3376 C:\Windows\SysWOW64\normaliz.dll - ok
21:47:23.0144 3376 [ 954950D11ADA98AC1B7EE3C770E4622C ] C:\Windows\System32\drivers\asmthub3.sys
21:47:23.0144 3376 C:\Windows\System32\drivers\asmthub3.sys - ok
21:47:23.0144 3376 [ 4429B91B0FE91F9BE8E24E93CC960368 ] C:\Windows\System32\drivers\IntcDAud.sys
21:47:23.0144 3376 C:\Windows\System32\drivers\IntcDAud.sys - ok
21:47:23.0160 3376 [ BF24D6F2ED97FE830BFD52B246F98E67 ] C:\Windows\System32\drivers\dxapi.sys
21:47:23.0160 3376 C:\Windows\System32\drivers\dxapi.sys - ok
21:47:23.0160 3376 [ 86F96630D28523F1C402C783F046DEF1 ] C:\Windows\System32\win32k.sys
21:47:23.0160 3376 C:\Windows\System32\win32k.sys - ok
21:47:23.0160 3376 [ 60C2862B4BF0FD9F582EF344C2B1EC72 ] C:\Windows\System32\csrss.exe
21:47:23.0160 3376 C:\Windows\System32\csrss.exe - ok
21:47:23.0160 3376 [ CEC1EDF4022DC4DCA40384DCEC672B0E ] C:\Windows\System32\csrsrv.dll
21:47:23.0160 3376 C:\Windows\System32\csrsrv.dll - ok
21:47:23.0176 3376 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\System32\basesrv.dll
21:47:23.0176 3376 C:\Windows\System32\basesrv.dll - ok
21:47:23.0176 3376 [ CCA2AB1752A61F29C3C941CD79D78CEA ] C:\Windows\System32\drivers\usbd.sys
21:47:23.0176 3376 C:\Windows\System32\drivers\usbd.sys - ok
21:47:23.0176 3376 [ FED648B01349A3C8395A5169DB5FB7D6 ] C:\Windows\System32\drivers\USBSTOR.SYS
21:47:23.0176 3376 C:\Windows\System32\drivers\USBSTOR.SYS - ok
21:47:23.0176 3376 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\System32\winsrv.dll
21:47:23.0176 3376 C:\Windows\System32\winsrv.dll - ok
21:47:23.0191 3376 [ 49EE2E52E6CD03947DAD72F65367BE06 ] C:\Windows\System32\drivers\hidparse.sys
21:47:23.0191 3376 C:\Windows\System32\drivers\hidparse.sys - ok
21:47:23.0191 3376 [ B03D591DC7DA45ECE20B3B467E6AADAA ] C:\Windows\System32\drivers\monitor.sys
21:47:23.0191 3376 C:\Windows\System32\drivers\monitor.sys - ok
21:47:23.0191 3376 [ 7AF9DAC504FBD047CBC3E64AE52C92BF ] C:\Windows\System32\drivers\dc3d.sys
21:47:23.0191 3376 C:\Windows\System32\drivers\dc3d.sys - ok
21:47:23.0191 3376 [ 8B0E40E7E8BBF5ACF390465609D89FF1 ] C:\Windows\System32\drivers\hidclass.sys
21:47:23.0191 3376 C:\Windows\System32\drivers\hidclass.sys - ok
21:47:23.0207 3376 [ 9592090A7E2B61CD582B612B6DF70536 ] C:\Windows\System32\drivers\hidusb.sys
21:47:23.0207 3376 C:\Windows\System32\drivers\hidusb.sys - ok
21:47:23.0207 3376 [ 6F1A3157A1C89435352CEB543CDB359C ] C:\Windows\System32\drivers\usbccgp.sys
21:47:23.0207 3376 C:\Windows\System32\drivers\usbccgp.sys - ok
21:47:23.0207 3376 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] C:\Windows\System32\drivers\mouhid.sys
21:47:23.0207 3376 C:\Windows\System32\drivers\mouhid.sys - ok
21:47:23.0207 3376 [ 317020D31F1696334679B9D0416EB62E ] C:\Windows\System32\drivers\nuidfltr.sys
21:47:23.0207 3376 C:\Windows\System32\drivers\nuidfltr.sys - ok
21:47:23.0207 3376 [ 4F0878FD62D5F7444C5F1C4C66D9D293 ] C:\Windows\System32\drivers\point64.sys
21:47:23.0207 3376 C:\Windows\System32\drivers\point64.sys - ok
21:47:23.0222 3376 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] C:\Windows\System32\drivers\kbdhid.sys
21:47:23.0222 3376 C:\Windows\System32\drivers\kbdhid.sys - ok
21:47:23.0222 3376 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\System32\sxssrv.dll
21:47:23.0222 3376 C:\Windows\System32\sxssrv.dll - ok
21:47:23.0222 3376 [ F29FE765E1448EF371CFE05BFAC74ADB ] C:\Windows\System32\tsddd.dll
21:47:23.0222 3376 C:\Windows\System32\tsddd.dll - ok
21:47:23.0222 3376 [ 94355C28C1970635A31B3FE52EB7CEBA ] C:\Windows\System32\wininit.exe
21:47:23.0222 3376 C:\Windows\System32\wininit.exe - ok
21:47:23.0238 3376 [ 05569A79BF4693670B709144382D02D4 ] C:\Windows\System32\cdd.dll
21:47:23.0238 3376 C:\Windows\System32\cdd.dll - ok
21:47:23.0238 3376 [ 2C942733A5983DD4502219FF37C7EBC7 ] C:\Windows\System32\profapi.dll
21:47:23.0238 3376 C:\Windows\System32\profapi.dll - ok
21:47:23.0238 3376 [ C2A8CB1275ECB85D246A9ECC02A728E3 ] C:\Windows\System32\RpcRtRemote.dll
21:47:23.0238 3376 C:\Windows\System32\RpcRtRemote.dll - ok
21:47:23.0238 3376 [ 0F5CD07A098D6A5989019CC377722989 ] C:\Windows\System32\KBDCA.DLL
21:47:23.0238 3376 C:\Windows\System32\KBDCA.DLL - ok
21:47:23.0238 3376 [ 1151B1BAA6F350B1DB6598E0FEA7C457 ] C:\Windows\System32\winlogon.exe
21:47:23.0238 3376 C:\Windows\System32\winlogon.exe - ok
21:47:23.0254 3376 [ 0D9764D58C5EFD672B7184854B152E5E ] C:\Windows\System32\winsta.dll
21:47:23.0254 3376 C:\Windows\System32\winsta.dll - ok
21:47:23.0254 3376 [ 283C64A094A763C2F3DE2C926AEAE8CD ] C:\Windows\System32\KBDCAN.DLL
21:47:23.0254 3376 C:\Windows\System32\KBDCAN.DLL - ok
21:47:23.0254 3376 [ 78523A26F5604C0568FE9D1CE86E36F4 ] C:\Windows\System32\KBDUS.DLL
21:47:23.0254 3376 C:\Windows\System32\KBDUS.DLL - ok
21:47:23.0254 3376 [ B26B1801356760841C3BC69F9F91537F ] C:\Windows\System32\WlS0WndH.dll
21:47:23.0254 3376 C:\Windows\System32\WlS0WndH.dll - ok
21:47:23.0269 3376 [ 9CEAD32E79A62150FE9F8557E58E008B ] C:\Windows\System32\sxs.dll
21:47:23.0269 3376 C:\Windows\System32\sxs.dll - ok
21:47:23.0269 3376 [ 784FA3DF338E2E8F5F0389D6FAC428AF ] C:\Windows\System32\cryptbase.dll
21:47:23.0269 3376 C:\Windows\System32\cryptbase.dll - ok
21:47:23.0269 3376 [ 90499F3163A9F815CF196A205EA3CD5D ] C:\Windows\System32\apphelp.dll
21:47:23.0269 3376 C:\Windows\System32\apphelp.dll - ok
21:47:23.0269 3376 [ C118A82CD78818C29AB228366EBF81C3 ] C:\Windows\System32\lsass.exe
21:47:23.0269 3376 C:\Windows\System32\lsass.exe - ok
21:47:23.0269 3376 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\System32\services.exe
21:47:23.0269 3376 C:\Windows\System32\services.exe - ok
21:47:23.0285 3376 [ 685527DA09EBFB681E98C515978BDEE2 ] C:\Windows\System32\lsasrv.dll
21:47:23.0285 3376 C:\Windows\System32\lsasrv.dll - ok
21:47:23.0285 3376 [ 9662EE182644511439F1C53745DC1C88 ] C:\Windows\System32\lsm.exe
21:47:23.0285 3376 C:\Windows\System32\lsm.exe - ok
21:47:23.0285 3376 [ BBCDF350817BA86416C0F06B6981BE8D ] C:\Windows\System32\scesrv.dll
21:47:23.0285 3376 C:\Windows\System32\scesrv.dll - ok
21:47:23.0285 3376 [ E914A50A151DFFE63D3935226DB5E2C1 ] C:\Windows\System32\scext.dll
21:47:23.0285 3376 C:\Windows\System32\scext.dll - ok
21:47:23.0300 3376 [ 0144D8D75A0B12938AEEE859E3310A46 ] C:\Windows\System32\secur32.dll
21:47:23.0300 3376 C:\Windows\System32\secur32.dll - ok
21:47:23.0300 3376 [ B66BC8B20B7F33975865B1DF99783FD8 ] C:\Windows\System32\sspicli.dll
21:47:23.0300 3376 C:\Windows\System32\sspicli.dll - ok
21:47:23.0300 3376 [ 3A0CE5FE781708CD6ABD55313607EC8B ] C:\Windows\System32\sspisrv.dll
21:47:23.0300 3376 C:\Windows\System32\sspisrv.dll - ok
21:47:23.0300 3376 [ A744BA6E04C8AA4592818178DBF89521 ] C:\Windows\System32\samsrv.dll
21:47:23.0300 3376 C:\Windows\System32\samsrv.dll - ok
21:47:23.0316 3376 [ 68083118797CAF30FB2EA3E71494D67E ] C:\Windows\System32\sysntfy.dll
21:47:23.0316 3376 C:\Windows\System32\sysntfy.dll - ok
21:47:23.0316 3376 [ DEE7267C5D232A3B816866872CE199E6 ] C:\Windows\System32\wmsgapi.dll
21:47:23.0316 3376 C:\Windows\System32\wmsgapi.dll - ok
21:47:23.0316 3376 [ 3A061472B38233BAFF9CFEFF2E49C46B ] C:\Windows\System32\cryptdll.dll
21:47:23.0316 3376 C:\Windows\System32\cryptdll.dll - ok
21:47:23.0316 3376 [ 3C073B0C596A0AF84933E7406766B040 ] C:\Windows\System32\wevtapi.dll
21:47:23.0316 3376 C:\Windows\System32\wevtapi.dll - ok
21:47:23.0316 3376 [ 86FE1B1F8FD42CD0DB641AB1CDB13093 ] C:\Windows\System32\cngaudit.dll
21:47:23.0316 3376 C:\Windows\System32\cngaudit.dll - ok
21:47:23.0332 3376 [ 7FBEBD2229EA5FD48D41B199EC2D541C ] C:\Windows\System32\authz.dll
21:47:23.0332 3376 C:\Windows\System32\authz.dll - ok
21:47:23.0332 3376 [ B9A95365E52F421A20E1501935FADDA5 ] C:\Windows\System32\bcrypt.dll
21:47:23.0332 3376 C:\Windows\System32\bcrypt.dll - ok
21:47:23.0332 3376 [ 02B64609F865A39365FF88580DF11738 ] C:\Windows\System32\msprivs.dll
21:47:23.0332 3376 C:\Windows\System32\msprivs.dll - ok
21:47:23.0332 3376 [ 5F3307352216618221A17CFEF273EEE2 ] C:\Windows\System32\ncrypt.dll
21:47:23.0332 3376 C:\Windows\System32\ncrypt.dll - ok
21:47:23.0332 3376 [ 3A9C9BAF610B0DD4967086040B3B62A9 ] C:\Windows\System32\srvcli.dll
21:47:23.0332 3376 C:\Windows\System32\srvcli.dll - ok
21:47:23.0332 3376 [ 50532FCD7ECF02DD169CE5C485F02534 ] C:\Windows\System32\negoexts.dll
21:47:23.0332 3376 C:\Windows\System32\negoexts.dll - ok
21:47:23.0347 3376 [ C6505DE3561537BA1004D638C2F93F2F ] C:\Windows\System32\netjoin.dll
21:47:23.0347 3376 C:\Windows\System32\netjoin.dll - ok
21:47:23.0347 3376 [ CB2ABB2DA1E9C977302A78D86D4AE3B0 ] C:\Windows\System32\atmfd.dll
21:47:23.0347 3376 C:\Windows\System32\atmfd.dll - ok
21:47:23.0347 3376 [ 44E1A196DFCB53B01FE4B855C3B56A15 ] C:\Windows\System32\kerberos.dll
21:47:23.0347 3376 C:\Windows\System32\kerberos.dll - ok
21:47:23.0347 3376 [ D0C2FBB6D97416B0166478FC7AE2B212 ] C:\Windows\System32\cryptsp.dll
21:47:23.0347 3376 C:\Windows\System32\cryptsp.dll - ok
21:47:23.0347 3376 [ 1D5185A4C7E6695431AE4B55C3D7D333 ] C:\Windows\System32\mswsock.dll
21:47:23.0347 3376 C:\Windows\System32\mswsock.dll - ok
21:47:23.0363 3376 [ EF12B8385AA2849999008A977918F96B ] C:\Windows\System32\msv1_0.dll
21:47:23.0363 3376 C:\Windows\System32\msv1_0.dll - ok
21:47:23.0363 3376 [ AA339DD8BB128EF66660DFBBB59043D3 ] C:\Windows\System32\netlogon.dll
21:47:23.0363 3376 C:\Windows\System32\netlogon.dll - ok
21:47:23.0363 3376 [ EC7CBFF96B05ECF3D366355B3C64ADCF ] C:\Windows\System32\wship6.dll
21:47:23.0363 3376 C:\Windows\System32\wship6.dll - ok
21:47:23.0363 3376 [ 492D07D79E7024CA310867B526D9636D ] C:\Windows\System32\dnsapi.dll
21:47:23.0363 3376 C:\Windows\System32\dnsapi.dll - ok
21:47:23.0363 3376 [ 8FFE297B8449386E7B6851458B6E474E ] C:\Windows\System32\logoncli.dll
21:47:23.0363 3376 C:\Windows\System32\logoncli.dll - ok
21:47:23.0378 3376 [ B7D42CB36C08FA017E73FF2433CD7287 ] C:\Windows\System32\schannel.dll
21:47:23.0378 3376 C:\Windows\System32\schannel.dll - ok
21:47:23.0378 3376 [ 95FB6CA4374E343DDD653FCC43F9D26B ] C:\Windows\System32\wdigest.dll
21:47:23.0378 3376 C:\Windows\System32\wdigest.dll - ok
21:47:23.0378 3376 [ E08088A97F95345E181C3DFCE2C615EF ] C:\Windows\System32\pku2u.dll
21:47:23.0378 3376 C:\Windows\System32\pku2u.dll - ok
21:47:23.0378 3376 [ 5D8874A8C11DDDDE29E12DE0E2013493 ] C:\Windows\System32\rsaenh.dll
21:47:23.0378 3376 C:\Windows\System32\rsaenh.dll - ok
21:47:23.0378 3376 [ 8A25506B6948EFBD5A7F37E53CCD36D9 ] C:\Windows\System32\TSpkg.dll
21:47:23.0378 3376 C:\Windows\System32\TSpkg.dll - ok
21:47:23.0378 3376 [ 7DBA64AD70C2E2481C68D9E0F7CD7840 ] C:\Windows\System32\LIVESSP.DLL
21:47:23.0378 3376 C:\Windows\System32\LIVESSP.DLL - ok
21:47:23.0394 3376 [ D6C7780A364C6BBACFA796BAB9F1B374 ] C:\Windows\System32\bcryptprimitives.dll
21:47:23.0394 3376 C:\Windows\System32\bcryptprimitives.dll - ok
21:47:23.0394 3376 [ 52D3D5E3586988D4D9E34ACAAC33105C ] C:\Windows\System32\credssp.dll
21:47:23.0394 3376 C:\Windows\System32\credssp.dll - ok
21:47:23.0394 3376 [ 90BDEFC5DF334E5100EAA781D798DE1A ] C:\Windows\System32\efslsaext.dll
21:47:23.0394 3376 C:\Windows\System32\efslsaext.dll - ok
21:47:23.0394 3376 [ ED78427259134C63ED69804D2132B86C ] C:\Windows\System32\scecli.dll
21:47:23.0394 3376 C:\Windows\System32\scecli.dll - ok
21:47:23.0394 3376 [ 7CC7DF5B654DA579613F811D8C637E29 ] C:\Windows\System32\ubpm.dll
21:47:23.0394 3376 C:\Windows\System32\ubpm.dll - ok
21:47:23.0394 3376 [ C78655BC80301D76ED4FEF1C1EA40A7D ] C:\Windows\System32\svchost.exe
21:47:23.0394 3376 C:\Windows\System32\svchost.exe - ok
21:47:23.0410 3376 [ 25FBDEF06C4D92815B353F6E792C8129 ] C:\Windows\System32\umpnpmgr.dll
21:47:23.0410 3376 C:\Windows\System32\umpnpmgr.dll - ok
21:47:23.0410 3376 [ CD1B5AD07E5F7FEF30E055DCC9E96180 ] C:\Windows\System32\devrtl.dll
21:47:23.0410 3376 C:\Windows\System32\devrtl.dll - ok
21:47:23.0410 3376 [ E6EB44ABAAF1F330119F854856C53EBE ] C:\Windows\System32\SPInf.dll
21:47:23.0410 3376 C:\Windows\System32\SPInf.dll - ok
21:47:23.0410 3376 [ 9C9307C95671AC962F3D6EB3A4A89BAE ] C:\Windows\System32\gpapi.dll
21:47:23.0410 3376 C:\Windows\System32\gpapi.dll - ok
21:47:23.0410 3376 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] C:\Windows\System32\umpo.dll
21:47:23.0410 3376 C:\Windows\System32\umpo.dll - ok
21:47:23.0410 3376 [ 7A17485DC7D8A7AC81321A42CD034519 ] C:\Windows\System32\userenv.dll
21:47:23.0410 3376 C:\Windows\System32\userenv.dll - ok
21:47:23.0425 3376 [ F6C011B46FAEEF33536B2E80F48B5CBE ] C:\Windows\System32\pcwum.dll
21:47:23.0425 3376 C:\Windows\System32\pcwum.dll - ok
21:47:23.0425 3376 [ 716175021BDA290504CE434273F666BC ] C:\Windows\System32\powrprof.dll
21:47:23.0425 3376 C:\Windows\System32\powrprof.dll - ok
21:47:23.0425 3376 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] C:\Windows\System32\drivers\luafv.sys
21:47:23.0425 3376 C:\Windows\System32\drivers\luafv.sys - ok
21:47:23.0425 3376 [ A7F08A73F2668FCD2B51A66751FA7FF3 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
21:47:23.0425 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe - ok
21:47:23.0425 3376 [ 259EB5F7D95A29842B476C5B3EB6E186 ] C:\Windows\System32\wow64.dll
21:47:23.0425 3376 C:\Windows\System32\wow64.dll - ok
21:47:23.0441 3376 [ E73B0F1819602CB6EF176FB78D76A47B ] C:\Windows\SysWOW64\ntdll.dll
21:47:23.0441 3376 C:\Windows\SysWOW64\ntdll.dll - ok
21:47:23.0441 3376 [ 5674E21E82CFBEA36DDAD5DB285D6DBC ] C:\Windows\System32\wow64win.dll
21:47:23.0441 3376 C:\Windows\System32\wow64win.dll - ok
21:47:23.0441 3376 [ 3EE3AA76D8AB6D5644C4C8F34471CEB3 ] C:\Windows\System32\wow64cpu.dll
21:47:23.0441 3376 C:\Windows\System32\wow64cpu.dll - ok
21:47:23.0441 3376 [ AC0B6F41882FC6ED186962D770EBF1D2 ] C:\Windows\SysWOW64\kernel32.dll
21:47:23.0441 3376 C:\Windows\SysWOW64\kernel32.dll - ok
21:47:23.0441 3376 [ 7DE363A7E337159FC4C4B9421BBC62C0 ] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\UMEngx86.dll
21:47:23.0441 3376 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\UMEngx86.dll - ok
21:47:23.0441 3376 [ E954A79D6A754A5475582CACED1565E6 ] C:\Windows\SysWOW64\KernelBase.dll
21:47:23.0441 3376 C:\Windows\SysWOW64\KernelBase.dll - ok
21:47:23.0456 3376 [ 6C765E82B57F2E66CE9C54AC238471D9 ] C:\Windows\SysWOW64\oleaut32.dll
21:47:23.0456 3376 C:\Windows\SysWOW64\oleaut32.dll - ok
21:47:23.0456 3376 [ 928CF7268086631F54C3D8E17238C6DD ] C:\Windows\SysWOW64\ole32.dll
21:47:23.0456 3376 C:\Windows\SysWOW64\ole32.dll - ok
21:47:23.0456 3376 [ 9DC80A8AAAAAC397BDAB3C67165A824E ] C:\Windows\SysWOW64\msvcrt.dll
21:47:23.0456 3376 C:\Windows\SysWOW64\msvcrt.dll - ok
21:47:23.0456 3376 [ D6D3AD7BF1D6F6CE9547613ED5E170A2 ] C:\Windows\SysWOW64\gdi32.dll
21:47:23.0456 3376 C:\Windows\SysWOW64\gdi32.dll - ok
21:47:23.0456 3376 [ 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 ] C:\Windows\SysWOW64\user32.dll
21:47:23.0456 3376 C:\Windows\SysWOW64\user32.dll - ok
21:47:23.0456 3376 [ 95E2376B3323F062EB562B8586D0F14A ] C:\Windows\SysWOW64\advapi32.dll
21:47:23.0456 3376 C:\Windows\SysWOW64\advapi32.dll - ok
21:47:23.0472 3376 [ C5AD8083CF94201F1F8084ECC696A8B7 ] C:\Windows\SysWOW64\rpcrt4.dll
21:47:23.0472 3376 C:\Windows\SysWOW64\rpcrt4.dll - ok
21:47:23.0472 3376 [ CFC97F07904067A1E5FAE195D534DA3A ] C:\Windows\SysWOW64\sechost.dll
21:47:23.0472 3376 C:\Windows\SysWOW64\sechost.dll - ok
21:47:23.0472 3376 [ F08F6FCD09F9BE94C37ACC1B344685FF ] C:\Windows\SysWOW64\cryptbase.dll
21:47:23.0472 3376 C:\Windows\SysWOW64\cryptbase.dll - ok
21:47:23.0472 3376 [ 384721EF4024890092625E20CADFAF85 ] C:\Windows\SysWOW64\lpk.dll
21:47:23.0472 3376 C:\Windows\SysWOW64\lpk.dll - ok
21:47:23.0472 3376 [ 18AB2E5A40064ED5F7791AC5946A90F3 ] C:\Windows\SysWOW64\msimg32.dll
21:47:23.0472 3376 C:\Windows\SysWOW64\msimg32.dll - ok
21:47:23.0472 3376 [ 29E9794708DF51DB5DC89FB2E903A0F6 ] C:\Windows\SysWOW64\shell32.dll
21:47:23.0472 3376 C:\Windows\SysWOW64\shell32.dll - ok
21:47:23.0488 3376 [ BFB26890612FB8AE8B0463EBEBE84B7E ] C:\Windows\SysWOW64\sspicli.dll
21:47:23.0488 3376 C:\Windows\SysWOW64\sspicli.dll - ok
21:47:23.0488 3376 [ B7230010D97787AF3D25E4C82F2B06B9 ] C:\Windows\SysWOW64\usp10.dll
21:47:23.0488 3376 C:\Windows\SysWOW64\usp10.dll - ok
21:47:23.0488 3376 [ 702254574E7E52052DE39408457B7149 ] C:\Windows\SysWOW64\version.dll
21:47:23.0488 3376 C:\Windows\SysWOW64\version.dll - ok
21:47:23.0488 3376 [ 8CC3C111D653E96F3EA1590891491D71 ] C:\Windows\SysWOW64\shlwapi.dll
21:47:23.0488 3376 C:\Windows\SysWOW64\shlwapi.dll - ok
21:47:23.0488 3376 [ BDAC1AA64495D0F7E1FF810EBBF1F018 ] C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
21:47:23.0488 3376 C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll - ok
21:47:23.0503 3376 [ 9E4B0E7472B4CEBA9E17F440B8CB0AB8 ] C:\Windows\SysWOW64\winspool.drv
21:47:23.0503 3376 C:\Windows\SysWOW64\winspool.drv - ok
21:47:23.0503 3376 [ 60D21799A4AF4EDCE65FB98830E4B0C8 ] C:\Windows\SysWOW64\crypt32.dll
21:47:23.0503 3376 C:\Windows\SysWOW64\crypt32.dll - ok
21:47:23.0503 3376 [ A90DC9ABD65DB1A8902F361103029952 ] C:\Windows\SysWOW64\IPHLPAPI.DLL
21:47:23.0503 3376 C:\Windows\SysWOW64\IPHLPAPI.DLL - ok
21:47:23.0503 3376 [ 6377051C63D5552A311935C67E9FDFDC ] C:\Windows\SysWOW64\nsi.dll
21:47:23.0503 3376 C:\Windows\SysWOW64\nsi.dll - ok
21:47:23.0503 3376 [ 40CAEEE0EAF1B8569F7C8DF6420F2CB9 ] C:\Windows\SysWOW64\sfc.dll
21:47:23.0503 3376 C:\Windows\SysWOW64\sfc.dll - ok
21:47:23.0503 3376 [ 84799328D87B3091A3BDD251E1AD31F9 ] C:\Windows\SysWOW64\sfc_os.dll
21:47:23.0503 3376 C:\Windows\SysWOW64\sfc_os.dll - ok
21:47:23.0519 3376 [ CFF35B879D1618D42C86644C717BA947 ] C:\Windows\SysWOW64\winnsi.dll
21:47:23.0519 3376 C:\Windows\SysWOW64\winnsi.dll - ok
21:47:23.0519 3376 [ 938F39B50BAFE13D6F58C7790682C010 ] C:\Windows\SysWOW64\msasn1.dll
21:47:23.0519 3376 C:\Windows\SysWOW64\msasn1.dll - ok
21:47:23.0519 3376 [ 17448AF0BBA9E7AB5EC955AF93F271BD ] C:\Windows\SysWOW64\wintrust.dll
21:47:23.0519 3376 C:\Windows\SysWOW64\wintrust.dll - ok
21:47:23.0519 3376 [ 9691DF758E606711942B88A8AFA8461B ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2engine.dll
21:47:23.0519 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2engine.dll - ok
21:47:23.0534 3376 [ 1755023407FDE00D9916505A557569D5 ] C:\Program Files (x86)\Emsisoft Anti-Malware\bdcore.dll
21:47:23.0534 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\bdcore.dll - ok
21:47:23.0534 3376 [ A6F09E5669D9A19035F6D942CAA15882 ] C:\Windows\SysWOW64\imm32.dll
21:47:23.0534 3376 C:\Windows\SysWOW64\imm32.dll - ok
21:47:23.0534 3376 [ A543AC1F7138376D778D630A35FCBC4C ] C:\Windows\SysWOW64\psapi.dll
21:47:23.0534 3376 C:\Windows\SysWOW64\psapi.dll - ok
21:47:23.0534 3376 [ C9618BC9B2B0FD7C1138D8774795A79B ] C:\Windows\SysWOW64\msctf.dll
21:47:23.0534 3376 C:\Windows\SysWOW64\msctf.dll - ok
21:47:23.0534 3376 [ 7FF15A4F092CD4A96055BA69F903E3E9 ] C:\Windows\SysWOW64\ws2_32.dll
21:47:23.0534 3376 C:\Windows\SysWOW64\ws2_32.dll - ok
21:47:23.0534 3376 [ DF13A51A5C591887D2EC6AE64CEED0FA ] C:\Windows\SysWOW64\wsock32.dll
21:47:23.0534 3376 C:\Windows\SysWOW64\wsock32.dll - ok
21:47:23.0550 3376 [ 8999B8631C7FD9F7F9EC3CAFD953BA24 ] C:\Windows\SysWOW64\mswsock.dll
21:47:23.0550 3376 C:\Windows\SysWOW64\mswsock.dll - ok
21:47:23.0550 3376 [ 496E8656BDA277EF2A7BBA3D948A4664 ] C:\Program Files (x86)\Emsisoft Anti-Malware\quarantine.dll
21:47:23.0550 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\quarantine.dll - ok
21:47:23.0550 3376 [ C733D233B623B7FFCE5031E4B756EE26 ] C:\Windows\SysWOW64\profapi.dll
21:47:23.0550 3376 C:\Windows\SysWOW64\profapi.dll - ok
21:47:23.0550 3376 [ D15618A0FF8DBC2C5BF3726BACC75A0B ] C:\Windows\SysWOW64\userenv.dll
21:47:23.0550 3376 C:\Windows\SysWOW64\userenv.dll - ok
21:47:23.0550 3376 [ 6A6B2EE4565A178035BE2A4FF6F2C968 ] C:\Windows\SysWOW64\wtsapi32.dll
21:47:23.0550 3376 C:\Windows\SysWOW64\wtsapi32.dll - ok
21:47:23.0566 3376 [ 5A72AD2C0DD3DC226F9407F582913E84 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2core32.dll
21:47:23.0566 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2core32.dll - ok
21:47:23.0566 3376 [ EB38F568D21259B410D252A40B39366A ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix86.dll
21:47:23.0566 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix86.dll - ok
21:47:23.0566 3376 [ 1EBE9524683C7C4EED8B8BC93FB6FBCC ] C:\Windows\SysWOW64\fltLib.dll
21:47:23.0566 3376 C:\Windows\SysWOW64\fltLib.dll - ok
21:47:23.0566 3376 [ 14140AA65B8AC9ED2ED38052FD3D5BB2 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2update.dll
21:47:23.0566 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2update.dll - ok
21:47:23.0566 3376 [ 3FD15B4611D9BDA3F8013548C0ECAECA ] C:\Windows\SysWOW64\ntmarta.dll
21:47:23.0566 3376 C:\Windows\SysWOW64\ntmarta.dll - ok
21:47:23.0581 3376 [ A8BB45F9ECAD993461E0FEF8E2A99152 ] C:\Windows\SysWOW64\Wldap32.dll
21:47:23.0581 3376 C:\Windows\SysWOW64\Wldap32.dll - ok
21:47:23.0581 3376 [ 8F571F016FA1976F445147E9E6C8AE9B ] C:\Windows\System32\drivers\Sftvollh.sys
21:47:23.0581 3376 C:\Windows\System32\drivers\Sftvollh.sys - ok
21:47:23.0581 3376 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] C:\Windows\System32\RpcEpMap.dll
21:47:23.0581 3376 C:\Windows\System32\RpcEpMap.dll - ok
21:47:23.0581 3376 [ 5C627D1B1138676C0A7AB2C2C190D123 ] C:\Windows\System32\rpcss.dll
21:47:23.0581 3376 C:\Windows\System32\rpcss.dll - ok
21:47:23.0581 3376 [ 16E964ABF6D1E0F0CC7822FCA9BA754D ] C:\Windows\System32\wshqos.dll
21:47:23.0581 3376 C:\Windows\System32\wshqos.dll - ok
21:47:23.0581 3376 [ 31559F3244C6BC00A52030CAA83B6B91 ] C:\Windows\System32\WSHTCPIP.DLL
21:47:23.0581 3376 C:\Windows\System32\WSHTCPIP.DLL - ok
21:47:23.0597 3376 [ 715F03B4C7223349768013EA95D9E5B7 ] C:\Windows\System32\LogonUI.exe
21:47:23.0597 3376 C:\Windows\System32\LogonUI.exe - ok
21:47:23.0597 3376 [ 9AD9E06F8656F296D91FAE8EE5B95A27 ] C:\Windows\System32\FirewallAPI.dll
21:47:23.0597 3376 C:\Windows\System32\FirewallAPI.dll - ok
21:47:23.0597 3376 [ 94E026870A55AAEAFF7853C1754091E9 ] C:\Windows\System32\version.dll
21:47:23.0597 3376 C:\Windows\System32\version.dll - ok
21:47:23.0597 3376 [ 6011714C8C5C55CBFFAD24D61E879FBD ] C:\Windows\System32\wevtsvc.dll
21:47:23.0597 3376 C:\Windows\System32\wevtsvc.dll - ok
21:47:23.0597 3376 [ F23FEF6D569FCE88671949894A8BECF1 ] C:\Windows\System32\audiosrv.dll
21:47:23.0597 3376 C:\Windows\System32\audiosrv.dll - ok
21:47:23.0612 3376 [ 78A1E65207484B7F8D3217507745F47C ] C:\Windows\System32\avrt.dll
21:47:23.0612 3376 C:\Windows\System32\avrt.dll - ok
21:47:23.0612 3376 [ E40E80D0304A73E8D269F7141D77250B ] C:\Windows\System32\mmcss.dll
21:47:23.0612 3376 C:\Windows\System32\mmcss.dll - ok
21:47:23.0612 3376 [ 227E2C382A1E02F8D4965E664D3BBE43 ] C:\Windows\System32\MMDevAPI.dll
21:47:23.0612 3376 C:\Windows\System32\MMDevAPI.dll - ok
21:47:23.0612 3376 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] C:\Windows\System32\profsvc.dll
21:47:23.0612 3376 C:\Windows\System32\profsvc.dll - ok
21:47:23.0628 3376 [ 0BEE002C68E28CE6DA161DCF1376D7D7 ] C:\Windows\System32\authui.dll
21:47:23.0628 3376 C:\Windows\System32\authui.dll - ok
21:47:23.0628 3376 [ B3BFBD758506ECB50C5804AAA76318F9 ] C:\Windows\System32\cryptui.dll
21:47:23.0628 3376 C:\Windows\System32\cryptui.dll - ok
21:47:23.0628 3376 [ F06BB4E336EA57511FDBAFAFCC47DE62 ] C:\Windows\System32\propsys.dll
21:47:23.0628 3376 C:\Windows\System32\propsys.dll - ok
21:47:23.0628 3376 [ D5CCA1453B98A5801E6D5FF0FF89DC6C ] C:\Windows\System32\audiodg.exe
21:47:23.0628 3376 C:\Windows\System32\audiodg.exe - ok
21:47:23.0644 3376 [ 1F4492FE41767CDB8B89D17655847CDD ] C:\Windows\System32\ntmarta.dll
21:47:23.0644 3376 C:\Windows\System32\ntmarta.dll - ok
21:47:23.0644 3376 [ C4C183E6551084039EC862DA1C945E3D ] C:\Windows\System32\FntCache.dll
21:47:23.0644 3376 C:\Windows\System32\FntCache.dll - ok
21:47:23.0644 3376 [ 58775492FFD419248B08325E583C527F ] C:\Windows\System32\atl.dll
21:47:23.0644 3376 C:\Windows\System32\atl.dll - ok
21:47:23.0644 3376 [ F0344071948D1A1FA732231785A0664C ] C:\Windows\System32\themeservice.dll
21:47:23.0644 3376 C:\Windows\System32\themeservice.dll - ok
21:47:23.0644 3376 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] C:\Windows\System32\gpsvc.dll
21:47:23.0644 3376 C:\Windows\System32\gpsvc.dll - ok
21:47:23.0659 3376 [ 4166F82BE4D24938977DD1746BE9B8A0 ] C:\Windows\System32\es.dll
21:47:23.0659 3376 C:\Windows\System32\es.dll - ok
21:47:23.0659 3376 [ A77BE7CB3222B4FB0AC6C71D1C2698D4 ] C:\Windows\System32\dsrole.dll
21:47:23.0659 3376 C:\Windows\System32\dsrole.dll - ok
21:47:23.0659 3376 [ 46BB91A169B9B31FF44EB04C48EC1D41 ] C:\Windows\System32\nlaapi.dll
21:47:23.0659 3376 C:\Windows\System32\nlaapi.dll - ok
21:47:23.0659 3376 [ C32AB8FA018EF34C0F113BD501436D21 ] C:\Windows\System32\Sens.dll
21:47:23.0659 3376 C:\Windows\System32\Sens.dll - ok
21:47:23.0659 3376 [ BE097F5BB10F9079FCEB2DC4E7E20F02 ] C:\Windows\System32\slc.dll
21:47:23.0659 3376 C:\Windows\System32\slc.dll - ok
21:47:23.0659 3376 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] C:\Windows\System32\uxsms.dll
21:47:23.0659 3376 C:\Windows\System32\uxsms.dll - ok
21:47:23.0675 3376 [ BD3674BE7FC9D8D3732C83E8499576ED ] C:\Windows\System32\wtsapi32.dll
21:47:23.0675 3376 C:\Windows\System32\wtsapi32.dll - ok
21:47:23.0675 3376 [ 7FA8FDC2C2A27817FD0F624E78D3B50C ] C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll
21:47:23.0675 3376 C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll - ok
21:47:23.0675 3376 [ 5B3EBFC3DA142324B388DDCC4465E1FF ] C:\Windows\System32\samlib.dll
21:47:23.0675 3376 C:\Windows\System32\samlib.dll - ok
21:47:23.0675 3376 [ 4E9C2DB10F7E6AE91BF761139D4B745B ] C:\Windows\System32\shacct.dll
21:47:23.0675 3376 C:\Windows\System32\shacct.dll - ok
21:47:23.0675 3376 [ D29E998E8277666982B4F0303BF4E7AF ] C:\Windows\System32\uxtheme.dll
21:47:23.0675 3376 C:\Windows\System32\uxtheme.dll - ok
21:47:23.0690 3376 [ 179E8401224D557ECFF3695F2016EA5B ] C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_2b253c8271ec7765\GdiPlus.dll
21:47:23.0690 3376 C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_2b253c8271ec7765\GdiPlus.dll - ok
21:47:23.0690 3376 [ 3CB6A7286422C72C34DAB54A5DFF1A34 ] C:\Windows\System32\dui70.dll
21:47:23.0690 3376 C:\Windows\System32\dui70.dll - ok
21:47:23.0690 3376 [ 1473768973453DE50DC738C2955FC4DD ] C:\Windows\System32\wdmaud.drv
21:47:23.0690 3376 C:\Windows\System32\wdmaud.drv - ok
21:47:23.0690 3376 [ EF2AE43BCD46ABB13FC3E5B2B1935C73 ] C:\Windows\System32\winmm.dll
21:47:23.0690 3376 C:\Windows\System32\winmm.dll - ok
21:47:23.0690 3376 [ 8CCDE014A4CDF84564E03ACE064CA753 ] C:\Windows\System32\duser.dll
21:47:23.0690 3376 C:\Windows\System32\duser.dll - ok
21:47:23.0706 3376 [ 8560FFFC8EB3A806DCD4F82252CFC8C6 ] C:\Windows\System32\ksuser.dll
21:47:23.0706 3376 C:\Windows\System32\ksuser.dll - ok
21:47:23.0706 3376 [ D7F1EF374A90709B31591823B002F918 ] C:\Windows\System32\SndVolSSO.dll
21:47:23.0706 3376 C:\Windows\System32\SndVolSSO.dll - ok
21:47:23.0706 3376 [ DA1B7075260F3872585BFCDD668C648B ] C:\Windows\System32\dwmapi.dll
21:47:23.0706 3376 C:\Windows\System32\dwmapi.dll - ok
21:47:23.0706 3376 [ 896F15A6434D93EDB42519D5E18E6B50 ] C:\Windows\System32\hid.dll
21:47:23.0706 3376 C:\Windows\System32\hid.dll - ok
21:47:23.0706 3376 [ 6F8B48F3D343E4B186AB6A9E302B7E16 ] C:\Windows\System32\xmllite.dll
21:47:23.0706 3376 C:\Windows\System32\xmllite.dll - ok
21:47:23.0722 3376 [ DC220AE6F64819099F7EBD6F137E32E7 ] C:\Windows\System32\AudioSes.dll
21:47:23.0722 3376 C:\Windows\System32\AudioSes.dll - ok
21:47:23.0722 3376 [ 1B7C3A37362C7B2890168C5FC61C8D9B ] C:\Windows\System32\msacm32.drv
21:47:23.0722 3376 C:\Windows\System32\msacm32.drv - ok
21:47:23.0722 3376 [ 588CD0C78A7FAAE4186B5EEA0AF3ED67 ] C:\Windows\System32\adtschema.dll
21:47:23.0722 3376 C:\Windows\System32\adtschema.dll - ok
21:47:23.0722 3376 [ 1A47D52E303B7543E4E6026595B95422 ] C:\Windows\System32\comres.dll
21:47:23.0722 3376 C:\Windows\System32\comres.dll - ok
21:47:23.0722 3376 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] C:\Windows\System32\wlansvc.dll
21:47:23.0722 3376 C:\Windows\System32\wlansvc.dll - ok
21:47:23.0737 3376 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] C:\Windows\System32\netprofm.dll
21:47:23.0737 3376 C:\Windows\System32\netprofm.dll - ok
21:47:23.0737 3376 [ DA6B67270FD9DB3697B20FCE94950741 ] C:\Windows\System32\drivers\fltMgr.sys
21:47:23.0737 3376 C:\Windows\System32\drivers\fltMgr.sys - ok
21:47:23.0737 3376 [ 50544D04AD845C43130B70212EC05CCD ] C:\Windows\System32\microsoft-windows-kernel-power-events.dll
21:47:23.0737 3376 C:\Windows\System32\microsoft-windows-kernel-power-events.dll - ok
21:47:23.0737 3376 [ B1DF2D87DC8BF6072699AC8301B37796 ] C:\Windows\System32\WUDFPlatform.dll
21:47:23.0737 3376 C:\Windows\System32\WUDFPlatform.dll - ok
