[brunos]

I've been having problems with my computer lately.  Avast keeps telling me that the web agent blocked a malware.  It says :

 

Object : hxxp://go.wydeo.com/resutsa/?x=0g?...

Infection : Url: Mal

Process : c:\windows\explorer.exe

 

I've run the scan and it didnt find anything.  I ran adwcleaner without any success.  What else can I do ?

 

Thanks,

 

Bruno

[Advertisements]

Hello brunos, welcome to Geeks to Go Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• Ensure you are following this topic. Click  at the top of the page. 
   

======================================================
 
Please run the following diagnostic scans so I can ascertain the state of your computer.
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
 TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select  Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach the file in your next reply.
   

======================================================
 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• TDSSKiller log (attached)

[LiquidTension]

Hello brunos, welcome to Geeks to Go Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
• Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
• Ensure you are following this topic. Click  at the top of the page. 
   

======================================================
 
Please run the following diagnostic scans so I can ascertain the state of your computer.
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
 TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select  Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach the file in your next reply.
   

======================================================
 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• TDSSKiller log (attached)

[brunos]

Thank you Adam for your help.  Here are the logs :

 

The FRST log :

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015

Ran by Bruno Sanfacon (administrator) on BRUNO on 29-01-2015 08:26:52

Running from C:\Users\Bruno Sanfacon\Desktop

Loaded Profiles: Bruno Sanfacon (Available profiles: Bruno Sanfacon)

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

(Farbar) C:\Users\Bruno Sanfacon\Desktop\FRST64 (1).exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-02] (Realtek Semiconductor)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2758200 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [155704 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [155704 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-20] (Synaptics Incorporated)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-01] (CyberLink Corp.)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-08] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-28] (AVAST Software)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON14/4

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON14/4

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 

HKU\S-1-5-21-3923409957-1760440807-4282318547-1002\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/

HKU\S-1-5-21-3923409957-1760440807-4282318547-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON14/4

HKU\S-1-5-21-3923409957-1760440807-4282318547-1002\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/HPCON14/4

SearchScopes: HKLM -> {BC8EC301-16E1-451F-B70B-7C3DB0090AB4} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...56705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {BC8EC301-16E1-451F-B70B-7C3DB0090AB4} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...56705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002 -> {BC8EC301-16E1-451F-B70B-7C3DB0090AB4} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...56705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Tcpip\Parameters: [DhcpNameServer] 90.0.0.254

 

FireFox:

========

FF ProfilePath: C:\Users\Bruno Sanfacon\AppData\Roaming\Mozilla\Firefox\Profiles\g25oy61h.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-03-09]

 

Chrome: 

=======

CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR Profile: C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-16]

CHR Extension: (Google Drive) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-16]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-16]

CHR Extension: (YouTube) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-16]

CHR Extension: (Google Search) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-16]

CHR Extension: (Avast Online Security) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-16]

CHR Extension: (Google Wallet) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-16]

CHR Extension: (Gmail) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-16]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-28]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [99328 2013-09-25] () [File not signed]

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-09-25] (Advanced Micro Devices, Inc.) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-28] (AVAST Software)

R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-10-14] () [File not signed]

R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-10-18] (CyberLink)

R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-10-18] (CyberLink)

R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [255040 2014-08-25] (WildTangent)

S2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-08-29] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-10-14] (Softex Inc.) [File not signed]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-08-23] (Realtek Semiconductor)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-26] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17504 2013-11-19] (Advanced Micro Devices, INC.)

