StartupList report, 12/5/2011, 6:16:34 PM StartupList version: 1.52.2 Started from : C:\Program Files (x86)\Trend Micro\HiJackThis\analyze.EXE Detected: Windows 7 SP1 (WinNT 6.00.3505) Detected: Internet Explorer v9.00 (9.00.8112.16421) * Using default options * Including empty and uninteresting sections * Showing rarely important sections ================================================== Running processes: C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe C:\Program Files (x86)\Verizon\VSP\ServicepointService.exe C:\Program Files (x86)\NCNETWORKSDM\bin\sprtsvc.exe C:\Program Files (x86)\NCNETWORKSDM\bin\tgsrvc.exe C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe C:\Program Files (x86)\Verizon\VSP\VerizonServicepoint.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\Program Files (x86)\NCNETWORKSDM\bin\sprtcmd.exe C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\PROGRA~2\KASPER~1\KASPER~1\KASPER~2\MODULE~1\stpass.exe C:\Program Files (x86)\Verizon\VSP\VerizonServicepointComHandler.exe C:\Program Files (x86)\Trend Micro\HiJackThis\analyze.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\Users\Administrator.Kyle-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup] Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe Shell folders AltStartup: *Folder not found* User shell folders Startup: *Folder not found* User shell folders AltStartup: *Folder not found* Shell folders Common Startup: [C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup] *No files* Shell folders Common AltStartup: *Folder not found* User shell folders Common Startup: *Folder not found* User shell folders Alternate Common Startup: *Folder not found* -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = userinit.exe [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon] *Registry key not found* [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] *Registry value not found* [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon] *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run avp = "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe" VerizonServicepoint.exe = "C:\Program Files (x86)\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN TkBellExe = "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot NCNETWORKSDM = "C:\Program Files (x86)\NCNETWORKSDM\bin\sprtcmd.exe" /P NCNETWORKSDM LWS = C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide GrooveMonitor = "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" Adobe ARM = "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Google Update = "C:\Users\Kyle\AppData\Local\Google\Update\GoogleUpdate.exe" /c cdloader = "C:\Users\Administrator.Kyle-PC\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK Advanced SystemCare 5 = "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart DriverMax = "C:\Program Files\DriverMax\devices.exe" -agent DriverMax_RESTART = "C:\Program Files\DriverMax\devices.exe" -RESTART PowerPanel Personal Edition User Interaction = "C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe" -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\Run *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* -------------------------------------------------- File association entry for .EXE: HKEY_CLASSES_ROOT\exefile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .COM: HKEY_CLASSES_ROOT\comfile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .BAT: HKEY_CLASSES_ROOT\batfile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .PIF: HKEY_CLASSES_ROOT\piffile\shell\open\command (Default) = "%1" %* -------------------------------------------------- File association entry for .SCR: HKEY_CLASSES_ROOT\scrfile\shell\open\command (Default) = "%1" /S -------------------------------------------------- File association entry for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (Default) = C:\Windows\SysWOW64\mshta.exe "%1" %* -------------------------------------------------- File association entry for .TXT: HKEY_CLASSES_ROOT\txtfile\shell\open\command (Default) = %SystemRoot%\system32\NOTEPAD.EXE %1 -------------------------------------------------- Enumerating Active Setup stub paths: HKLM\Software\Microsoft\Active Setup\Installed Components (* = disabled by HKCU twin) [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] StubPath = %SystemRoot%\system32\unregmp2.exe /ShowWMP [>{26923b43-4d38-484f-9b9e-de460746276c}] * StubPath = C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] * StubPath = "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] * StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] * StubPath = "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] * StubPath = %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI [{89820200-ECBD-11cf-8B85-00AA005B4340}] * StubPath = regsvr32.exe /s /n /i:U shell32.dll [{89820200-ECBD-11cf-8B85-00AA005B4383}] * StubPath = C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] * StubPath = C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install -------------------------------------------------- Enumerating ICQ Agent Autostart apps: HKCU\Software\Mirabilis\ICQ\Agent\Apps *Registry key not found* -------------------------------------------------- Load/Run keys from C:\Windows\WIN.INI: load=*INI section not found* run=*INI section not found* Load/Run keys from Registry: HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found* HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found* HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found* HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found* HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found* HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found* HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found* HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found* HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll -------------------------------------------------- Shell & screensaver key from C:\Windows\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=explorer.exe SCRNSAVE.EXE=*Registry value not found* drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Checking for EXPLORER.EXE instances: C:\Windows\Explorer.exe: PRESENT! C:\Explorer.exe: not present C:\Windows\Explorer\Explorer.exe: not present C:\Windows\System\Explorer.exe: not present C:\Windows\System32\Explorer.exe: not present C:\Windows\Command\Explorer.exe: not present C:\Windows\Fonts\Explorer.exe: not present -------------------------------------------------- Checking for superhidden extensions: .lnk: HIDDEN! (arrow overlay: yes) .pif: HIDDEN! (arrow overlay: yes) .exe: not hidden .com: not hidden .bat: not hidden .hta: not hidden .scr: not hidden .shs: *Registry key not found* .shb: *Registry key not found* .vbs: not hidden .vbe: not hidden .wsh: not hidden .scf: HIDDEN! (arrow overlay: NO!) .url: HIDDEN! (arrow overlay: yes) .js: not hidden .jse: not hidden -------------------------------------------------- Verifying REGEDIT.EXE integrity: - Regedit.exe found in C:\Windows - .reg open command is normal (regedit.exe %1) - Company name OK: 'Microsoft Corporation' - Original filename NOT OK: 'REGEDIT.EXE.MUI' - File description: 'Registry Editor' Registry check failed! -------------------------------------------------- Enumerating Browser Helper Objects: AcroIEHelperStub - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} (no name) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA} IEVkbdBHO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ievkbd.dll - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} (no name) - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} (no name) - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6} URLRedirectionBHO - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL - {B4F3A835-0E21-4959-BA22-42B3008E02FF} (no name) - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9} link filter bho - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll - {E33CF602-D945-461A-83F0-819F76A199F8} -------------------------------------------------- Enumerating Task Scheduler jobs: EasyShare Registration RunOnce Task.job EasyShare Registration Task.job GoogleUpdateTaskUserS-1-5-21-1925622841-252461325-3542563712-1004UA.job GoogleUpdateTaskUserS-1-5-21-1925622841-252461325-3542563712-1006Core.job GoogleUpdateTaskUserS-1-5-21-1925622841-252461325-3542563712-1006UA.job -------------------------------------------------- Enumerating Download Program Files: [Java Plug-in 1.6.0_29] InProcServer32 = C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab [Java Plug-in 1.6.0_29] InProcServer32 = C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab [Java Plug-in 1.6.0_29] InProcServer32 = C:\Program Files (x86)\Java\jre6\bin\npjpi160_29.dll CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab [Shockwave Flash Object] InProcServer32 = C:\Windows\SysWOW64\Macromed\Flash\Flash11e.ocx CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab -------------------------------------------------- Enumerating Winsock LSP files: NameSpace #1: C:\Windows\system32\NLAapi.dll NameSpace #2: C:\Windows\system32\napinsp.dll NameSpace #3: C:\Windows\system32\pnrpnsp.dll NameSpace #4: C:\Windows\system32\pnrpnsp.dll NameSpace #5: C:\Windows\System32\mswsock.dll NameSpace #6: C:\Windows\System32\winrnr.dll NameSpace #7: C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL NameSpace #8: C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Protocol #1: C:\Windows\system32\mswsock.dll Protocol #2: C:\Windows\system32\mswsock.dll Protocol #3: C:\Windows\system32\mswsock.dll Protocol #4: C:\Windows\system32\mswsock.dll Protocol #5: C:\Windows\system32\mswsock.dll Protocol #6: C:\Windows\system32\mswsock.dll Protocol #7: C:\Windows\system32\mswsock.dll Protocol #8: C:\Windows\system32\mswsock.dll Protocol #9: C:\Windows\system32\mswsock.dll Protocol #10: C:\Windows\system32\mswsock.dll -------------------------------------------------- Enumerating Windows NT/2000/XP services 1394 OHCI Compliant Host Controller: \SystemRoot\system32\drivers\1394ohci.sys (manual start) a2acc: \??\C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys (manual start) Emsisoft Anti-Malware 6.0 - Service: "C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe" (autostart) A2 Direct Disk Access Support Driver: \??\C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys (system) Microsoft ACPI Driver: system32\drivers\ACPI.sys (system) ACPI Power Meter Driver: \SystemRoot\system32\drivers\acpipmi.sys (manual start) Adobe Acrobat Update Service: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" (autostart) adp94xx: \SystemRoot\system32\DRIVERS\adp94xx.sys (manual start) adpahci: \SystemRoot\system32\DRIVERS\adpahci.sys (manual start) adpu320: \SystemRoot\system32\DRIVERS\adpu320.sys (manual start) Advanced SystemCare Service 5: C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (autostart) @%SystemRoot%\system32\aelupsvc.dll,-1: %systemroot%\system32\svchost.exe -k netsvcs (manual start) @%systemroot%\system32\drivers\afd.sys,-1000: \SystemRoot\system32\drivers\afd.sys (system) Intel AGP Bus Filter: \SystemRoot\system32\drivers\agp440.sys (manual start) @%SystemRoot%\system32\Alg.exe,-112: %SystemRoot%\System32\alg.exe (manual start) aliide: \SystemRoot\system32\drivers\aliide.sys (manual start) amdide: \SystemRoot\system32\drivers\amdide.sys (manual start) AMD K8 Processor Driver: \SystemRoot\system32\DRIVERS\amdk8.sys (manual start) AMD Processor Driver: \SystemRoot\system32\DRIVERS\amdppm.sys (manual start) amdsata: \SystemRoot\system32\drivers\amdsata.sys (manual start) amdsbs: \SystemRoot\system32\DRIVERS\amdsbs.sys (manual start) amdxata: system32\drivers\amdxata.sys (system) @%systemroot%\system32\appidsvc.dll,-102: \SystemRoot\system32\drivers\appid.sys (manual start) @%systemroot%\system32\appidsvc.