21:47:23.0737 3376 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] C:\Windows\System32\MPSSVC.dll
21:47:23.0737 3376 C:\Windows\System32\MPSSVC.dll - ok
21:47:23.0753 3376 [ A3DB3C17EE6CAE65D53602B4E80BCCBC ] C:\Windows\System32\PSHED.DLL
21:47:23.0753 3376 C:\Windows\System32\PSHED.DLL - ok
21:47:23.0753 3376 [ B0945E538CF906BBDDC5A11C8EE868CC ] C:\Windows\System32\microsoft-windows-kernel-processor-power-events.dll
21:47:23.0753 3376 C:\Windows\System32\microsoft-windows-kernel-processor-power-events.dll - ok
21:47:23.0753 3376 [ 1538831CF8AD2979A04C423779465827 ] C:\Windows\System32\drivers\lltdio.sys
21:47:23.0753 3376 C:\Windows\System32\drivers\lltdio.sys - ok
21:47:23.0753 3376 [ CA2A0750ED830678997695FF61B04C30 ] C:\Windows\System32\midimap.dll
21:47:23.0753 3376 C:\Windows\System32\midimap.dll - ok
21:47:23.0753 3376 [ 10AC5CE9F78DC281A1BBD9B8CC587B8A ] C:\Windows\System32\msacm32.dll
21:47:23.0753 3376 C:\Windows\System32\msacm32.dll - ok
21:47:23.0768 3376 [ BDDF242A49E7B7DC5CCEC291BCE53ACB ] C:\Windows\System32\WindowsCodecs.dll
21:47:23.0768 3376 C:\Windows\System32\WindowsCodecs.dll - ok
21:47:23.0768 3376 [ 5EDBB34736DD7AC1A73CF8792A835E10 ] C:\Windows\System32\AudioEng.dll
21:47:23.0768 3376 C:\Windows\System32\AudioEng.dll - ok
21:47:23.0768 3376 [ C1395286B822E306B4FE1568A8A77813 ] C:\Windows\System32\AUDIOKSE.dll
21:47:23.0768 3376 C:\Windows\System32\AUDIOKSE.dll - ok
21:47:23.0768 3376 [ 9EFAE006B2AE8ACB6BA0E75DFD317F26 ] C:\Windows\System32\RtkAPO64.dll
21:47:23.0768 3376 C:\Windows\System32\RtkAPO64.dll - ok
21:47:23.0784 3376 [ 9F2BACD5E1776A4BB7CC0EC3C3A4F96D ] C:\Windows\System32\winbrand.dll
21:47:23.0784 3376 C:\Windows\System32\winbrand.dll - ok
21:47:23.0784 3376 [ C2762A57DF0EE85E63CE4893C5215313 ] C:\Windows\System32\VaultCredProvider.dll
21:47:23.0784 3376 C:\Windows\System32\VaultCredProvider.dll - ok
21:47:23.0784 3376 [ 6F3C559B82F2912354BE5B098744CC8C ] C:\Windows\System32\WMALFXGFXDSP.dll
21:47:23.0784 3376 C:\Windows\System32\WMALFXGFXDSP.dll - ok
21:47:23.0784 3376 [ 54B5DCD55B223BC5DF50B82E1E9E86B1 ] C:\Windows\System32\mfplat.dll
21:47:23.0784 3376 C:\Windows\System32\mfplat.dll - ok
21:47:23.0784 3376 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] C:\Windows\System32\drivers\nwifi.sys
21:47:23.0784 3376 C:\Windows\System32\drivers\nwifi.sys - ok
21:47:23.0800 3376 [ 136185F9FB2CC61E573E676AA5402356 ] C:\Windows\System32\drivers\ndisuio.sys
21:47:23.0800 3376 C:\Windows\System32\drivers\ndisuio.sys - ok
21:47:23.0800 3376 [ DDC86E4F8E7456261E637E3552E804FF ] C:\Windows\System32\drivers\rspndr.sys
21:47:23.0800 3376 C:\Windows\System32\drivers\rspndr.sys - ok
21:47:23.0800 3376 [ E16B7C030A05EF649B18FAB0A93D871F ] C:\Windows\System32\drivers\RtNdPt60.sys
21:47:23.0800 3376 C:\Windows\System32\drivers\RtNdPt60.sys - ok
21:47:23.0800 3376 [ F993A32249B66C9D622EA5592A8B76B8 ] C:\Windows\System32\lmhsvc.dll
21:47:23.0800 3376 C:\Windows\System32\lmhsvc.dll - ok
21:47:23.0815 3376 [ D54BFDF3E0C953F823B3D0BFE4732528 ] C:\Windows\System32\nsisvc.dll
21:47:23.0815 3376 C:\Windows\System32\nsisvc.dll - ok
21:47:23.0815 3376 [ F9EC845C5EECF20E9A67F9F805F2EF1F ] C:\Windows\System32\keyiso.dll
21:47:23.0815 3376 C:\Windows\System32\keyiso.dll - ok
21:47:23.0815 3376 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] C:\Windows\System32\eapsvc.dll
21:47:23.0815 3376 C:\Windows\System32\eapsvc.dll - ok
21:47:23.0815 3376 [ 87356377F31DA5F20A833811CD59499C ] C:\Windows\System32\eapphost.dll
21:47:23.0815 3376 C:\Windows\System32\eapphost.dll - ok
21:47:23.0831 3376 [ CA2985996BB49924B677113DF95CFEA7 ] C:\Windows\System32\SmartcardCredentialProvider.dll
21:47:23.0831 3376 C:\Windows\System32\SmartcardCredentialProvider.dll - ok
21:47:23.0831 3376 [ 9FCA3A84338ADEF2AFF67CDA46EF8539 ] C:\Windows\System32\umb.dll
21:47:23.0831 3376 C:\Windows\System32\umb.dll - ok
21:47:23.0831 3376 [ BF352E73615F5461AA6884472435A544 ] C:\Windows\System32\BioCredProv.dll
21:47:23.0831 3376 C:\Windows\System32\BioCredProv.dll - ok
21:47:23.0831 3376 [ 796B8123A7859AFD3A4AE10514DBAEB5 ] C:\Windows\System32\winbio.dll
21:47:23.0831 3376 C:\Windows\System32\winbio.dll - ok
21:47:23.0831 3376 [ A648C4A06DE367065B24056D067B4460 ] C:\Windows\System32\wlanmsm.dll
21:47:23.0831 3376 C:\Windows\System32\wlanmsm.dll - ok
21:47:23.0846 3376 [ 06A1386B6E3A0CBC368665C1840906F4 ] C:\Windows\System32\wlansec.dll
21:47:23.0846 3376 C:\Windows\System32\wlansec.dll - ok
21:47:23.0846 3376 [ 2B81776DA02017A37FE26C662827470E ] C:\Windows\System32\IPHLPAPI.DLL
21:47:23.0846 3376 C:\Windows\System32\IPHLPAPI.DLL - ok
21:47:23.0846 3376 [ B73A6E4B319AFFE64582AC5C1801BB3F ] C:\Windows\System32\nrpsrv.dll
21:47:23.0846 3376 C:\Windows\System32\nrpsrv.dll - ok
21:47:23.0846 3376 [ 4C9210E8F4E052F6A4EB87716DA0C24C ] C:\Windows\System32\winnsi.dll
21:47:23.0846 3376 C:\Windows\System32\winnsi.dll - ok
21:47:23.0862 3376 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] C:\Windows\System32\dnsrslvr.dll
21:47:23.0862 3376 C:\Windows\System32\dnsrslvr.dll - ok
21:47:23.0862 3376 [ 885D0942E0F28DB90919BE3129ECF279 ] C:\Windows\System32\dnsext.dll
21:47:23.0862 3376 C:\Windows\System32\dnsext.dll - ok
21:47:23.0862 3376 [ 0040C486584A8E582C861CFB57AB5387 ] C:\Windows\System32\FWPUCLNT.DLL
21:47:23.0862 3376 C:\Windows\System32\FWPUCLNT.DLL - ok
21:47:23.0862 3376 [ F568F7C08458D69E4FCD8675BBB107E4 ] C:\Windows\System32\dhcpcsvc.dll
21:47:23.0862 3376 C:\Windows\System32\dhcpcsvc.dll - ok
21:47:23.0862 3376 [ 3C06D5A929B798D0B13F6481242A0FD2 ] C:\Windows\System32\dhcpcsvc6.dll
21:47:23.0862 3376 C:\Windows\System32\dhcpcsvc6.dll - ok
21:47:23.0878 3376 [ CC0AB40F02D2C2A12209715A3C1B07B8 ] C:\Windows\System32\credui.dll
21:47:23.0878 3376 C:\Windows\System32\credui.dll - ok
21:47:23.0878 3376 [ 972C3301DB3DA91AE06A95F6B4160B1B ] C:\Windows\System32\certCredProvider.dll
21:47:23.0878 3376 C:\Windows\System32\certCredProvider.dll - ok
21:47:23.0878 3376 [ EEEA40F0EDB0A6E5359E539E15D0BC77 ] C:\Windows\System32\netapi32.dll
21:47:23.0878 3376 C:\Windows\System32\netapi32.dll - ok
21:47:23.0878 3376 [ 6CECA4C6A489C9B2E6073AFDAAE3F607 ] C:\Windows\System32\netutils.dll
21:47:23.0878 3376 C:\Windows\System32\netutils.dll - ok
21:47:23.0878 3376 [ FC51229C7D4AFA0D6F186133728B95AB ] C:\Windows\System32\samcli.dll
21:47:23.0878 3376 C:\Windows\System32\samcli.dll - ok
21:47:23.0893 3376 [ 44B9C66177651F3F53C87B665D58D17A ] C:\Windows\System32\vaultcli.dll
21:47:23.0893 3376 C:\Windows\System32\vaultcli.dll - ok
21:47:23.0893 3376 [ 3C91392D448F6E5D525A85B7550D8BA9 ] C:\Windows\System32\wkscli.dll
21:47:23.0893 3376 C:\Windows\System32\wkscli.dll - ok
21:47:23.0893 3376 [ 032229246107C5C7211E6D1498B52D3D ] C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL
21:47:23.0893 3376 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL - ok
21:47:23.0893 3376 [ 87FA0C48C3B2E9FEE518818FE26B15B5 ] C:\Windows\System32\rasplap.dll
21:47:23.0893 3376 C:\Windows\System32\rasplap.dll - ok
21:47:23.0909 3376 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] C:\Windows\System32\dhcpcore.dll
21:47:23.0909 3376 C:\Windows\System32\dhcpcore.dll - ok
21:47:23.0909 3376 [ 3CC16A849E6092E43909F48EF0E60306 ] C:\Windows\System32\dhcpcore6.dll
21:47:23.0909 3376 C:\Windows\System32\dhcpcore6.dll - ok
21:47:23.0909 3376 [ 0D753307D274F3688BD21C377B616700 ] C:\Windows\System32\eappcfg.dll
21:47:23.0909 3376 C:\Windows\System32\eappcfg.dll - ok
21:47:23.0909 3376 [ 65522E77A1360DBC8D199DA3BF5EFFE4 ] C:\Windows\System32\eappprxy.dll
21:47:23.0909 3376 C:\Windows\System32\eappprxy.dll - ok
21:47:23.0909 3376 [ 97E43F324BE1503CB2FFB058534688DA ] C:\Windows\System32\l2gpstore.dll
21:47:23.0909 3376 C:\Windows\System32\l2gpstore.dll - ok
21:47:23.0909 3376 [ 73FCB7919DEE80EE556F2E498594EBAE ] C:\Windows\System32\onex.dll
21:47:23.0924 3376 C:\Windows\System32\onex.dll - ok
21:47:23.0924 3376 [ 730BF204A595D5B6D7DC57A247CC741C ] C:\Windows\System32\wlgpclnt.dll
21:47:23.0924 3376 C:\Windows\System32\wlgpclnt.dll - ok
21:47:23.0924 3376 [ 7D5645EE0EA77D539828433D9B95F5EB ] C:\Windows\System32\WinSCard.dll
21:47:23.0924 3376 C:\Windows\System32\WinSCard.dll - ok
21:47:23.0924 3376 [ 7F1B4C6FF3B85F9ADF74055187B8A22C ] C:\Windows\System32\wlanutil.dll
21:47:23.0924 3376 C:\Windows\System32\wlanutil.dll - ok
21:47:23.0924 3376 [ 99B91C5D2FCEF218CAD3600ECB62A799 ] C:\Windows\System32\msxml6.dll
21:47:23.0924 3376 C:\Windows\System32\msxml6.dll - ok
21:47:23.0924 3376 [ AAF932B4011D14052955D4B212A4DA8D ] C:\Windows\System32\shsvcs.dll
21:47:23.0924 3376 C:\Windows\System32\shsvcs.dll - ok
21:47:23.0940 3376 [ 262F6592C3299C005FD6BEC90FC4463A ] C:\Windows\System32\schedsvc.dll
21:47:23.0940 3376 C:\Windows\System32\schedsvc.dll - ok
21:47:23.0940 3376 [ BC414631876B2F28B8DAB08E849C12C5 ] C:\Windows\System32\ktmw32.dll
21:47:23.0940 3376 C:\Windows\System32\ktmw32.dll - ok
21:47:23.0940 3376 [ 945E54F23C72D37B8CD1987AF0DB63BF ] C:\Windows\System32\fveapi.dll
21:47:23.0940 3376 C:\Windows\System32\fveapi.dll - ok
21:47:23.0940 3376 [ 891ECFD08E2C538B7948CBC45106D697 ] C:\Windows\System32\fvecerts.dll
21:47:23.0940 3376 C:\Windows\System32\fvecerts.dll - ok
21:47:23.0956 3376 [ 03706015DB44368375AEBE6339490E66 ] C:\Windows\System32\netcfgx.dll
21:47:23.0956 3376 C:\Windows\System32\netcfgx.dll - ok
21:47:23.0956 3376 [ 694865362F0965779F92BCFE97712323 ] C:\Windows\System32\tbs.dll
21:47:23.0956 3376 C:\Windows\System32\tbs.dll - ok
21:47:23.0956 3376 [ 6DC4A7242F565C9E9C9CCC7BB0FA75C7 ] C:\Windows\System32\taskcomp.dll
21:47:23.0956 3376 C:\Windows\System32\taskcomp.dll - ok
21:47:23.0956 3376 [ 8269210DAF3B12BC8300631B28A2A442 ] C:\Windows\System32\wiarpc.dll
21:47:23.0956 3376 C:\Windows\System32\wiarpc.dll - ok
21:47:23.0956 3376 [ C07D5582F2107ACAB4564E1DAE977C64 ] C:\Windows\ehome\ehprivjob.exe
21:47:23.0956 3376 C:\Windows\ehome\ehprivjob.exe - ok
21:47:23.0971 3376 [ 1BCDB508143B517F21BBDAC10F5777BF ] C:\Windows\System32\conhost.exe
21:47:23.0971 3376 C:\Windows\System32\conhost.exe - ok
21:47:23.0971 3376 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] C:\Windows\System32\drivers\http.sys
21:47:23.0971 3376 C:\Windows\System32\drivers\http.sys - ok
21:47:23.0971 3376 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] C:\Windows\System32\spoolsv.exe
21:47:23.0971 3376 C:\Windows\System32\spoolsv.exe - ok
21:47:23.0971 3376 [ 82974D6A2FD19445CC5171FC378668A4 ] C:\Windows\System32\BFE.DLL
21:47:23.0971 3376 C:\Windows\System32\BFE.DLL - ok
21:47:23.0987 3376 [ 6C02A83164F5CC0A262F4199F0871CF5 ] C:\Windows\System32\drivers\bowser.sys
21:47:23.0987 3376 C:\Windows\System32\drivers\bowser.sys - ok
21:47:23.0987 3376 [ DB76DB15EFC6E4D1153A6C5BC895948D ] C:\Windows\System32\sppc.dll
21:47:23.0987 3376 C:\Windows\System32\sppc.dll - ok
21:47:23.0987 3376 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] C:\Windows\System32\drivers\mpsdrv.sys
21:47:23.0987 3376 C:\Windows\System32\drivers\mpsdrv.sys - ok
21:47:23.0987 3376 [ C67F8A962B2534224D5908D16D2AD3CE ] C:\Windows\System32\wfapigp.dll
21:47:23.0987 3376 C:\Windows\System32\wfapigp.dll - ok
21:47:23.0987 3376 [ 9E0FF5DDD8B908DA5611445C35D6CD24 ] C:\Windows\System32\slcext.dll
21:47:23.0987 3376 C:\Windows\System32\slcext.dll - ok
21:47:24.0002 3376 [ A5D9106A73DC88564C825D317CAC68AC ] C:\Windows\System32\drivers\mrxsmb.sys
21:47:24.0002 3376 C:\Windows\System32\drivers\mrxsmb.sys - ok
21:47:24.0002 3376 [ 6F5BE3F67D7F66FFA861ABBFC6A8C973 ] C:\Windows\System32\sppcext.dll
21:47:24.0002 3376 C:\Windows\System32\sppcext.dll - ok
21:47:24.0002 3376 [ 58F4493BF748A3A89689997B7BD00E95 ] C:\Windows\System32\winhttp.dll
21:47:24.0002 3376 C:\Windows\System32\winhttp.dll - ok
21:47:24.0002 3376 [ 1834B31C749B86DAC233BBBA1C03BC48 ] C:\Windows\System32\mscms.dll
21:47:24.0002 3376 C:\Windows\System32\mscms.dll - ok
21:47:24.0002 3376 [ D711B3C1D5F42C0C2415687BE09FC163 ] C:\Windows\System32\drivers\mrxsmb10.sys
21:47:24.0002 3376 C:\Windows\System32\drivers\mrxsmb10.sys - ok
21:47:24.0018 3376 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] C:\Windows\System32\drivers\mrxsmb20.sys
21:47:24.0018 3376 C:\Windows\System32\drivers\mrxsmb20.sys - ok
21:47:24.0018 3376 [ 3AEAA8B561E63452C655DC0584922257 ] C:\Windows\System32\pcasvc.dll
21:47:24.0018 3376 C:\Windows\System32\pcasvc.dll - ok
21:47:24.0018 3376 [ 6313F223E817CC09AA41811DAA7F541D ] C:\Windows\System32\snmptrap.exe
21:47:24.0018 3376 C:\Windows\System32\snmptrap.exe - ok
21:47:24.0018 3376 [ 851A1382EED3E3A7476DB004F4EE3E1A ] C:\Windows\System32\wkssvc.dll
21:47:24.0018 3376 C:\Windows\System32\wkssvc.dll - ok
21:47:24.0034 3376 [ 581D88B25C4D4121824FED2CA38E562F ] C:\Program Files\SUPERAntiSpyware\SASCore64.exe
21:47:24.0034 3376 C:\Program Files\SUPERAntiSpyware\SASCore64.exe - ok
21:47:24.0034 3376 [ 08C2957BB30058E663720C5606885653 ] C:\Windows\System32\iphlpsvc.dll
21:47:24.0034 3376 C:\Windows\System32\iphlpsvc.dll - ok
21:47:24.0034 3376 [ 3927397AC60D943DAF8808AFFED582B7 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:47:24.0034 3376 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - ok
21:47:24.0034 3376 [ E9A0777DCA9148157E0EF9B71D7DE353 ] C:\Windows\System32\RdpGroupPolicyExtension.dll
21:47:24.0034 3376 C:\Windows\System32\RdpGroupPolicyExtension.dll - ok
21:47:24.0034 3376 [ B3892E6DA8E2C8CE4B0A9D3EB9A185E5 ] C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\msvcr90.dll
21:47:24.0034 3376 C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\msvcr90.dll - ok
21:47:24.0049 3376 [ 908ACB1F594274965A53926B10C81E89 ] C:\Windows\System32\provsvc.dll
21:47:24.0049 3376 C:\Windows\System32\provsvc.dll - ok
21:47:24.0049 3376 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] C:\Windows\System32\sstpsvc.dll
21:47:24.0049 3376 C:\Windows\System32\sstpsvc.dll - ok
21:47:24.0049 3376 [ F401929EE0CC92BFE7F15161CA535383 ] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:47:24.0049 3376 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe - ok
21:47:24.0049 3376 [ 0B3595A4FF0B36D68E5FC67FD7D70FDC ] C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcp80.dll
21:47:24.0049 3376 C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcp80.dll - ok
21:47:24.0065 3376 [ C9564CF4976E7E96B4052737AA2492B4 ] C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll
21:47:24.0065 3376 C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\msvcr80.dll - ok
21:47:24.0065 3376 [ 8C22C6088057A00EAE7D963600F26EEB ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\AppleVersions.dll
21:47:24.0065 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\AppleVersions.dll - ok
21:47:24.0065 3376 [ 53A6FFB9FFF5C3E64B64E9B68C31D4E5 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\YSCrashDump.dll
21:47:24.0065 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\YSCrashDump.dll - ok
21:47:24.0065 3376 [ 67B539D844F804EBAC7A1E3828FDE709 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CoreFoundation.dll
21:47:24.0065 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CoreFoundation.dll - ok
21:47:24.0065 3376 [ 32D78DCABFB942275E01363D5232C77D ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\objc.dll
21:47:24.0065 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\objc.dll - ok
21:47:24.0080 3376 [ 62169BDD927A67C360A35F4526429B01 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll
21:47:24.0080 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll - ok
21:47:24.0080 3376 [ 3BDE52411DF2FE4252C9289F51CB0F7E ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libdispatch.dll
21:47:24.0080 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libdispatch.dll - ok
21:47:24.0080 3376 [ D5AEFAD57C08349A4393D987DF7C715D ] C:\Windows\SysWOW64\winmm.dll
21:47:24.0080 3376 C:\Windows\SysWOW64\winmm.dll - ok
21:47:24.0080 3376 [ 9ABB7CDAC0914579C86990048771B1B4 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuin.dll
21:47:24.0080 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuin.dll - ok
21:47:24.0096 3376 [ D47913F993A0E3A0C9F1E88FD02E98C6 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuuc.dll
21:47:24.0096 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuuc.dll - ok
21:47:24.0096 3376 [ 43A0A24CD12B110DC93462D6B035C961 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\icudt46.dll
21:47:24.0096 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\icudt46.dll - ok
21:47:24.0096 3376 [ BA02F01BE7ED88E8974C798ACB3075F5 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ASL.dll
21:47:24.0096 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\ASL.dll - ok
21:47:24.0096 3376 [ 3B7D8EAE5E44CBDA4CD772720594F116 ] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService_main.dll
21:47:24.0096 3376 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService_main.dll - ok
21:47:24.0112 3376 [ 10FB16B50AFFDA6D44588F3C445DC273 ] C:\Windows\SysWOW64\setupapi.dll
21:47:24.0112 3376 C:\Windows\SysWOW64\setupapi.dll - ok
21:47:24.0112 3376 [ F436E847FA799ECD75AD8C313673F450 ] C:\Windows\SysWOW64\cfgmgr32.dll
21:47:24.0112 3376 C:\Windows\SysWOW64\cfgmgr32.dll - ok
21:47:24.0112 3376 [ 2EEFF4502F5E13B1BED4A04CCAD64C08 ] C:\Windows\SysWOW64\devobj.dll
21:47:24.0112 3376 C:\Windows\SysWOW64\devobj.dll - ok
21:47:24.0112 3376 [ 062373995EAE5F0EAC9EAA9192136BFB ] C:\Windows\SysWOW64\dnssd.dll
21:47:24.0112 3376 C:\Windows\SysWOW64\dnssd.dll - ok
21:47:24.0112 3376 [ EE5C8E27C37B79CB54A2FCEEED2DC262 ] C:\Windows\SysWOW64\WSHTCPIP.DLL
21:47:24.0112 3376 C:\Windows\SysWOW64\WSHTCPIP.DLL - ok
21:47:24.0127 3376 [ B0BF87F9E247BB0621BCE59EB8CD113F ] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\MobileDevice.dll
21:47:24.0127 3376 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\MobileDevice.dll - ok
21:47:24.0127 3376 [ CFE0CEE587F9CEA4C29DEEC6D85FC91C ] C:\Windows\SysWOW64\wininet.dll
21:47:24.0127 3376 C:\Windows\SysWOW64\wininet.dll - ok
21:47:24.0127 3376 [ FB03A917C1294D3E6D671F24722E1BA3 ] C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
21:47:24.0127 3376 C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe - ok
21:47:24.0127 3376 [ 6A13B4F3B3F575F1E24B877B9359AABA ] C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
21:47:24.0127 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll - ok
21:47:24.0127 3376 [ 6951562DC4625EEFC6EACD52AD165866 ] C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
21:47:24.0127 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll - ok
21:47:24.0143 3376 [ 589CBC4989F750E1DA35625AB481CF43 ] C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
21:47:24.0143 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll - ok
21:47:24.0143 3376 [ 3BE0D923AA45A4DBE091C2D84F0B4FE7 ] C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
21:47:24.0143 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll - ok
21:47:24.0143 3376 [ 2E33DFD10F28F86C3FC40EE123CC3904 ] C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
21:47:24.0143 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll - ok
21:47:24.0143 3376 [ B5DEC0D4CBBC333CA99FE10B06D4747E ] C:\Windows\SysWOW64\iertutil.dll
21:47:24.0143 3376 C:\Windows\SysWOW64\iertutil.dll - ok
21:47:24.0143 3376 [ 019CD868461B646E09BDF04474C19341 ] C:\Windows\System32\rasapi32.dll
21:47:24.0143 3376 C:\Windows\System32\rasapi32.dll - ok
21:47:24.0158 3376 [ 352B3DC62A0D259A82A052238425C872 ] C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
21:47:24.0158 3376 C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll - ok
21:47:24.0158 3376 [ 58B61578D5704E9FC8B8A9861A85069D ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
21:47:24.0158 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll - ok
21:47:24.0158 3376 [ AF54247F97CCF3539DE7505C09972FF9 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CFNetwork.dll
21:47:24.0158 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\CFNetwork.dll - ok
21:47:24.0158 3376 [ 8128B54EAA48F9C06B19A86C87752996 ] C:\Windows\SysWOW64\AsIO.dll
21:47:24.0158 3376 C:\Windows\SysWOW64\AsIO.dll - ok
21:47:24.0158 3376 [ 703FFD301AB900B047337C5D40FD6F96 ] C:\Windows\SysWOW64\olepro32.dll
21:47:24.0158 3376 C:\Windows\SysWOW64\olepro32.dll - ok
21:47:24.0174 3376 [ DC6612A9EE015A36BA2A27BC9CC12537 ] C:\Windows\SysWOW64\mfc42.dll
21:47:24.0174 3376 C:\Windows\SysWOW64\mfc42.dll - ok
21:47:24.0174 3376 [ 7D34AF98A706230CC2DEDFE0CABF87AB ] C:\Windows\SysWOW64\odbc32.dll
21:47:24.0174 3376 C:\Windows\SysWOW64\odbc32.dll - ok
21:47:24.0174 3376 [ ABA457BFC7EC0B5E130B2F1E0F549DFF ] C:\Windows\SysWOW64\odbcint.dll
21:47:24.0174 3376 C:\Windows\SysWOW64\odbcint.dll - ok
21:47:24.0174 3376 [ 8A1CBAE63FC06EDAEDCCE1B23E9C9267 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\SQLite3.dll
21:47:24.0174 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\SQLite3.dll - ok
21:47:24.0190 3376 [ C3C8D359D1FCB72941F75F8A302BFBDE ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
21:47:24.0190 3376 C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll - ok
21:47:24.0190 3376 [ 603EBD34E216C5654A2D774EAC98D278 ] C:\Windows\System32\webio.dll
21:47:24.0190 3376 C:\Windows\System32\webio.dll - ok
21:47:24.0190 3376 [ 239D0007E11454D5D5479E3C35866F0C ] C:\Program Files (x86)\ASUS\AXSP\1.00.13\PEbiosinterface32.dll
21:47:24.0190 3376 C:\Program Files (x86)\ASUS\AXSP\1.00.13\PEbiosinterface32.dll - ok
21:47:24.0190 3376 [ 3BDCBB29D727C49DC3E3256253467281 ] C:\Windows\System32\wmdrmsdk.dll
21:47:24.0190 3376 C:\Windows\System32\wmdrmsdk.dll - ok
21:47:24.0205 3376 [ AFFEBDF6CE01FCB74B3BB7CC3C7B7EEC ] C:\Program Files (x86)\ASUS\AXSP\1.00.13\ATKEX.dll
21:47:24.0205 3376 C:\Program Files (x86)\ASUS\AXSP\1.00.13\ATKEX.dll - ok
21:47:24.0205 3376 [ FF5688D309347F2720911D8796912834 ] C:\Windows\SysWOW64\clbcatq.dll
21:47:24.0205 3376 C:\Windows\SysWOW64\clbcatq.dll - ok
21:47:24.0205 3376 [ 7321F18D1F820612ED0E9F2D4B578A7E ] C:\Windows\SysWOW64\cryptsp.dll
21:47:24.0205 3376 C:\Windows\SysWOW64\cryptsp.dll - ok
21:47:24.0205 3376 [ 5997D769CDB108390DCFAEBF442BF816 ] C:\Windows\SysWOW64\RpcRtRemote.dll
21:47:24.0205 3376 C:\Windows\SysWOW64\RpcRtRemote.dll - ok
21:47:24.0221 3376 [ ED8EC63F7522DF4852147C84EC62C36A ] C:\Windows\SysWOW64\rsaenh.dll
21:47:24.0221 3376 C:\Windows\SysWOW64\rsaenh.dll - ok
21:47:24.0221 3376 [ A63173897EA1A73A75D0E65036DE5B15 ] C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
21:47:24.0221 3376 C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe - ok
21:47:24.0221 3376 [ 68FB60221D8C7143C01BC758F9853784 ] C:\Program Files (x86)\ASUS\AAHM\1.00.14\AsAcpi.dll
21:47:24.0221 3376 C:\Program Files (x86)\ASUS\AAHM\1.00.14\AsAcpi.dll - ok
21:47:24.0221 3376 [ EDAA17CE771C696655B6585F7CAD2100 ] C:\Windows\SysWOW64\drivers\AsInsHelp64.sys
21:47:24.0221 3376 C:\Windows\SysWOW64\drivers\AsInsHelp64.sys - ok
21:47:24.0236 3376 [ 5C31DFB196CB3A488A041881634D86D2 ] C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
21:47:24.0236 3376 C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe - ok
21:47:24.0236 3376 [ A7A060977ABC1D51246580EFC3106293 ] C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsAcpi.dll
21:47:24.0236 3376 C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsAcpi.dll - ok
21:47:24.0236 3376 [ FCDF60EA278867B930C53DD9777F7682 ] C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\asacpiex.dll
21:47:24.0236 3376 C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\asacpiex.dll - ok
21:47:24.0236 3376 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] C:\Program Files\Bonjour\mDNSResponder.exe
21:47:24.0236 3376 C:\Program Files\Bonjour\mDNSResponder.exe - ok
21:47:24.0252 3376 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] C:\Windows\System32\cryptsvc.dll
21:47:24.0252 3376 C:\Windows\System32\cryptsvc.dll - ok
21:47:24.0252 3376 [ 8792BAB371B4B1589E015B6FD1ED3B15 ] C:\Windows\System32\cryptnet.dll
21:47:24.0252 3376 C:\Windows\System32\cryptnet.dll - ok
21:47:24.0252 3376 [ 0E2F58F6E698EDCB9E58FAD0CBCD0567 ] C:\Windows\System32\vssapi.dll
21:47:24.0252 3376 C:\Windows\System32\vssapi.dll - ok
21:47:24.0252 3376 [ 0A403702CB00432AC818523CD416BF67 ] C:\Windows\SysWOW64\AsHookDevice.exe
21:47:24.0252 3376 C:\Windows\SysWOW64\AsHookDevice.exe - ok
21:47:24.0252 3376 [ 919001D2BB17DF06CA3F8AC16AD039F6 ] C:\Windows\SysWOW64\sxs.dll
21:47:24.0252 3376 C:\Windows\SysWOW64\sxs.dll - ok
21:47:24.0268 3376 [ 8E01332CC4B68BC6B5B7EFFE374442AA ] C:\Windows\SysWOW64\oleacc.dll
21:47:24.0268 3376 C:\Windows\SysWOW64\oleacc.dll - ok
21:47:24.0268 3376 [ D1DE1EAFDE97BE41CF6585027FF3E732 ] C:\Windows\SysWOW64\comdlg32.dll
21:47:24.0268 3376 C:\Windows\SysWOW64\comdlg32.dll - ok
21:47:24.0268 3376 [ 287923557447D7E4BDD7E65B1F0F5428 ] C:\Windows\System32\vsstrace.dll
21:47:24.0268 3376 C:\Windows\System32\vsstrace.dll - ok
21:47:24.0268 3376 [ 802496CB59A30349F9A6DD22D6947644 ] C:\Windows\System32\FDResPub.dll
21:47:24.0268 3376 C:\Windows\System32\FDResPub.dll - ok
21:47:24.0268 3376 [ 9DB17B1DD76CF0FD0BB3DA5F1DA078C2 ] C:\Windows\System32\drivers\LxrSII1d.sys
21:47:24.0268 3376 C:\Windows\System32\drivers\LxrSII1d.sys - ok
21:47:24.0283 3376 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] C:\Windows\System32\dps.dll
21:47:24.0283 3376 C:\Windows\System32\dps.dll - ok
21:47:24.0283 3376 [ E66286727FBF58EB323625AF3EFDA53E ] C:\Windows\SysWOW64\LxrSII1s.exe
21:47:24.0283 3376 C:\Windows\SysWOW64\LxrSII1s.exe - ok
21:47:24.0283 3376 [ F1B205F932F62F94506A5F332C895DAF ] C:\Windows\System32\WSDApi.dll
21:47:24.0283 3376 C:\Windows\System32\WSDApi.dll - ok
21:47:24.0283 3376 [ BAAFAF9CEAEC0B73C2A3550A01F6CECB ] C:\Windows\System32\taskschd.dll
21:47:24.0283 3376 C:\Windows\System32\taskschd.dll - ok
21:47:24.0299 3376 [ 241BD3019FB31E812A51B31B06906335 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccsvchst.exe
21:47:24.0299 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccsvchst.exe - ok
21:47:24.0299 3376 [ E3C817F7FE44CC870ECDBCBC3EA36132 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\msvcp100.dll
21:47:24.0299 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\msvcp100.dll - ok
21:47:24.0299 3376 [ C55516D98DD5D8F0153C2A9B4227DA86 ] C:\Windows\System32\webservices.dll
21:47:24.0299 3376 C:\Windows\System32\webservices.dll - ok
21:47:24.0299 3376 [ BF38660A9125935658CFA3E53FDC7D65 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\msvcr100.dll
21:47:24.0299 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\msvcr100.dll - ok
21:47:24.0314 3376 [ B5055B51BAA0FD0A736A88653DA3C1C0 ] C:\Windows\System32\fundisc.dll
21:47:24.0314 3376 C:\Windows\System32\fundisc.dll - ok
21:47:24.0314 3376 [ 0739819B2653DBD8D71EC5784BE6D9FC ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccl120u.dll
21:47:24.0314 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccl120u.dll - ok
21:47:24.0314 3376 [ 53223B673A3FA2F9A4D1C31C8D3F6CD8 ] C:\Windows\SysWOW64\dbghelp.dll
21:47:24.0314 3376 C:\Windows\SysWOW64\dbghelp.dll - ok
21:47:24.0314 3376 [ 35AC6003760ED3C65942F6D89C28CFA7 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccvrtrst.dll
21:47:24.0314 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccvrtrst.dll - ok
21:47:24.0314 3376 [ 3ECC194DFEA426A3F3B4ECFDB8454F14 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\efacli.dll
21:47:24.0314 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\efacli.dll - ok
21:47:24.0330 3376 [ DC6530A291D4BDF6DF399F1F128E7F8F ] C:\Windows\System32\HPZinw12.dll
21:47:24.0330 3376 C:\Windows\System32\HPZinw12.dll - ok
21:47:24.0330 3376 [ BCEA9AB347E53BC03B2E36BE0B8BA0EF ] C:\Windows\System32\httpapi.dll
21:47:24.0330 3376 C:\Windows\System32\httpapi.dll - ok
21:47:24.0330 3376 [ 847D3AE376C0817161A14A82C8922A9E ] C:\Windows\System32\netman.dll
21:47:24.0330 3376 C:\Windows\System32\netman.dll - ok
21:47:24.0330 3376 [ E36112A8A6C7F840169A7E92C12F4203 ] C:\Windows\System32\wsock32.dll
21:47:24.0330 3376 C:\Windows\System32\wsock32.dll - ok
21:47:24.0346 3376 [ 68769C3356B3BE5D1C732C97B9A80D6E ] C:\Windows\System32\drivers\PEAuth.sys
21:47:24.0346 3376 C:\Windows\System32\drivers\PEAuth.sys - ok
21:47:24.0346 3376 [ 3EA8A16169C26AFBEB544E0E48421186 ] C:\Windows\System32\drivers\secdrv.sys
21:47:24.0346 3376 C:\Windows\System32\drivers\secdrv.sys - ok
21:47:24.0346 3376 [ 8AD77806D336673F270DB31645267293 ] C:\Windows\System32\nlasvc.dll
21:47:24.0346 3376 C:\Windows\System32\nlasvc.dll - ok
21:47:24.0346 3376 [ B9CF40ABF316A863DB9760727D882C6A ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccsvc.dll
21:47:24.0346 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccsvc.dll - ok
21:47:24.0346 3376 [ D4FAC263861BAE06971C7F7D0A8EBF15 ] C:\Windows\System32\ncsi.dll
21:47:24.0361 3376 C:\Windows\System32\ncsi.dll - ok
21:47:24.0361 3376 [ 2BBF3FDB70B8965DFA0258CBAB41ECCE ] C:\Windows\System32\ssdpapi.dll
21:47:24.0361 3376 C:\Windows\System32\ssdpapi.dll - ok