R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [219360 2013-04-18] (AppEx Networks Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-28] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-28] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-28] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-28] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-28] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-28] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-28] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-28] ()

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [138240 2013-11-19] (Advanced Micro Devices)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290520 2013-08-27] (Realtek Semiconductor Corp.)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation                           )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-20] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [34544 2013-09-20] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-29 08:26 - 2015-01-29 08:31 - 00016594 _____ () C:\Users\Bruno Sanfacon\Desktop\FRST.txt

2015-01-29 08:26 - 2015-01-29 08:22 - 02130432 _____ (Farbar) C:\Users\Bruno Sanfacon\Desktop\FRST64 (1).exe

2015-01-29 08:22 - 2015-01-29 08:22 - 02130432 _____ (Farbar) C:\Users\Bruno Sanfacon\Downloads\FRST64 (1).exe

2015-01-28 21:04 - 2015-01-28 21:04 - 00003950 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{079F1DF8-06E1-476F-8586-D84F1366EC6A}

2015-01-28 19:17 - 2015-01-28 19:19 - 00025382 _____ () C:\Users\Bruno Sanfacon\Downloads\Addition.txt

2015-01-28 19:12 - 2015-01-29 08:27 - 00000000 ____D () C:\FRST

2015-01-28 19:12 - 2015-01-28 19:19 - 00026548 _____ () C:\Users\Bruno Sanfacon\Downloads\FRST.txt

2015-01-28 19:11 - 2015-01-28 19:11 - 02130432 _____ (Farbar) C:\Users\Bruno Sanfacon\Downloads\FRST64.exe

2015-01-28 18:42 - 2015-01-28 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software

2015-01-28 18:39 - 2015-01-28 18:18 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2015-01-28 18:30 - 2015-01-28 18:30 - 05006864 _____ (AVAST Software) C:\Users\Bruno Sanfacon\Downloads\avast_free_antivirus_setup_online.exe

2015-01-28 18:22 - 2015-01-28 18:22 - 563087693 _____ () C:\Windows\MEMORY.DMP

2015-01-28 18:22 - 2015-01-28 18:22 - 00281104 _____ () C:\Windows\Minidump\012815-49765-01.dmp

2015-01-28 18:22 - 2015-01-28 18:22 - 00000000 ____D () C:\Windows\Minidump

2015-01-28 18:20 - 2015-01-28 18:42 - 00001947 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-01-28 18:18 - 2015-01-28 18:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2015-01-28 17:56 - 2015-01-28 18:06 - 00000000 ____D () C:\AdwCleaner

2015-01-28 17:55 - 2015-01-28 17:55 - 02194432 _____ () C:\Users\Bruno Sanfacon\Downloads\AdwCleaner (1).exe

2015-01-28 17:54 - 2015-01-28 17:55 - 02194432 _____ () C:\Users\Bruno Sanfacon\Downloads\AdwCleaner.exe

2015-01-27 21:13 - 2015-01-28 21:04 - 00000000 ___HD () C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}

2015-01-27 21:13 - 2015-01-27 21:15 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage

2015-01-14 19:03 - 2015-01-28 18:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-13 18:04 - 2014-12-19 01:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-13 18:04 - 2014-12-11 21:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-13 18:04 - 2014-12-11 19:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys

2015-01-13 18:04 - 2014-12-08 20:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe

2015-01-13 18:04 - 2014-12-08 14:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe

2015-01-13 18:04 - 2014-12-05 22:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll

2015-01-13 18:04 - 2014-12-05 20:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-13 18:04 - 2014-12-05 20:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll

2015-01-13 18:04 - 2014-10-28 23:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe

2015-01-13 18:04 - 2014-10-28 23:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe

2015-01-13 18:04 - 2014-10-28 22:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2015-01-13 18:04 - 2014-10-28 22:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2015-01-13 18:04 - 2014-10-28 22:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2015-01-13 18:04 - 2014-10-28 22:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe

2015-01-13 18:04 - 2014-10-28 22:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe

2015-01-13 18:04 - 2014-10-28 22:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe

2015-01-13 18:04 - 2014-10-28 22:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2015-01-13 18:04 - 2014-10-28 22:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2015-01-13 18:04 - 2014-10-28 22:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2015-01-13 18:04 - 2014-10-28 21:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll

2015-01-13 18:04 - 2014-10-28 20:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll

2015-01-13 18:04 - 2014-10-28 20:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll

2015-01-13 18:04 - 2014-10-28 20:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2015-01-13 18:04 - 2014-10-28 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-29 08:30 - 2014-03-19 18:16 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-29 08:24 - 2014-03-09 12:15 - 01345365 _____ () C:\Windows\WindowsUpdate.log

2015-01-29 08:19 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\sru

2015-01-28 21:09 - 2014-08-16 05:48 - 00001088 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-28 21:09 - 2014-03-09 12:23 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3923409957-1760440807-4282318547-1002

2015-01-28 21:05 - 2014-05-11 17:35 - 00000000 ___DO () C:\Users\Bruno Sanfacon\SkyDrive

2015-01-28 21:04 - 2014-08-16 05:48 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-28 20:57 - 2013-08-22 09:46 - 00028486 _____ () C:\Windows\setupact.log

2015-01-28 20:57 - 2013-08-22 09:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-28 20:57 - 2013-08-22 08:25 - 00524288 ___SH () C:\Windows\system32\config\BBI

2015-01-28 20:54 - 2013-08-22 10:20 - 00000000 ____D () C:\Windows\CbsTemp

2015-01-28 19:33 - 2014-06-06 16:49 - 00054784 ___SH () C:\Users\Bruno Sanfacon\Desktop\Thumbs.db

2015-01-28 19:33 - 2014-06-06 16:49 - 00004094 _____ () C:\Users\Bruno Sanfacon\Desktop\Films - Shortcut.lnk

2015-01-28 18:53 - 2013-12-06 14:48 - 00844692 _____ () C:\Windows\system32\perfh00C.dat

2015-01-28 18:53 - 2013-12-06 14:48 - 00174132 _____ () C:\Windows\system32\perfc00C.dat

2015-01-28 18:53 - 2013-08-26 01:09 - 01966994 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-28 18:43 - 2013-08-26 01:01 - 00031602 _____ () C:\Windows\PFRO.log

2015-01-28 18:40 - 2014-03-09 13:00 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-01-28 18:40 - 2014-03-09 12:59 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2015-01-28 18:18 - 2014-08-15 19:23 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2015-01-27 22:01 - 2014-02-08 12:29 - 00065536 _____ () C:\Windows\system32\spu_storage.bin

2015-01-27 21:13 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\migwiz

2015-01-25 21:27 - 2014-03-09 12:17 - 00000000 ____D () C:\Users\Bruno Sanfacon

2015-01-25 15:12 - 2014-08-16 05:50 - 00002210 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-24 15:28 - 2014-03-19 18:16 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-24 15:20 - 2014-12-18 10:00 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-01-24 15:20 - 2014-12-18 10:00 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-24 07:01 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\AppReadiness

2015-01-18 20:59 - 2014-03-09 12:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-01-18 12:29 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\rescache

2015-01-15 18:13 - 2014-03-19 15:47 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-15 17:57 - 2014-03-19 15:47 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-14 21:09 - 2014-12-10 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak

2014-12-30 20:25 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\NDF

 

Some content of TEMP:

====================

C:\Users\Bruno Sanfacon\AppData\Local\Temp\ICReinstall_AcrobatReaderSetup(2).exe

C:\Users\Bruno Sanfacon\AppData\Local\Temp\ose00000.exe

C:\Users\Bruno Sanfacon\AppData\Local\Temp\ose00001.exe

C:\Users\Bruno Sanfacon\AppData\Local\Temp\Quarantine.exe

C:\Users\Bruno Sanfacon\AppData\Local\Temp\sqlite3.dll

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-01-10 20:22

 

==================== End Of Log ============================

 

The Addition Log :

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015

Ran by Bruno Sanfacon at 2015-01-29 08:32:33

Running from C:\Users\Bruno Sanfacon\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)

Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden

Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden

AMD Catalyst Install Manager (HKLM\...\{301D3AA1-5DCC-FCFD-622E-3C7CBA87C80F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.4.2 - AppEx Networks)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden

CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6902 - CyberLink Corp.)