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) @%systemroot%\system32\appinfo.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) @appmgmts.dll,-3250: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) arc: \SystemRoot\system32\DRIVERS\arc.sys (manual start) arcsas: \SystemRoot\system32\DRIVERS\arcsas.sys (manual start) @%systemroot%\system32\rascfg.dll,-32000: system32\DRIVERS\asyncmac.sys (manual start) IDE Channel: system32\drivers\atapi.sys (system) atikmdag: \SystemRoot\system32\drivers\atikmdag.sys (manual start) @%SystemRoot%\system32\audiosrv.dll,-204: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart) @%SystemRoot%\system32\audiosrv.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart) Kaspersky PURE: "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe" -r (autostart) @%SystemRoot%\system32\AxInstSV.dll,-103: %SystemRoot%\system32\svchost.exe -k AxInstSVGroup (manual start) Broadcom NetXtreme II VBD: \SystemRoot\system32\DRIVERS\bxvbda.sys (manual start) Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0: system32\DRIVERS\b57nd60a.sys (manual start) @%SystemRoot%\system32\bdesvc.dll,-100: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) @%SystemRoot%\system32\bfe.dll,-1001: %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork (autostart) @%SystemRoot%\system32\qmgr.dll,-1000: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) blbdrive: system32\DRIVERS\blbdrive.sys (system) @%systemroot%\system32\browser.dll,-102: system32\DRIVERS\bowser.sys (manual start) Brother USB Mass-Storage Lower Filter Driver: \SystemRoot\system32\DRIVERS\BrFiltLo.sys (manual start) Brother USB Mass-Storage Upper Filter Driver: \SystemRoot\system32\DRIVERS\BrFiltUp.sys (manual start) @%systemroot%\system32\browser.dll,-100: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Brother MFC Serial Port Interface Driver (WDM): \SystemRoot\System32\Drivers\Brserid.sys (manual start) Brother WDM Serial driver: \SystemRoot\System32\Drivers\BrSerWdm.sys (manual start) Brother MFC USB Fax Only Modem: \SystemRoot\System32\Drivers\BrUsbMdm.sys (manual start) Brother MFC USB Serial WDM Driver: \SystemRoot\System32\Drivers\BrUsbSer.sys (manual start) Bluetooth Serial Communications Driver: \SystemRoot\system32\DRIVERS\bthmodem.sys (manual start) @%SystemRoot%\System32\bthserv.dll,-101: %SystemRoot%\system32\svchost.exe -k bthsvcs (manual start) CD/DVD File System Reader: system32\DRIVERS\cdfs.sys (disabled) CD-ROM Driver: \SystemRoot\system32\drivers\cdrom.sys (system) @%SystemRoot%\System32\certprop.dll,-11: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) Consumer IR Devices: \SystemRoot\system32\DRIVERS\circlass.sys (manual start) @%SystemRoot%\system32\clfs.sys,-100: System32\CLFS.sys (system) Microsoft .NET Framework NGEN v2.0.50727_X86: %systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (disabled) Microsoft .NET Framework NGEN v2.0.50727_X64: %systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (disabled) Microsoft .NET Framework NGEN v4.0.30319_X86: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (autostart) Microsoft .NET Framework NGEN v4.0.30319_X64: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (autostart) Microsoft ACPI Control Method Battery Driver: \SystemRoot\system32\DRIVERS\CmBatt.sys (manual start) cmdide: \SystemRoot\system32\drivers\cmdide.sys (manual start) : System32\Drivers\cng.sys (system) Microsoft Composite Battery Driver: system32\DRIVERS\compbatt.sys (system) Composite Bus Enumerator Driver: \SystemRoot\system32\drivers\CompositeBus.sys (manual start) @comres.dll,-947: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start) Crcdisk Filter Driver: \SystemRoot\system32\DRIVERS\crcdisk.sys (disabled) @%SystemRoot%\system32\cryptsvc.dll,-1001: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart) @%systemroot%\system32\cscsvc.dll,-202: system32\drivers\csc.sys (system) InfoWatch Encrypt Sector Library driver: system32\DRIVERS\CSCrySec.sys (system) @%systemroot%\system32\cscsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart) CryptoStorage control service: "C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe" (autostart) InfoWatch Virtual Disk driver: system32\DRIVERS\CSVirtualDiskDrv.sys (system) @oleres.dll,-5012: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart) @%SystemRoot%\system32\defragsvc.dll,-101: %SystemRoot%\system32\svchost.exe -k defragsvc (manual start) @%systemroot%\system32\drivers\dfsc.sys,-101: System32\Drivers\dfsc.sys (system) @%SystemRoot%\system32\dhcpcore.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (autostart) @%systemroot%\system32\drivers\discache.sys,-102: System32\drivers\discache.sys (system) Disk Driver: system32\DRIVERS\disk.sys (system) @%SystemRoot%\System32\dnsapi.dll,-101: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart) @%systemroot%\system32\dot3svc.dll,-1102: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%systemroot%\system32\dps.