21:47:24.0361 3376 [ BDBC187D16A423F5E10CEA4F85E335FB ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\srtsp32.dll
21:47:24.0361 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\srtsp32.dll - ok
21:47:24.0361 3376 [ C6CC9297BD53E5229653303E556AA539 ] C:\Windows\System32\drivers\Sftfslh.sys
21:47:24.0361 3376 C:\Windows\System32\drivers\Sftfslh.sys - ok
21:47:24.0361 3376 [ 1727B2A2F379A32B864C096FA794AADC ] C:\Windows\System32\aepic.dll
21:47:24.0361 3376 C:\Windows\System32\aepic.dll - ok
21:47:24.0361 3376 [ 71F62C51DFDFBC04C83C5C64B2B8058E ] C:\Windows\System32\HPZipm12.dll
21:47:24.0361 3376 C:\Windows\System32\HPZipm12.dll - ok
21:47:24.0377 3376 [ C6DCD1D11ED6827F05C00773C3E7053C ] C:\Windows\System32\sfc.dll
21:47:24.0377 3376 C:\Windows\System32\sfc.dll - ok
21:47:24.0377 3376 [ 895C9AB0A855547445C4181195230757 ] C:\Windows\System32\sfc_os.dll
21:47:24.0377 3376 C:\Windows\System32\sfc_os.dll - ok
21:47:24.0377 3376 [ 57D1527A7EB0D6F6BBA04796AA4839EE ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccipc.dll
21:47:24.0377 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccipc.dll - ok
21:47:24.0377 3376 [ 53E1D3752A82C0256E58B53140AC1F58 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\dimaster.dll
21:47:24.0377 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\dimaster.dll - ok
21:47:24.0392 3376 [ 390AA7BC52CEE43F6790CDEA1E776703 ] C:\Windows\System32\drivers\Sftplaylh.sys
21:47:24.0392 3376 C:\Windows\System32\drivers\Sftplaylh.sys - ok
21:47:24.0392 3376 [ C3CDDD18F43D44AB713CF8C4916F7696 ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
21:47:24.0392 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe - ok
21:47:24.0392 3376 [ DB001FAEA818AE2E14A74E0ADC530FC0 ] C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\msvcp90.dll
21:47:24.0392 3376 C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\msvcp90.dll - ok
21:47:24.0392 3376 [ 27E461F0BE5BFF5FC737328F749538C3 ] C:\Windows\System32\drivers\srvnet.sys
21:47:24.0392 3376 C:\Windows\System32\drivers\srvnet.sys - ok
21:47:24.0392 3376 [ B53C4B69B695EDA1B7E41D35CA4244E2 ] C:\Windows\System32\rtutils.dll
21:47:24.0392 3376 C:\Windows\System32\rtutils.dll - ok
21:47:24.0392 3376 [ 4E5FE39C1076D115EC8BFCFE14D75B80 ] C:\Windows\SysWOW64\credssp.dll
21:47:24.0392 3376 C:\Windows\SysWOW64\credssp.dll - ok
21:47:24.0408 3376 [ A113AFEED3159A1ED52D78CB0226006D ] C:\Windows\SysWOW64\secur32.dll
21:47:24.0408 3376 C:\Windows\SysWOW64\secur32.dll - ok
21:47:24.0408 3376 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] C:\Windows\System32\drivers\tcpipreg.sys
21:47:24.0408 3376 C:\Windows\System32\drivers\tcpipreg.sys - ok
21:47:24.0408 3376 [ 2BACD71123F42CEA603F4E205E1AE337 ] C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:47:24.0408 3376 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE - ok
21:47:24.0408 3376 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] C:\Windows\System32\wiaservc.dll
21:47:24.0408 3376 C:\Windows\System32\wiaservc.dll - ok
21:47:24.0424 3376 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] C:\Windows\System32\sysmain.dll
21:47:24.0424 3376 C:\Windows\System32\sysmain.dll - ok
21:47:24.0424 3376 [ 210FCACAF902B2CD47CF9FD17D846146 ] C:\Windows\System32\aeevts.dll
21:47:24.0424 3376 C:\Windows\System32\aeevts.dll - ok
21:47:24.0424 3376 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] C:\Windows\System32\tapisrv.dll
21:47:24.0424 3376 C:\Windows\System32\tapisrv.dll - ok
21:47:24.0424 3376 [ 7E7AFD841694F6AC397E99D75CEAD49D ] C:\Windows\System32\trkwks.dll
21:47:24.0424 3376 C:\Windows\System32\trkwks.dll - ok
21:47:24.0424 3376 [ 0364256B4A2A93A8C8CDA6B3B5A0EFF5 ] C:\Windows\System32\wiatrace.dll
21:47:24.0424 3376 C:\Windows\System32\wiatrace.dll - ok
21:47:24.0439 3376 [ B837D1528CE2E3CB79F09496BC08DDC6 ] C:\Windows\System32\SensApi.dll
21:47:24.0439 3376 C:\Windows\System32\SensApi.dll - ok
21:47:24.0439 3376 [ 93812FDC01AA864195816CD814445F95 ] C:\Program Files\Common Files\Microsoft Shared\Windows Live\SQMAPI.DLL
21:47:24.0439 3376 C:\Program Files\Common Files\Microsoft Shared\Windows Live\SQMAPI.DLL - ok
21:47:24.0439 3376 [ 9689A9C7F7C2A1A423CDA2C3B43FFF65 ] C:\Windows\System32\wer.dll
21:47:24.0439 3376 C:\Windows\System32\wer.dll - ok
21:47:24.0439 3376 [ 079FD1D59EAD19270C979AF174D881A3 ] C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
21:47:24.0439 3376 C:\ProgramData\Microsoft\IdentityCRL\production\ppcrlconfig600.dll - ok
21:47:24.0439 3376 [ 13693B6354DD6E72DC5131DA7D764B90 ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
21:47:24.0439 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe - ok
21:47:24.0455 3376 [ 371948BC5911ABA06168FAC91ED25F06 ] C:\Windows\System32\msxml3.dll
21:47:24.0455 3376 C:\Windows\System32\msxml3.dll - ok
21:47:24.0455 3376 [ 6177E1A8F215576A56D437B48A00848B ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftsync.dll
21:47:24.0455 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftsync.dll - ok
21:47:24.0455 3376 [ 295E1F2BC1AFDAFD98FF426BCE524BA9 ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftuser.dll
21:47:24.0455 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftuser.dll - ok
21:47:24.0455 3376 [ B9A8CBCFCD3EC9D2EA4740AF347BF108 ] C:\Windows\SysWOW64\mpr.dll
21:47:24.0455 3376 C:\Windows\SysWOW64\mpr.dll - ok
21:47:24.0455 3376 [ 2A46FFE841EC43001D5A293A54DB34DE ] C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
21:47:24.0455 3376 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE - ok
21:47:24.0470 3376 [ A733CC986EB51F8FBF598B981DC19FBA ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftcore.dll
21:47:24.0470 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftcore.dll - ok
21:47:24.0470 3376 [ 2FCA0D2C59A855C54BAFA22AA329DF0F ] C:\Windows\SysWOW64\netapi32.dll
21:47:24.0470 3376 C:\Windows\SysWOW64\netapi32.dll - ok
21:47:24.0470 3376 [ 20B3934DB73EABA2B49B7177873CB81F ] C:\Windows\SysWOW64\netutils.dll
21:47:24.0470 3376 C:\Windows\SysWOW64\netutils.dll - ok
21:47:24.0470 3376 [ 5CCDCD40E732D54E0F7451AC66AC1C87 ] C:\Windows\SysWOW64\srvcli.dll
21:47:24.0470 3376 C:\Windows\SysWOW64\srvcli.dll - ok
21:47:24.0486 3376 [ E5A4A1326A02F8E7B59E6C3270CE7202 ] C:\Windows\SysWOW64\wkscli.dll
21:47:24.0486 3376 C:\Windows\SysWOW64\wkscli.dll - ok
21:47:24.0486 3376 [ 32BFCF1CA719F2A3A31C721BD5F90303 ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftpsr.dll
21:47:24.0486 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftpsr.dll - ok
21:47:24.0486 3376 [ 40EE4E67311F4019CCA2120D88C60576 ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftfsi_wow64.dll
21:47:24.0486 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftfsi_wow64.dll - ok
21:47:24.0486 3376 [ 09AB81CEE443569D9A3CC151DDF70444 ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftcomp.dll
21:47:24.0486 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftcomp.dll - ok
21:47:24.0502 3376 [ 6F8E3B7B70E1BBA871212940C1FBDF60 ] C:\Windows\SysWOW64\SensApi.dll
21:47:24.0502 3376 C:\Windows\SysWOW64\SensApi.dll - ok
21:47:24.0502 3376 [ 4D842C5081F06E61BFF461CF87D13525 ] C:\Windows\ehome\ehtrace.dll
21:47:24.0502 3376 C:\Windows\ehome\ehtrace.dll - ok
21:47:24.0502 3376 [ B28DEEC597C8DEB70C744C7CF9210E3E ] C:\Windows\System32\rasman.dll
21:47:24.0502 3376 C:\Windows\System32\rasman.dll - ok
21:47:24.0502 3376 [ CA9F7888B524D8100B977C81F44C3234 ] C:\Windows\SysWOW64\winhttp.dll
21:47:24.0502 3376 C:\Windows\SysWOW64\winhttp.dll - ok
21:47:24.0502 3376 [ FB19FC5951A88F3C523E35C2C98D23C0 ] C:\Windows\SysWOW64\webio.dll
21:47:24.0502 3376 C:\Windows\SysWOW64\webio.dll - ok
21:47:24.0517 3376 [ 8EA53101FF2B15BDFF934B62A8FB326D ] C:\Windows\SysWOW64\logoncli.dll
21:47:24.0517 3376 C:\Windows\SysWOW64\logoncli.dll - ok
21:47:24.0517 3376 [ A6C29DB53ECA94FA8591C5388D604B82 ] C:\Windows\SysWOW64\msi.dll
21:47:24.0517 3376 C:\Windows\SysWOW64\msi.dll - ok
21:47:24.0517 3376 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] C:\Windows\System32\drivers\srv2.sys
21:47:24.0517 3376 C:\Windows\System32\drivers\srv2.sys - ok
21:47:24.0517 3376 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] C:\Windows\System32\drivers\srv.sys
21:47:24.0517 3376 C:\Windows\System32\drivers\srv.sys - ok
21:47:24.0533 3376 [ 617E29A0B0A2807466560D4C4E338D3E ] C:\Windows\System32\drivers\Sftredirlh.sys
21:47:24.0533 3376 C:\Windows\System32\drivers\Sftredirlh.sys - ok
21:47:24.0533 3376 [ AF78F66116814FDD6677CEBD73035CDD ] C:\Windows\SysWOW64\schannel.dll
21:47:24.0533 3376 C:\Windows\SysWOW64\schannel.dll - ok
21:47:24.0533 3376 [ F11A57E91FDAECFB41A5CB21EB1EBC8E ] C:\Windows\System32\dssenh.dll
21:47:24.0533 3376 C:\Windows\System32\dssenh.dll - ok
21:47:24.0533 3376 [ 9BC8610C32C96A2983A65DC21CAFA921 ] C:\Windows\System32\UXInit.dll
21:47:24.0533 3376 C:\Windows\System32\UXInit.dll - ok
21:47:24.0548 3376 [ CF636C92B762B26F0B39B38E92380A09 ] C:\Windows\System32\oleacc.dll
21:47:24.0548 3376 C:\Windows\System32\oleacc.dll - ok
21:47:24.0548 3376 [ 019BDD35DE269CB98B22DE8923C2AA3B ] C:\Windows\System32\UIAutomationCore.dll
21:47:24.0548 3376 C:\Windows\System32\UIAutomationCore.dll - ok
21:47:24.0548 3376 [ FCD84C381E0140AF901E58D48882D26B ] C:\Windows\System32\IKEEXT.DLL
21:47:24.0548 3376 C:\Windows\System32\IKEEXT.DLL - ok
21:47:24.0548 3376 [ E424B3EF666B184CEE0B6871AAA8C9F6 ] C:\Windows\System32\msimg32.dll
21:47:24.0548 3376 C:\Windows\System32\msimg32.dll - ok
21:47:24.0548 3376 [ 418E881201583A3039D81F43E39E6C78 ] C:\Windows\SysWOW64\winsta.dll
21:47:24.0548 3376 C:\Windows\SysWOW64\winsta.dll - ok
21:47:24.0564 3376 [ 3B2DF621CADA482C06AF0006EC18BF2E ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccset.dll
21:47:24.0564 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccset.dll - ok
21:47:24.0564 3376 [ C5B0324DB461559ADD070E632A6919FA ] C:\Windows\SysWOW64\wbem\wbemprox.dll
21:47:24.0564 3376 C:\Windows\SysWOW64\wbem\wbemprox.dll - ok
21:47:24.0564 3376 [ 704314FD398C81D5F342CAA5DF7B7F21 ] C:\Windows\SysWOW64\wbemcomn.dll
21:47:24.0564 3376 C:\Windows\SysWOW64\wbemcomn.dll - ok
21:47:24.0564 3376 [ DB120EB91429B4056344B35C434CBE41 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\fwsetup.dll
21:47:24.0564 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\fwsetup.dll - ok
21:47:24.0564 3376 [ 539C49CEBB3C50957AC8A09D95ECD880 ] C:\Windows\SysWOW64\shfolder.dll
21:47:24.0564 3376 C:\Windows\SysWOW64\shfolder.dll - ok
21:47:24.0580 3376 [ A2A729F6925252E3DB9ADF3E4FA39A48 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\symneti.dll
21:47:24.0580 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\symneti.dll - ok
21:47:24.0580 3376 [ 3F50200237961034FACE602373838980 ] C:\Windows\SysWOW64\FirewallAPI.dll
21:47:24.0580 3376 C:\Windows\SysWOW64\FirewallAPI.dll - ok
21:47:24.0580 3376 [ BC617A4E1B4FA8DF523A061739A0BD87 ] C:\Windows\System32\seclogon.dll
21:47:24.0580 3376 C:\Windows\System32\seclogon.dll - ok
21:47:24.0580 3376 [ CC19133AB94723A75727D632C24D1B13 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccgevt.dll
21:47:24.0580 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccgevt.dll - ok
21:47:24.0580 3376 [ 19B07E7E8915D701225DA41CB3877306 ] C:\Windows\System32\wbem\WMIsvc.dll
21:47:24.0580 3376 C:\Windows\System32\wbem\WMIsvc.dll - ok
21:47:24.0595 3376 [ 7DB5AA22A8A8E5C2D335F44853C1F6DE ] C:\Windows\System32\wbemcomn.dll
21:47:24.0595 3376 C:\Windows\System32\wbemcomn.dll - ok
21:47:24.0595 3376 [ EE867A0870FC9E4972BA9EAAD35651E2 ] C:\Windows\System32\rasmans.dll
21:47:24.0595 3376 C:\Windows\System32\rasmans.dll - ok
21:47:24.0595 3376 [ D9F42719019740BAA6D1C6D536CBDAA6 ] C:\Windows\System32\srvsvc.dll
21:47:24.0595 3376 C:\Windows\System32\srvsvc.dll - ok
21:47:24.0595 3376 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] C:\Windows\System32\browser.dll
21:47:24.0595 3376 C:\Windows\System32\browser.dll - ok
21:47:24.0611 3376 [ 44C96B48112EB24AE7764EBF1C527000 ] C:\Windows\System32\rastapi.dll
21:47:24.0611 3376 C:\Windows\System32\rastapi.dll - ok
21:47:24.0611 3376 [ FAFAE01E889DC9C05A6CA2138CFC220B ] C:\Windows\System32\tapi32.dll
21:47:24.0611 3376 C:\Windows\System32\tapi32.dll - ok
21:47:24.0611 3376 [ 27B9E163740A226B65E4B9E186117911 ] C:\Windows\System32\sqmapi.dll
21:47:24.0611 3376 C:\Windows\System32\sqmapi.dll - ok
21:47:24.0611 3376 [ 7B38D7916A7CD058C16A0A6CA5077901 ] C:\Windows\System32\wdscore.dll
21:47:24.0611 3376 C:\Windows\System32\wdscore.dll - ok
21:47:24.0611 3376 [ 0255C22D99602534F15CBB8D9B6F152F ] C:\Windows\System32\wbem\WinMgmtR.dll
21:47:24.0611 3376 C:\Windows\System32\wbem\WinMgmtR.dll - ok
21:47:24.0626 3376 [ CFEFA40DDE34659BE5211966EAD86437 ] C:\Windows\System32\netmsg.dll
21:47:24.0626 3376 C:\Windows\System32\netmsg.dll - ok
21:47:24.0626 3376 [ FF80CAD87555E8E4D2CFD7B9058343F8 ] C:\Windows\System32\sscore.dll
21:47:24.0626 3376 C:\Windows\System32\sscore.dll - ok
21:47:24.0626 3376 [ 81749E073AC5857B044A686B406E5244 ] C:\Windows\System32\clusapi.dll
21:47:24.0626 3376 C:\Windows\System32\clusapi.dll - ok
21:47:24.0626 3376 [ 344FCC9850C3A8A3B4D3C65151AF8E4C ] C:\Windows\System32\resutils.dll
21:47:24.0626 3376 C:\Windows\System32\resutils.dll - ok
21:47:24.0642 3376 [ 5AA945234E9D4CCE4F715276B9AA712C ] C:\Windows\System32\imageres.dll
21:47:24.0642 3376 C:\Windows\System32\imageres.dll - ok
21:47:24.0642 3376 [ 3B367397320C26DBA890B260F80D1B1B ] C:\Windows\System32\hnetcfg.dll
21:47:24.0642 3376 C:\Windows\System32\hnetcfg.dll - ok
21:47:24.0642 3376 [ D2A0FFA75AB181B19B5EB93BB29C7686 ] C:\Windows\System32\unimdm.tsp
21:47:24.0642 3376 C:\Windows\System32\unimdm.tsp - ok
21:47:24.0642 3376 [ 94B7DF336815B47236724019FAB24B7C ] C:\Windows\System32\uniplat.dll
21:47:24.0642 3376 C:\Windows\System32\uniplat.dll - ok
21:47:24.0658 3376 [ 77B5035BC6EDF4D1B6265391AECEE4C0 ] C:\Windows\System32\vpnikeapi.dll
21:47:24.0658 3376 C:\Windows\System32\vpnikeapi.dll - ok
21:47:24.0658 3376 [ 666A60F6F5E719856FF6254E0966EFF7 ] C:\Windows\System32\wbem\wbemprox.dll
21:47:24.0658 3376 C:\Windows\System32\wbem\wbemprox.dll - ok
21:47:24.0658 3376 [ 5EB55F661DEBF156E126160BCD4D89F8 ] C:\Windows\System32\wbem\wbemcore.dll
21:47:24.0658 3376 C:\Windows\System32\wbem\wbemcore.dll - ok
21:47:24.0658 3376 [ 087D8668C71634A3A3761135ABF16EEE ] C:\Windows\System32\wbem\esscli.dll
21:47:24.0658 3376 C:\Windows\System32\wbem\esscli.dll - ok
21:47:24.0658 3376 [ A3F5E8EC1316C3E2562B82694A251C9E ] C:\Windows\System32\wbem\fastprox.dll
21:47:24.0658 3376 C:\Windows\System32\wbem\fastprox.dll - ok
21:47:24.0673 3376 [ EAADD6E47ED2A7003ACE1793B98CF63F ] C:\Windows\SysWOW64\msxml6.dll
21:47:24.0673 3376 C:\Windows\SysWOW64\msxml6.dll - ok
21:47:24.0673 3376 [ 69CB1A65B835EE6ADF9E16ED6D443072 ] C:\Windows\SysWOW64\urlmon.dll
21:47:24.0673 3376 C:\Windows\SysWOW64\urlmon.dll - ok
21:47:24.0673 3376 [ 1C60E09CA1C3A045BC4D367F67C915B7 ] C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
21:47:24.0673 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll - ok
21:47:24.0673 3376 [ 007863E45F25AA47A4C30D0930BBFD85 ] C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
21:47:24.0673 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll - ok
21:47:24.0673 3376 [ 0C52762C606BCF6A377D5E4688191A6B ] C:\Windows\System32\wbem\WmiDcPrv.dll
21:47:24.0673 3376 C:\Windows\System32\wbem\WmiDcPrv.dll - ok
21:47:24.0689 3376 [ 2472BDF30C62F3E81AE27A968C25608C ] C:\Windows\System32\unimdmat.dll
21:47:24.0689 3376 C:\Windows\System32\unimdmat.dll - ok
21:47:24.0689 3376 [ 72794D112CBAFF3BC0C29BF7350D4741 ] C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
21:47:24.0689 3376 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE - ok
21:47:24.0689 3376 [ C797D1677BA81306AFBB9FA8A9A8F483 ] C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSHARED.DLL
21:47:24.0689 3376 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSHARED.DLL - ok
21:47:24.0689 3376 [ 108C2CFA5527458C096A699929ECBD80 ] C:\Windows\SysWOW64\credui.dll
21:47:24.0689 3376 C:\Windows\SysWOW64\credui.dll - ok
21:47:24.0704 3376 [ 7717F84F483002815490033BF069DABD ] C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\GdiPlus.dll
21:47:24.0704 3376 C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\GdiPlus.dll - ok
21:47:24.0704 3376 [ 565A30B70BE8A9B171839003F2D69683 ] C:\Windows\SysWOW64\hlink.dll
21:47:24.0704 3376 C:\Windows\SysWOW64\hlink.dll - ok
21:47:24.0704 3376 [ 74AF1FFCAFD60DA88A386AE161F56438 ] C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\en-us\CVHIntl.dll
21:47:24.0704 3376 C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\en-us\CVHIntl.dll - ok
21:47:24.0704 3376 [ B08E3476F0874DBAD672D0AC4FB2580B ] C:\Program Files (x86)\Microsoft Application Virtualization Client\sftintf.dll
21:47:24.0704 3376 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftintf.dll - ok
21:47:24.0704 3376 [ 1128637CAD49A8E3C8B5FA5D0A061525 ] C:\Windows\SysWOW64\cryptdll.dll
21:47:24.0704 3376 C:\Windows\SysWOW64\cryptdll.dll - ok
21:47:24.0720 3376 [ 4C1E16B9A53102C8D6FBA587CBCB95DE ] C:\Windows\SysWOW64\msv1_0.dll
21:47:24.0720 3376 C:\Windows\SysWOW64\msv1_0.dll - ok
21:47:24.0720 3376 [ 21D3A18769EC2C4E56756D04E989A221 ] C:\Windows\SysWOW64\msxml3.dll
21:47:24.0720 3376 C:\Windows\SysWOW64\msxml3.dll - ok
21:47:24.0720 3376 [ EE26D130808D16C0E417BBBED0451B34 ] C:\Windows\System32\ntdsapi.dll
21:47:24.0720 3376 C:\Windows\System32\ntdsapi.dll - ok
21:47:24.0720 3376 [ 718B6F51AB7F6FE2988A36868F9AD3AB ] C:\Windows\System32\wbem\wbemsvc.dll
21:47:24.0720 3376 C:\Windows\System32\wbem\wbemsvc.dll - ok
21:47:24.0720 3376 [ 0143DB80DACFB7C2B5B7009ED9063353 ] C:\Windows\System32\wbem\wmiutils.dll
21:47:24.0720 3376 C:\Windows\System32\wbem\wmiutils.dll - ok
21:47:24.0736 3376 [ 776AE0564F8B1C282E331FD95A1BDC5F ] C:\Windows\SysWOW64\wbem\wbemsvc.dll
21:47:24.0736 3376 C:\Windows\SysWOW64\wbem\wbemsvc.dll - ok
21:47:24.0736 3376 [ CFC7D8289D2B5F3CF8D16E2DB7F93D4A ] C:\Windows\SysWOW64\wbem\fastprox.dll
21:47:24.0736 3376 C:\Windows\SysWOW64\wbem\fastprox.dll - ok
21:47:24.0736 3376 [ 0AB34456654C283DAA13B8D2BA21439B ] C:\Windows\System32\wbem\repdrvfs.dll
21:47:24.0736 3376 C:\Windows\System32\wbem\repdrvfs.dll - ok
21:47:24.0736 3376 [ E3E811471DE781900FF21C1FD84E941E ] C:\Windows\SysWOW64\ntdsapi.dll
21:47:24.0736 3376 C:\Windows\SysWOW64\ntdsapi.dll - ok
21:47:24.0736 3376 [ AFB5B500AD69E24ED1BC15D1161641EF ] C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
21:47:24.0736 3376 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL - ok
21:47:24.0751 3376 [ F9D908DE6B166DAC9B89BF62FA291CE8 ] C:\Program Files\Bonjour\mdnsNSP.dll
21:47:24.0751 3376 C:\Program Files\Bonjour\mdnsNSP.dll - ok
21:47:24.0751 3376 [ C1446A66BB89FC3AA2485C67562247DA ] C:\Windows\System32\modemui.dll
21:47:24.0751 3376 C:\Windows\System32\modemui.dll - ok
21:47:24.0751 3376 [ 7C1BAE7D23D4874FEE256A2B9C00E019 ] C:\Windows\System32\hidphone.tsp
21:47:24.0751 3376 C:\Windows\System32\hidphone.tsp - ok
21:47:24.0751 3376 [ 41326DD08ACC0CDC5F8177AF96C066E8 ] C:\Windows\System32\kmddsp.tsp
21:47:24.0751 3376 C:\Windows\System32\kmddsp.tsp - ok
21:47:24.0751 3376 [ 1D6BC2769DA66C1145F4DA5A65F52E61 ] C:\Windows\System32\ndptsp.tsp
21:47:24.0751 3376 C:\Windows\System32\ndptsp.tsp - ok
21:47:24.0767 3376 [ DDD0357A92FA843EFF8915ED17253D6C ] C:\Windows\System32\wbem\WmiPrvSD.dll
21:47:24.0767 3376 C:\Windows\System32\wbem\WmiPrvSD.dll - ok
21:47:24.0767 3376 [ D41FEBD098234F02485A4EA98D4730A4 ] C:\Windows\System32\ncobjapi.dll
21:47:24.0767 3376 C:\Windows\System32\ncobjapi.dll - ok
21:47:24.0767 3376 [ 88351B29B622B30962D2FEB6CA8D860B ] C:\Windows\System32\rasadhlp.dll
21:47:24.0767 3376 C:\Windows\System32\rasadhlp.dll - ok
21:47:24.0767 3376 [ 6F40D6FB05E0C1E5402812B426971AF0 ] C:\Windows\System32\wbem\wbemess.dll
21:47:24.0767 3376 C:\Windows\System32\wbem\wbemess.dll - ok
21:47:24.0782 3376 [ A717A35120DBAB5AB707AB40662AF9DD ] C:\Windows\System32\rasppp.dll
21:47:24.0782 3376 C:\Windows\System32\rasppp.dll - ok
21:47:24.0782 3376 [ 0FE5CD5F9C9248F42D1EF56E495B182E ] C:\Windows\System32\vpnike.dll
21:47:24.0782 3376 C:\Windows\System32\vpnike.dll - ok
21:47:24.0782 3376 [ 6A84E68B538B8B04608BF2F0D426CE6F ] C:\Windows\System32\raschap.dll
21:47:24.0782 3376 C:\Windows\System32\raschap.dll - ok
21:47:24.0782 3376 [ B95F6501A2F8B2E78C697FEC401970CE ] C:\Windows\System32\ipnathlp.dll
21:47:24.0782 3376 C:\Windows\System32\ipnathlp.dll - ok
21:47:24.0798 3376 [ 2DF29664ED261F0FC448E58F338F0671 ] C:\Windows\System32\mprapi.dll
21:47:24.0798 3376 C:\Windows\System32\mprapi.dll - ok
21:47:24.0798 3376 [ A42F2C1EB3B66C54FB3C7B79D30C1A6D ] C:\Windows\System32\netshell.dll
21:47:24.0798 3376 C:\Windows\System32\netshell.dll - ok
21:47:24.0798 3376 [ BD9EB3958F213F96B97B1D897DEE006D ] C:\Windows\System32\hidserv.dll
21:47:24.0798 3376 C:\Windows\System32\hidserv.dll - ok
21:47:24.0798 3376 [ F7073C962C4FB7C415565DDE109DE49F ] C:\Windows\System32\npmproxy.dll
21:47:24.0798 3376 C:\Windows\System32\npmproxy.dll - ok
21:47:24.0814 3376 [ BF1FC3F79B863C914687A737C2F3D681 ] C:\Windows\System32\wdi.dll
21:47:24.0814 3376 C:\Windows\System32\wdi.dll - ok
21:47:24.0814 3376 [ 93221146D4EBBF314C29B23CD6CC391D ] C:\Windows\System32\wpdbusenum.dll
21:47:24.0814 3376 C:\Windows\System32\wpdbusenum.dll - ok
21:47:24.0814 3376 [ BF4AC709BE5BF64F331F5D67773A0C82 ] C:\Windows\System32\perftrack.dll
21:47:24.0814 3376 C:\Windows\System32\perftrack.dll - ok
21:47:24.0814 3376 [ E64D9EC8018C55873B40FDEE9DBEF5B3 ] C:\Windows\System32\PortableDeviceApi.dll
21:47:24.0814 3376 C:\Windows\System32\PortableDeviceApi.dll - ok
21:47:24.0814 3376 [ 4449D23E8F197862F1B16F1E6C89C36C ] C:\Windows\System32\diagperf.dll
21:47:24.0814 3376 C:\Windows\System32\diagperf.dll - ok
21:47:24.0814 3376 [ 58A0CDABEA255616827B1C22C9994466 ] C:\Windows\System32\NapiNSP.dll
21:47:24.0814 3376 C:\Windows\System32\NapiNSP.dll - ok
21:47:24.0829 3376 [ 619A67C9F617B7E69315BB28ECD5E1DF ] C:\Windows\System32\wbem\WmiPrvSE.exe
21:47:24.0829 3376 C:\Windows\System32\wbem\WmiPrvSE.exe - ok
21:47:24.0829 3376 [ 613C8CE10A5FDE582BA5FA64C4D56AAA ] C:\Windows\System32\pnrpnsp.dll
21:47:24.0829 3376 C:\Windows\System32\pnrpnsp.dll - ok
21:47:24.0829 3376 [ 2E2072EB48238FCA8FBB7A9F5FABAC45 ] C:\Windows\System32\winrnr.dll
21:47:24.0829 3376 C:\Windows\System32\winrnr.dll - ok
21:47:24.0829 3376 [ E1B22739C933BE33F53DB58C5393ADD3 ] C:\Windows\System32\Apphlpdm.dll
21:47:24.0829 3376 C:\Windows\System32\Apphlpdm.dll - ok
21:47:24.0829 3376 [ 9719E3D834F5C8C43F56A93DFA497023 ] C:\Windows\System32\pnpts.dll
21:47:24.0829 3376 C:\Windows\System32\pnpts.dll - ok
21:47:24.0829 3376 [ E811F8510B133E70CF6E509FB809824F ] C:\Windows\System32\wdiasqmmodule.dll
21:47:24.0829 3376 C:\Windows\System32\wdiasqmmodule.dll - ok
21:47:24.0845 3376 [ AFA79C343F9D1555F7E5D5FA70BB2A14 ] C:\Windows\System32\PortableDeviceConnectApi.dll
21:47:24.0845 3376 C:\Windows\System32\PortableDeviceConnectApi.dll - ok
21:47:24.0845 3376 [ 6607C2182C6A53ED983813AFE2F85768 ] C:\Windows\System32\wbem\cimwin32.dll
21:47:24.0845 3376 C:\Windows\System32\wbem\cimwin32.dll - ok
21:47:24.0845 3376 [ E629F1A051C82795DDFFD3E8D4855811 ] C:\Windows\System32\dimsjob.dll
21:47:24.0845 3376 C:\Windows\System32\dimsjob.dll - ok
21:47:24.0845 3376 [ 46863C4CC5B68EB09EA2D5EEF0F1193A ] C:\Windows\System32\radardt.dll
21:47:24.0845 3376 C:\Windows\System32\radardt.dll - ok
21:47:24.0860 3376 [ 639774C9ACD063F028F6084ABF5593AD ] C:\Windows\System32\taskhost.exe
21:47:24.0860 3376 C:\Windows\System32\taskhost.exe - ok
21:47:24.0860 3376 [ 35CB97CBC3EDC463418ED4997AAB29B6 ] C:\Windows\System32\pautoenr.dll
21:47:24.0860 3376 C:\Windows\System32\pautoenr.dll - ok
21:47:24.0860 3376 [ 94DFBB481BF51158B216E23C5C1C9D6E ] C:\Windows\System32\certcli.dll
21:47:24.0860 3376 C:\Windows\System32\certcli.dll - ok
21:47:24.0860 3376 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] C:\Windows\System32\IPSECSVC.DLL
21:47:24.0860 3376 C:\Windows\System32\IPSECSVC.DLL - ok
21:47:24.0860 3376 [ DDA4CAF29D8C0A297F886BFE561E6659 ] C:\Windows\System32\drivers\WUDFRd.sys
21:47:24.0860 3376 C:\Windows\System32\drivers\WUDFRd.sys - ok
21:47:24.0860 3376 [ 9BC93C9ACFA34DB5A41B89357B31E4ED ] C:\Windows\System32\FwRemoteSvr.dll
21:47:24.0860 3376 C:\Windows\System32\FwRemoteSvr.dll - ok
21:47:24.0876 3376 [ 1484B9EBF567346582DE571B0E164AE0 ] C:\Windows\System32\framedynos.dll
21:47:24.0876 3376 C:\Windows\System32\framedynos.dll - ok
21:47:24.0876 3376 [ 79AFFC7FEEA9CD2FEFEA5EF3B631A02C ] C:\Windows\System32\ndiscapCfg.dll
21:47:24.0876 3376 C:\Windows\System32\ndiscapCfg.dll - ok
21:47:24.0876 3376 [ 3D6AF45673C4B31CDECD7F80AF09D443 ] C:\Windows\System32\rascfg.dll
21:47:24.0876 3376 C:\Windows\System32\rascfg.dll - ok
21:47:24.0876 3376 [ 263B26106606A010CF877472B535E4BB ] C:\Windows\System32\CertEnroll.dll
21:47:24.0876 3376 C:\Windows\System32\CertEnroll.dll - ok
21:47:24.0876 3376 [ 1CF21800E337F4039AAD4C94B4280EE4 ] C:\Windows\System32\mprmsg.dll
21:47:24.0876 3376 C:\Windows\System32\mprmsg.dll - ok
21:47:24.0876 3376 [ 55DE45B116711881C852D2841E4C84DD ] C:\Windows\System32\tcpipcfg.dll
21:47:24.0876 3376 C:\Windows\System32\tcpipcfg.dll - ok
21:47:24.0892 3376 [ AB886378EEB55C6C75B4F2D14B6C869F ] C:\Windows\System32\drivers\WUDFPf.sys
21:47:24.0892 3376 C:\Windows\System32\drivers\WUDFPf.sys - ok
21:47:24.0892 3376 [ B20F051B03A966392364C83F009F7D17 ] C:\Windows\System32\WUDFSvc.dll
21:47:24.0892 3376 C:\Windows\System32\WUDFSvc.dll - ok
21:47:24.0892 3376 [ 8ABFE00F213F2571498F1B8FD7939A98 ] C:\Windows\System32\WUDFHost.exe
21:47:24.0892 3376 C:\Windows\System32\WUDFHost.exe - ok
21:47:24.0892 3376 [ 25AE683DCB4AE7E6F1B193A0CB9DB35F ] C:\Windows\System32\WUDFx.dll
21:47:24.0892 3376 C:\Windows\System32\WUDFx.dll - ok
21:47:24.0892 3376 [ 91D6F0AB79AA36FFB932157865206F35 ] C:\Windows\System32\drivers\UMDF\WpdFs.dll
21:47:24.0892 3376 C:\Windows\System32\drivers\UMDF\WpdFs.dll - ok
21:47:24.0907 3376 [ 9864D52F15AD32094A636C6B5281D9E7 ] C:\Windows\System32\WMVCORE.DLL
21:47:24.0907 3376 C:\Windows\System32\WMVCORE.DLL - ok
21:47:24.0907 3376 [ AACC48FE239F0DF126DA2F28930A5B83 ] C:\Windows\System32\WMASF.DLL
21:47:24.0907 3376 C:\Windows\System32\WMASF.DLL - ok
21:47:24.0907 3376 [ A8EDB86FC2A4D6D1285E4C70384AC35A ] C:\Windows\System32\dllhost.exe
21:47:24.0907 3376 C:\Windows\System32\dllhost.exe - ok
21:47:24.0907 3376 [ 389CA818132C1D7DCF0C791E8D9035DE ] C:\Windows\System32\PortableDeviceClassExtension.dll
21:47:24.0907 3376 C:\Windows\System32\PortableDeviceClassExtension.dll - ok
21:47:24.0907 3376 [ 4F3CD1C59EA71401E155C432BCECE180 ] C:\Windows\System32\PortableDeviceTypes.dll
21:47:24.0907 3376 C:\Windows\System32\PortableDeviceTypes.dll - ok
21:47:24.0907 3376 [ 14DFDEAF4E589ED3F1FF187A86B9408C ] C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll
21:47:24.0907 3376 C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll - ok
21:47:24.0923 3376 [ A0A2C1D812C231C9BFE119FDC68E341B ] C:\Windows\System32\IDStore.dll
21:47:24.0923 3376 C:\Windows\System32\IDStore.dll - ok
21:47:24.0923 3376 [ 863F793D15B4026B1A5FDECA873D4D84 ] C:\Windows\SysWOW64\apphelp.dll
21:47:24.0923 3376 C:\Windows\SysWOW64\apphelp.dll - ok
21:47:24.0923 3376 [ 65EA57712340C09B1B0C427B4848AE05 ] C:\Windows\System32\taskeng.exe
21:47:24.0923 3376 C:\Windows\System32\taskeng.exe - ok
21:47:24.0923 3376 [ 23566F9723771108D2E6CD768AC27407 ] C:\Windows\System32\AtBroker.exe
21:47:24.0923 3376 C:\Windows\System32\AtBroker.exe - ok
21:47:24.0923 3376 [ 6CEF7856A3EFAC59470F6208F0F585CE ] C:\Windows\System32\mpr.dll
21:47:24.0923 3376 C:\Windows\System32\mpr.dll - ok
21:47:24.0938 3376 [ BAFE84E637BF7388C96EF48D4D3FDD53 ] C:\Windows\System32\userinit.exe
21:47:24.0938 3376 C:\Windows\System32\userinit.exe - ok
21:47:24.0938 3376 [ 1096BC8A5E091EDE2A28C30D1626297C ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll
21:47:24.0938 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll - ok
21:47:24.0938 3376 [ FD526000A4DA0AE0ABE0A8DD970D0D65 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2hooks32.dll
21:47:24.0938 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2hooks32.dll - ok
21:47:24.0938 3376 [ F162D5F5E845B9DC352DD1BAD8CEF1BC ] C:\Windows\System32\dwm.exe
21:47:24.0938 3376 C:\Windows\System32\dwm.exe - ok
21:47:24.0938 3376 [ FCFCD1101C5DA23B4B95F93D02B2C169 ] C:\Windows\System32\dwmredir.dll
21:47:24.0938 3376 C:\Windows\System32\dwmredir.dll - ok
21:47:24.0938 3376 [ 1F1CA9E99DD5BF918BE0BF30B5A42FDA ] C:\Windows\System32\MsCtfMonitor.dll
21:47:24.0938 3376 C:\Windows\System32\MsCtfMonitor.dll - ok
21:47:24.0954 3376 [ F09A9A1AD21FE618C4C8B0A0D830C886 ] C:\Windows\System32\msutb.dll
21:47:24.0954 3376 C:\Windows\System32\msutb.dll - ok
21:47:24.0954 3376 [ 43964FA89CCF97BA6BE34D69455AC65F ] C:\Windows\SysWOW64\uxtheme.dll