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3303 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3416 - CyberLink Corp.)

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3418 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.2.3302 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden

DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden

Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden

Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden

HP Documentation (HKLM-x32\...\{71D55970-20A4-43F2-BECD-8F315DEB64F1}) (Version: 1.1.1.0 - Hewlett-Packard)

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7127.4628 - Hewlett-Packard)

HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.57 - Hewlett-Packard)

HP Support Assistant (HKLM-x32\...\{3AF15EEA-8EDF-4393-BB6C-CF8A9986486A}) (Version: 7.3.35.20 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}) (Version: 1.0.10 - Hewlett-Packard Company)

HP Utility Center (HKLM\...\{D72E8F9D-1FB1-4816-93DA-19B4E45604BF}) (Version: 2.3.3 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

Inst5675 (Version: 8.00.57 - Softex Inc.) Hidden

Inst5676 (Version: 8.00.57 - Softex Inc.) Hidden

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden

Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden

Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Mise à jour Microsoft Office Excel 2007 Help  (KB963678) (HKLM-x32\...\{90120000-0016-040C-0000-0000000FF1CE}_PROPLUS_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version:  - Microsoft)

Mise à jour Microsoft Office Outlook 2007 Help  (KB963677) (HKLM-x32\...\{90120000-001A-040C-0000-0000000FF1CE}_PROPLUS_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version:  - Microsoft)

Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669) (HKLM-x32\...\{90120000-0018-040C-0000-0000000FF1CE}_PROPLUS_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version:  - Microsoft)

Mise à jour Microsoft Office Word 2007 Help  (KB963665) (HKLM-x32\...\{90120000-001B-040C-0000-0000000FF1CE}_PROPLUS_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version:  - Microsoft)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

OEM Application Profile (HKLM-x32\...\{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)

Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Pinger (HKLM-x32\...\Pinger 1.4.0.1) (Version: 1.4.0.1 - Pinger Inc.)

Pinger (x32 Version: 1.4.0.1 - Pinger Inc.) Hidden

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29070 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 8.20.815.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7032 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)

Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)

The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden

Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden

WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)

WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

CustomCLSID: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002_Classes\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}\InprocServer32 -> C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\propsys.dll (Microsoft Corporation)

 

==================== Restore Points  =========================

 

24-12-2014 18:35:55 Windows Update

10-01-2015 20:16:22 Scheduled Checkpoint

15-01-2015 17:53:31 Windows Update

25-01-2015 07:14:25 Windows Update

28-01-2015 18:11:00 avast! antivirus system restore point

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {03A5163C-756B-4133-A8EB-9BB8F6C7E90F} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)

Task: {2C129AEF-829A-429A-9E04-E09B4555F7AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-16] (Google Inc.)

Task: {2F9BFCA8-C17C-4F66-90EE-4F073270DB26} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-28] (AVAST Software)

Task: {3E6C785E-24CD-4462-946D-397923F14CD3} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)

Task: {429C9F84-42F6-4A51-9DCA-5F1F6E67A397} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard)

Task: {6B2E0615-41B4-4F7B-8A46-24CFE68E4CEB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)

Task: {70553B94-D124-4B6C-9E8A-B51746E75A7C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {98583E30-C303-455E-B5CD-64196BF21CC3} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-20] (Synaptics Incorporated)

Task: {9C927CD0-7F09-4D2D-82D1-B2140F36048A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)

Task: {B36E4C6F-1823-47FB-8FB2-C9F96EBF489C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-24] (Adobe Systems Incorporated)

Task: {C1B705AA-0B5D-4D92-BDA9-27AA46C0C334} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-16] (Google Inc.)