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork (autostart) Microsoft Trusted Audio Drivers: system32\drivers\drmkaud.sys (manual start) LDDM Graphics Subsystem: \SystemRoot\System32\drivers\dxgkrnl.sys (manual start) @%systemroot%\system32\eapsvc.dll,-1: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Broadcom NetXtreme II 10 GigE VBD: \SystemRoot\system32\DRIVERS\evbda.sys (manual start) @%SystemRoot%\system32\efssvc.dll,-100: %SystemRoot%\System32\lsass.exe (manual start) @%SystemRoot%\ehome\ehrecvr.exe,-101: %systemroot%\ehome\ehRecvr.exe (manual start) @%SystemRoot%\ehome\ehsched.exe,-101: %systemroot%\ehome\ehsched.exe (manual start) elxstor: \SystemRoot\system32\DRIVERS\elxstor.sys (manual start) EPSON V5 Service4(01): C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (autostart) EPSON V3 Service4(01): C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (autostart) Microsoft Hardware Error Device Driver: \SystemRoot\system32\drivers\errdev.sys (manual start) @%SystemRoot%\system32\wevtsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart) @comres.dll,-2450: %SystemRoot%\system32\svchost.exe -k LocalService (autostart) @%systemroot%\system32\fxsresm.dll,-118: %systemroot%\system32\fxssvc.exe (manual start) Floppy Disk Controller Driver: \SystemRoot\system32\DRIVERS\fdc.sys (manual start) @%systemroot%\system32\fdPHost.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) @%systemroot%\system32\fdrespub.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (autostart) @%SystemRoot%\system32\drivers\fileinfo.sys,-100: system32\drivers\fileinfo.sys (system) @%SystemRoot%\system32\drivers\filetrace.sys,-10001: system32\drivers\filetrace.sys (manual start) Floppy Disk Driver: \SystemRoot\system32\DRIVERS\flpydisk.sys (manual start) @%SystemRoot%\system32\drivers\fltmgr.sys,-10001: system32\drivers\fltmgr.sys (system) @%systemroot%\system32\FntCache.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (autostart) @%SystemRoot%\system32\PresentationHost.exe,-3309: %systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (manual start) @%SystemRoot%\system32\drivers\fsdepends.sys,-10001: System32\drivers\FsDepends.sys (manual start) @%SystemRoot%\system32\drivers\fvevol.sys,-100: System32\DRIVERS\fvevol.sys (system) Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms: \SystemRoot\system32\DRIVERS\gagp30kx.sys (manual start) @gpapi.dll,-112: %systemroot%\system32\svchost.exe -k netsvcs (autostart) Hauppauge Consumer Infrared Receiver: \SystemRoot\system32\drivers\hcw85cir.sys (manual start) Microsoft 1.1 UAA Function Driver for High Definition Audio Service: \SystemRoot\system32\drivers\HdAudio.sys (manual start) Microsoft UAA Bus Driver for High Definition Audio: \SystemRoot\system32\drivers\HDAudBus.sys (manual start) HID UPS Battery Driver: system32\DRIVERS\HidBatt.sys (manual start) Microsoft Bluetooth HID Miniport: \SystemRoot\system32\DRIVERS\hidbth.sys (manual start) Microsoft Infrared HID Driver: \SystemRoot\system32\DRIVERS\hidir.sys (manual start) @%SystemRoot%\System32\hidserv.dll,-101: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start) Microsoft HID Class Driver: \SystemRoot\system32\drivers\hidusb.sys (manual start) @%SystemRoot%\system32\kmsvc.dll,-6: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) @%SystemRoot%\System32\ListSvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%SystemRoot%\System32\provsvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (manual start) HpSAMD: \SystemRoot\system32\drivers\HpSAMD.sys (manual start) @%SystemRoot%\system32\drivers\http.sys,-1: system32\drivers\HTTP.sys (manual start) @%systemroot%\system32\drivers\hwpolicy.sys,-101: System32\drivers\hwpolicy.sys (system) i8042 Keyboard and PS/2 Mouse Port Driver: \SystemRoot\system32\drivers\i8042prt.sys (manual start) Intel RAID Controller Windows 7: \SystemRoot\system32\drivers\iaStorV.sys (manual start) @%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193: "%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe" (manual start) iirsp: \SystemRoot\system32\DRIVERS\iirsp.sys (manual start) @%SystemRoot%\system32\ikeext.dll,-501: %systemroot%\system32\svchost.exe -k netsvcs (autostart) intelide: system32\drivers\intelide.sys (system) Intel Processor Driver: system32\DRIVERS\intelppm.sys (manual start) @%systemroot%\system32\IPBusEnum.dll,-102: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%systemroot%\system32\rascfg.dll,-32013: system32\DRIVERS\ipfltdrv.sys (manual start) @%SystemRoot%\system32\iphlpsvc.dll,-500: %SystemRoot%\System32\svchost.exe -k NetSvcs (autostart) IPMIDRV: \SystemRoot\system32\drivers\IPMIDrv.sys (manual start) IP Network Address Translator: System32\drivers\ipnat.sys (manual start) @%SystemRoot%\system32\drivers\irenum.sys,-100: system32\drivers\irenum.sys (manual start) isapnp: \SystemRoot\system32\drivers\isapnp.sys (manual start) iScsiPort Driver: \SystemRoot\system32\drivers\msiscsi.sys (manual start) Keyboard Class Driver: \SystemRoot\system32\drivers\kbdclass.sys (manual start) Keyboard HID Driver: \SystemRoot\system32\drivers\kbdhid.sys (manual start) @keyiso.dll,-100: %SystemRoot%\system32\lsass.exe (manual start) kl1: system32\DRIVERS\kl1.sys (system) Kaspersky Lab Boot Guard Driver: system32\DRIVERS\klbg.sys (system) Kaspersky Lab Driver: system32\DRIVERS\klif.sys (system) Kaspersky Anti-Virus NDIS 6 Filter: system32\DRIVERS\klim6.sys (system) Kaspersky Lab KLMOUFLT: system32\DRIVERS\klmouflt.sys (manual start) : System32\Drivers\ksecdd.sys (system) : System32\Drivers\ksecpkg.sys (system) Kernel Streaming Thunks: \SystemRoot\system32\drivers\ksthunk.sys (manual start) @comres.dll,-2946: %SystemRoot%\System32\svchost.exe -k NetworkServiceAndNoImpersonation (manual start) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20): system32\DRIVERS\L1E62x64.sys (manual start) @%systemroot%\system32\srvsvc.