21:47:24.0954 3376 C:\Windows\SysWOW64\uxtheme.dll - ok
21:47:24.0954 3376 [ 39C5F32747B3414D1BB216FDB1DEFC58 ] C:\Windows\SysWOW64\dwmapi.dll
21:47:24.0954 3376 C:\Windows\SysWOW64\dwmapi.dll - ok
21:47:24.0954 3376 [ 08DFDBD2FD4EA951DC46B1C7661ED35A ] C:\Windows\SysWOW64\powrprof.dll
21:47:24.0954 3376 C:\Windows\SysWOW64\powrprof.dll - ok
21:47:24.0954 3376 [ D54FE0387CB469B43CDCDFAA03AE5A55 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\npctray.dll
21:47:24.0954 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\npctray.dll - ok
21:47:24.0970 3376 [ 9BB99503D6A4DD62569EDE9E5E2672A5 ] C:\Windows\System32\HotStartUserAgent.dll
21:47:24.0970 3376 C:\Windows\System32\HotStartUserAgent.dll - ok
21:47:24.0970 3376 [ 94EEAC26F57811BD1AEFC164412F7FCE ] C:\Windows\System32\PlaySndSrv.dll
21:47:24.0970 3376 C:\Windows\System32\PlaySndSrv.dll - ok
21:47:24.0970 3376 [ F5CEF064C7E6D95DA86B9D064A56A969 ] C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
21:47:24.0970 3376 C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll - ok
21:47:24.0970 3376 [ 522B0466ED967A0762E9AF5B37D8F40A ] C:\Windows\System32\esent.dll
21:47:24.0970 3376 C:\Windows\System32\esent.dll - ok
21:47:24.0970 3376 [ 805A52C5AE26C28E88FDD9BCCFE6F312 ] C:\Windows\System32\TSChannel.dll
21:47:24.0970 3376 C:\Windows\System32\TSChannel.dll - ok
21:47:24.0985 3376 [ C15B26CEE45AD230A083F59A60794CDA ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\uimain.dll
21:47:24.0985 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\uimain.dll - ok
21:47:24.0985 3376 [ D241DDF08B6BEB9E5EAF01E2B8829EA8 ] C:\Program Files (x86)\ASUS\AsBackupWizard\AsRunBkWizardHelper.exe
21:47:24.0985 3376 C:\Program Files (x86)\ASUS\AsBackupWizard\AsRunBkWizardHelper.exe - ok
21:47:24.0985 3376 [ 6EF5F3F18413C367195F06E503AB86A6 ] C:\Windows\SysWOW64\d3d9.dll
21:47:24.0985 3376 C:\Windows\SysWOW64\d3d9.dll - ok
21:47:24.0985 3376 [ 576C72830E3FD6ACE2910545B6130803 ] C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
21:47:24.0985 3376 C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe - ok
21:47:24.0985 3376 [ 77B1471A490B53B24EFE136F09F76550 ] C:\Windows\SysWOW64\d3d8thk.dll
21:47:24.0985 3376 C:\Windows\SysWOW64\d3d8thk.dll - ok
21:47:24.0985 3376 [ 936F728E04ACCF3F38801CFFCF1E3F40 ] C:\Windows\SysWOW64\oledlg.dll
21:47:24.0985 3376 C:\Windows\SysWOW64\oledlg.dll - ok
21:47:25.0001 3376 [ 7BAD1E584DBE290C06B8AE0FABF7BEDE ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\symhtmdx.dll
21:47:25.0001 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\symhtmdx.dll - ok
21:47:25.0001 3376 [ 12C45E3CB6D65F73209549E2D02ECA7A ] C:\Windows\SysWOW64\propsys.dll
21:47:25.0001 3376 C:\Windows\SysWOW64\propsys.dll - ok
21:47:25.0001 3376 [ 45CFBFA8EDC3DF4E2B7FB0D0260FE051 ] C:\Windows\System32\localspl.dll
21:47:25.0001 3376 C:\Windows\System32\localspl.dll - ok
21:47:25.0001 3376 [ 3285481F5C12305CA104A6C493CA5A0B ] C:\Windows\System32\spoolss.dll
21:47:25.0001 3376 C:\Windows\System32\spoolss.dll - ok
21:47:25.0001 3376 [ 0015ACFBBDD164A8A730009908868CA7 ] C:\Windows\System32\winspool.drv
21:47:25.0001 3376 C:\Windows\System32\winspool.drv - ok
21:47:25.0016 3376 [ 46B8E04B3C35CB93F89EF27746D7A908 ] C:\Windows\System32\EP0SLM01.DLL
21:47:25.0016 3376 C:\Windows\System32\EP0SLM01.DLL - ok
21:47:25.0016 3376 [ 19E41CCCEE697CC9465396B370929792 ] C:\Windows\System32\FXSMON.dll
21:47:25.0016 3376 C:\Windows\System32\FXSMON.dll - ok
21:47:25.0016 3376 [ C5AC93CF3BA30D367FB49148A2B673B9 ] C:\Windows\System32\PrintIsolationProxy.dll
21:47:25.0016 3376 C:\Windows\System32\PrintIsolationProxy.dll - ok
21:47:25.0016 3376 [ 93518C6EDE0B61BCBD02BDB02BD05FEE ] C:\Windows\System32\snmpapi.dll
21:47:25.0016 3376 C:\Windows\System32\snmpapi.dll - ok
21:47:25.0016 3376 [ 32A3C8600AF124CBAAD845F13CFAE3CB ] C:\Windows\System32\tcpmon.dll
21:47:25.0016 3376 C:\Windows\System32\tcpmon.dll - ok
21:47:25.0016 3376 [ FFF9D00CF16397C64317F213484F94BD ] C:\Windows\System32\wsnmp32.dll
21:47:25.0016 3376 C:\Windows\System32\wsnmp32.dll - ok
21:47:25.0032 3376 [ 49ACA548B2423F1C67898E6AC719A9A6 ] C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
21:47:25.0032 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll - ok
21:47:25.0032 3376 [ DF72A9936D0C3F517083119648814B09 ] C:\Windows\System32\usbmon.dll
21:47:25.0032 3376 C:\Windows\System32\usbmon.dll - ok
21:47:25.0032 3376 [ A1D7E3ADCDB07DDB6F423862DCB1A52B ] C:\Windows\System32\WSDMon.dll
21:47:25.0032 3376 C:\Windows\System32\WSDMon.dll - ok
21:47:25.0032 3376 [ 4581716B4BF76ACFD8E167EB0B26D82A ] C:\Windows\System32\fdPnp.dll
21:47:25.0032 3376 C:\Windows\System32\fdPnp.dll - ok
21:47:25.0032 3376 [ DAEEAD506E5B84E177D88C4D7B739401 ] C:\Windows\System32\spool\prtprocs\x64\EP0NPP01.DLL
21:47:25.0032 3376 C:\Windows\System32\spool\prtprocs\x64\EP0NPP01.DLL - ok
21:47:25.0048 3376 [ 1D626FE2E13C1CE49CA0136CFF214E93 ] C:\Windows\System32\spool\prtprocs\x64\winprint.dll
21:47:25.0048 3376 C:\Windows\System32\spool\prtprocs\x64\winprint.dll - ok
21:47:25.0048 3376 [ 0353B239C28B0E9EBC7FA3D1F6181661 ] C:\Windows\System32\win32spl.dll
21:47:25.0048 3376 C:\Windows\System32\win32spl.dll - ok
21:47:25.0048 3376 [ 507D5567A0A4EE86C4B0CE2CE1777025 ] C:\Windows\System32\inetpp.dll
21:47:25.0048 3376 C:\Windows\System32\inetpp.dll - ok
21:47:25.0048 3376 [ 617B43FE89B8DF6A8BFE84DB4426E040 ] C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
21:47:25.0048 3376 C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe - ok
21:47:25.0048 3376 [ 162D247E995EAEBF3EF4289069E1111C ] C:\Windows\SysWOW64\devrtl.dll
21:47:25.0048 3376 C:\Windows\SysWOW64\devrtl.dll - ok
21:47:25.0063 3376 [ 68FB60221D8C7143C01BC758F9853784 ] C:\Program Files (x86)\ASUS\AI Suite II\EPU\AsAcpi.dll
21:47:25.0063 3376 C:\Program Files (x86)\ASUS\AI Suite II\EPU\AsAcpi.dll - ok
21:47:25.0063 3376 [ 1BF0CB861A48FEB1638228760750F3CB ] C:\Windows\System32\cscapi.dll
21:47:25.0063 3376 C:\Windows\System32\cscapi.dll - ok
21:47:25.0063 3376 [ FEB91B4DA0D540865260A33838654FA3 ] C:\Windows\System32\nci.dll
21:47:25.0063 3376 C:\Windows\System32\nci.dll - ok
21:47:25.0063 3376 [ AC0C9CEA1218DAB1994AF8B28E680BD9 ] C:\Windows\System32\wlaninst.dll
21:47:25.0063 3376 C:\Windows\System32\wlaninst.dll - ok
21:47:25.0079 3376 [ 5A406C9C8E0880D3EABADC5DFD1ACDAE ] C:\Windows\System32\wwaninst.dll
21:47:25.0079 3376 C:\Windows\System32\wwaninst.dll - ok
21:47:25.0079 3376 [ 4277F5164DE9B7C665BB928B9145BEE0 ] C:\Windows\SysWOW64\DWrite.dll
21:47:25.0079 3376 C:\Windows\SysWOW64\DWrite.dll - ok
21:47:25.0079 3376 [ C3EE2CE6A16AEED78AAD518FDE72958A ] C:\Program Files (x86)\ASUS\AI Suite II\EPU\asacpiEx.dll
21:47:25.0079 3376 C:\Program Files (x86)\ASUS\AI Suite II\EPU\asacpiEx.dll - ok
21:47:25.0079 3376 [ 4BA77A5EF71C14C764B0ED4701683E3E ] C:\Windows\System32\dwmcore.dll
21:47:25.0079 3376 C:\Windows\System32\dwmcore.dll - ok
21:47:25.0079 3376 [ D3785EB61DEE2BC1B9253C1DEB2BDC03 ] C:\Program Files (x86)\ASUS\AsBackupWizard\AsBackupWizard.exe
21:47:25.0079 3376 C:\Program Files (x86)\ASUS\AsBackupWizard\AsBackupWizard.exe - ok
21:47:25.0094 3376 [ B2DB6ABA2E292235749B80A9C3DFA867 ] C:\Windows\SysWOW64\imagehlp.dll
21:47:25.0094 3376 C:\Windows\SysWOW64\imagehlp.dll - ok
21:47:25.0094 3376 [ 332FEAB1435662FC6C672E25BEB37BE3 ] C:\Windows\explorer.exe
21:47:25.0094 3376 C:\Windows\explorer.exe - ok
21:47:25.0094 3376 [ 198803E5E93E29967DFB0BCFD0186151 ] C:\Windows\System32\spfileq.dll
21:47:25.0094 3376 C:\Windows\System32\spfileq.dll - ok
21:47:25.0094 3376 [ 3C1936A12C62254F914A01BBC6A8DC69 ] C:\Windows\SysWOW64\d3d10_1.dll
21:47:25.0094 3376 C:\Windows\SysWOW64\d3d10_1.dll - ok
21:47:25.0094 3376 [ D4212AB475A3B25EC4DF574536C3EDC5 ] C:\Windows\SysWOW64\d3d10_1core.dll
21:47:25.0094 3376 C:\Windows\SysWOW64\d3d10_1core.dll - ok
21:47:25.0110 3376 [ D4F264FE23F8953D840904418220C15E ] C:\Windows\SysWOW64\dxgi.dll
21:47:25.0110 3376 C:\Windows\SysWOW64\dxgi.dll - ok
21:47:25.0110 3376 [ 7ACDFB4CC67F4993DF0E0731576309B2 ] C:\Windows\SysWOW64\d3d11.dll
21:47:25.0110 3376 C:\Windows\SysWOW64\d3d11.dll - ok
21:47:25.0110 3376 [ E441484F4344AFEDE90461021AB9E82F ] C:\Windows\System32\igdumd64.dll
21:47:25.0110 3376 C:\Windows\System32\igdumd64.dll - ok
21:47:25.0110 3376 [ E255B2CAB18194ABE1CFF3587A9365D9 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2acc.dll
21:47:25.0110 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2acc.dll - ok
21:47:25.0110 3376 [ 2D6434E957F7CFA0035C20890F77BBC6 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys
21:47:25.0110 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys - ok
21:47:25.0126 3376 [ F432EB8D1D84A565167107E2EF001473 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2wsc.dll
21:47:25.0126 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2wsc.dll - ok
21:47:25.0126 3376 [ A8CDF3768604FF95B54669E20053D569 ] C:\Windows\SysWOW64\wscapi.dll
21:47:25.0126 3376 C:\Windows\SysWOW64\wscapi.dll - ok
21:47:25.0126 3376 [ 8258362DDB18B644A82D8B5061AD9426 ] C:\Windows\SysWOW64\wscisvif.dll
21:47:25.0126 3376 C:\Windows\SysWOW64\wscisvif.dll - ok
21:47:25.0126 3376 [ 6854FB9454029CF7CC4EEA1835AFFE34 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\distrptr.dll
21:47:25.0126 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\distrptr.dll - ok
21:47:25.0126 3376 [ 3C93FC270C3DAACF83689F72F3C9BD83 ] C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
21:47:25.0126 3376 C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe - ok
21:47:25.0126 3376 [ 9AE80F6A66B30E3ED8CDF858CF28B11B ] C:\Windows\System32\d3d10_1.dll
21:47:25.0126 3376 C:\Windows\System32\d3d10_1.dll - ok
21:47:25.0141 3376 [ 63F72417CA38D8FC8F53709649B589E3 ] C:\Windows\System32\d3d10_1core.dll
21:47:25.0141 3376 C:\Windows\System32\d3d10_1core.dll - ok
21:47:25.0141 3376 [ 5D246A8495F7E7C6836ABAE2789B639C ] C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
21:47:25.0141 3376 C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll - ok
21:47:25.0141 3376 [ 8DFB5752FCE145A6B295093C0A8BE131 ] C:\Windows\System32\dxgi.dll
21:47:25.0141 3376 C:\Windows\System32\dxgi.dll - ok
21:47:25.0141 3376 [ 448B02AD260EC3E1E892FCE6DFDDEEBD ] C:\Windows\System32\d3d11.dll
21:47:25.0141 3376 C:\Windows\System32\d3d11.dll - ok
21:47:25.0141 3376 [ BF6D6ED5FADCEEE885BD0144ECF1BA27 ] C:\Windows\SysWOW64\ncrypt.dll
21:47:25.0141 3376 C:\Windows\SysWOW64\ncrypt.dll - ok
21:47:25.0157 3376 [ CE71B9119A258EDD0A05B37D7B0F92E3 ] C:\Windows\SysWOW64\bcrypt.dll
21:47:25.0157 3376 C:\Windows\SysWOW64\bcrypt.dll - ok
21:47:25.0157 3376 [ A5BD2A901B11C3B0C47E7C7488CBC1D8 ] C:\Windows\System32\igd10umd64.dll
21:47:25.0157 3376 C:\Windows\System32\igd10umd64.dll - ok
21:47:25.0157 3376 [ E8449FE262D7406BCB2AC2A45C53EC5F ] C:\Windows\SysWOW64\bcryptprimitives.dll
21:47:25.0157 3376 C:\Windows\SysWOW64\bcryptprimitives.dll - ok
21:47:25.0157 3376 [ 49E5753D923F1AC63B22D3DCB0B47E00 ] C:\Windows\System32\uDWM.dll
21:47:25.0157 3376 C:\Windows\System32\uDWM.dll - ok
21:47:25.0157 3376 [ 1097F3035BAF46CED8B332B3564C5108 ] C:\Windows\SysWOW64\gpapi.dll
21:47:25.0157 3376 C:\Windows\SysWOW64\gpapi.dll - ok
21:47:25.0172 3376 [ CA79539D3D4C0BA66F0F051A5EE5E923 ] C:\Windows\SysWOW64\cryptnet.dll
21:47:25.0172 3376 C:\Windows\SysWOW64\cryptnet.dll - ok
21:47:25.0172 3376 [ 181F69BC9C406B7FB5C0ADE8031630AC ] C:\Windows\SysWOW64\wpdshext.dll
21:47:25.0172 3376 C:\Windows\SysWOW64\wpdshext.dll - ok
21:47:25.0172 3376 [ BE247AE996A9FDE007A27B51413A6C79 ] C:\Windows\SysWOW64\shdocvw.dll
21:47:25.0172 3376 C:\Windows\SysWOW64\shdocvw.dll - ok
21:47:25.0172 3376 [ B31F1C113241EAE5F5840240259583D1 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\mclntask.dll
21:47:25.0172 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\mclntask.dll - ok
21:47:25.0188 3376 [ 4B78B431F225FD8624C5655CB1DE7B61 ] C:\Windows\System32\aelupsvc.dll
21:47:25.0188 3376 C:\Windows\System32\aelupsvc.dll - ok
21:47:25.0188 3376 [ 0B6118058942961D504AAEA04FECB116 ] C:\Windows\SysWOW64\ieframe.dll
21:47:25.0188 3376 C:\Windows\SysWOW64\ieframe.dll - ok
21:47:25.0188 3376 [ 60F4AEFA103D421EA4A40E31409B4756 ] C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
21:47:25.0188 3376 C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll - ok
21:47:25.0188 3376 [ 8549F4D70BDD647DAB1562731F4E4BFB ] C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
21:47:25.0188 3376 C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe - ok
21:47:25.0188 3376 [ 4BE86D640A489E937B43769A99355664 ] C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
21:47:25.0188 3376 C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll - ok
21:47:25.0204 3376 [ 4BE86D640A489E937B43769A99355664 ] C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
21:47:25.0204 3376 C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll - ok
21:47:25.0204 3376 [ 3BCECD87AB4E6743BFB45B352AD1A529 ] C:\Windows\SysWOW64\WindowsCodecs.dll
21:47:25.0204 3376 C:\Windows\SysWOW64\WindowsCodecs.dll - ok
21:47:25.0204 3376 [ B5106A79DD046815332B6E3B6E8D27D1 ] C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll
21:47:25.0204 3376 C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll - ok
21:47:25.0204 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\AsMultiLang.dll
21:47:25.0204 3376 C:\Program Files (x86)\ASUS\AI Suite II\AsMultiLang.dll - ok
21:47:25.0204 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AsMultiLang.dll
21:47:25.0204 3376 C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AsMultiLang.dll - ok
21:47:25.0219 3376 [ 2F0E7344F65852B0085593A4B7B135CB ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\isdatapr.dll
21:47:25.0219 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\isdatapr.dll - ok
21:47:25.0219 3376 [ EED05D42D91835064703E2318552ED25 ] C:\Windows\System32\ExplorerFrame.dll
21:47:25.0219 3376 C:\Windows\System32\ExplorerFrame.dll - ok
21:47:25.0219 3376 [ E2A17BCC08D92F42E08AF6BA2F93ABA7 ] C:\Windows\SysWOW64\ExplorerFrame.dll
21:47:25.0219 3376 C:\Windows\SysWOW64\ExplorerFrame.dll - ok
21:47:25.0219 3376 [ 6E1F8165C365D35C8E3C045AF0CDD481 ] C:\Windows\SysWOW64\duser.dll
21:47:25.0219 3376 C:\Windows\SysWOW64\duser.dll - ok
21:47:25.0219 3376 [ EE06B85BC69F18826302348A2AD089E0 ] C:\Windows\SysWOW64\dui70.dll
21:47:25.0219 3376 C:\Windows\SysWOW64\dui70.dll - ok
21:47:25.0235 3376 [ 68FB60221D8C7143C01BC758F9853784 ] C:\Program Files (x86)\ASUS\AI Suite II\AsAcpi.dll
21:47:25.0235 3376 C:\Program Files (x86)\ASUS\AI Suite II\AsAcpi.dll - ok
21:47:25.0235 3376 [ ADBA8A211DEB8EE1B2AC332F05378B1C ] C:\Users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
21:47:25.0235 3376 C:\Users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll - ok
21:47:25.0235 3376 [ 349B1D5D8D1B5A7B10BCD01470BD5F64 ] C:\Users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\msvcp110.dll
21:47:25.0235 3376 C:\Users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\msvcp110.dll - ok
21:47:25.0235 3376 [ C72ABC6B7B90A61364B6DD889B5435F3 ] C:\Users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\msvcr110.dll
21:47:25.0235 3376 C:\Users\Ken\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\msvcr110.dll - ok
21:47:25.0250 3376 [ 024352FEEC9042260BB4CFB4D79A206B ] C:\Windows\System32\EhStorShell.dll
21:47:25.0250 3376 C:\Windows\System32\EhStorShell.dll - ok
21:47:25.0250 3376 [ D526B6964EB436530F14982B86151F17 ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\bushell.dll
21:47:25.0250 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\bushell.dll - ok
21:47:25.0250 3376 [ 4F096D96285E06CD51AEF7D2D3DE04DA ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\msvcp100.dll
21:47:25.0250 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\msvcp100.dll - ok
21:47:25.0250 3376 [ C3EE2CE6A16AEED78AAD518FDE72958A ] C:\Program Files (x86)\ASUS\AI Suite II\asacpiex.dll
21:47:25.0250 3376 C:\Program Files (x86)\ASUS\AI Suite II\asacpiex.dll - ok
21:47:25.0250 3376 [ BB32651504EA632D6FDCA0A6C9823B68 ] C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll
21:47:25.0250 3376 C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll - ok
21:47:25.0266 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\AsMultiLang.dll
21:47:25.0266 3376 C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\AsMultiLang.dll - ok
21:47:25.0266 3376 [ 9D10FF467DC8771420CAA47BB1C5AF54 ] C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
21:47:25.0266 3376 C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll - ok
21:47:25.0266 3376 [ 07A5FFCB80D3455EB1A7530F5150B3C6 ] C:\Program Files (x86)\ASUS\AI Suite II\Cpu Frequency\CpuFrequency.dll
21:47:25.0266 3376 C:\Program Files (x86)\ASUS\AI Suite II\Cpu Frequency\CpuFrequency.dll - ok
21:47:25.0266 3376 [ 07F56C93537C240734A81D9FE92AF206 ] C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPU.dll
21:47:25.0266 3376 C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPU.dll - ok
21:47:25.0266 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\EPU\AsMultiLang.dll
21:47:25.0266 3376 C:\Program Files (x86)\ASUS\AI Suite II\EPU\AsMultiLang.dll - ok
21:47:25.0266 3376 [ 7EA5411C7B39D8CD52A8A322E3D17E37 ] C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll
21:47:25.0266 3376 C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll - ok
21:47:25.0282 3376 [ DF3CA8D16BDED6A54977B30E66864D33 ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\msvcr100.dll
21:47:25.0282 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\msvcr100.dll - ok
21:47:25.0282 3376 [ 8888EB78B322F6FE1F2623485CAD43FF ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\ccl120u.dll
21:47:25.0282 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\ccl120u.dll - ok
21:47:25.0282 3376 [ 150A6B194D920ECA14FD1A08785B45C5 ] C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll
21:47:25.0282 3376 C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll - ok
21:47:25.0282 3376 [ DCADCF8D6D4CB5F752A50624A1F0D276 ] C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
21:47:25.0282 3376 C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll - ok
21:47:25.0282 3376 [ CED2EDB52AB09D5C1141F962A1A6B8B5 ] C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
21:47:25.0282 3376 C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll - ok
21:47:25.0297 3376 [ FA4DE7F01F89FBC7D01663B0A824AAE3 ] C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
21:47:25.0297 3376 C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll - ok
21:47:25.0297 3376 [ 60B41B69810FAF54BDABBC24FC079AB3 ] C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
21:47:25.0297 3376 C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll - ok
21:47:25.0297 3376 [ 8DACED4159BF387EA4DCDC703296A6EC ] C:\Program Files (x86)\ASUS\AI Suite II\System Information\SystemInfo.dll
21:47:25.0297 3376 C:\Program Files (x86)\ASUS\AI Suite II\System Information\SystemInfo.dll - ok
21:47:25.0297 3376 [ 76C331D8F1801A25613187CAE9E78FF6 ] C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
21:47:25.0297 3376 C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll - ok
21:47:25.0297 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\AsMultiLang.dll
21:47:25.0297 3376 C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\AsMultiLang.dll - ok
21:47:25.0313 3376 [ A64FD422D01E71057B65B448C835D4E7 ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\efacli64.dll
21:47:25.0313 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\efacli64.dll - ok
21:47:25.0313 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\AsMultiLang.dll
21:47:25.0313 3376 C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\AsMultiLang.dll - ok
21:47:25.0313 3376 [ 7FB99BB09CF9199C566160936B26CE2D ] C:\Program Files (x86)\ASUS\AI Suite II\Splitter\AsMultiLang.dll
21:47:25.0313 3376 C:\Program Files (x86)\ASUS\AI Suite II\Splitter\AsMultiLang.dll - ok
21:47:25.0313 3376 [ 67D5FF7BFA5B4A93AE0F1E0D1291E5F8 ] C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMLib.dll
21:47:25.0313 3376 C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMLib.dll - ok
21:47:25.0313 3376 [ C3EE2CE6A16AEED78AAD518FDE72958A ] C:\Program Files (x86)\ASUS\AAHM\1.00.14\asacpiex.dll
21:47:25.0313 3376 C:\Program Files (x86)\ASUS\AAHM\1.00.14\asacpiex.dll - ok
21:47:25.0328 3376 [ 037A719DAD50603202C978CD802623E4 ] C:\Windows\System32\ntshrui.dll
21:47:25.0328 3376 C:\Windows\System32\ntshrui.dll - ok
21:47:25.0328 3376 [ 1D63F4366288B8A7595397E27010FD44 ] C:\Windows\System32\IconCodecService.dll
21:47:25.0328 3376 C:\Windows\System32\IconCodecService.dll - ok
21:47:25.0328 3376 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] C:\Windows\System32\appinfo.dll
21:47:25.0328 3376 C:\Windows\System32\appinfo.dll - ok
21:47:25.0328 3376 [ 025E7DBDB98866ED3CB2D4DDA70B364D ] C:\Windows\System32\runonce.exe
21:47:25.0328 3376 C:\Windows\System32\runonce.exe - ok
21:47:25.0328 3376 [ D44741F65A1D71F65814A12CF6E2400A ] C:\Windows\SysWOW64\runonce.exe
21:47:25.0328 3376 C:\Windows\SysWOW64\runonce.exe - ok
21:47:25.0344 3376 [ AD7B9C14083B52BC532FBA5948342B98 ] C:\Windows\SysWOW64\cmd.exe
21:47:25.0344 3376 C:\Windows\SysWOW64\cmd.exe - ok
21:47:25.0344 3376 [ 326C7F76A29897A892AA7726E91C1C67 ] C:\Windows\SysWOW64\winbrand.dll
21:47:25.0344 3376 C:\Windows\SysWOW64\winbrand.dll - ok
21:47:25.0344 3376 [ 178A34E5554DCE485E1262DDF027960C ] C:\Users\Ken\AppData\Local\Temp\3C2ACD0D-8193-43EB-9AD3-6A1B7446F832.exe
21:47:25.0344 3376 C:\Users\Ken\AppData\Local\Temp\3C2ACD0D-8193-43EB-9AD3-6A1B7446F832.exe - ok
21:47:25.0344 3376 [ 846D0E4DB261CFAF363902E41498E961 ] C:\Windows\SysWOW64\EhStorShell.dll
21:47:25.0344 3376 C:\Windows\SysWOW64\EhStorShell.dll - ok
21:47:25.0344 3376 [ 03F3B770DFBED6131653CEDA8CA780F0 ] C:\Windows\SysWOW64\ntshrui.dll
21:47:25.0344 3376 C:\Windows\SysWOW64\ntshrui.dll - ok
21:47:25.0360 3376 [ 465BEA35F7ED4A4A57686DEA7EA10F47 ] C:\Windows\SysWOW64\cscapi.dll
21:47:25.0360 3376 C:\Windows\SysWOW64\cscapi.dll - ok
21:47:25.0360 3376 [ 8B74CEC6980D4816B0037AE9A27E538F ] C:\Windows\SysWOW64\slc.dll
21:47:25.0360 3376 C:\Windows\SysWOW64\slc.dll - ok
21:47:25.0360 3376 [ 827CB0D6C3F8057EA037FF271F8E9795 ] C:\Windows\SysWOW64\imageres.dll
21:47:25.0360 3376 C:\Windows\SysWOW64\imageres.dll - ok
21:47:25.0360 3376 [ 523CF74A52C9A1762DA8B83AEE734498 ] C:\Windows\SysWOW64\IconCodecService.dll
21:47:25.0360 3376 C:\Windows\SysWOW64\IconCodecService.dll - ok
21:47:25.0360 3376 [ FB10715E4099AF9FA389C71873245226 ] C:\Windows\System32\timedate.cpl
21:47:25.0360 3376 C:\Windows\System32\timedate.cpl - ok
21:47:25.0375 3376 [ E6F0F82788E8BD0F7A616350EFA0761C ] C:\Windows\System32\actxprxy.dll
21:47:25.0375 3376 C:\Windows\System32\actxprxy.dll - ok
21:47:25.0375 3376 [ 73E8667A19FEEDD856DF2695E9E511D4 ] C:\Windows\SysWOW64\wship6.dll
21:47:25.0375 3376 C:\Windows\SysWOW64\wship6.dll - ok
21:47:25.0375 3376 [ B40420876B9288E0A1C8CCA8A84E5DC9 ] C:\Windows\SysWOW64\dnsapi.dll
21:47:25.0375 3376 C:\Windows\SysWOW64\dnsapi.dll - ok
21:47:25.0375 3376 [ C4F40F6CACD796A8E16671D0E9A2F319 ] C:\Windows\System32\shdocvw.dll
21:47:25.0375 3376 C:\Windows\System32\shdocvw.dll - ok
21:47:25.0375 3376 [ 12B79422A23814429CDA9E734C58F78F ] C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL
21:47:25.0375 3376 C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL - ok
21:47:25.0391 3376 [ A0A65D306A5490D2EB8E7DE66898ECFD ] C:\Windows\System32\linkinfo.dll
21:47:25.0391 3376 C:\Windows\System32\linkinfo.dll - ok
21:47:25.0391 3376 [ 40947436A70E0034E41123DF5A0A7702 ] C:\Program Files (x86)\Bonjour\mdnsNSP.dll
21:47:25.0391 3376 C:\Program Files (x86)\Bonjour\mdnsNSP.dll - ok
21:47:25.0391 3376 [ ED6EE83D61EBC683C2CD8E899EA6FEBE ] C:\Windows\SysWOW64\rasadhlp.dll
21:47:25.0391 3376 C:\Windows\SysWOW64\rasadhlp.dll - ok
21:47:25.0391 3376 [ E6DD15E668DAF0A02470CF551B0A0105 ] C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgslang.dll
21:47:25.0391 3376 C:\PROGRA~2\WIC4A1~1\MESSEN~1\msgslang.dll - ok
21:47:25.0391 3376 [ 1EAC1A8CA6874BF5B15E2EFB9A9A7B86 ] C:\Windows\System32\msftedit.dll
21:47:25.0391 3376 C:\Windows\System32\msftedit.dll - ok
21:47:25.0406 3376 [ 112183DF91C9BAECB498E4A86ECDE598 ] C:\Windows\System32\msls31.dll
21:47:25.0406 3376 C:\Windows\System32\msls31.dll - ok
21:47:25.0406 3376 [ 03A03A453F1AAAE0C73AAAF895321C7A ] C:\Windows\SysWOW64\FWPUCLNT.DLL
21:47:25.0406 3376 C:\Windows\SysWOW64\FWPUCLNT.DLL - ok
21:47:25.0406 3376 [ 2BCBA6052374959A30BD7948444DBB79 ] C:\Windows\System32\gameux.dll
21:47:25.0406 3376 C:\Windows\System32\gameux.dll - ok
21:47:25.0406 3376 [ 7DBA84667DC18877AEF693E3543DFAD7 ] C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll
21:47:25.0406 3376 C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll - ok
21:47:25.0406 3376 [ 4C2C4640BF23AAFCF90519E0F34436CE ] C:\Windows\System32\DeviceCenter.dll
21:47:25.0406 3376 C:\Windows\System32\DeviceCenter.dll - ok
21:47:25.0406 3376 [ FBDF607ED7EF0467639DB501E1FD938C ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
21:47:25.0406 3376 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe - ok
21:47:25.0422 3376 [ 9110FFAD124283F37D38771BB60556AF ] C:\Windows\System32\dsound.dll
21:47:25.0422 3376 C:\Windows\System32\dsound.dll - ok
21:47:25.0422 3376 [ 585FED4CDB8034B8B58AEB8008255817 ] C:\Windows\System32\opengl32.dll
21:47:25.0422 3376 C:\Windows\System32\opengl32.dll - ok
21:47:25.0422 3376 [ F2967C0A97C0EA67D79D7F557213950D ] C:\Windows\System32\glu32.dll
21:47:25.0422 3376 C:\Windows\System32\glu32.dll - ok
21:47:25.0422 3376 [ A6C09924C6730DE8DEED9890A12AA691 ] C:\Windows\System32\ddraw.dll
21:47:25.0422 3376 C:\Windows\System32\ddraw.dll - ok
21:47:25.0422 3376 [ 29C22748937F45C26590909E9F8E7137 ] C:\Windows\System32\dciman32.dll
21:47:25.0422 3376 C:\Windows\System32\dciman32.dll - ok
21:47:25.0422 3376 [ 263E9A047D17CD50BAA9D3C02910D18D ] C:\Windows\System32\oledlg.dll
21:47:25.0422 3376 C:\Windows\System32\oledlg.dll - ok
21:47:25.0438 3376 [ 5B72629C8144D1A96490D4C090D28DA1 ] C:\Program Files\Microsoft IntelliPoint\ipoint.exe
21:47:25.0438 3376 C:\Program Files\Microsoft IntelliPoint\ipoint.exe - ok
21:47:25.0438 3376 [ 24F4B480F335A6C724AF352253C5D98B ] C:\Windows\System32\thumbcache.dll
21:47:25.0438 3376 C:\Windows\System32\thumbcache.dll - ok
21:47:25.0438 3376 [ 93812FDC01AA864195816CD814445F95 ] C:\Program Files\Microsoft IntelliPoint\SQMAPI.dll
21:47:25.0438 3376 C:\Program Files\Microsoft IntelliPoint\SQMAPI.dll - ok
21:47:25.0438 3376 [ 0805289E121F3E3C458C970B08314EB2 ] C:\Windows\System32\RtkCfg64.dll
21:47:25.0438 3376 C:\Windows\System32\RtkCfg64.dll - ok
21:47:25.0438 3376 [ 3CDC9975457E78EE6A9D64599DBB76DD ] C:\Program Files\Microsoft IntelliPoint\dpgmkb.dll
21:47:25.0438 3376 C:\Program Files\Microsoft IntelliPoint\dpgmkb.dll - ok
21:47:25.0453 3376 [ 5EB6E9C8BE1ACC5830780E0F9A846255 ] C:\Windows\System32\msi.dll
21:47:25.0453 3376 C:\Windows\System32\msi.dll - ok
21:47:25.0453 3376 [ BE49AF92F13030E188DBE8E2841D173A ] C:\Windows\System32\igfxtray.exe
21:47:25.0453 3376 C:\Windows\System32\igfxtray.exe - ok
21:47:25.0453 3376 [ 78E38D8FBAF394FC0721E4FB95D69576 ] C:\Windows\System32\hccutils.dll
21:47:25.0453 3376 C:\Windows\System32\hccutils.dll - ok
21:47:25.0453 3376 [ 664FF61BE83FCACBF67A8D307011ADF5 ] C:\Windows\System32\hkcmd.exe
21:47:25.0453 3376 C:\Windows\System32\hkcmd.exe - ok
21:47:25.0453 3376 [ 7AC06967981D21A695D15FBEF011730E ] C:\Windows\System32\igfxsrvc.exe
21:47:25.0453 3376 C:\Windows\System32\igfxsrvc.exe - ok
21:47:25.0453 3376 [ 405F4D32D2185F1F1BD753D8EEAFFB3A ] C:\Windows\System32\networkexplorer.dll
21:47:25.0453 3376 C:\Windows\System32\networkexplorer.dll - ok
21:47:25.0469 3376 [ 69754747274B76E7FAF287239333D7E6 ] C:\Windows\System32\msiltcfg.dll
21:47:25.0469 3376 C:\Windows\System32\msiltcfg.dll - ok
21:47:25.0469 3376 [ 899D435E1C190C204E349CE0E483098B ] C:\Windows\System32\igfxpers.exe
21:47:25.0469 3376 C:\Windows\System32\igfxpers.exe - ok
21:47:25.0469 3376 [ F146E2BA475893DD77B2370DC1211FC6 ] C:\Windows\System32\drivers\89152843.sys
21:47:25.0469 3376 C:\Windows\System32\drivers\89152843.sys - ok
21:47:25.0469 3376 [ 8940C6BC05AA8A4A05C390975AEF2FF2 ] C:\Windows\System32\igfxdev.dll
21:47:25.0469 3376 C:\Windows\System32\igfxdev.dll - ok
21:47:25.0469 3376 [ 457085667CF2A2071C8D89C728C94A08 ] C:\Windows\System32\igfxsrvc.dll
21:47:25.0469 3376 C:\Windows\System32\igfxsrvc.dll - ok
21:47:25.0469 3376 [ 105CFE016CCB20175BEACEC146F175AB ] C:\Windows\System32\IccLibDll_x64.dll
21:47:25.0484 3376 C:\Windows\System32\IccLibDll_x64.dll - ok
21:47:25.0484 3376 [ D744D5B8145C2303B19A288AF695E9AD ] C:\Windows\System32\ieframe.dll
21:47:25.0484 3376 C:\Windows\System32\ieframe.dll - ok
21:47:25.0484 3376 [ 1C178D0AF299D315DB0A84673CDE5598 ] C:\Windows\System32\igfxrenu.lrc
21:47:25.0484 3376 C:\Windows\System32\igfxrenu.lrc - ok
21:47:25.0484 3376 [ FB4045578F5180BDB1963AB352B78548 ] C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
21:47:25.0484 3376 C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll - ok
21:47:25.0484 3376 [ 9108540E866F75C7AF2B91DD921A8091 ] C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
21:47:25.0484 3376 C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll - ok
21:47:25.0484 3376 [ E3BF29CED96790CDAAFA981FFDDF53A3 ] C:\Program Files\Windows Sidebar\sidebar.exe
21:47:25.0484 3376 C:\Program Files\Windows Sidebar\sidebar.exe - ok
21:47:25.0500 3376 [ 1E70071E1753E43983B1202CE98AEC6F ] C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
21:47:25.0500 3376 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe - ok
21:47:25.0500 3376 [ 03C1AEFCEC08062B426165234F045027 ] C:\Windows\System32\igfxress.dll
21:47:25.0500 3376 C:\Windows\System32\igfxress.dll - ok
21:47:25.0500 3376 [ 6C12BD722FFC94584348DD34F4059FC5 ] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
21:47:25.0500 3376 C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe - ok
21:47:25.0500 3376 [ C3761661C17C2248A9379A8FB89E3DE1 ] C:\Windows\System32\stobject.dll
21:47:25.0500 3376 C:\Windows\System32\stobject.dll - ok
21:47:25.0500 3376 [ 394ECD933CD66BADF97EA85A183B9E1E ] C:\Windows\System32\mshtml.dll
21:47:25.0500 3376 C:\Windows\System32\mshtml.dll - ok
21:47:25.0500 3376 [ F832EEEA97CDDA1AF577E721F652A0D1 ] C:\Windows\System32\batmeter.dll
21:47:25.0500 3376 C:\Windows\System32\batmeter.dll - ok
21:47:25.0516 3376 [ E6476B55AB986A74AADF55700C4D466D ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
21:47:25.0516 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe - ok
21:47:25.0516 3376 [ 3CB07566302BCEEB898DE270A0BEC175 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
21:47:25.0516 3376 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - ok
21:47:25.0516 3376 [ 2D2A6EC8EAD30EC3ACE2FD6FB1B3E122 ] C:\Windows\System32\prnfldr.dll
21:47:25.0516 3376 C:\Windows\System32\prnfldr.dll - ok
21:47:25.0516 3376 [ B3CE0951E3C1EA3C733573C472EE85F9 ] C:\Windows\System32\msimtf.dll
21:47:25.0516 3376 C:\Windows\System32\msimtf.dll - ok
21:47:25.0516 3376 [ 198552AEFECA69D646867EC8D792DE95 ] C:\Windows\SysWOW64\ddraw.dll
21:47:25.0516 3376 C:\Windows\SysWOW64\ddraw.dll - ok
21:47:25.0531 3376 [ 42A9CB6906D9A8BEDC83B57163E62924 ] C:\Windows\System32\DXP.dll
21:47:25.0531 3376 C:\Windows\System32\DXP.dll - ok
21:47:25.0531 3376 [ 2BC7C9FD0A9F2C9AFC373F3AD1EE3891 ] C:\Windows\System32\Syncreg.dll
21:47:25.0531 3376 C:\Windows\System32\Syncreg.dll - ok
21:47:25.0531 3376 [ 12DBA51A6D1126E88F78D79AE0F7600F ] C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
21:47:25.0531 3376 C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe - ok
21:47:25.0531 3376 [ DE3C3B1B4FA5FBF1F17BCD3B3AE1ED15 ] C:\Windows\System32\jscript9.dll
21:47:25.0531 3376 C:\Windows\System32\jscript9.dll - ok
21:47:25.0531 3376 [ C836175870E00ACC546066632E15BD10 ] C:\Windows\ehome\ehSSO.dll
21:47:25.0531 3376 C:\Windows\ehome\ehSSO.dll - ok
21:47:25.0531 3376 [ 55E5B32AE8D1F51A63C82919656FD275 ] C:\Windows\SysWOW64\dciman32.dll
21:47:25.0531 3376 C:\Windows\SysWOW64\dciman32.dll - ok
21:47:25.0547 3376 [ 5B7C789CAEA2BD078D62B8E8FAD144A1 ] C:\Program Files (x86)\Emsisoft Anti-Malware\a2framework.dll
21:47:25.0547 3376 C:\Program Files (x86)\Emsisoft Anti-Malware\a2framework.dll - ok
21:47:25.0547 3376 [ E7368F0A8D19445EAF5C5D0DBB8B8DAB ] C:\Windows\System32\AltTab.dll
21:47:25.0547 3376 C:\Windows\System32\AltTab.dll - ok
21:47:25.0547 3376 [ FC6B4D5450871A4D5CB344AFF6C090EF ] C:\Windows\System32\dxtrans.dll
21:47:25.0547 3376 C:\Windows\System32\dxtrans.dll - ok
21:47:25.0547 3376 [ 4938A4350327E1A5DEB0CD134AC1AAA3 ] C:\Windows\System32\ddrawex.dll
21:47:25.0547 3376 C:\Windows\System32\ddrawex.dll - ok
21:47:25.0547 3376 [ 07DD9DCD1CC2840751A1F8772F3C0195 ] C:\Program Files\Microsoft Games\Chess\Chess.exe
21:47:25.0547 3376 C:\Program Files\Microsoft Games\Chess\Chess.exe - ok
21:47:25.0562 3376 [ 7E8A672B7B06A6EB11960C22E0360C59 ] C:\Windows\System32\d2d1.dll
21:47:25.0562 3376 C:\Windows\System32\d2d1.dll - ok
21:47:25.0562 3376 [ 63BB89DED1E9104E68D33E54DE4D340D ] C:\Windows\System32\DWrite.dll
21:47:25.0562 3376 C:\Windows\System32\DWrite.dll - ok
21:47:25.0562 3376 [ C8FDF0FA9E97E2FAAF3F814716AAA881 ] C:\Windows\System32\WPDShServiceObj.dll
21:47:25.0562 3376 C:\Windows\System32\WPDShServiceObj.dll - ok
21:47:25.0562 3376 [ C498EF41B93986BCBD483597573EB96D ] C:\Windows\System32\d3d10warp.dll
21:47:25.0562 3376 C:\Windows\System32\d3d10warp.dll - ok
21:47:25.0562 3376 [ 7EC25F7ABF7CE6B0FE93787524EE537B ] C:\Windows\System32\dxtmsft.dll
21:47:25.0562 3376 C:\Windows\System32\dxtmsft.dll - ok
21:47:25.0578 3376 [ 10F815BE90A66AAFC6C713D1BD626064 ] C:\Windows\System32\pnidui.dll
21:47:25.0578 3376 C:\Windows\System32\pnidui.dll - ok
21:47:25.0578 3376 [ 58B8702C20DE211D1FCB248D2FDD71D1 ] C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe
21:47:25.0578 3376 C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe - ok
21:47:25.0578 3376 [ B9F0A4020AA98B7A20287BF7FE99A1FD ] C:\Windows\System32\QUTIL.DLL
21:47:25.0578 3376 C:\Windows\System32\QUTIL.DLL - ok
21:47:25.0578 3376 [ E3C817F7FE44CC870ECDBCBC3EA36132 ] C:\Windows\SysWOW64\msvcp100.dll
21:47:25.0578 3376 C:\Windows\SysWOW64\msvcp100.dll - ok
21:47:25.0578 3376 [ BF38660A9125935658CFA3E53FDC7D65 ] C:\Windows\SysWOW64\msvcr100.dll
21:47:25.0578 3376 C:\Windows\SysWOW64\msvcr100.dll - ok
21:47:25.0578 3376 [ 92DBF0A4C9239169010FC6E07859C82E ] C:\Windows\System32\ActionCenter.dll
21:47:25.0578 3376 C:\Windows\System32\ActionCenter.dll - ok
21:47:25.0594 3376 [ F7A256EC899C72B4ECDD2C02CB592EFD ] C:\Windows\System32\bthprops.cpl
21:47:25.0594 3376 C:\Windows\System32\bthprops.cpl - ok
21:47:25.0594 3376 [ 8569E35D00F45972E506502EEE622BA4 ] C:\Windows\System32\srchadmin.dll
21:47:25.0594 3376 C:\Windows\System32\srchadmin.dll - ok
21:47:25.0594 3376 [ E0B340996A41C9A75DFA3B99BBA9C500 ] C:\Windows\System32\SearchIndexer.exe
21:47:25.0594 3376 C:\Windows\System32\SearchIndexer.exe - ok
21:47:25.0594 3376 [ 6CBE5D3CA5A08CFFE70E5860EF2E881E ] C:\Program Files\Easy File Locker\FileLocker.exe
21:47:25.0594 3376 C:\Program Files\Easy File Locker\FileLocker.exe - ok
21:47:25.0594 3376 [ 589DF683A6C81424A6CECE52ABF98A50 ] C:\Windows\System32\tquery.dll
21:47:25.0594 3376 C:\Windows\System32\tquery.dll - ok
21:47:25.0594 3376 [ 33975A7AF1AF19E24E773948A7257407 ] C:\Program Files\Internet Explorer\sqmapi.dll
21:47:25.0594 3376 C:\Program Files\Internet Explorer\sqmapi.dll - ok
21:47:25.0609 3376 [ D2155709E336C3BC15729EB87FEC6064 ] C:\Windows\System32\rasdlg.dll
21:47:25.0609 3376 C:\Windows\System32\rasdlg.dll - ok
21:47:25.0609 3376 [ 7568CC720ACE4D03B84AF97817E745EF ] C:\Windows\System32\mssrch.dll
21:47:25.0609 3376 C:\Windows\System32\mssrch.dll - ok
21:47:25.0609 3376 [ 102CF6879887BBE846A00C459E6D4ABC ] C:\Windows\SysWOW64\riched20.dll
21:47:25.0609 3376 C:\Windows\SysWOW64\riched20.dll - ok
21:47:25.0609 3376 [ F783EC309D42813F74319EB776153B2B ] C:\Users\Ken\Desktop\SystemLook_x64.exe
21:47:25.0609 3376 C:\Users\Ken\Desktop\SystemLook_x64.exe - ok
21:47:25.0609 3376 [ 862596399AAFD2A21DB2AF9270CD4F70 ] C:\Windows\System32\mstask.dll
21:47:25.0609 3376 C:\Windows\System32\mstask.dll - ok
21:47:25.0625 3376 [ 9AA7C9E9CCB96F99C1D5349534253FE6 ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\ccvrtrst.dll
21:47:25.0625 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\ccvrtrst.dll - ok
21:47:25.0625 3376 [ 3121A79D13A61562BE9CC902CD46B542 ] C:\Windows\System32\msidle.dll
21:47:25.0625 3376 C:\Windows\System32\msidle.dll - ok
21:47:25.0625 3376 [ ABB1B50F36CCBEF119FBEF8FDF14AD61 ] C:\Program Files\SUPERAntiSpyware\SASCTXMN64.DLL
21:47:25.0625 3376 C:\Program Files\SUPERAntiSpyware\SASCTXMN64.DLL - ok
21:47:25.0625 3376 [ FB355B817AE641BBAE08607E58CB5CE2 ] C:\Windows\System32\hhctrl.ocx
21:47:25.0625 3376 C:\Windows\System32\hhctrl.ocx - ok
21:47:25.0625 3376 [ F9AFD12BB4B1CFA5FCC0A5B37C604FD2 ] C:\Windows\System32\dot3api.dll
21:47:25.0625 3376 C:\Windows\System32\dot3api.dll - ok
21:47:25.0640 3376 [ ACE1BB07E0377E37A2C514CD2EC119B1 ] C:\Windows\System32\mssprxy.dll
21:47:25.0640 3376 C:\Windows\System32\mssprxy.dll - ok
21:47:25.0640 3376 [ 5046E55184021406C27E8D48A1B2C9D2 ] C:\Windows\System32\l3codeca.acm
21:47:25.0640 3376 C:\Windows\System32\l3codeca.acm - ok
21:47:25.0640 3376 [ E4FCA0F99A41E460C84016DEFD31E6EF ] C:\Windows\System32\wlanhlp.dll
21:47:25.0640 3376 C:\Windows\System32\wlanhlp.dll - ok
21:47:25.0640 3376 [ 357BE883C5236BFC7341CB9E82308908 ] C:\Windows\System32\wlanapi.dll
21:47:25.0640 3376 C:\Windows\System32\wlanapi.dll - ok
21:47:25.0640 3376 [ 4CFBEC37E4FAD530E623E1541E1EA958 ] C:\Windows\System32\vbscript.dll
21:47:25.0640 3376 C:\Windows\System32\vbscript.dll - ok
21:47:25.0640 3376 [ 675E21013EA33011C5DD609BCA59D887 ] C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\ccset.dll
21:47:25.0656 3376 C:\Program Files (x86)\Norton 360\Engine64\20.3.1.22\ccset.dll - ok
21:47:25.0656 3376 [ 04CB7C8FDC6D9640DD82A527208F72C4 ] C:\Windows\System32\UIAnimation.dll
21:47:25.0656 3376 C:\Windows\System32\UIAnimation.dll - ok
21:47:25.0656 3376 [ C9FB9038B15036CA28CF0B4BE2BED9BD ] C:\Windows\System32\en-US\tquery.dll.mui
21:47:25.0656 3376 C:\Windows\System32\en-US\tquery.dll.mui - ok
21:47:25.0656 3376 [ 1EA7969E3271CBC59E1730697DC74682 ] C:\Windows\System32\qmgr.dll
21:47:25.0656 3376 C:\Windows\System32\qmgr.dll - ok
21:47:25.0656 3376 [ 29409ED7400CA5BCCC30C0EE5147A60D ] C:\Windows\System32\bitsperf.dll
21:47:25.0656 3376 C:\Windows\System32\bitsperf.dll - ok
21:47:25.0656 3376 [ 6699A112A3BDC9B52338512894EBA9D6 ] C:\Program Files\Windows Media Player\wmpnscfg.exe
21:47:25.0656 3376 C:\Program Files\Windows Media Player\wmpnscfg.exe - ok
21:47:25.0672 3376 [ D9431DCF90B0253773F51FDEFE7FD42F ] C:\Windows\System32\bitsigd.dll
21:47:25.0672 3376 C:\Windows\System32\bitsigd.dll - ok
21:47:25.0672 3376 [ C746F3BF98E92FB137B5BD2B8B5925BD ] C:\Windows\System32\FXSST.dll
21:47:25.0672 3376 C:\Windows\System32\FXSST.dll - ok
21:47:25.0672 3376 [ 96DB78C9C50CEED9DA5050EFFEE272A2 ] C:\Windows\System32\upnp.dll
21:47:25.0672 3376 C:\Windows\System32\upnp.dll - ok
21:47:25.0672 3376 [ 650CAEA856943E29F25A25D31E004B18 ] C:\Windows\System32\FXSAPI.dll
21:47:25.0672 3376 C:\Windows\System32\FXSAPI.dll - ok
21:47:25.0672 3376 [ C8E8B8239FCF17BEA10E751BE5854631 ] C:\Windows\System32\FXSRESM.dll
21:47:25.0672 3376 C:\Windows\System32\FXSRESM.dll - ok
21:47:25.0672 3376 [ 5BACFD51D926774C8DD8028BEC9B4374 ] C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe
21:47:25.0672 3376 C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe - ok
21:47:25.0687 3376 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] C:\Windows\System32\ssdpsrv.dll
21:47:25.0687 3376 C:\Windows\System32\ssdpsrv.dll - ok
21:47:25.0687 3376 [ 5DA219F57A9076FB6FBD3C9C3713A672 ] C:\Windows\System32\WWanAPI.dll
21:47:25.0687 3376 C:\Windows\System32\WWanAPI.dll - ok
21:47:25.0687 3376 [ 62C7AACC746C9723468A8F2169ED3E85 ] C:\Windows\System32\wwapi.dll
21:47:25.0687 3376 C:\Windows\System32\wwapi.dll - ok
21:47:25.0687 3376 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] C:\Windows\System32\FXSSVC.exe
21:47:25.0687 3376 C:\Windows\System32\FXSSVC.exe - ok
21:47:25.0687 3376 [ 6B851E682A36453E1B1EE297FFB6E2AB ] C:\Windows\System32\QAGENT.DLL
21:47:25.0687 3376 C:\Windows\System32\QAGENT.DLL - ok
21:47:25.0703 3376 [ 53534F0BC0BEFFD60FC13864B3034984 ] C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe
21:47:25.0703 3376 C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe - ok
21:47:25.0703 3376 [ 8494E126F0B10180F3293AF861CE1F7A ] C:\Windows\System32\mlang.dll
21:47:25.0703 3376 C:\Windows\System32\mlang.dll - ok
21:47:25.0703 3376 [ AC5DF873913B00E554D8F553459BC431 ] C:\Windows\System32\qmgrprxy.dll
21:47:25.0703 3376 C:\Windows\System32\qmgrprxy.dll - ok
21:47:25.0703 3376 [ 85B45B4B285B159ACDB355FC8C1E8925 ] C:\Windows\SysWOW64\qmgrprxy.dll
21:47:25.0703 3376 C:\Windows\SysWOW64\qmgrprxy.dll - ok
21:47:25.0703 3376 [ 7AE299BC0A183A37A5A2F7FC7AFF083C ] C:\Program Files\Windows Mail\wab.exe
21:47:25.0703 3376 C:\Program Files\Windows Mail\wab.exe - ok
21:47:25.0703 3376 [ FE1897800D8FCA8579CCABC83A0CA181 ] C:\Program Files\WinRAR\WinRAR.exe
21:47:25.0703 3376 C:\Program Files\WinRAR\WinRAR.exe - ok
21:47:25.0718 3376 [ C7494C67A6BF6FE914808E42F8265FEF ] C:\Program Files\Windows Media Player\wmpnssci.dll
21:47:25.0718 3376 C:\Program Files\Windows Media Player\wmpnssci.dll - ok
21:47:25.0718 3376 [ A9F3BFC9345F49614D5859EC95B9E994 ] C:\Program Files\Windows Media Player\wmpnetwk.exe
21:47:25.0718 3376 C:\Program Files\Windows Media Player\wmpnetwk.exe - ok
21:47:25.0718 3376 [ 423982DD851406A52B6399DDB196C606 ] C:\Windows\System32\wmdrmdev.dll
21:47:25.0718 3376 C:\Windows\System32\wmdrmdev.dll - ok
21:47:25.0718 3376 [ B540D64EFE0E63286A4C0BBA9A4C7A21 ] C:\Program Files\Windows Media Player\wmprph.exe
21:47:25.0718 3376 C:\Program Files\Windows Media Player\wmprph.exe - ok
21:47:25.0718 3376 [ 2C1055E2C6D42753241FB2A129136994 ] C:\Windows\System32\drmv2clt.dll
21:47:25.0718 3376 C:\Windows\System32\drmv2clt.dll - ok
21:47:25.0734 3376 [ 715BFF236158F61C042928A53C0D5AA8 ] C:\Program Files\Windows NT\Accessories\wordpad.exe
21:47:25.0734 3376 C:\Program Files\Windows NT\Accessories\wordpad.exe - ok
21:47:25.0734 3376 [ 1EB82516F21F27EED1833B4F9FD9614E ] C:\Windows\System32\wmp.dll
21:47:25.0734 3376 C:\Windows\System32\wmp.dll - ok
21:47:25.0734 3376 [ E19AD0D49BFF5938B3E374873AC174DE ] C:\Windows\System32\wmploc.DLL
21:47:25.0734 3376 C:\Windows\System32\wmploc.DLL - ok
21:47:25.0734 3376 [ F924D18569D6E32F867C80F217A185E8 ] C:\Program Files\Microsoft IntelliPoint\dpgcmd.dll
21:47:25.0734 3376 C:\Program Files\Microsoft IntelliPoint\dpgcmd.dll - ok
21:47:25.0734 3376 [ 0FEC5F3C533DAE4B68C57EB8432E7881 ] C:\Program Files\Microsoft IntelliPoint\Components\Commands\DPGHnt\DPGHnt.dll
21:47:25.0734 3376 C:\Program Files\Microsoft IntelliPoint\Components\Commands\DPGHnt\DPGHnt.dll - ok
21:47:25.0750 3376 [ E389EA130C4A9A4DBA0F138222261056 ] C:\Program Files\SUPERAntiSpyware\SSUpdate64.exe
21:47:25.0750 3376 C:\Program Files\SUPERAntiSpyware\SSUpdate64.exe - ok
21:47:25.0750 3376 [ 97A891E2BF7FDA830BCFC6269DA3F5E9 ] C:\Windows\System32\blackbox.dll
21:47:25.0750 3376 C:\Windows\System32\blackbox.dll - ok
21:47:25.0750 3376 [ 41446E7545BB7B4167DE8A274CC924E3 ] C:\Program Files\Internet Explorer\ieproxy.dll
21:47:25.0750 3376 C:\Program Files\Internet Explorer\ieproxy.dll - ok
21:47:25.0750 3376 [ 355A138ABDFD43FBABCAE3A1B06AB93D ] C:\Windows\System32\wmpps.dll
21:47:25.0750 3376 C:\Windows\System32\wmpps.dll - ok
21:47:25.0750 3376 [ 6554208814632C25C77EE02355EB8E95 ] C:\Program Files\Internet Explorer\iexplore.exe
21:47:25.0750 3376 C:\Program Files\Internet Explorer\iexplore.exe - ok
21:47:25.0750 3376 [ 220159496484D34009DE71CA1A68E0D4 ] C:\Windows\System32\wbem\NCProv.dll
21:47:25.0750 3376 C:\Windows\System32\wbem\NCProv.dll - ok
21:47:25.0765 3376 [ BC0D4AFBE94D8E1F81C8926D805C3366 ] C:\Windows\System32\webcheck.dll
21:47:25.0765 3376 C:\Windows\System32\webcheck.dll - ok
21:47:25.0765 3376 [ 61AE136B3772D7380BC2A56E50F44398 ] C:\Program Files\Internet Explorer\IEShims.dll
21:47:25.0765 3376 C:\Program Files\Internet Explorer\IEShims.dll - ok
21:47:25.0765 3376 [ 101797BA603D227946B4B5109867EB19 ] C:\Windows\System32\SyncCenter.dll
21:47:25.0765 3376 C:\Windows\System32\SyncCenter.dll - ok
21:47:25.0765 3376 [ 8130391F82D52D36C0441F714136957F ] C:\Windows\System32\imapi2.dll
21:47:25.0765 3376 C:\Windows\System32\imapi2.dll - ok
21:47:25.0765 3376 [ 6A5C1A8AC0B572679361026D0E900420 ] C:\Windows\System32\hgcpl.dll
21:47:25.0765 3376 C:\Windows\System32\hgcpl.dll - ok
21:47:25.0781 3376 [ 0438CAB2E03F4FB61455A7956026FE86 ] C:\Windows\System32\fdPHost.dll
21:47:25.0781 3376 C:\Windows\System32\fdPHost.dll - ok
21:47:25.0781 3376 [ 171D7DB433314A868507C4326E8209DC ] C:\Windows\System32\fdWSD.dll
21:47:25.0781 3376 C:\Windows\System32\fdWSD.dll - ok
21:47:25.0781 3376 [ E4F6125ED5185F8FA37CC4F449B85526 ] C:\Program Files (x86)\Internet Explorer\iexplore.exe
21:47:25.0781 3376 C:\Program Files (x86)\Internet Explorer\iexplore.exe - ok
21:47:25.0781 3376 [ A2E5B2D20954210DCE1A75A1FC8CC36D ] C:\Windows\System32\fdSSDP.dll
21:47:25.0781 3376 C:\Windows\System32\fdSSDP.dll - ok
21:47:25.0781 3376 [ 1C3C4D34DCF354620B76B42620B4DFAD ] C:\Windows\System32\ieui.dll
21:47:25.0781 3376 C:\Windows\System32\ieui.dll - ok
21:47:25.0781 3376 [ 2A436796758BF2555A26C770FE8A6FEE ] C:\Windows\System32\fdProxy.dll
21:47:25.0781 3376 C:\Windows\System32\fdProxy.dll - ok
21:47:25.0796 3376 [ B32ED424FD72FFA7554F23F125F2132D ] C:\Program Files (x86)\Internet Explorer\IEShims.dll
21:47:25.0796 3376 C:\Program Files (x86)\Internet Explorer\IEShims.dll - ok
21:47:25.0796 3376 [ FD31DFF0CC05BD581C2DB1BB6F7FFDCE ] C:\Program Files (x86)\Internet Explorer\ieproxy.dll
21:47:25.0796 3376 C:\Program Files (x86)\Internet Explorer\ieproxy.dll - ok
21:47:25.0796 3376 [ 90F785F7594E3AF23D4392677042BE9A ] C:\Windows\SysWOW64\ieui.dll
21:47:25.0796 3376 C:\Windows\SysWOW64\ieui.dll - ok
21:47:25.0796 3376 [ D017BF8D92938EEB9B3A1D1C53FDA152 ] C:\Windows\SysWOW64\mshtml.dll
21:47:25.0796 3376 C:\Windows\SysWOW64\mshtml.dll - ok
21:47:25.0796 3376 [ B39FBBB2460C3C43317CD65E82FFBBF8 ] C:\Program Files (x86)\Internet Explorer\sqmapi.dll
21:47:25.0796 3376 C:\Program Files (x86)\Internet Explorer\sqmapi.dll - ok
21:47:25.0796 3376 [ 9FF8F684BACF326082E5562F7C104A79 ] C:\Windows\SysWOW64\d2d1.dll
21:47:25.0796 3376 C:\Windows\SysWOW64\d2d1.dll - ok
21:47:25.0812 3376 [ 7267D99F3AB9FBF8A9ADCAC9D91089A3 ] C:\Windows\SysWOW64\igd10umd32.dll
21:47:25.0812 3376 C:\Windows\SysWOW64\igd10umd32.dll - ok
21:47:25.0812 3376 [ 8EE6BDE1D572677AA35707C52C585F75 ] C:\Windows\SysWOW64\mlang.dll
21:47:25.0812 3376 C:\Windows\SysWOW64\mlang.dll - ok
21:47:25.0812 3376 [ 7D9F94C51B7CF7DE6C5E73FC485CA8D5 ] C:\Windows\SysWOW64\igdumd32.dll
21:47:25.0812 3376 C:\Windows\SysWOW64\igdumd32.dll - ok
21:47:25.0812 3376 [ A992F4190098B3D5F87F297C992DA6A9 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ips\ipsbho.dll
21:47:25.0812 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ips\ipsbho.dll - ok
21:47:25.0812 3376 [ 4E4B26EA95206229B0B84E026CFF83CB ] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130425.001\Scxpx86.dll
21:47:25.0812 3376 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130425.001\Scxpx86.dll - ok
21:47:25.0828 3376 [ 27861540F6A834218C9ED6E2FE75E32B ] C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
21:47:25.0828 3376 C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll - ok
21:47:25.0828 3376 [ 0E0D229CC5AD08ADB848878FD167E0C5 ] C:\Program Files (x86)\Java\jre7\bin\ssv.dll
21:47:25.0828 3376 C:\Program Files (x86)\Java\jre7\bin\ssv.dll - ok
21:47:25.0828 3376 [ F38B92211F961CF9D48B2192BC7B00D6 ] C:\Program Files (x86)\Java\jre7\bin\deploy.dll
21:47:25.0828 3376 C:\Program Files (x86)\Java\jre7\bin\deploy.dll - ok
21:47:25.0828 3376 [ 67EC459E42D3081DD8FD34356F7CAFC1 ] C:\Program Files (x86)\Java\jre7\bin\msvcr100.dll
21:47:25.0828 3376 C:\Program Files (x86)\Java\jre7\bin\msvcr100.dll - ok
21:47:25.0828 3376 [ 74FE40A1508752E3886FC4FE27F5DED8 ] C:\Windows\System32\Macromed\Flash\Flash64_11_7_700_169.ocx
21:47:25.0828 3376 C:\Windows\System32\Macromed\Flash\Flash64_11_7_700_169.ocx - ok
21:47:25.0843 3376 [ 9B59687619B27CDA24638CDC3AF079FB ] C:\Windows\SysWOW64\jscript9.dll
21:47:25.0843 3376 C:\Windows\SysWOW64\jscript9.dll - ok
21:47:25.0843 3376 [ 0F44172A5B34E8F208CD0F209EDD4A73 ] C:\Windows\SysWOW64\ieapfltr.dll
21:47:25.0843 3376 C:\Windows\SysWOW64\ieapfltr.dll - ok
21:47:25.0843 3376 [ 1D1EAA16D193C6A2D45981ED3914D22A ] C:\Windows\SysWOW64\msimtf.dll
21:47:25.0843 3376 C:\Windows\SysWOW64\msimtf.dll - ok
21:47:25.0843 3376 [ EDF2A5E96BEC469DA3F64E9BDD386111 ] C:\Windows\SysWOW64\xmllite.dll
21:47:25.0843 3376 C:\Windows\SysWOW64\xmllite.dll - ok
21:47:25.0843 3376 [ 8C3D32A4A46326031309A43C52539D7F ] C:\Windows\SysWOW64\ieapfltr.dat
21:47:25.0843 3376 C:\Windows\SysWOW64\ieapfltr.dat - ok
21:47:25.0843 3376 [ C225E5307D8D4982A1687F2702C37C78 ] C:\Windows\SysWOW64\msls31.dll
21:47:25.0843 3376 C:\Windows\SysWOW64\msls31.dll - ok
21:47:25.0859 3376 [ D2958325C1AE1AE37A83334C6229E3BC ] C:\Windows\SysWOW64\actxprxy.dll
21:47:25.0859 3376 C:\Windows\SysWOW64\actxprxy.dll - ok
21:47:25.0859 3376 [ 402D797A7905DC3C6FE11E75CD5252EB ] C:\Windows\System32\url.dll
21:47:25.0859 3376 C:\Windows\System32\url.dll - ok
21:47:25.0859 3376 [ FD049C25A168D3DE310D9207B7B6367B ] C:\Windows\SysWOW64\UIAutomationCore.dll
21:47:25.0859 3376 C:\Windows\SysWOW64\UIAutomationCore.dll - ok
21:47:25.0859 3376 [ 9D8F3B5E2FACDAF0183CAA834AAD7171 ] C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_7_700_169.ocx
21:47:25.0859 3376 C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_7_700_169.ocx - ok
21:47:25.0859 3376 [ 0E85C11F8850D524B02181C6E02BA9AE ] C:\Windows\SysWOW64\dsound.dll
21:47:25.0859 3376 C:\Windows\SysWOW64\dsound.dll - ok
21:47:25.0859 3376 [ 7F8678C59F188528D60104E697C2361E ] C:\Windows\SysWOW64\mscms.dll
21:47:25.0874 3376 C:\Windows\SysWOW64\mscms.dll - ok
21:47:25.0874 3376 [ 62A6EB5771580CAE445804389F3F7432 ] C:\Windows\SysWOW64\WindowsCodecsExt.dll
21:47:25.0874 3376 C:\Windows\SysWOW64\WindowsCodecsExt.dll - ok
21:47:25.0874 3376 [ 325E1FD6A5BCCDB486007988987D8D7C ] C:\Windows\System32\Macromed\Flash\FlashUtil64_11_7_700_169_ActiveX.exe
21:47:25.0874 3376 C:\Windows\System32\Macromed\Flash\FlashUtil64_11_7_700_169_ActiveX.exe - ok
21:47:25.0874 3376 [ 4C3DAEE652B005B483F16B8E9131C99D ] C:\Windows\System32\d3d9.dll
21:47:25.0874 3376 C:\Windows\System32\d3d9.dll - ok
21:47:25.0874 3376 [ 3044D07ABDF4BBEA27E2EE7B1E0C0C65 ] C:\Windows\System32\d3d8thk.dll
21:47:25.0874 3376 C:\Windows\System32\d3d8thk.dll - ok
21:47:25.0874 3376 [ A7A8CA53D9C9FD90C07AB0EB38E5316B ] C:\Windows\System32\dbghelp.dll
21:47:25.0874 3376 C:\Windows\System32\dbghelp.dll - ok
21:47:25.0890 3376 [ C621FB6BF9741AA18E55377FDD2CE96F ] C:\Windows\System32\oleaccrc.dll
21:47:25.0890 3376 C:\Windows\System32\oleaccrc.dll - ok
21:47:25.0890 3376 [ ECBFA912A3FC8BAA7D5EAFAF77C29C8A ] C:\Windows\System32\Macromed\Flash\FlashUtil64_11_7_700_169_ActiveX.dll
21:47:25.0890 3376 C:\Windows\System32\Macromed\Flash\FlashUtil64_11_7_700_169_ActiveX.dll - ok
21:47:25.0890 3376 [ D9E21CBF9E6A87847AFFD39EA3FA28EE ] C:\Windows\System32\SearchProtocolHost.exe
21:47:25.0890 3376 C:\Windows\System32\SearchProtocolHost.exe - ok
21:47:25.0890 3376 [ D2A5B2B09F2AF5ED13BF494508B09788 ] C:\Windows\System32\msshooks.dll
21:47:25.0890 3376 C:\Windows\System32\msshooks.dll - ok
21:47:25.0890 3376 [ 49A3AD5CE578CD77F445F3D244AEAB2D ] C:\Windows\System32\SearchFilterHost.exe
21:47:25.0890 3376 C:\Windows\System32\SearchFilterHost.exe - ok
21:47:25.0906 3376 [ A08C010D859F8EB42BDD7E1D55B8CA27 ] C:\Windows\System32\mscoree.dll
21:47:25.0906 3376 C:\Windows\System32\mscoree.dll - ok
21:47:25.0906 3376 [ 6EB75D77133B9B42C0EB9D4D0F861CD9 ] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
21:47:25.0906 3376 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll - ok
21:47:25.0906 3376 [ C5413BC4F10CEB4C3070BBF04D324117 ] C:\Windows\SysWOW64\msisip.dll
21:47:25.0906 3376 C:\Windows\SysWOW64\msisip.dll - ok
21:47:25.0906 3376 [ C5A75EB48E2344ABDC162BDA79E16841 ] C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:47:25.0906 3376 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - ok
21:47:25.0906 3376 [ E5F7C30EDF0892667933BE879F067D67 ] C:\Windows\SysWOW64\msvcr100_clr0400.dll
21:47:25.0906 3376 C:\Windows\SysWOW64\msvcr100_clr0400.dll - ok
21:47:25.0906 3376 [ D83947A58613E9091B4C9CC0F1546A8D ] C:\Windows\SysWOW64\mscoree.dll
21:47:25.0906 3376 C:\Windows\SysWOW64\mscoree.dll - ok
21:47:25.0921 3376 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:47:25.0921 3376 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - ok
21:47:25.0921 3376 [ CB21CD39637AC13F3455454B2F648257 ] C:\Windows\System32\msvcr100_clr0400.dll
21:47:25.0921 3376 C:\Windows\System32\msvcr100_clr0400.dll - ok
21:47:25.0921 3376 [ 98B16E756243BEA9410E32025B19C06F ] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:47:25.0921 3376 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe - ok
21:47:25.0921 3376 [ E0E4A1F81A7D69C595A8A9DDAD084C19 ] C:\Program Files (x86)\Nero\Update\NASvc.exe
21:47:25.0921 3376 C:\Program Files (x86)\Nero\Update\NASvc.exe - ok
21:47:25.0921 3376 [ E17E0188BB90FAE42D83E98707EFA59C ] C:\Windows\System32\sppsvc.exe
21:47:25.0921 3376 C:\Windows\System32\sppsvc.exe - ok
21:47:25.0921 3376 [ FFF95479C7AB1550F0750A5D01744211 ] C:\Windows\System32\drivers\spsys.sys
21:47:25.0921 3376 C:\Windows\System32\drivers\spsys.sys - ok
21:47:25.0937 3376 [ B29280AA00BC34FEECDC0426B11B9DAC ] C:\Windows\SysWOW64\RstrtMgr.dll
21:47:25.0937 3376 C:\Windows\SysWOW64\RstrtMgr.dll - ok
21:47:25.0937 3376 [ F1278B3514EA6FA9BC39B20D26139AAC ] C:\Windows\SysWOW64\msiltcfg.dll
21:47:25.0937 3376 C:\Windows\SysWOW64\msiltcfg.dll - ok
21:47:25.0937 3376 [ F6F22291024906E43D135A4B1705FEAC ] C:\Windows\System32\sppwinob.dll
21:47:25.0937 3376 C:\Windows\System32\sppwinob.dll - ok
21:47:25.0937 3376 [ E8B1FE6669397D1772D8196DF0E57A9E ] C:\Windows\System32\wscsvc.dll
21:47:25.0937 3376 C:\Windows\System32\wscsvc.dll - ok
21:47:25.0937 3376 [ 39F03455A7C449FFFB2BC4BBDE480EB5 ] C:\Program Files (x86)\Nero\Update\NASvcPS.dll
21:47:25.0937 3376 C:\Program Files (x86)\Nero\Update\NASvcPS.dll - ok
21:47:25.0952 3376 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] C:\Windows\System32\wuaueng.dll
21:47:25.0952 3376 C:\Windows\System32\wuaueng.dll - ok
21:47:25.0952 3376 [ FA43D418BC945D27D0625B697B8442B5 ] C:\Windows\System32\cabinet.dll
21:47:25.0952 3376 C:\Windows\System32\cabinet.dll - ok
21:47:25.0952 3376 [ 617F6EC0AC677C685479C1D0D1E76C6F ] C:\Windows\System32\mspatcha.dll
21:47:25.0952 3376 C:\Windows\System32\mspatcha.dll - ok
21:47:25.0952 3376 [ 92E0508D924512F63FFEEFE498CBD11F ] C:\Windows\System32\p2pcollab.dll
21:47:25.0952 3376 C:\Windows\System32\p2pcollab.dll - ok
21:47:25.0952 3376 [ 582AC6D9873E31DFA28A4547270862DD ] C:\Windows\System32\QAGENTRT.DLL
21:47:25.0952 3376 C:\Windows\System32\QAGENTRT.DLL - ok
21:47:25.0952 3376 [ 506A83A3BEEE9FCA09F0170DE9FC7D1B ] C:\Windows\System32\fveui.dll
21:47:25.0952 3376 C:\Windows\System32\fveui.dll - ok
21:47:25.0968 3376 [ C47F35CC6FA4F1BDBEF8F87AC1A46537 ] C:\Windows\System32\wuapi.dll
21:47:25.0968 3376 C:\Windows\System32\wuapi.dll - ok
21:47:25.0968 3376 [ E746ED90132C6B6313CE9179F56BD31D ] C:\Windows\System32\wups.dll
21:47:25.0968 3376 C:\Windows\System32\wups.dll - ok
21:47:25.0968 3376 [ 2B373B5F7E36B5ED5DA176D4400EF091 ] C:\Windows\System32\sppobjs.dll
21:47:25.0968 3376 C:\Windows\System32\sppobjs.dll - ok
21:47:25.0968 3376 [ 7FE0D0C8F53735EA17C9AE93EFE7AD5A ] C:\Windows\System32\wups2.dll
21:47:25.0968 3376 C:\Windows\System32\wups2.dll - ok
21:47:25.0968 3376 [ EAA2B8155272BC5789E81E7819518559 ] C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\wscstub.exe
21:47:25.0968 3376 C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\wscstub.exe - ok
21:47:25.0984 3376 [ 7DF186D86CF8C571A12AAB788C777F84 ] C:\Windows\SysWOW64\wscproxystub.dll
21:47:25.0984 3376 C:\Windows\SysWOW64\wscproxystub.dll - ok
21:47:25.0984 3376 [ 7A78ED1088890114DFDE2C4AB038D6B6 ] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:47:25.0984 3376 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe - ok
21:47:25.0984 3376 [ D480C9220BFE667DE65A46CDE80EA7E9 ] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\StatusStrings.dll
21:47:25.0984 3376 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\StatusStrings.dll - ok
21:47:25.0984 3376 [ 122F89E0905FC656D56F65CD7A2E9B4D ] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\xerces-c_2_7.dll
21:47:25.0984 3376 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\xerces-c_2_7.dll - ok
21:47:25.0984 3376 ============================================================
21:47:25.0984 3376 Scan finished
21:47:25.0984 3376 ============================================================
21:47:25.0999 4432 Detected object count: 2
21:47:25.0999 4432 Actual detected object count: 2
21:48:10.0846 4432 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
21:48:10.0846 4432 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
21:48:10.0846 4432 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
21:48:10.0846 4432 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip