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) @%systemroot%\system32\wkssvc.dll,-100: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart) Link-Layer Topology Discovery Mapper I/O Driver: system32\DRIVERS\lltdio.sys (autostart) @%SystemRoot%\system32\lltdres.dll,-1: %SystemRoot%\System32\svchost.exe -k LocalService (manual start) @%SystemRoot%\system32\lmhsvc.dll,-101: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (autostart) LSI_FC: \SystemRoot\system32\DRIVERS\lsi_fc.sys (manual start) LSI_SAS: \SystemRoot\system32\DRIVERS\lsi_sas.sys (manual start) LSI_SAS2: \SystemRoot\system32\DRIVERS\lsi_sas2.sys (manual start) LSI_SCSI: \SystemRoot\system32\DRIVERS\lsi_scsi.sys (manual start) @%systemroot%\system32\drivers\luafv.sys,-100: \SystemRoot\system32\drivers\luafv.sys (autostart) Logitech Webcam 120(UVC): system32\DRIVERS\lvuvc64.sys (manual start) @%SystemRoot%\ehome\ehres.dll,-15501: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (disabled) megasas: \SystemRoot\system32\DRIVERS\megasas.sys (manual start) MegaSR: \SystemRoot\system32\DRIVERS\MegaSR.sys (manual start) Microsoft Office Groove Audit Service: "C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe" (manual start) @%systemroot%\system32\mmcss.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) : system32\drivers\modem.sys (manual start) Microsoft Monitor Class Function Driver Service: system32\DRIVERS\monitor.sys (manual start) Mouse Class Driver: \SystemRoot\system32\drivers\mouclass.sys (manual start) Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start) @%SystemRoot%\system32\drivers\mountmgr.sys,-100: System32\drivers\mountmgr.sys (system) Microsoft Multi-Path Bus Driver: \SystemRoot\system32\drivers\mpio.sys (manual start) @%SystemRoot%\system32\FirewallAPI.dll,-23092: System32\drivers\mpsdrv.sys (manual start) @%SystemRoot%\system32\FirewallAPI.dll,-23090: %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork (autostart) @%systemroot%\system32\webclnt.dll,-104: \SystemRoot\system32\drivers\mrxdav.sys (manual start) @%systemroot%\system32\wkssvc.dll,-1002: system32\DRIVERS\mrxsmb.sys (manual start) @%systemroot%\system32\wkssvc.dll,-1004: system32\DRIVERS\mrxsmb10.sys (manual start) @%systemroot%\system32\wkssvc.dll,-1006: system32\DRIVERS\mrxsmb20.sys (manual start) msahci: \SystemRoot\system32\drivers\msahci.sys (manual start) Microsoft Multi-Path Device Specific Module: \SystemRoot\system32\drivers\msdsm.sys (manual start) @comres.dll,-2797: %SystemRoot%\System32\msdtc.exe (manual start) @%SystemRoot%\system32\drivers\mshidkmdf.sys,-100: \SystemRoot\System32\drivers\mshidkmdf.sys (manual start) msisadrv: system32\drivers\msisadrv.sys (system) @%SystemRoot%\system32\iscsidsc.dll,-5000: %systemroot%\system32\svchost.exe -k netsvcs (manual start) @%SystemRoot%\system32\msimsg.dll,-27: %systemroot%\system32\msiexec.exe /V (manual start) Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start) Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start) Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start) Microsoft System Management BIOS Driver: \SystemRoot\system32\drivers\mssmbios.sys (system) Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start) Microsoft Input Configuration Driver: \SystemRoot\system32\DRIVERS\MTConfig.sys (manual start) ATK0110 ACPI UTILITY: system32\DRIVERS\ASACPI.sys (manual start) @%systemroot%\system32\drivers\mup.sys,-101: System32\Drivers\mup.sys (system) @%SystemRoot%\system32\qagentrt.dll,-6: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start) NativeWiFi Filter: system32\DRIVERS\nwifi.sys (manual start) @%SystemRoot%\system32\drivers\ndis.sys,-200: system32\drivers\ndis.sys (system) NDIS Capture LightWeight Filter: system32\DRIVERS\ndiscap.sys (manual start) @%systemroot%\system32\rascfg.dll,-32001: system32\DRIVERS\ndistapi.sys (manual start) NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start) @%systemroot%\system32\rascfg.dll,-32002: system32\DRIVERS\ndiswan.sys (manual start) NetBIOS Interface: system32\DRIVERS\netbios.sys (system) @%SystemRoot%\system32\drivers\netbt.sys,-2: System32\DRIVERS\netbt.sys (system) @%SystemRoot%\System32\netlogon.dll,-102: %systemroot%\system32\lsass.exe (manual start) @%SystemRoot%\system32\netman.dll,-109: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%SystemRoot%\system32\netprofm.dll,-202: %SystemRoot%\System32\svchost.exe -k LocalService (manual start) @%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8201: "%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled) nfrd960: \SystemRoot\system32\DRIVERS\nfrd960.sys (manual start) @%SystemRoot%\System32\nlasvc.dll,-1: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart) @%SystemRoot%\system32\nsisvc.dll,-200: %systemroot%\system32\svchost.exe -k LocalService (autostart) @%SystemRoot%\system32\drivers\nsiproxy.sys,-2: system32\drivers\nsiproxy.sys (system) nvraid: \SystemRoot\system32\drivers\nvraid.sys (manual start) nvstor: \SystemRoot\system32\drivers\nvstor.sys (manual start) NVIDIA nForce AGP Bus Filter: \SystemRoot\system32\drivers\nv_agp.sys (manual start) Microsoft Office Diagnostics Service: "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" (manual start) 1394 OHCI Compliant Host Controller (Legacy): \SystemRoot\system32\drivers\ohci1394.sys (manual start) Office Source Engine: "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start) Office Software Protection Platform: "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE" (manual start) @%SystemRoot%\system32\pnrpsvc.dll,-8004: %SystemRoot%\System32\svchost.exe -k LocalServicePeerNet (manual start) @%SystemRoot%\system32\p2psvc.dll,-8006: %SystemRoot%\System32\svchost.exe -k LocalServicePeerNet (manual start) Parallel port driver: system32\DRIVERS\parport.sys (manual start) @%SystemRoot%\system32\drivers\partmgr.sys,-100: System32\drivers\partmgr.sys (system) @%SystemRoot%\system32\pcasvc.dll,-1: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart) PCI Bus Driver: system32\drivers\pci.sys (system) pciide: \SystemRoot\system32\drivers\pciide.sys (manual start) pcmcia: \SystemRoot\system32\DRIVERS\pcmcia.sys (manual start) Performance Counters for Windows Driver: System32\drivers\pcw.sys (system) PEAUTH: system32\drivers\peauth.sys (autostart) @%SystemRoot%\system32\peerdistsvc.dll,-9000: %SystemRoot%\System32\svchost.exe -k PeerDist (manual start) @%systemroot%\sysWow64\perfhost.exe,-2: %SystemRoot%\SysWow64\perfhost.exe (manual start) @%systemroot%\system32\pla.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork (manual start) @%SystemRoot%\system32\umpnpmgr.dll,-100: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart) @%SystemRoot%\system32\pnrpauto.dll,-8002: %SystemRoot%\System32\svchost.exe -k LocalServicePeerNet (manual start) @%SystemRoot%\system32\pnrpsvc.dll,-8000: %SystemRoot%\System32\svchost.exe -k LocalServicePeerNet (manual start) @%SystemRoot%\System32\polstore.dll,-5010: %SystemRoot%\system32\svchost.exe -k NetworkServiceNetworkRestricted (autostart) @%SystemRoot%\system32\umpo.dll,-100: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart) @%systemroot%\system32\rascfg.dll,-32006: system32\DRIVERS\raspptp.sys (manual start) Processor Driver: \SystemRoot\system32\DRIVERS\processr.sys (manual start) @%systemroot%\system32\profsvc.dll,-300: %systemroot%\system32\svchost.exe -k netsvcs (autostart) @%systemroot%\system32\psbase.dll,-300: %SystemRoot%\system32\lsass.exe (manual start) @%SystemRoot%\System32\drivers\pacer.sys,-101: system32\DRIVERS\pacer.sys (system) ql2300: \SystemRoot\system32\DRIVERS\ql2300.sys (manual start) ql40xx: \SystemRoot\system32\DRIVERS\ql40xx.sys (manual start) @%SystemRoot%\system32\qwave.dll,-1: %windir%\system32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) @%SystemRoot%\system32\drivers\qwavedrv.sys,-1: \SystemRoot\system32\drivers\qwavedrv.sys (manual start) Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (manual start) WAN Miniport (IKEv2): system32\DRIVERS\AgileVpn.sys (manual start) @%Systemroot%\system32\rasauto.dll,-200: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) @%systemroot%\system32\rascfg.dll,-32005: system32\DRIVERS\rasl2tp.sys (manual start) @%Systemroot%\system32\rasmans.dll,-200: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) @%systemroot%\system32\rascfg.dll,-32007: system32\DRIVERS\raspppoe.sys (manual start) @%systemroot%\system32\sstpsvc.dll,-202: system32\DRIVERS\rassstp.sys (manual start) @%systemroot%\system32\wkssvc.dll,-1000: system32\DRIVERS\rdbss.sys (system) Remote Desktop Device Redirector Bus Driver: system32\DRIVERS\rdpbus.sys (manual start) @%systemroot%\system32\DRIVERS\RDPCDD.sys,-100: System32\DRIVERS\RDPCDD.sys (system) Terminal Server Device Redirector Driver: System32\drivers\rdpdr.sys (manual start) @%systemroot%\system32\drivers\RDPENCDD.sys,-101: system32\drivers\rdpencdd.sys (system) @%systemroot%\system32\drivers\RdpRefMp.sys,-101: system32\drivers\rdprefmp.sys (system) ReadyBoost: System32\drivers\rdyboost.sys (system) @%Systemroot%\system32\mprdim.dll,-200: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled) @regsvc.dll,-1: %SystemRoot%\system32\svchost.exe -k regsvc (manual start) @%windir%\system32\RpcEpMap.dll,-1001: %SystemRoot%\system32\svchost.exe -k RPCSS (autostart) @%systemroot%\system32\Locator.exe,-2: %SystemRoot%\system32\locator.exe (manual start) @oleres.dll,-5010: %SystemRoot%\system32\svchost.exe -k rpcss (autostart) Link-Layer Topology Discovery Responder: system32\DRIVERS\rspndr.sys (autostart) s3cap: \SystemRoot\system32\drivers\vms3cap.sys (manual start) @%SystemRoot%\system32\samsrv.dll,-1: %SystemRoot%\system32\lsass.exe (autostart) SBP-2 Transport/Protocol Bus Driver: \SystemRoot\system32\drivers\sbp2port.sys (manual start) @%SystemRoot%\System32\SCardSvr.dll,-1: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) @%SystemRoot%\System32\drivers\scfilter.sys,-11: System32\DRIVERS\scfilter.sys (manual start) @%SystemRoot%\system32\schedsvc.dll,-100: %systemroot%\system32\svchost.exe -k netsvcs (autostart) @%SystemRoot%\System32\certprop.dll,-13: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) @%SystemRoot%\system32\sdrsvc.dll,-107: %SystemRoot%\system32\svchost.exe -k SDRSVC (manual start) @%SystemRoot%\system32\seclogon.dll,-7001: %windir%\system32\svchost.exe -k netsvcs (manual start) @%SystemRoot%\system32\Sens.dll,-200: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) @%SystemRoot%\System32\sensrsvc.dll,-1000: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start) Serial port driver: system32\DRIVERS\serial.sys (system) Serial Mouse Driver: \SystemRoot\system32\DRIVERS\sermouse.sys (manual start) ServicepointService: "C:\Program Files (x86)\Verizon\VSP\ServicepointService.exe" (autostart) @%SystemRoot%\System32\SessEnv.dll,-1026: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) SFF Storage Class Driver: \SystemRoot\system32\drivers\sffdisk.sys (manual start) SFF Storage Protocol Driver for MMC: \SystemRoot\system32\drivers\sffp_mmc.sys (manual start) SFF Storage Protocol Driver for SDBus: \SystemRoot\system32\drivers\sffp_sd.sys (manual start) High-Capacity Floppy Disk Drive: \SystemRoot\system32\DRIVERS\sfloppy.sys (manual start) @%SystemRoot%\system32\ipnathlp.dll,-106: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled) @%SystemRoot%\System32\shsvcs.dll,-12288: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) SiSRaid2: \SystemRoot\system32\DRIVERS\SiSRaid2.sys (manual start) SiSRaid4: \SystemRoot\system32\DRIVERS\sisraid4.sys (manual start) SmartDefragDriver: System32\Drivers\SmartDefragDriver.sys (system) @%SystemRoot%\system32\tcpipcfg.dll,-50005: system32\DRIVERS\smb.sys (manual start) @%SystemRoot%\system32\snmptrap.exe,-3: %SystemRoot%\System32\snmptrap.exe (manual start) @%systemroot%\system32\spoolsv.exe,-1: %SystemRoot%\System32\spoolsv.exe (autostart) @%SystemRoot%\system32\sppsvc.exe,-101: %SystemRoot%\system32\sppsvc.exe (autostart) @%SystemRoot%\system32\sppuinotify.dll,-103: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) SupportSoft Sprocket Service (ncnetworksdm): C:\Program Files (x86)\NCNETWORKSDM\bin\sprtsvc.exe /service /p ncnetworksdm (autostart) @%systemroot%\system32\srvsvc.dll,-102: System32\DRIVERS\srv.sys (manual start) @%systemroot%\system32\srvsvc.dll,-104: System32\DRIVERS\srv2.sys (manual start) : System32\DRIVERS\srvnet.sys (manual start) @%systemroot%\system32\ssdpsrv.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) @%SystemRoot%\system32\sstpsvc.dll,-200: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) stexstor: \SystemRoot\system32\DRIVERS\stexstor.sys (manual start) @%SystemRoot%\system32\wiaservc.dll,-9: %SystemRoot%\system32\svchost.exe -k imgsvc (autostart) @%SystemRoot%\system32\vmstorfltres.dll,-1000: system32\drivers\vmstorfl.sys (system) @%SystemRoot%\System32\StorSvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start) storvsc: \SystemRoot\system32\drivers\storvsc.sys (manual start) Software Bus Driver: \SystemRoot\system32\drivers\swenum.sys (manual start) @%SystemRoot%\System32\swprv.dll,-103: %SystemRoot%\System32\svchost.exe -k swprv (manual start) @%SystemRoot%\system32\sysmain.dll,-1000: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart) @%SystemRoot%\system32\TabSvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%SystemRoot%\system32\tapisrv.dll,-10100: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start) @%SystemRoot%\system32\tbssvc.dll,-100: %SystemRoot%\System32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) @%SystemRoot%\system32\tcpipcfg.dll,-50003: System32\drivers\tcpip.sys (system) Microsoft IPv6 Protocol Driver: system32\DRIVERS\tcpip.sys (manual start) TCP/IP Registry Compatibility: System32\drivers\tcpipreg.sys (autostart) TDPIPE: system32\drivers\tdpipe.sys (manual start) TDTCP: system32\drivers\tdtcp.sys (manual start) @%SystemRoot%\system32\tcpipcfg.dll,-50004: system32\DRIVERS\tdx.sys (system) Terminal Device Driver: \SystemRoot\system32\drivers\termdd.sys (system) @%SystemRoot%\System32\termsrv.dll,-268: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start) SupportSoft Repair Service (ncnetworksdm): C:\Program Files (x86)\NCNETWORKSDM\bin\tgsrvc.exe /p ncnetworksdm (autostart) @%SystemRoot%\System32\themeservice.dll,-8192: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) @%systemroot%\system32\mmcss.dll,-102: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) @%SystemRoot%\system32\trkwks.dll,-1: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart) @%SystemRoot%\servicing\TrustedInstaller.exe,-100: %SystemRoot%\servicing\TrustedInstaller.exe (manual start) @%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101: System32\DRIVERS\tssecsrv.sys (manual start) : system32\drivers\tsusbflt.sys (manual start) Microsoft Tunnel Miniport Adapter Driver: system32\DRIVERS\tunnel.sys (manual start) Microsoft AGPv3.5 Filter: \SystemRoot\system32\DRIVERS\uagp35.sys (manual start) udfs: system32\DRIVERS\udfs.sys (disabled) @%SystemRoot%\system32\ui0detect.exe,-101: %SystemRoot%\system32\UI0Detect.exe (manual start) Uli AGP Bus Filter: \SystemRoot\system32\drivers\uliagpkx.sys (manual start) UMBus Enumerator Driver: \SystemRoot\system32\drivers\umbus.sys (manual start) Microsoft UMPass Driver: \SystemRoot\system32\DRIVERS\umpass.sys (manual start) @%SystemRoot%\system32\umrdp.dll,-1000: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start) UMVPFSrv: C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (autostart) @%systemroot%\system32\upnphost.dll,-213: %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) USB Audio Driver (WDM): \SystemRoot\system32\drivers\usbaudio.sys (manual start) Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start) eHome Infrared Receiver (USBCIR): \SystemRoot\system32\drivers\usbcir.sys (manual start) Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start) Microsoft USB Standard Hub Driver: system32\DRIVERS\usbhub.sys (manual start) Microsoft USB Open Host Controller Miniport Driver: \SystemRoot\system32\drivers\usbohci.sys (manual start) Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start) USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start) USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start) Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start) @%SystemRoot%\system32\dwm.exe,-2000: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart) @%SystemRoot%\system32\vaultsvc.dll,-1003: %SystemRoot%\system32\lsass.exe (manual start) Microsoft Virtual Drive Enumerator Driver: system32\drivers\vdrvroot.sys (system) @%SystemRoot%\system32\vds.exe,-100: %SystemRoot%\System32\vds.exe (manual start) vga: system32\DRIVERS\vgapnp.sys (manual start) : \SystemRoot\System32\drivers\vga.sys (system) vhdmp: \SystemRoot\system32\drivers\vhdmp.sys (manual start) viaide: \SystemRoot\system32\drivers\viaide.sys (manual start) @%SystemRoot%\system32\vmbusres.dll,-1000: system32\drivers\vmbus.sys (system) VMBusHID: \SystemRoot\system32\drivers\VMBusHID.sys (manual start) Virtual Machine Monitor: \??