----------



## maggie88ca (Nov 19, 2006)

And here is the gmer log....

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-04-25 22:04:24
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-8 WDC_WD15EARX-22PASB0 rev.51.0AB51 1397.27GB
Running: 9jobdrjv.exe; Driver: C:\Users\Ken\AppData\Local\Temp\uwddqpow.sys

---- Kernel code sections - GMER 2.1 ----

INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80003202000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607 fffff8000320202f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010011091c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100110048
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001001102ee
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001001104b2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001001109fe
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100110ae0
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010011012a
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100110758
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100110676
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001001103d0
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100110594
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010011083a
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010011020c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 000000010012059e
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100110f52
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 0000000100120210
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 0000000100120048
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff898aa9d1}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100110ca6
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001001203d8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 000000010012012c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001001202f4
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1608] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100110e6e
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010010091c
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100100048
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001001002ee
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001001004b2
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001001009fe
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100100ae0
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010010012a
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100100758
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100100676
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001001003d0
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100100594
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010010083a
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010010020c
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100100f52
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 0000000100150210
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 0000000100150048
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff898da9d1}
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100100ca6
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001001503d8
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 000000010015012c
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001001502f4
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100100e6e
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1640] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001001504bc
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010050091c
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100500048
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001005002ee
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001005004b2
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001005009fe
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100500ae0
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010050012a
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100500758
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100500676
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001005003d0
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100500594
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010050083a
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010050020c
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100500f52
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 0000000100510210
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 0000000100510048
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff89c9a9d1}
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100500ca6
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001005103d8
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 000000010051012c
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001005102f4
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100500e6e
.text C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe[1712] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001005104bc
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010025091c
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100250048
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002502ee
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002504b2
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001002509fe
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100250ae0
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010003004c
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010025012a
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100250758
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100250676
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002503d0
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100250594
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010025083a
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010025020c
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001002604bc
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100250f52
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 0000000100260210
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 0000000100260048
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff899ea9d1}
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100250ca6
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001002603d8
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 000000010026012c
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001002602f4
.text C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe[1772] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100250e6e
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010029091c
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100290048
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002902ee
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002904b2
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001002909fe
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100290ae0
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010003004c
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010029012a
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100290758
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100290676
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002903d0
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100290594
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010029083a
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010029020c
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100290f52
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 00000001002a0210
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 00000001002a0048
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff89a2a9d1}
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100290ca6
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001002a03d8
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 00000001002a012c
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001002a02f4
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100290e6e
.text C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe[1836] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001002a04bc
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010029091c
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100290048
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002902ee
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002904b2
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory  0000000076f10018 5 bytes JMP 00000001002909fe
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100290ae0
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010003004c
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010029012a
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100290758
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100290676
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002903d0
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100290594
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010029083a
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010029020c
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001002a059e
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100290f52
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 00000001002a0210
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 00000001002a0048
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff89a2a9d1}
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100290ca6
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001002a03d8
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 00000001002a012c
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001002a02f4
.text C:\Windows\SysWOW64\AsHookDevice.exe[1924] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100290e6e
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010009091c
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100090048
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001000902ee
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001000904b2
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001000909fe
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100090ae0
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010009012a
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100090758
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100090676
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001000903d0
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100090594
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010009083a
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010009020c
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100090f52
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380  00000000768753d0 7 bytes JMP 00000001000a0210
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 00000001000a0048
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff8982a9d1}
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100090ca6
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001000a03d8
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 00000001000a012c
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001000a02f4
.text C:\Windows\SysWOW64\LxrSII1s.exe[2012] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100090e6e
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ec1465 2 bytes [EC, 76]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ec14bb 2 bytes [EC, 76]
.text ... * 2
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes CALL 9
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007fefdf23b44 6 bytes {JMP QWORD [RIP+0xfc4ec]}
.text C:\Windows\system32\taskhost.exe[3096] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007fefdf3b704 6 bytes {JMP QWORD [RIP+0xc492c]}
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076f0fc00 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076f0fc04 2 bytes [89, 71]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076f0fd44 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076f0fd48 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f10094 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f10098 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f101a4 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f101a8 2 bytes [8F, 71]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f10a24 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f10a28 2 bytes [8C, 71]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe[3120] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f11904 2 bytes [80, 71]
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\system32\taskeng.exe[3140] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes CALL 5b000038
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\system32\Dwm.exe[3216] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes CALL 5b000038
.text C:\Windows\Explorer.EXE[3868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes CALL 5b000038
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\ws2_32.dll!WSALookupServiceBeginW 0000000002ac3030 6 bytes {JMP QWORD [RIP+0x12d000]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\ws2_32.dll!connect + 1 0000000002ac45c1 5 bytes {JMP QWORD [RIP+0x6ba70]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\ws2_32.dll!listen 0000000002ac8290 6 bytes {JMP QWORD [RIP+0xf7da0]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef3e35cd0 6 bytes JMP 72005c
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef3eb0f20 6 bytes {JMP QWORD [RIP+0x2bf110]}
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef3ebfaa8 6 bytes JMP 0
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef6587b34 6 bytes JMP 300030
.text C:\Windows\Explorer.EXE[3868] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef65903c0 6 bytes JMP 75006f
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076f0fc00 3 bytes JMP 718a000a
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076f0fc04 2 bytes JMP 718a000a
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010028091c
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076f0fd44 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076f0fd48 2 bytes [83, 71]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100280048
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002802ee
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002804b2
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001002809fe
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100280ae0
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f10094 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f10098 2 bytes [86, 71]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f101a4 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f101a8 2 bytes [8F, 71]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010028012a
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100280758
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100280676
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f10a24 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f10a28 2 bytes [8C, 71]
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002803d0
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100280594
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010028083a
.text C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe[3896] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010028020c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile  0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes [65, 65, 06]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef6587b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1120] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef65903c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes CALL 5b000038
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef3e35cd0 6 bytes {JMP QWORD [RIP+0x49a360]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef3eb0f20 6 bytes {JMP QWORD [RIP+0x3df110]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef3ebfaa8 6 bytes {JMP QWORD [RIP+0x3f0588]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW  000007fefdeb3030 6 bytes {JMP QWORD [RIP+0x40d000]}
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefdeb45c1 5 bytes JMP 0
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[948] C:\Windows\system32\WS2_32.dll!listen 000007fefdeb8290 6 bytes {JMP QWORD [RIP+0x3d7da0]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\System32\igfxtray.exe[2128] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes [65, 65, 06]
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\System32\hkcmd.exe[3432] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes [65, 65, 06]
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes {JMP QWORD [RIP+0x93deac0]}
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes {JMP QWORD [RIP+0x941e9f0]}
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes {JMP QWORD [RIP+0x93fe7d0]}
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes {JMP QWORD [RIP+0x943d7f0]}
.text C:\Windows\System32\igfxpers.exe[3564] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 3 bytes [65, 65, 06]
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d61570 6 bytes JMP 93deb00
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d61640 6 bytes JMP 0
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d61860 6 bytes JMP 0
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d61910 6 bytes {JMP QWORD [RIP+0x939e720]}
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d61ea0 6 bytes {JMP QWORD [RIP+0x93be190]}
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d62840 6 bytes JMP 0
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefce89aa5 4 bytes {CALL QWORD [RIP+0x1026565]}
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 0000000002d43030 6 bytes JMP 0
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\system32\WS2_32.dll!connect + 1 0000000002d445c1 5 bytes {JMP QWORD [RIP+0x13ba70]}
.text C:\Program Files\Windows Sidebar\sidebar.exe[3620] C:\Windows\system32\WS2_32.dll!listen 0000000002d48290 6 bytes JMP 0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010029091c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100290048
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002902ee
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002904b2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001002909fe
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100290ae0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010029012a
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100290758
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100290676
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002903d0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100290594
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010029083a
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010029020c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100290f52
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 00000001002a0210
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 00000001002a0048
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff89a2a9d1}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542  000000007687589a 7 bytes JMP 0000000100290ca6
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001002a03d8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 00000001002a012c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001002a02f4
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100290e6e
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1568] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001002a04bc
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010011091c
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100110048
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001001102ee
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001001104b2
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001001109fe
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100110ae0
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010011012a
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100110758
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100110676
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001001103d0
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100110594
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010011083a
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010011020c
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 000000010012059e
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 0000000100110f52
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 0000000100120210
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 0000000100120048
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff898aa9d1}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100110ca6
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001001203d8
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 000000010012012c
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001001202f4
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4436] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100110e6e
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 00000001002a091c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 00000001002a0048
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002a02ee
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002a04b2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001002a09fe
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 00000001002a0ae0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010024004c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 00000001002a012a
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 00000001002a0758
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 00000001002a0676
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002a03d0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 00000001002a0594
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 00000001002a083a
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 00000001002a020c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 00000001002a0f52
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 00000001002b0210
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 1 byte JMP 00000001002b0048
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151 0000000076875679 5 bytes {JMP 0xffffffff89a3a9d1}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 00000001002a0ca6
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001002b03d8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 00000001002b012c
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001002b02f4
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 00000001002a0e6e
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3304] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 00000001002b059e
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076f0fc00 3 bytes JMP 718a000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076f0fc04 2 bytes JMP 718a000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f0fc90 5 bytes JMP 000000010028091c
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076f0fd44 3 bytes JMP 7184000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076f0fd48 2 bytes JMP 7184000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000076f0fdf4 5 bytes JMP 0000000100280048
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent 0000000076f0fe88 5 bytes JMP 00000001002802ee
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread 0000000076f0ffe4 5 bytes JMP 00000001002804b2
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f10018 5 bytes JMP 00000001002809fe
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000076f10048 5 bytes JMP 0000000100280ae0
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread 0000000076f10064 5 bytes JMP 000000010002004c
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f10094 3 bytes JMP 7187000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4  0000000076f10098 2 bytes JMP 7187000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f101a4 3 bytes JMP 7190000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f101a8 2 bytes JMP 7190000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant 0000000076f1077c 5 bytes JMP 000000010028012a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject 0000000076f1086c 5 bytes JMP 0000000100280758
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx 0000000076f10884 5 bytes JMP 0000000100280676
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f10a24 3 bytes JMP 718d000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f10a28 2 bytes JMP 718d000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver 0000000076f10dd4 5 bytes JMP 00000001002803d0
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f11900 5 bytes JMP 0000000100280594
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation 0000000076f11bc4 5 bytes JMP 000000010028083a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread 0000000076f11d50 5 bytes JMP 000000010028020c
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000074f32c91 4 bytes CALL 71af0000
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076209679 6 bytes JMP 719f000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000762112a5 6 bytes JMP 7199000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076213baa 6 bytes JMP 719c000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007621612e 6 bytes JMP 71a2000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!SendInput 000000007622ff4a 3 bytes JMP 71a5000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007622ff4e 2 bytes JMP 71a5000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882 0000000076251492 7 bytes JMP 0000000100280bc2
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!mouse_event 000000007626027b 6 bytes JMP 71ab000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\USER32.dll!keybd_event 00000000762602bf 6 bytes JMP 71a8000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 000000007510712c 6 bytes JMP 7193000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000075123158 6 bytes JMP 7196000a
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206 000000007687524f 7 bytes JMP 00000001002b0048
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380 00000000768753d0 7 bytes JMP 00000001002b02f4
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149 0000000076875677 7 bytes JMP 00000001002b012c
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542 000000007687589a 7 bytes JMP 0000000100280d88
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382 0000000076875a1d 7 bytes JMP 00000001002b04bc
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370 0000000076875c9b 7 bytes JMP 00000001002b0210
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231 0000000076875d87 7 bytes JMP 00000001002b03d8
.text C:\Users\Ken\Desktop\9jobdrjv.exe[3860] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123 0000000076877240 7 bytes JMP 0000000100280f50

---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk0\DR0 unknown MBR code

---- EOF - GMER 2.1 ----


----------



## maggie88ca (Nov 19, 2006)

Just an FYI after the last 2 logs I tried to reboot again and it froze on the message that computer is shutting down. It was like that for quite a while and I had to unplug it and plug it back in again to get it to restart. That has been happening a lot lately where it freezes up and I cant reboot it and the only way to restart it is by unplugging it and plugging it back in again.

Thanks again for all your help.


----------



## eddie5659 (Mar 19, 2001)

Hmmmm

Is this a laptop or a desktop computer?

Lets see if this will help. First, uninstall SUPERAntiSpyware (as this will start on startup all the time).

Then, run the following programs:

Download *TFC* to your desktop 

Open the file and close any other windows. 
It *will close all programs itself* when run, make sure to let it run uninterrupted. 
Click the Start button to begin the process. The program should not take long to finish its job 
Once its finished it should *reboot your machine*, if not, do this yourself to ensure a complete clean

----


Go to Start | Programs | Accessories | System Tools | Disk Cleanup
It should start straight away, but if you have to select a drive, click on the C-drive.
Let it run, and at the end it will give you some boxes to tick. 
All are okay to enable, then press *OK* and then *Yes* to the question after.
It will close after its completed.

----

Reboot, and post a fresj copy of OTL log as follows:

Download *OTL* to your Desktop 

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. 
When the window appears, underneath *Output* at the top change it to *Standard Output*.
Select 
*All Users*
*LOP Check*
*Purity Check*
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. 
When the scan completes, it will a notepad window. *OTL.Txt*. This is saved in the same location as OTL. 
Please copy *(Edit->Select All, Edit->Copy)* the contents of this file and post them in your topic 


*IF OTL SAYS 'NOT RESPONDING' DON'T USE THE MOUSE. IT WILL CARRY ON SCANNING AFTER A FEW MINUTES*

Only the one log will appear 

eddie


----------



## maggie88ca (Nov 19, 2006)

It's a desktop. Whew that part scared the crap out of me lol after running TFC and rebooting a message came up saying something like 'windows cannot start' 'do you want to end program or cancel' I choose end program and everything was gone and my desktop was empty. I rebooted again and same message came up but this time I hit cancel a few times and then everything finally loaded like normal.

Here is latest OTL log....

OTL logfile created on: 27/04/2013 11:38:14 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ken\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.91 Gb Total Physical Memory | 2.29 Gb Available Physical Memory | 58.46% Memory free
7.83 Gb Paging File | 6.06 Gb Available in Paging File | 77.39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 558.90 Gb Total Space | 436.23 Gb Free Space | 78.05% Space Free | Partition Type: NTFS
Drive D: | 824.17 Gb Total Space | 480.19 Gb Free Space | 58.26% Space Free | Partition Type: NTFS

Computer Name: KEN-PC | User Name: Ken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/04/15 15:42:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
PRC - [2013/03/27 14:00:20 | 003,363,752 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
PRC - [2013/03/27 14:00:20 | 003,089,856 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
PRC - [2012/12/23 23:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccsvchst.exe
PRC - [2012/12/18 15:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/13 17:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/02/01 17:20:46 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011/01/11 20:21:14 | 001,214,080 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
PRC - [2010/12/20 15:18:48 | 001,425,536 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
PRC - [2010/12/01 22:15:14 | 000,915,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
PRC - [2010/11/27 01:50:04 | 002,931,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
PRC - [2010/11/03 05:30:14 | 000,918,144 | ---- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010/10/21 05:52:26 | 000,586,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2010/09/25 01:29:32 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
PRC - [2009/12/30 14:21:02 | 000,065,536 | ---- | M] (Lexar Media, Inc.) -- C:\Windows\SysWOW64\LxrSII1s.exe
PRC - [2009/12/23 17:59:22 | 000,203,392 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Windows\SysWOW64\AsHookDevice.exe

========== Modules (No Company Name) ==========

MOD - [2012/05/30 02:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\wincfi39.dll
MOD - [2011/03/11 23:53:12 | 001,257,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll
MOD - [2011/02/17 15:10:20 | 001,035,776 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll
MOD - [2011/01/20 16:09:34 | 000,964,096 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
MOD - [2011/01/13 20:47:34 | 000,881,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
MOD - [2011/01/12 14:53:30 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
MOD - [2011/01/07 20:39:36 | 001,246,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
MOD - [2011/01/06 14:38:48 | 001,027,072 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll
MOD - [2010/09/28 00:51:16 | 001,607,168 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
MOD - [2010/08/22 22:17:40 | 000,662,016 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMLib.dll
MOD - [2010/08/06 22:13:48 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
MOD - [2010/08/06 22:11:20 | 000,850,944 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
MOD - [2010/06/21 19:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
MOD - [2010/06/21 19:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
MOD - [2009/08/13 00:15:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/27 14:00:20 | 003,089,856 | ---- | M] (Emsisoft GmbH) [Auto | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)
SRV - [2012/12/23 23:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe -- (N360)
SRV - [2012/12/18 15:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/12/14 02:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012/07/13 17:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/02/01 17:20:48 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/01 17:20:46 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/12/01 22:15:14 | 000,915,584 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010/11/03 05:30:14 | 000,918,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010/10/21 05:52:26 | 000,586,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/12/30 14:21:02 | 000,065,536 | ---- | M] (Lexar Media, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\LxrSII1s.exe -- (LxrSII1s)
SRV - [2009/12/23 17:59:22 | 000,203,392 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysWOW64\AsHookDevice.exe -- (Device Handle Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/02/25 10:12:04 | 002,426,672 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:*64bit:* - [2013/02/12 00:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:*64bit:* - [2013/01/30 23:18:18 | 000,432,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\symnets.sys -- (SymNetS)
DRV:*64bit:* - [2013/01/30 23:18:06 | 001,139,800 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\symefa64.sys -- (SymEFA)
DRV:*64bit:* - [2013/01/28 21:45:19 | 000,796,248 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\srtsp64.sys -- (SRTSP)
DRV:*64bit:* - [2013/01/28 21:45:19 | 000,036,952 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\srtspx64.sys -- (SRTSPX)
DRV:*64bit:* - [2013/01/21 22:15:33 | 000,493,656 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\symds64.sys -- (SymDS)
DRV:*64bit:* - [2012/12/30 15:27:15 | 000,177,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:*64bit:* - [2012/12/14 02:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2012/11/15 22:22:01 | 000,224,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\ironx64.sys -- (SymIRON)
DRV:*64bit:* - [2012/11/15 22:18:04 | 000,168,096 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\ccsetx64.sys -- (ccSet_N360)
DRV:*64bit:* - [2012/09/20 00:35:36 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:*64bit:* - [2012/09/20 00:35:36 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:*64bit:* - [2012/08/23 10:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:*64bit:* - [2012/08/23 10:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:*64bit:* - [2012/08/23 10:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2012/05/04 23:47:24 | 000,030,456 | ---- | M] (XOSLAB.COM) [File_System | System | Running] -- C:\Windows\SysNative\drivers\xlkfs.sys -- (xlkfs)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2012/02/15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/08/01 16:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:*64bit:* - [2011/08/01 16:59:06 | 000,023,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:*64bit:* - [2011/07/25 18:44:46 | 000,074,752 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:*64bit:* - [2011/07/20 15:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:*64bit:* - [2011/06/10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2011/05/18 09:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:*64bit:* - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2011/02/24 11:30:50 | 000,389,608 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:*64bit:* - [2011/02/24 11:30:50 | 000,126,952 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:*64bit:* - [2011/01/30 17:58:40 | 000,036,448 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asahci64.sys -- (asahci64)
DRV:*64bit:* - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/10/19 20:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:*64bit:* - [2010/08/31 09:07:05 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:*64bit:* - [2010/01/14 08:27:46 | 000,032,544 | ---- | M] (Realtek ) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\RtNdPt60.sys -- (RtNdPt60)
DRV:*64bit:* - [2010/01/14 08:27:30 | 000,048,416 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (TEAM)
DRV:*64bit:* - [2010/01/14 08:27:30 | 000,048,416 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (RTTEAMPT)
DRV:*64bit:* - [2010/01/14 08:27:18 | 000,029,472 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (RTVLANPT)
DRV:*64bit:* - [2009/12/30 11:32:04 | 000,063,064 | ---- | M] (Lexar Media, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\LxrSII1d.sys -- (LxrSII1d)
DRV:*64bit:* - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:*64bit:* - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2013/04/12 19:53:05 | 001,390,680 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130412.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2013/03/27 14:00:23 | 000,026,176 | ---- | M] (Emsisoft GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys -- (A2DDA)
DRV - [2013/03/27 14:00:23 | 000,017,384 | ---- | M] (Emsisoft GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys -- (a2util)
DRV - [2013/01/16 02:33:08 | 002,087,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130427.007\ex64.sys -- (NAVEX15)
DRV - [2013/01/16 02:33:08 | 000,126,192 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130427.007\eng64.sys -- (NAVENG)
DRV - [2012/12/30 15:33:43 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012/12/30 15:33:43 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/12/28 17:39:26 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130426.001\IDSviA64.sys -- (IDSVia64)
DRV - [2012/06/18 11:37:53 | 000,066,320 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys -- (a2acc)
DRV - [2012/06/18 11:37:51 | 000,044,688 | ---- | M] (Emsisoft GmbH) [File_System | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys -- (a2injectiondriver)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008/01/04 17:34:48 | 000,011,832 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\AsInsHelp64.sys -- (ASInsHelp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP08&src=IE-SearchBox

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:*64bit:* - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:*64bit:* - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:*64bit:* - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn\ [2012/12/30 15:27:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn\ [2013/04/27 23:37:56 | 000,000,000 | ---D | M]

[2013/04/21 22:31:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions

O1 HOSTS File: ([2013/04/25 01:11:29 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:*64bit:* - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:*64bit:* - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\coieplg.dll (Symantec Corporation)
O4:*64bit:* - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:*64bit:* - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files (x86)\emsisoft anti-malware\a2guard.exe (Emsisoft GmbH)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2938170701-155988706-608106729-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2938170701-155988706-608106729-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab (Java Plug-in 1.7.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{62D71BE2-9D6B-4ED6-B6F2-EEADD29E9560}: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C2054CE-5C51-4ABE-BAAB-9440D076B6ED}: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O18:*64bit:* - Protocol\Handler\livecall - No CLSID value found
O18:*64bit:* - Protocol\Handler\msnim - No CLSID value found
O18:*64bit:* - Protocol\Handler\wlmailhtml - No CLSID value found
O18:*64bit:* - Protocol\Handler\wlpg - No CLSID value found
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/27 23:18:20 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Ken\Desktop\TFC.exe
[2013/04/27 11:49:09 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{C93EC3FD-06BE-4A18-B43B-10E4DFDA3B03}
[2013/04/26 14:13:16 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{4A985D33-EC11-417B-BBA3-1F1AFE44E8B1}
[2013/04/25 21:40:36 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Ken\Desktop\tdsskiller.exe
[2013/04/25 21:21:37 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{0E4E2837-54F6-406C-BF5A-A007B349518E}
[2013/04/25 01:11:47 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/04/24 11:21:29 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{5A1FE8C8-B91D-492B-8942-FAA87FC8E166}
[2013/04/23 21:38:21 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{14D6385B-57D9-4D41-ACEA-95C742ADD7EE}
[2013/04/23 08:10:26 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{16D56805-B907-4355-A944-0EB1D0177ABC}
[2013/04/22 17:43:19 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{4E1DA8A9-869C-4D4D-9296-495C82202751}
[2013/04/21 09:15:28 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{A5173279-994D-49C9-9526-406701B08B09}
[2013/04/20 14:09:21 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{D663A466-5BA9-4D45-82DC-140FE1DDDCAB}
[2013/04/20 10:08:37 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{B7B483F3-2859-436E-A3E3-5D1C0F11C1A7}
[2013/04/19 19:22:46 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{C03A5891-CEB2-4001-B857-96463E41DEB6}
[2013/04/19 08:22:15 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{37020AC6-BD54-460C-A1A9-46B6249FC362}
[2013/04/19 08:05:06 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{BE1743C5-1745-422F-913E-686F96CD8FCF}
[2013/04/18 14:47:05 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{E7A41D4E-6CBC-4951-A024-697A84ECAC56}
[2013/04/18 03:49:40 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{236820D0-B5FF-4F8C-A402-044BEC81D9F3}
[2013/04/17 17:13:44 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/04/17 15:48:07 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{8AF25769-36F9-4719-9011-A3124ED63809}
[2013/04/17 03:51:55 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{0AD75D35-4CED-431B-80B4-B8EEF9F0F1AE}
[2013/04/16 15:51:29 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{26BEDB8B-30B3-43AF-B24C-5892AD9D381B}
[2013/04/16 03:49:20 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{444B75A1-9C1A-4C26-A4EE-D76273A4F51B}
[2013/04/15 21:40:04 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\Kids Work
[2013/04/15 15:42:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
[2013/04/15 15:39:13 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\RK_Quarantine
[2013/04/15 15:36:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013/04/15 14:51:01 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{EAF83D9E-D714-4081-AEB4-F0CE1A7D67A7}
[2013/04/14 18:38:29 | 000,000,000 | ---D | C] -- C:\username123
[2013/04/14 18:34:08 | 005,059,017 | R--- | C] (Swearware) -- C:\Users\Ken\Desktop\username123.exe
[2013/04/14 18:30:06 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/04/14 18:30:05 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/04/14 18:30:05 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/04/14 18:28:07 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/04/14 18:27:22 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/04/14 17:23:14 | 000,000,000 | R--D | C] -- C:\Users\Ken\SkyDrive
[2013/04/14 17:23:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SkyDrive
[2013/04/14 17:22:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2013/04/14 09:01:50 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{BC9194F0-511C-455E-81FB-A08157093F1C}
[2013/04/13 22:06:59 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{FF39293F-0748-42B6-944B-8D1293342A1A}
[2013/04/13 08:24:36 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{A516502F-480D-4DB6-B15D-1B339610DF21}
[2013/04/12 16:47:28 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{8EBDABE1-FAF3-452A-814F-5F1DAA53BA06}
[2013/04/12 03:17:39 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Local\{2C58C7C9-D5BB-422D-9886-D8E1B182F9AF}
[2013/04/11 18:25:42 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/04/11 18:25:13 | 000,000,000 | ---D | C] -- C:\JRT
[2013/04/11 18:24:29 | 000,551,587 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Ken\Desktop\JRT.exe
[2013/04/11 16:37:32 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Roaming\SUPERAntiSpyware.com
[2013/04/11 16:33:36 | 000,000,000 | ---D | C] -- C:\Users\Ken\AppData\Roaming\Malwarebytes
[2013/04/11 16:33:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/11 16:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/04/11 16:33:12 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/04/11 16:33:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/04/08 21:05:45 | 000,000,000 | ---D | C] -- C:\ProgramData\ClubSanDisk
[2013/04/07 17:34:47 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Ken\Desktop\HijackThis.exe
[2013/04/07 12:48:33 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\Video
[2013/04/07 12:47:17 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\Music
[2013/04/07 12:47:02 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\LOST.DIR
[2013/04/07 12:46:55 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\DCIM

========== Files - Modified Within 30 Days ==========

[2013/04/27 23:35:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/04/27 23:35:18 | 3152,257,024 | -HS- | M] () -- C:\hiberfil.sys
[2013/04/27 23:34:27 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/04/27 23:34:27 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/04/27 23:18:20 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\TFC.exe
[2013/04/25 21:54:32 | 000,377,856 | ---- | M] () -- C:\Users\Ken\Desktop\9jobdrjv.exe
[2013/04/25 21:40:42 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Ken\Desktop\tdsskiller.exe
[2013/04/25 01:11:29 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/04/25 00:49:52 | 005,059,017 | R--- | M] (Swearware) -- C:\Users\Ken\Desktop\username123.exe
[2013/04/25 00:18:15 | 000,742,690 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/04/25 00:18:15 | 000,640,270 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/04/25 00:18:15 | 000,114,536 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/04/24 03:17:28 | 001,889,153 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1403010.016\Cat.DB
[2013/04/21 09:24:37 | 000,681,984 | ---- | M] () -- C:\Users\Ken\Desktop\CKScanner.exe
[2013/04/17 18:14:17 | 000,165,376 | ---- | M] () -- C:\Users\Ken\Desktop\SystemLook_x64.exe
[2013/04/16 16:49:14 | 000,014,818 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1403010.016\VT20130115.021
[2013/04/15 15:42:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
[2013/04/15 15:38:30 | 000,816,128 | ---- | M] () -- C:\Users\Ken\Desktop\RogueKiller.exe
[2013/04/14 18:23:34 | 000,000,512 | ---- | M] () -- C:\Users\Ken\Desktop\MBR.dat
[2013/04/14 17:53:07 | 000,002,800 | ---- | M] () -- C:\{39340EFA-9C19-4108-ADCA-C1ACD12E8607}
[2013/04/11 18:26:45 | 000,613,083 | ---- | M] () -- C:\Users\Ken\Desktop\adwcleaner.exe
[2013/04/11 18:25:12 | 000,551,587 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Ken\Desktop\JRT.exe
[2013/04/11 16:33:15 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/11 16:29:08 | 000,890,815 | ---- | M] () -- C:\Users\Ken\Desktop\SecurityCheck.exe
[2013/04/11 03:17:09 | 000,277,608 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/09 17:01:15 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/04/09 15:27:19 | 000,000,990 | ---- | M] () -- C:\Windows\xlkfs.dat
[2013/04/09 15:27:19 | 000,000,078 | ---- | M] () -- C:\Windows\xlkfs.ini
[2013/04/07 17:44:21 | 000,377,856 | ---- | M] () -- C:\Users\Ken\Desktop\ppdbdq4w.exe
[2013/04/07 17:36:37 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Ken\Desktop\HijackThis.exe
[2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/04/03 04:21:26 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\N360x64\1403010.016\isolate.ini
[2013/04/02 03:02:08 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/04/02 03:02:08 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf

========== Files Created - No Company Name ==========

[2013/04/25 21:54:32 | 000,377,856 | ---- | C] () -- C:\Users\Ken\Desktop\9jobdrjv.exe
[2013/04/21 09:24:18 | 000,681,984 | ---- | C] () -- C:\Users\Ken\Desktop\CKScanner.exe
[2013/04/17 18:13:52 | 000,165,376 | ---- | C] () -- C:\Users\Ken\Desktop\SystemLook_x64.exe
[2013/04/15 15:38:30 | 000,816,128 | ---- | C] () -- C:\Users\Ken\Desktop\RogueKiller.exe
[2013/04/14 18:30:06 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/04/14 18:30:06 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/04/14 18:30:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/04/14 18:30:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/04/14 18:30:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/04/14 18:23:34 | 000,000,512 | ---- | C] () -- C:\Users\Ken\Desktop\MBR.dat
[2013/04/14 17:53:07 | 000,002,800 | ---- | C] () -- C:\{39340EFA-9C19-4108-ADCA-C1ACD12E8607}
[2013/04/14 17:23:07 | 000,002,152 | ---- | C] () -- C:\Users\Ken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
[2013/04/11 18:26:41 | 000,613,083 | ---- | C] () -- C:\Users\Ken\Desktop\adwcleaner.exe
[2013/04/11 16:33:15 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/11 16:29:05 | 000,890,815 | ---- | C] () -- C:\Users\Ken\Desktop\SecurityCheck.exe
[2013/04/07 17:44:17 | 000,377,856 | ---- | C] () -- C:\Users\Ken\Desktop\ppdbdq4w.exe
[2013/04/02 03:02:08 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/04/02 03:02:08 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013/02/21 15:02:40 | 000,000,215 | ---- | C] () -- C:\Users\Ken\AppData\Local\Lockdir6
[2013/02/21 15:02:40 | 000,000,051 | ---- | C] () -- C:\Users\Ken\AppData\Local\Lockdir6.lg
[2012/12/14 02:42:30 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2012/12/14 02:42:30 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012/12/14 02:42:28 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2012/10/29 13:09:28 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012/10/29 13:09:28 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012/10/29 13:09:28 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012/10/29 13:09:28 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012/10/29 13:09:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012/02/05 12:22:38 | 000,750,190 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/23 10:44:56 | 000,013,931 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2011/12/11 07:04:25 | 009,191,424 | ---- | C] () -- C:\Users\Ken\s-1-5-21-2305161544-3229008522-4247653988-1001.rrr
[2011/08/31 20:51:16 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011/08/31 20:51:16 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011/05/06 18:25:41 | 000,014,464 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys
[2011/05/06 18:25:06 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011/05/06 18:25:00 | 000,221,184 | ---- | C] () -- C:\Windows\SysWow64\drivers\ServiceHelp.dll
[2011/05/06 18:25:00 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011/05/06 18:25:00 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2011/05/06 18:14:07 | 000,012,795 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2011/05/06 18:14:01 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2011/05/06 18:14:01 | 000,007,058 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2011/05/06 18:14:01 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011/05/06 18:02:40 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011/01/16 02:01:22 | 405,012,479 | ---- | C] () -- C:\Users\Ken\THRSB_BY_CH69.iso

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 01:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/04/14 08:03:15 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\.minecraft
[2012/02/24 10:17:32 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\AnvSoft
[2012/12/01 09:03:51 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\Samsung
[2013/04/25 01:08:19 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\SoftGrid Client
[2012/02/05 12:23:21 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\TP
[2013/04/25 00:45:04 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\uTorrent
[2012/01/24 16:34:50 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

< End of report >


----------



## eddie5659 (Mar 19, 2001)

Just seeing if there is something I've missed that could be causing the problems, will reply soon.

In the meantime, can you run this:


Go to here
Click the *download* button under *Kaspersky Security Scan*
Download and run the file
It will start to download the Kaspersky Security Scan program data
Once downloaded the installer will begin
Click *Next*
*Accept* the License Agreement
Click *Install*
The program will now install
Click *Finish*
Kaspersky Security Scan will now start










Click the *Full Scan* button










The scan will take about an *hour or two* depending on the amount of data on your hard drive
If the scan detects problems it will open a *Problems found* window
Click *Details* to generate a scan results report










Once the scan is complete do the following:
For *XP*: Navigate to *C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\KSS2\DataRoot*
For *Vista/7*: Navigate to *C:\ProgramData\Kaspersky Lab\KSS2\DataRoot*
Right-click on the *HtmlReport* folder --> Click *Send to* --> Click *Compressed (zipped) folder*
Attach the *HtmlReport zipped folder* to your next post
























You can now close *Kaspersky Security Scan*


----------



## maggie88ca (Nov 19, 2006)

It did find problems and here is the attached folder. So I still have Kaspersky security scan program open should I click fix now?


----------



## maggie88ca (Nov 19, 2006)

It froze up again so I had to unplug it again then I ran Kaspersky security scan and it found the same problems. I still have it open just waiting on the next step.


----------



## eddie5659 (Mar 19, 2001)

Okay, looking at the report now. Do you know what this is:

C:\Documents and Settings\Ken\Downloads\SaveAs.exe

I'm looking at the other found things, but just want to check up on the above before we continue. Also, as it seems to be still having problems, can you do this as well, and we'll see if anything is showing up:

Then, lets have a look at the Event logs.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.


Please download the Event Viewer Tool by Vino Rosso:

http://images.malwareremoval.com/vino/VEW.exe

and save it to your Desktop.

 Right-click *VEW.exe* and Run AS Administrator

 Under *Select log to query*, select:

*System*

 Under *Select type to list*, select:

** Error
* Warning*

Then use the *Number of events* as follows:

 Click the radio button for *Number of events*

Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application.


----------



## maggie88ca (Nov 19, 2006)

C:\Documents and Settings\Ken\Downloads\SaveAs.exe


I saw that in the report also and have no idea what it is. I'm pretty sure I didn't save it there or save it as that.


Here are the VEW logs....



Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 01/05/2013 11:27:35 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 02/05/2013 3:24:05 AM
Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device WpdBusEnumRoot\UMB\2&37c186b&2&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MULTI-CARD&REV_1.00#20071114173400000&0#.

Log: 'System' Date/Time: 02/05/2013 3:21:54 AM
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped. 




Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 01/05/2013 11:28:56 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 02/05/2013 3:24:31 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 02/05/2013 3:23:47 AM
Type: Warning Category: 6
Event: 3057 Source: Application Virtualization Client
{tid=7CC}
The Application Virtualization Client Core initialized correctly. Installed Product: Version: 4.6.1.10263 Install Path: C:\Program Files (x86)\Microsoft Application Virtualization Client Global Data Directory: C:\ProgramData\Microsoft\Application Virtualization Client\ Machine Name: KEN-PC Operating System: Windows 7 64-bit Service Pack 1.0 Build 7601 OSD Command: 

Log: 'Application' Date/Time: 02/05/2013 3:23:32 AM
Type: Warning Category: 3
Event: 3191 Source: Application Virtualization Client
{tid=7CC}
-------------------------------------------------------- Initialized client log (C:\ProgramData\Microsoft\Application Virtualization Client\sftlog.txt)

Log: 'Application' Date/Time: 02/05/2013 3:21:43 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2938170701-155988706-608106729-1000_Classes:
Process 6084 (\Device\HarddiskVolume2\Windows\System32\rundll32.exe) has opened key \REGISTRY\USER\S-1-5-21-2938170701-155988706-608106729-1000_CLASSES


Log: 'Application' Date/Time: 02/05/2013 3:21:42 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 2 user registry handles leaked from \Registry\User\S-1-5-21-2938170701-155988706-608106729-1000:
Process 1764 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe) has opened key \REGISTRY\USER\S-1-5-21-2938170701-155988706-608106729-1000
Process 6084 (\Device\HarddiskVolume2\Windows\System32\rundll32.exe) has opened key \REGISTRY\USER\S-1-5-21-2938170701-155988706-608106729-1000


----------



## maggie88ca (Nov 19, 2006)

C:\Documents and Settings\Ken\Downloads\SaveAs.exe

I went to properties of the above file and under details it says original filename:TSULoader.exe I then googled that and some sites say its malware and others says its not so I'm not sure.

Thanks again.


----------



## maggie88ca (Nov 19, 2006)

I used an online file scan website to check out that suspicious and file and a few of the scanners came back as virus or malware. I'm not sure if you can see the results here...

http://virusscan.jotti.org/en/scanresult/68e095fcd894b727dbfb1126ca1c552c2097ff98


----------



## eddie5659 (Mar 19, 2001)

Sorry for the lateness, its bank holiday weekend, and had Friday off work to get away for a few days 

Thanks for the info on that file, I'll post about that in a min.

Firstly, I looked through the Kaspersky log, and I didn't want you to press Fix straight away, as there were some AutoRun entries that would become disabled, which may cause some annoyance in later times (like popping a cd in, and having to select the audio program everytime).

But, one thing did stand out:

*Service termination timeout is out of admissible values*

This can cause slowness at shutdown, which is what you're getting. So, there is a way to fix that manually.

However, as this involves editing the Registry, we'll make a backup first:

*Backing Up Your Registry*
Download *ERUNT* 
_(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)_
Install *ERUNT* by following the prompts
_(use the default install settings but say no to the portion that asks you to add *ERUNT* to the start-up folder, if you like you can enable this option later)_
Start *ERUNT*
_(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)_
Choose a location for the backup
_(the default location is C:\WINDOWS\ERDNT which is acceptable)._
Make sure that at least the first two check boxes are ticked
Press *OK*
Press *YES* to create the folder.










--

Now, copy/paste the following line into a new Notepad file. Then click File | Save As, and in the *File Name*, call it *fix.reg*. Ensure the *Save as Type* is showing as *All Files*. Save it to your Desktop.


```
REGEDIT4
[HKEY_CURRENT_USER\Control Panel\Desktop]
"WaitToKillServiceTimeout"="1000"
```
Locate the *fix.reg* file on your Desktop, doubleclick and when the option appears saying *Are you sure you want to Add the information in fix.reg to the Registry?*, select *Yes*.

Reboot and see if that helps.

-------

For that file, can you get me a copy so I can check it out further?

Download suspicious file packer from http://www.safer-networking.org/files/sfp.zip

Unzip it to desktop, open it & paste in the contents of the quote box below, press next & it will create an archive (zip/cab file) on desktop.

Please upload that to http://www.thespykiller.co.uk/index.php?board=1.0 so we can examine the files.

Just Register, press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, When the file is listed in the windows press send to upload the file:



> *
> C:\Documents and Settings\Ken\Downloads\SaveAs.exe
> *


Let me know when its uploaded 

eddie


----------



## maggie88ca (Nov 19, 2006)

No apology needed I just grateful you are able to help. That file is loaded to thespykiller. I did the fix reg stuff and I'll let you know if still freezes up.

Thanks again for all your help.


----------



## eddie5659 (Mar 19, 2001)

Oki doki 

Looks like the file uploaded okay, now to fire up the old laptop and check it out


----------



## eddie5659 (Mar 19, 2001)

Okay, had a look at the file, and it does appear to be bad. However, before we remove it, I want to see if it ran at all, by looking at the locations where files/Registry entries will appear.