\C:\Windows\system32\Drivers\vmm.sys (system) Volume Manager Driver: system32\drivers\volmgr.sys (system) @%SystemRoot%\system32\drivers\volmgrx.sys,-100: System32\drivers\volmgrx.sys (system) Storage volumes: system32\drivers\volsnap.sys (system) Virtual Machine Network Services Driver: system32\DRIVERS\VMNetSrv.sys (manual start) vsmraid: \SystemRoot\system32\DRIVERS\vsmraid.sys (manual start) @%systemroot%\system32\vssvc.exe,-102: %systemroot%\system32\vssvc.exe (manual start) @%SystemRoot%\System32\drivers\vwifibus.sys,-257: \SystemRoot\System32\drivers\vwifibus.sys (manual start) @%SystemRoot%\system32\w32time.dll,-200: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) Wacom Serial Pen HID Driver: \SystemRoot\system32\DRIVERS\wacompen.sys (manual start) @%systemroot%\system32\rascfg.dll,-32011: system32\DRIVERS\wanarp.sys (manual start) @%systemroot%\system32\rascfg.dll,-32012: system32\DRIVERS\wanarp.sys (system) @%SystemRoot%\system32\Wat\WatUX.exe,-601: %SystemRoot%\system32\Wat\WatAdminSvc.exe (manual start) @%systemroot%\system32\wbengine.exe,-104: "%systemroot%\system32\wbengine.exe" (manual start) @%systemroot%\system32\wbiosrvc.dll,-100: %SystemRoot%\system32\svchost.exe -k WbioSvcGroup (manual start) @%SystemRoot%\system32\wcncsvc.dll,-3: %SystemRoot%\System32\svchost.exe -k LocalServiceAndNoImpersonation (manual start) @%SystemRoot%\system32\WcsPlugInService.dll,-200: %SystemRoot%\system32\svchost.exe -k wcssvc (manual start) Wd: \SystemRoot\system32\DRIVERS\wd.sys (manual start) Kernel Mode Driver Frameworks service: system32\drivers\Wdf01000.sys (system) @%systemroot%\system32\wdi.dll,-502: %SystemRoot%\System32\svchost.exe -k LocalService (manual start) @%systemroot%\system32\wdi.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%systemroot%\system32\webclnt.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) @%SystemRoot%\system32\wecsvc.dll,-200: %SystemRoot%\system32\svchost.exe -k NetworkService (manual start) @%SystemRoot%\System32\wercplsupport.dll,-101: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) @%SystemRoot%\System32\wersvc.dll,-100: %SystemRoot%\System32\svchost.exe -k WerSvcGroup (manual start) WFP Lightweight Filter: system32\DRIVERS\wfplwf.sys (system) WIMMount: system32\drivers\wimmount.sys (manual start) @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103: %SystemRoot%\System32\svchost.exe -k secsvcs (autostart) @%SystemRoot%\system32\winhttp.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (manual start) @%Systemroot%\system32\wbem\wmisvc.dll,-205: %systemroot%\system32\svchost.exe -k netsvcs (autostart) @%Systemroot%\system32\wsmsvc.dll,-101: %SystemRoot%\System32\svchost.exe -k NetworkService (manual start) @%SystemRoot%\System32\wlansvc.dll,-257: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start) Windows Live ID Sign-in Assistant: "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" (autostart) Microsoft Windows Management Interface for ACPI: \SystemRoot\system32\drivers\wmiacpi.sys (manual start) @%Systemroot%\system32\wbem\wmiapsrv.exe,-110: %systemroot%\system32\wbem\WmiApSrv.exe (manual start) @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101: "%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe" (autostart) @%SystemRoot%\system32\wpcsvc.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (manual start) @%SystemRoot%\system32\wpdbusenum.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (manual start) @%systemroot%\System32\drivers\ws2ifsl.sys,-1000: \SystemRoot\system32\drivers\ws2ifsl.sys (disabled) @%SystemRoot%\System32\wscsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart) @%systemroot%\system32\SearchIndexer.exe,-103: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart) @%systemroot%\system32\wuaueng.dll,-105: %systemroot%\system32\svchost.exe -k netsvcs (autostart) User Mode Driver Frameworks Platform Driver: system32\drivers\WudfPf.sys (manual start) WUDFRd: system32\DRIVERS\WUDFRd.sys (manual start) @%SystemRoot%\system32\wudfsvc.dll,-1000: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart) @%SystemRoot%\System32\wwansvc.dll,-257: %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork (manual start) -------------------------------------------------- Enumerating Windows NT logon/logoff scripts: *No scripts set to run* Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: *Registry value not found* -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: WebCheck: *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *Registry key not found* -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *Registry key not found* -------------------------------------------------- End of report, 55,726 bytes Report generated in 0.109 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only