So, if you can do this with SystemLook and post the log, we'll go from there. If you don't have it still, get a fresh one as follows:

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:

```
:dir
C:\Documents and Settings\Administrator\Local Settings\Temp
:reg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found at on your Desktop entitled *SystemLook.txt*


----------



## maggie88ca (Nov 19, 2006)

Here is latest systemlook log.....

SystemLook 30.07.11 by jpshortstuff
Log created at 14:42 on 06/05/2013 by Ken
Administrator - Elevation successful

========== dir ==========

C:\Documents and Settings\Administrator\Local Settings\Temp - Unable to find folder.

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Controls Folder]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Controls Folder (Wow64)]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Device Metadata]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\DIFxApp]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Drivers]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\GrpConv]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\HomeGroup]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ime]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\MCT]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Media Center]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Photo Acquisition]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RADAR]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\runonce]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Screensavers]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Sidebar]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Telephony]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThumbnailCache]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Webcheck]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust]

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Looks like it may not have run, but you may have missed a part off the second part of the scan. Can you re-run but with this part:

*
:reg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
*

Think you just went up to the CurrentVersion only before


----------



## maggie88ca (Nov 19, 2006)

I thought when I copied and pasted it I may have missed part of it. Here is the second part and I'll try do it again just for good measure.

SystemLook 30.07.11 by jpshortstuff
Log created at 14:22 on 07/05/2013 by Ken
Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"IE5_UA_Backup_Flag"="5.0"
"User Agent"="Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
"PrivDiscUiShown"= 0x0000000001 (1)
"EnableHttp1_1"= 0x0000000001 (1)
"WarnOnIntranet"= 0x0000000001 (1)
"MimeExclusionListForCache"="multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "
"AutoConfigProxy"="wininet.dll"
"UseSchannelDirectly"=01 00 00 00 (REG_BINARY)
"WarnOnPost"=01 00 00 00 (REG_BINARY)
"UrlEncoding"= 0x0000000000 (0)
"SecureProtocols"= 0x00000000a0 (160)
"PrivacyAdvanced"= 0x0000000000 (0)
"DisableCachingOfSSLPages"= 0x0000000000 (0)
"WarnonZoneCrossing"= 0x0000000000 (0)
"CertificateRevocation"= 0x0000000001 (1)
"EnableNegotiate"= 0x0000000001 (1)
"MigrateProxy"= 0x0000000001 (1)
"ProxyEnable"= 0x0000000000 (0)
"WarnOnHTTPSToHTTPRedirect"= 0x0000000001 (1)
"WarnOnPostRedirect"= 0x0000000000 (0)
"EmailName"="[email protected]"
"EnableAutodial"= 0x0000000000 (0)
"GlobalUserOffline"= 0x0000000000 (0)
"NoNetAutodial"= 0x0000000000 (0)
"WarnonBadCertRecving"= 0x0000000001 (1)
"ZonesSecurityUpgrade"=5f 02 93 2f 79 2f ce 01 (REG_BINARY)
"ZonesSecurityUpgradeDone"= 0x0000000001 (1)
"ProxyHttp1.1"= 0x0000000001 (1)
"ShowPunycode"= 0x0000000000 (0)
"EnablePunycode"= 0x0000000001 (1)
"DisableIDNPrompt"= 0x0000000000 (0)
"ProxyOverride"="*.local"
"BackgroundConnections"= 0x0000000001 (1)
"CreateUriCacheSize"= 0x0000000050 (80)
"CoInternetCombineIUriCacheSize"= 0x0000000050 (80)
"SecurityIdIUriCacheSize"= 0x000000001e (30)
"SpecialFoldersCacheSize"= 0x0000000008 (8)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Activities]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]

-= EOF =-


----------



## maggie88ca (Nov 19, 2006)

SystemLook 30.07.11 by jpshortstuff
Log created at 14:25 on 07/05/2013 by Ken
Administrator - Elevation successful

========== dir ==========

C:\Documents and Settings\Administrator\Local Settings\Temp - Unable to find folder.

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"IE5_UA_Backup_Flag"="5.0"
"User Agent"="Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
"PrivDiscUiShown"= 0x0000000001 (1)
"EnableHttp1_1"= 0x0000000001 (1)
"WarnOnIntranet"= 0x0000000001 (1)
"MimeExclusionListForCache"="multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "
"AutoConfigProxy"="wininet.dll"
"UseSchannelDirectly"=01 00 00 00 (REG_BINARY)
"WarnOnPost"=01 00 00 00 (REG_BINARY)
"UrlEncoding"= 0x0000000000 (0)
"SecureProtocols"= 0x00000000a0 (160)
"PrivacyAdvanced"= 0x0000000000 (0)
"DisableCachingOfSSLPages"= 0x0000000000 (0)
"WarnonZoneCrossing"= 0x0000000000 (0)
"CertificateRevocation"= 0x0000000001 (1)
"EnableNegotiate"= 0x0000000001 (1)
"MigrateProxy"= 0x0000000001 (1)
"ProxyEnable"= 0x0000000000 (0)
"WarnOnHTTPSToHTTPRedirect"= 0x0000000001 (1)
"WarnOnPostRedirect"= 0x0000000000 (0)
"EmailName"="[email protected]"
"EnableAutodial"= 0x0000000000 (0)
"GlobalUserOffline"= 0x0000000000 (0)
"NoNetAutodial"= 0x0000000000 (0)
"WarnonBadCertRecving"= 0x0000000001 (1)
"ZonesSecurityUpgrade"=5f 02 93 2f 79 2f ce 01 (REG_BINARY)
"ZonesSecurityUpgradeDone"= 0x0000000001 (1)
"ProxyHttp1.1"= 0x0000000001 (1)
"ShowPunycode"= 0x0000000000 (0)
"EnablePunycode"= 0x0000000001 (1)
"DisableIDNPrompt"= 0x0000000000 (0)
"ProxyOverride"="*.local"
"BackgroundConnections"= 0x0000000001 (1)
"CreateUriCacheSize"= 0x0000000050 (80)
"CoInternetCombineIUriCacheSize"= 0x0000000050 (80)
"SecurityIdIUriCacheSize"= 0x000000001e (30)
"SpecialFoldersCacheSize"= 0x0000000008 (8)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Activities]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Thanks, and looks good to me 

I would just manually delete that file, but leave it in your Recycle bin for a few days, see how it goes. Is your computer shutting down faster now?


----------



## maggie88ca (Nov 19, 2006)

It does shut down faster now thanks but it still freezes up sometimes.

Can I click fix on the Kaspersky scan results?


----------



## eddie5659 (Mar 19, 2001)

Hiya

Sorry, didn't get my email coming through 

I've just run this on my system, and clicking the Fix Now button just takes you the website to purchase the full version. Not needed in my eyes.

Did you manually delete the file in the:

C:\Documents and Settings\Ken\Downloads\SaveAs.exe

Also, the fix you ran was one of the things that the log found, so we manually did that.

When it freezes, is that on startup or shutdown? If shutdown, does it say which program is freezing?

eddie


----------



## maggie88ca (Nov 19, 2006)

Yes I did delete this file...

C:\Documents and Settings\Ken\Downloads\SaveAs.exe

It freezes up while I'm surfing the web after I click a few links it will say waiting for website to load then it freezes and I can't click on anything or do anything and I have to unplug power and plug it back in and reboot.


----------



## eddie5659 (Mar 19, 2001)

Okay, lets see if there is something there that the older versions of the tools didn't see.

Can you delete the versions of JRT, AdwCleaner and OTL and get new ones as below and post the logs 

----








Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Please download *AdwCleaner* by Xplode onto your desktop.

Double click on *AdwCleaner.exe* to run the tool.
Click on *Search*.
A logfile will automatically open after the scan has finished.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[R1].txt* as well.

Download *OTL* to your Desktop 

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. 
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. 
When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL. 
Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time and post them in your topic 


-------

If only the one OTL log appears, that's okay 

eddie


----------



## maggie88ca (Nov 19, 2006)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Ken on 19/05/2013 at 18:45:46.82
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0672AE06-6031-45A7-A974-8EA6722D6540}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0AD75D35-4CED-431B-80B4-B8EEF9F0F1AE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0C33FA27-9D1D-40E8-A1D5-37D739321A74}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{0E4E2837-54F6-406C-BF5A-A007B349518E}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{11A391BD-C238-4C79-B442-9F593CB046F9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{14D6385B-57D9-4D41-ACEA-95C742ADD7EE}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{15351FFF-8C74-4591-B729-065741C78EA2}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{16D56805-B907-4355-A944-0EB1D0177ABC}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{236820D0-B5FF-4F8C-A402-044BEC81D9F3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{26BEDB8B-30B3-43AF-B24C-5892AD9D381B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{287FD9F4-7AA1-48F4-A178-6BE64A93AA8C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2C58C7C9-D5BB-422D-9886-D8E1B182F9AF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{2CDD03F4-AE97-49DC-8321-9CE50C92629F}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{37020AC6-BD54-460C-A1A9-46B6249FC362}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{37F7CB6C-0403-4355-9302-461B342C19B6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{3A24B386-03AE-4F33-AA22-B7467CED676B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{431FC860-E2DE-4B74-9C50-88C52E3EC26A}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{444B75A1-9C1A-4C26-A4EE-D76273A4F51B}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4717FB98-2299-4DD4-9378-70B9F3CC3EA9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4A985D33-EC11-417B-BBA3-1F1AFE44E8B1}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4C1798D8-2EA4-49F8-A43F-A89329CBC1E8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{4E1DA8A9-869C-4D4D-9296-495C82202751}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{5A1FE8C8-B91D-492B-8942-FAA87FC8E166}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{774551A4-F374-4AEC-AE3E-69FECEB42BBB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8A82C8D7-7AB0-4447-9C8D-0DD921E7AAD9}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8AF25769-36F9-4719-9011-A3124ED63809}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8C2587D9-B40C-4398-B82E-714C65774FD5}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{8EBDABE1-FAF3-452A-814F-5F1DAA53BA06}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{95C6EF5C-DDE8-4EB9-A88C-4FA25E7EDF79}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{97F26187-DE75-4E30-9C0E-556AF08A42EB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{9FCE0FAC-04CC-4426-8E71-AC81803033F4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A516502F-480D-4DB6-B15D-1B339610DF21}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A5173279-994D-49C9-9526-406701B08B09}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A8082D42-B750-47FA-9838-CCBC4E6656A8}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{A9A724B5-136B-467D-A67A-857EDB804B71}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B7B483F3-2859-436E-A3E3-5D1C0F11C1A7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{B8768569-524B-423F-9B6B-F95B8D77E9D4}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BB6AB9FB-A856-4AB4-9D91-7E28053F1711}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BC9194F0-511C-455E-81FB-A08157093F1C}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{BE1743C5-1745-422F-913E-686F96CD8FCF}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C03A5891-CEB2-4001-B857-96463E41DEB6}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C11896D0-C453-4620-B3C9-CC5CC9F9B6C3}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C75570CF-B1E0-4978-A9E8-7977E808AB58}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{C93EC3FD-06BE-4A18-B43B-10E4DFDA3B03}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{CDC5848D-3CDB-4248-8247-6C738B5F4769}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{D663A466-5BA9-4D45-82DC-140FE1DDDCAB}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E38291D1-232F-4AED-B35D-114523AB9407}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{E7A41D4E-6CBC-4951-A024-697A84ECAC56}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{EAF83D9E-D714-4081-AEB4-F0CE1A7D67A7}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FC878ED0-6ABB-406D-BFBA-366F0F61E1ED}
Successfully deleted: [Empty Folder] C:\Users\Ken\appdata\local\{FF39293F-0748-42B6-944B-8D1293342A1A}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19/05/2013 at 18:53:58.80
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


----------



## maggie88ca (Nov 19, 2006)

# AdwCleaner v2.301 - Logfile created 05/19/2013 at 18:55:51
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ken - KEN-PC
# Boot Mode : Normal
# Running from : C:\Users\Ken\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Found : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Found : HKLM\SOFTWARE\Classes\AppID\secman.DLL

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1084 octets] - [11/04/2013 18:35:01]
AdwCleaner[R2].txt - [821 octets] - [19/05/2013 18:55:51]
AdwCleaner[S1].txt - [1155 octets] - [14/04/2013 17:07:36]

########## EOF - C:\AdwCleaner[R2].txt - [940 octets] ##########


----------



## maggie88ca (Nov 19, 2006)

OTL logfile created on: 19/05/2013 6:57:51 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ken\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.91 Gb Total Physical Memory | 1.81 Gb Available Physical Memory | 46.32% Memory free
7.83 Gb Paging File | 4.68 Gb Available in Paging File | 59.85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 558.90 Gb Total Space | 431.90 Gb Free Space | 77.28% Space Free | Partition Type: NTFS
Drive D: | 824.17 Gb Total Space | 470.16 Gb Free Space | 57.05% Space Free | Partition Type: NTFS

Computer Name: KEN-PC | User Name: Ken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/19 18:44:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
PRC - [2013/05/19 14:25:13 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
PRC - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/03/27 14:00:20 | 003,363,752 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
PRC - [2013/03/27 14:00:20 | 003,089,856 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
PRC - [2012/12/23 23:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccsvchst.exe
PRC - [2012/07/13 17:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/02/01 17:20:48 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011/02/01 17:20:46 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011/01/11 20:21:14 | 001,214,080 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
PRC - [2010/12/20 15:18:48 | 001,425,536 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
PRC - [2010/12/01 22:15:14 | 000,915,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
PRC - [2010/11/27 01:50:04 | 002,931,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
PRC - [2010/11/03 05:30:14 | 000,918,144 | ---- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010/10/21 05:52:26 | 000,586,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2010/09/25 01:29:32 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
PRC - [2010/06/07 14:12:46 | 000,354,944 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsAPHider\AsAPHider.exe
PRC - [2009/12/30 14:21:02 | 000,065,536 | ---- | M] (Lexar Media, Inc.) -- C:\Windows\SysWOW64\LxrSII1s.exe
PRC - [2009/12/23 17:59:22 | 000,203,392 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Windows\SysWOW64\AsHookDevice.exe

========== Modules (No Company Name) ==========

MOD - [2012/08/17 21:40:16 | 000,068,024 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtWebKit\qmlwebkitplugin4.dll
MOD - [2012/08/17 21:38:56 | 000,479,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
MOD - [2012/05/30 02:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\wincfi39.dll
MOD - [2011/03/11 23:53:12 | 001,257,472 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll
MOD - [2011/02/17 15:10:20 | 001,035,776 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll
MOD - [2011/01/20 16:09:34 | 000,964,096 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
MOD - [2011/01/13 20:47:34 | 000,881,152 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
MOD - [2011/01/12 14:53:30 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
MOD - [2011/01/07 20:39:36 | 001,246,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
MOD - [2011/01/06 14:38:48 | 001,027,072 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll
MOD - [2010/09/28 00:51:16 | 001,607,168 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
MOD - [2010/08/22 22:17:40 | 000,662,016 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMLib.dll
MOD - [2010/08/06 22:13:48 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
MOD - [2010/08/06 22:11:20 | 000,850,944 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
MOD - [2010/06/21 19:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
MOD - [2010/06/21 19:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
MOD - [2009/08/13 00:15:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll

========== Services (SafeList) ==========

SRV:*64bit:* - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/05/19 14:25:13 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/03/27 14:00:20 | 003,089,856 | ---- | M] (Emsisoft GmbH) [Auto | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)
SRV - [2012/12/23 23:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe -- (N360)
SRV - [2012/12/14 02:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012/07/13 17:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2011/10/01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/02/01 17:20:48 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/01 17:20:46 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/12/01 22:15:14 | 000,915,584 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010/11/03 05:30:14 | 000,918,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010/10/21 05:52:26 | 000,586,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/12/30 14:21:02 | 000,065,536 | ---- | M] (Lexar Media, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\LxrSII1s.exe -- (LxrSII1s)
SRV - [2009/12/23 17:59:22 | 000,203,392 | ---- | M] (ASUSTeK Computer Inc.) [Auto | Running] -- C:\Windows\SysWOW64\AsHookDevice.exe -- (Device Handle Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:*64bit:* - [2013/05/19 14:30:28 | 000,620,128 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
DRV:*64bit:* - [2013/05/19 14:30:28 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps)
DRV:*64bit:* - [2013/05/19 14:30:28 | 000,055,056 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi)
DRV:*64bit:* - [2013/02/25 10:12:04 | 002,426,672 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:*64bit:* - [2013/02/12 00:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:*64bit:* - [2013/01/30 23:18:18 | 000,432,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\symnets.sys -- (SymNetS)
DRV:*64bit:* - [2013/01/30 23:18:06 | 001,139,800 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\symefa64.sys -- (SymEFA)
DRV:*64bit:* - [2013/01/28 21:45:19 | 000,796,248 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\srtsp64.sys -- (SRTSP)
DRV:*64bit:* - [2013/01/28 21:45:19 | 000,036,952 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\srtspx64.sys -- (SRTSPX)
DRV:*64bit:* - [2013/01/21 22:15:33 | 000,493,656 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\symds64.sys -- (SymDS)
DRV:*64bit:* - [2012/12/30 15:27:15 | 000,177,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:*64bit:* - [2012/12/14 02:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:*64bit:* - [2012/11/15 22:22:01 | 000,224,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\ironx64.sys -- (SymIRON)
DRV:*64bit:* - [2012/11/15 22:18:04 | 000,168,096 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\N360x64\1403010.016\ccsetx64.sys -- (ccSet_N360)
DRV:*64bit:* - [2012/10/25 17:40:22 | 000,029,528 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
DRV:*64bit:* - [2012/10/25 17:40:22 | 000,029,016 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt)
DRV:*64bit:* - [2012/09/20 00:35:36 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:*64bit:* - [2012/09/20 00:35:36 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:*64bit:* - [2012/08/23 10:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:*64bit:* - [2012/08/23 10:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:*64bit:* - [2012/08/23 10:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:*64bit:* - [2012/08/02 15:09:34 | 000,028,504 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
DRV:*64bit:* - [2012/06/19 17:28:12 | 000,458,584 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1)
DRV:*64bit:* - [2012/05/04 23:47:24 | 000,030,456 | ---- | M] (XOSLAB.COM) [File_System | System | Running] -- C:\Windows\SysNative\drivers\xlkfs.sys -- (xlkfs)
DRV:*64bit:* - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:*64bit:* - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:*64bit:* - [2012/02/15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:*64bit:* - [2011/10/01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:*64bit:* - [2011/10/01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:*64bit:* - [2011/10/01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:*64bit:* - [2011/08/01 16:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:*64bit:* - [2011/08/01 16:59:06 | 000,023,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:*64bit:* - [2011/07/25 18:44:46 | 000,074,752 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:*64bit:* - [2011/07/20 15:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:*64bit:* - [2011/06/10 07:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:*64bit:* - [2011/05/18 09:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:*64bit:* - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:*64bit:* - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:*64bit:* - [2011/02/24 11:30:50 | 000,389,608 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci)
DRV:*64bit:* - [2011/02/24 11:30:50 | 000,126,952 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3)
DRV:*64bit:* - [2011/01/30 17:58:40 | 000,036,448 | ---- | M] (Asmedia Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\asahci64.sys -- (asahci64)
DRV:*64bit:* - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:*64bit:* - [2010/10/19 20:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:*64bit:* - [2010/08/31 09:07:05 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:*64bit:* - [2010/01/14 08:27:46 | 000,032,544 | ---- | M] (Realtek ) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\RtNdPt60.sys -- (RtNdPt60)
DRV:*64bit:* - [2010/01/14 08:27:30 | 000,048,416 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (TEAM)
DRV:*64bit:* - [2010/01/14 08:27:30 | 000,048,416 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (RTTEAMPT)
DRV:*64bit:* - [2010/01/14 08:27:18 | 000,029,472 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (RTVLANPT)
DRV:*64bit:* - [2009/12/30 11:32:04 | 000,063,064 | ---- | M] (Lexar Media, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\LxrSII1d.sys -- (LxrSII1d)
DRV:*64bit:* - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:*64bit:* - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:*64bit:* - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:*64bit:* - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:*64bit:* - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:*64bit:* - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:*64bit:* - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:*64bit:* - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:*64bit:* - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2013/04/12 19:53:05 | 001,390,680 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130502.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2013/03/27 14:00:23 | 000,026,176 | ---- | M] (Emsisoft GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys -- (A2DDA)
DRV - [2013/03/27 14:00:23 | 000,017,384 | ---- | M] (Emsisoft GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys -- (a2util)
DRV - [2013/01/16 02:33:08 | 002,087,664 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130519.005\ex64.sys -- (NAVEX15)
DRV - [2013/01/16 02:33:08 | 000,126,192 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130519.005\eng64.sys -- (NAVENG)
DRV - [2012/12/30 15:33:43 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012/12/30 15:33:43 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/12/28 17:39:26 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130517.001\IDSviA64.sys -- (IDSVia64)
DRV - [2012/06/18 11:37:53 | 000,066,320 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys -- (a2acc)
DRV - [2012/06/18 11:37:51 | 000,044,688 | ---- | M] (Emsisoft GmbH) [File_System | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys -- (a2injectiondriver)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008/01/04 17:34:48 | 000,011,832 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\AsInsHelp64.sys -- (ASInsHelp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:*64bit:* - HKLM\..\SearchScopes,DefaultScope = 
IE:*64bit:* - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP08&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:*64bit:* - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:*64bit:* - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:*64bit:* - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn\ [2012/12/30 15:27:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn\ [2013/05/15 14:40:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[email protected] [2013/05/19 14:30:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[email protected] [2013/05/19 14:30:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[email protected] [2013/05/19 14:30:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[email protected] [2013/05/19 14:30:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[email protected] [2013/05/19 14:30:40 | 000,000,000 | ---D | M]

[2013/04/21 22:31:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\extensions

O1 HOSTS File: ([2013/04/25 01:11:29 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:*64bit:* - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2:*64bit:* - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2:*64bit:* - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:*64bit:* - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2:*64bit:* - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:*64bit:* - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\coieplg.dll (Symantec Corporation)
O4:*64bit:* - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:*64bit:* - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files (x86)\emsisoft anti-malware\a2guard.exe (Emsisoft GmbH)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:*64bit:* - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O9:*64bit:* - Extra Button: Virtual Keyboard - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9:*64bit:* - Extra Button: URLs check - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Virtual Keyboard - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: URLs check - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10:*64bit:* - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab (Java Plug-in 1.7.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{62D71BE2-9D6B-4ED6-B6F2-EEADD29E9560}: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C2054CE-5C51-4ABE-BAAB-9440D076B6ED}: DhcpNameServer = 64.71.255.204 64.71.255.198 192.168.1.1
O18:*64bit:* - Protocol\Handler\livecall - No CLSID value found
O18:*64bit:* - Protocol\Handler\msnim - No CLSID value found
O18:*64bit:* - Protocol\Handler\wlmailhtml - No CLSID value found
O18:*64bit:* - Protocol\Handler\wlpg - No CLSID value found
O20:*64bit:* - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:*64bit:* - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:*64bit:* - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:*64bit:* - HKLM\..comfile [open] -- "%1" %*
O35:*64bit:* - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:*64bit:* - HKLM\...com [@ = ComFile] -- "%1" %*
O37:*64bit:* - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/19 18:44:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
[2013/05/19 18:44:15 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Ken\Desktop\JRT.exe
[2013/05/19 14:21:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013
[2013/05/19 14:20:08 | 000,064,856 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\klfphc.dll
[2013/05/19 14:18:50 | 000,000,000 | ---D | C] -- C:\Windows\ELAMBKUP
[2013/05/19 14:18:25 | 000,090,208 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013/05/19 14:18:24 | 000,620,128 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013/05/06 17:42:15 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2013/05/05 16:18:16 | 000,518,656 | ---- | C] (Safer Networking Limited) -- C:\Users\Ken\Desktop\sfp.exe
[2013/04/30 07:13:05 | 000,000,000 | ---D | C] -- C:\Users\Ken\Desktop\Taxes
[2013/04/29 23:53:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2013/04/29 23:53:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
[2013/04/27 23:18:20 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Ken\Desktop\TFC.exe
[2013/04/25 21:40:36 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Ken\Desktop\tdsskiller.exe
[2013/04/25 01:11:47 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

========== Files - Modified Within 30 Days ==========

[2013/05/19 18:52:52 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/19 18:52:52 | 000,016,976 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/19 18:44:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\OTL.exe
[2013/05/19 18:44:37 | 000,632,031 | ---- | M] () -- C:\Users\Ken\Desktop\adwcleaner.exe
[2013/05/19 18:44:15 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Ken\Desktop\JRT.exe
[2013/05/19 14:30:28 | 000,620,128 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013/05/19 14:30:28 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kneps.sys
[2013/05/19 14:30:28 | 000,055,056 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kltdi.sys
[2013/05/19 14:30:27 | 000,090,208 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013/05/19 14:23:38 | 000,002,344 | ---- | M] () -- C:\Users\Ken\Desktop\Safe Money.lnk
[2013/05/19 14:20:09 | 000,001,150 | ---- | M] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013/05/18 22:18:58 | 000,742,690 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/05/18 22:18:58 | 000,640,270 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/05/18 22:18:58 | 000,114,536 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/05/15 14:36:48 | 000,277,608 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/05/15 14:36:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/15 14:36:14 | 3152,257,024 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/09 06:42:32 | 000,002,238 | ---- | M] () -- C:\Users\Ken\Desktop\My Movie.wlmp
[2013/05/09 06:35:45 | 023,058,987 | ---- | M] () -- C:\Users\Ken\Desktop\My Movie.wmv
[2013/05/08 19:55:39 | 020,988,493 | ---- | M] () -- C:\Users\Ken\Desktop\004.mp4
[2013/05/07 14:22:21 | 000,165,376 | ---- | M] () -- C:\Users\Ken\Desktop\SystemLook_x64.exe
[2013/05/05 16:19:30 | 000,295,815 | ---- | M] () -- C:\Users\Ken\Desktop\requested-files[2013-05-05_16_19].cab
[2013/05/05 16:16:33 | 000,000,086 | ---- | M] () -- C:\Users\Ken\Desktop\fix.reg
[2013/05/01 23:25:50 | 000,061,440 | ---- | M] ( ) -- C:\Users\Ken\Desktop\VEW.exe
[2013/04/29 11:39:54 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/04/27 23:18:20 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Ken\Desktop\TFC.exe
[2013/04/25 21:54:32 | 000,377,856 | ---- | M] () -- C:\Users\Ken\Desktop\9jobdrjv.exe
[2013/04/25 21:40:42 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Ken\Desktop\tdsskiller.exe
[2013/04/25 01:11:29 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/04/25 00:49:52 | 005,059,017 | R--- | M] (Swearware) -- C:\Users\Ken\Desktop\username123.exe
[2013/04/21 09:24:37 | 000,681,984 | ---- | M] () -- C:\Users\Ken\Desktop\CKScanner.exe

========== Files Created - No Company Name ==========

[2013/05/19 18:44:37 | 000,632,031 | ---- | C] () -- C:\Users\Ken\Desktop\adwcleaner.exe
[2013/05/19 14:23:37 | 000,002,344 | ---- | C] () -- C:\Users\Ken\Desktop\Safe Money.lnk
[2013/05/19 14:21:12 | 000,001,150 | ---- | C] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013/05/09 06:42:32 | 000,002,238 | ---- | C] () -- C:\Users\Ken\Desktop\My Movie.wlmp
[2013/05/09 06:35:06 | 023,058,987 | ---- | C] () -- C:\Users\Ken\Desktop\My Movie.wmv
[2013/05/09 06:31:14 | 020,988,493 | ---- | C] () -- C:\Users\Ken\Desktop\004.mp4
[2013/05/07 14:22:18 | 000,165,376 | ---- | C] () -- C:\Users\Ken\Desktop\SystemLook_x64.exe
[2013/05/05 16:19:30 | 000,295,815 | ---- | C] () -- C:\Users\Ken\Desktop\requested-files[2013-05-05_16_19].cab
[2013/05/05 16:16:33 | 000,000,086 | ---- | C] () -- C:\Users\Ken\Desktop\fix.reg
[2013/05/01 23:25:50 | 000,061,440 | ---- | C] ( ) -- C:\Users\Ken\Desktop\VEW.exe
[2013/04/25 21:54:32 | 000,377,856 | ---- | C] () -- C:\Users\Ken\Desktop\9jobdrjv.exe
[2013/04/21 09:24:18 | 000,681,984 | ---- | C] () -- C:\Users\Ken\Desktop\CKScanner.exe
[2013/04/14 18:30:06 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/04/14 18:30:06 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/04/14 18:30:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/04/14 18:30:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/04/14 18:30:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/02/21 15:02:40 | 000,000,215 | ---- | C] () -- C:\Users\Ken\AppData\Local\Lockdir6
[2013/02/21 15:02:40 | 000,000,051 | ---- | C] () -- C:\Users\Ken\AppData\Local\Lockdir6.lg
[2012/12/14 02:42:30 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2012/12/14 02:42:30 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012/12/14 02:42:28 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2012/10/29 13:09:28 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012/10/29 13:09:28 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012/10/29 13:09:28 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012/10/29 13:09:28 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012/10/29 13:09:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012/02/05 12:22:38 | 000,750,190 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/23 10:44:56 | 000,013,931 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2011/12/11 07:04:25 | 009,191,424 | ---- | C] () -- C:\Users\Ken\s-1-5-21-2305161544-3229008522-4247653988-1001.rrr
[2011/08/31 20:51:16 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011/08/31 20:51:16 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011/01/16 02:01:22 | 405,012,479 | ---- | C] () -- C:\Users\Ken\THRSB_BY_CH69.iso

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 01:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 00:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/04/14 08:03:15 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\.minecraft
[2012/02/24 10:17:32 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\AnvSoft
[2013/05/06 17:42:18 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\Samsung
[2013/04/25 01:08:19 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\SoftGrid Client
[2012/02/05 12:23:21 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\TP
[2013/05/15 16:13:08 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\uTorrent
[2012/01/24 16:34:50 | 000,000,000 | ---D | M] -- C:\Users\Ken\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

< End of report >


----------



## maggie88ca (Nov 19, 2006)

There was no extra.txt file. As you can see I downloaded Kaspersky Internet Security 2013 trial version.


----------



## maggie88ca (Nov 19, 2006)

Also when I have to restart I always get the message that there are programs running in the background do I want to force restart and I never know which programs they are because I've already closed everything.

Thanks again for your help.


----------



## eddie5659 (Mar 19, 2001)

Excellent, looks like AdwCleaner has spotted a few files linked to a trojan. However, lets see if its the full files there or just the remains.

So, using SystemLook, can you run the following code, and post the log it creates:


```
:file
%System%\OLL32.exe
%System%\osmax.ocx
%System%\osmax64.ocx
%System%\secman.dll
%System%\secman64.dll
:filefind
*OLL32.exe
*osmax.ocx
*osmax64.ocx
*secman.dll
*secman64.dll
:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\osmax.ocx
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5C731C2A-6ADF-487E-99A2-7291BF794A14}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7131C082-F3C6-404D-B8CC-8AF9CFB6209D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D20C383}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AddInExpress.OutlookSecurityManager
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AddInExpress.OutlookSecurityManager.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\secman.OutlookSecurityManager
```
eddie


----------



## maggie88ca (Nov 19, 2006)

SystemLook 30.07.11 by jpshortstuff
Log created at 17:01 on 20/05/2013 by Ken
Administrator - Elevation successful

========== file ==========

%System%\OLL32.exe - Unable to find/read file.

%System%\osmax.ocx - Unable to find/read file.

%System%\osmax64.ocx - Unable to find/read file.

%System%\secman.dll - Unable to find/read file.

%System%\secman64.dll - Unable to find/read file.

========== filefind ==========

Searching for "*OLL32.exe"
No files found.

Searching for "*osmax.ocx"
No files found.

Searching for "*osmax64.ocx"
No files found.

Searching for "*secman.dll"
C:\Program Files (x86)\Samsung\Kies\External\SyncModules\secman.dll	--a---- 144664 bytes	[17:10 29/10/2012]	[17:10 29/10/2012] 7753FC56F9CAC4B5AFDA3196DB654F21

Searching for "*secman64.dll"
No files found.

========== reg ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\osmax.ocx]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5C731C2A-6ADF-487E-99A2-7291BF794A14}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7131C082-F3C6-404D-B8CC-8AF9CFB6209D}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D20C383}]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AddInExpress.OutlookSecurityManager]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AddInExpress.OutlookSecurityManager.1]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\secman.OutlookSecurityManager]
(Unable to open key - key not found)

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Thanks 

Looks like it may be the remains, so lets remove them with adwcleaner 


Close all open programs and internet browsers.
Double click on *adwcleaner.exe* to run the tool.
Click on *Delete*.
Confirm each time with *Ok*.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at *C:\AdwCleaner[S1].txt* as well.


----------



## maggie88ca (Nov 19, 2006)

# AdwCleaner v2.301 - Logfile created 05/21/2013 at 17:00:53
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ken - KEN-PC
# Boot Mode : Normal
# Running from : C:\Users\Ken\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1084 octets] - [11/04/2013 18:35:01]
AdwCleaner[R2].txt - [1008 octets] - [19/05/2013 18:55:51]
AdwCleaner[S1].txt - [1155 octets] - [14/04/2013 17:07:36]
AdwCleaner[S2].txt - [947 octets] - [21/05/2013 17:00:53]

########## EOF - C:\AdwCleaner[S2].txt - [1006 octets] ##########


----------



## eddie5659 (Mar 19, 2001)

Just re-read this thread, to see if I overlooked anything. At the very beginning, in the DDS log was this. Now, LogMeIn is a legit program, but I can't see it installed:



> x64-RunOnce: [47_1636291575153] "C:\Users\Ken\AppData\Local\LOGMEI~1\LMIR0002.tmp_r.bat"
> x64-RunOnce: [47_17266331575153] "C:\Users\Ken\AppData\Local\LOGMEI~1\LMIR0001.tmp_r.bat"


Have you ever used LogMeIn? If not, first lets see if you still have the files, and also if you have anything else there. Using SystemLook, run the following code and post the log:


```
:filefind
*LMIR0002*
*LMIR0001*
:folderfind
*logmein*
:regfind
grusskartencenter
```


----------



## maggie88ca (Nov 19, 2006)

I have never used logmein and not even sure what it's for.

SystemLook 30.07.11 by jpshortstuff
Log created at 19:25 on 26/05/2013 by Ken
Administrator - Elevation successful

========== filefind ==========

Searching for "*LMIR0002*"
No files found.

Searching for "*LMIR0001*"
No files found.

========== folderfind ==========

Searching for "*logmein*"
C:\Users\Ken\AppData\Local\LogMeIn Rescue Applet	d------	[14:50 25/04/2012]

========== regfind ==========

Searching for "grusskartencenter"
No data found.

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Hmm, okay, lets see whats in that folder. It may have been installed with another program. Its a remote log in tool, that people can use to work on a pc from another pc (say I can work on my mums from a different town if she needs help).

Can you run this with Systemlook:


```
:dir
C:\Users\Ken\AppData\Local\LogMeIn Rescue Applet /s
```


----------



## maggie88ca (Nov 19, 2006)

Oh now that you mention it I think my ISP used it to remotely look at my computer when I first had the email problem.


SystemLook 30.07.11 by jpshortstuff
Log created at 14:43 on 27/05/2013 by Ken
Administrator - Elevation successful

========== dir ==========

C:\Users\Ken\AppData\Local\LogMeIn Rescue Applet - Parameters: "/s"

---Files---
None found.

No folders found.

-= EOF =-


----------



## eddie5659 (Mar 19, 2001)

Sorry for the lateness again 

That would account for it, as its not installed anymore, they must have removed it after the remote working.

Is it still slow just online or is it slow when not actually in websites?

I'm away for a week from tomorrow (holiday in Norfolk) but I'll see if anyone can look in on this whilst I'm away 

eddie


----------



## maggie88ca (Nov 19, 2006)

Its only slow while online and only freezes when going from site to site


----------



## eddie5659 (Mar 19, 2001)

Hi

Back from my holidays at last, but come back to a lousy cold, so a bit groggy today. May have to take tomorrow off (its man-flu, worse than anything on earth  ).

Do you use Internet Explorer or Firefox as the browser, or something else like Chrome?

Also, have you tried turning the modem off for about 5 mins and turning it back on? This can refresh things sometimes, but I tend to do it when the pc is turned off, wait for the modem to get fully back on again with the lights etc, then start up the pc. But, if you've already tried that, just ignore this bit 

eddie


----------



## maggie88ca (Nov 19, 2006)

It funny you mentioned it, I installed chrome 2 days ago and it seems to have solved the problem so far. It's been 2 days and no freezing up. I used to use internet explorer and it must of been corrupt somehow. I will let you know if it freezes up again. Fingers crossed lol


----------



## eddie5659 (Mar 19, 2001)

Ah, good old Chrome. A few of my mates use it for gaming, so much faster 

Let me know how it goes


----------



## maggie88ca (Nov 19, 2006)

It hasn't crashed since I started using Chrome so I guess the problem was with IE. Thanks again for all your help with this.


----------



## eddie5659 (Mar 19, 2001)

That's great to hear, so I'll post my closing speech 

*You can mark this thread Solved at the top of this page, if its all running okay *

*Any questions about the following, just ask  *

We have a couple of last steps to perform and then you're all set.

Firstly, lets uninstall the tools we've used:

*Follow these steps to uninstall Combofix and tools used in the removal of malware*

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

*ComboFix /Uninstall *

Then, run this:


Download *OTC* to your desktop and run it 
Click Yes to beginning the Cleanup process and remove these components, including this application. 
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes. 

======================
Uninstall *SUPERAntiSpyware and Kaspersky Security Scan* from AddRemove Programs.

Also, remove the following from the Desktop, if still there after doing the above:

*
SecurityCheck
JRT
AdwCleaner
aswMBR
RogueKiller
SystemLook
CKScanner
TDSSKiller
VEW
*

==============================

*Clear Cache/Temp Files*
Download *TFC by OldTimer* to your desktop

 Please double-click *TFC.exe* to run it. (*Note:* If you are running on Vista, right-click on the file and choose *Run As Administrator*).
It *will close all programs* when run, so make sure you have *saved all your work* before you begin.
Click the *Start* button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. *Let it run uninterrupted to completion*. 
Once it's finished it should *reboot your machine*. If it does not, please *manually reboot the machine* yourself to ensure a complete clean.

*Create Restore Point (Win7/Vista)*


Select *Start* > *Control Panel* then double-click on the *System* icon in the Control Panel.
In the left-hand pane click on the *System Protection* option.
When the Dialog comes up, click on the System Protection tab.
Check that the drive letter where Windows is located (usually C indicates System protection *ON*.
(This indicates System restore is turned ON for the Windows drive).
Click on the *Create* button to create a new restore point. In the Name dialog, type a descriptive name and then click on the *Create* button.
You will get a message that the Restore Point was created successfully. Click on the *Close* button.
Click on the *OK* button and close the System window in the Control Panel.

*Other Software Updates*
It is very important to update the other software on your computer to patch up any security issues you may have. Go HERE to scan your computer for any out of date software. In particular make sure you download the updates for *Java* and *Adobe* as these are subject to many security vulnerabilities.

Also, its a good idea to keep on top of removing any Temp files etc every month or so. To do this, Windows has a pretty good tool.

Go to Start | Programs | Accessories | System Tools | Disk Cleanup
It should start straight away, but if you have to select a drive, click on the C-drive.
Let it run, and at the end it will give you some boxes to tick. 
All are okay to enable, then press *OK* and then *Yes* to the question after.
It will close after its completed.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free program:
*SpywareBlaster* to help prevent spyware from installing in the first place.

To keep your operating system up to date visit 
*Microsoft Windows Update*
monthly. And to keep your system clean run this free malware scanner

*Malwarebytes' Anti-Malware*

weekly, and be aware of what emails you open and websites you visit.

To learn more about how to protect yourself while on the internet read this about Security online: *General Security Information, How to tighten Security Settings and Warnings *

Have a safe and happy computing day!

eddie


----------