Task: {DA56DFD7-80BB-4B20-AF52-427773C8866A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)

Task: {DB659232-DA59-425F-A02B-39484930A865} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-15] (Microsoft Corporation)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2013-10-14 14:23 - 2013-10-14 14:23 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

2013-10-14 14:24 - 2013-10-14 14:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll

2013-10-14 14:25 - 2013-10-14 14:25 - 02541056 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll

2013-10-14 14:22 - 2013-10-14 14:22 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll

2013-10-14 14:22 - 2013-10-14 14:22 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll

2013-10-14 14:22 - 2013-10-14 14:22 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll

2013-10-14 14:35 - 2013-10-14 14:35 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll

2013-10-14 14:35 - 2013-10-14 14:35 - 01297296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll

2013-09-25 09:49 - 2013-09-25 09:49 - 00099328 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe

2013-09-25 09:48 - 2013-09-25 09:48 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2013-10-14 14:30 - 2013-10-14 14:30 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

2015-01-28 17:33 - 2015-01-28 17:33 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15012800\algo.dll

2015-01-29 05:46 - 2015-01-29 05:46 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15012900\algo.dll

2014-02-08 12:53 - 2013-08-05 02:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2013-08-05 18:48 - 2013-08-05 18:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

2015-01-28 18:18 - 2015-01-28 18:18 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2015-01-25 15:11 - 2015-01-20 22:50 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libglesv2.dll

2015-01-25 15:11 - 2015-01-20 22:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libegl.dll

2015-01-25 15:12 - 2015-01-20 22:50 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\pdf.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

AlternateDataStreams: C:\Users\Bruno Sanfacon\SkyDrive:ms-properties

AlternateDataStreams: C:\Users\Bruno Sanfacon\SkyDrive (2).old:ms-properties

AlternateDataStreams: C:\Users\Bruno Sanfacon\SkyDrive.old:ms-properties

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-3923409957-1760440807-4282318547-500 - Administrator - Disabled)

Bruno Sanfacon (S-1-5-21-3923409957-1760440807-4282318547-1002 - Administrator - Enabled) => C:\Users\Bruno Sanfacon

Guest (S-1-5-21-3923409957-1760440807-4282318547-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3923409957-1760440807-4282318547-1004 - Limited - Enabled)

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (01/29/2015 05:47:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 3062

 

Error: (01/29/2015 05:47:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 3062

 

Error: (01/29/2015 05:47:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

Error: (01/28/2015 09:09:56 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program LiveComm.exe version 17.5.9600.20689 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

 

Process ID: 7f0

 

Start Time: 01d03b67ea94c55d

 

Termination Time: 4294967295

 

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe

 

Report Id: df778979-a75b-11e4-8313-fc15b407ab0a

 

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe

 

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

 

Error: (01/28/2015 07:59:32 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program firefox.exe version 35.0.1.5500 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

 

Process ID: 184c

 

Start Time: 01d03b5e2b7e7826

 

Termination Time: 121

 

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

 

Report Id: 0f87de8f-a752-11e4-8312-fc15b407ab0a

 

Faulting package full name: 

 

Faulting package-relative application ID:

 

Error: (01/28/2015 06:05:33 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program backgroundTaskHost.exe version 6.3.9600.16384 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

 

Process ID: 24b4

 

Start Time: 01d03b4e408d6f3c

 

Termination Time: 4294967295

 

Application Path: C:\Windows\system32\backgroundTaskHost.exe

 

Report Id: 26192a63-a742-11e4-830e-fc15b407ab0a

 

Faulting package full name: MediaMobileTechnologies.MediaPlayerLite_1.1.1.266_x64__pshwwm0bwg8de

 

Faulting package-relative application ID: App

 

Error: (01/27/2015 09:21:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 15359

 

Error: (01/27/2015 09:21:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 15359

 

Error: (01/27/2015 09:21:54 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

Error: (01/27/2015 07:10:02 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: BRUNO)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

 

System errors:

=============

Error: (01/29/2015 05:47:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 2 time(s).

 

Error: (01/28/2015 09:22:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (01/28/2015 09:00:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The HP Support Assistant Service service failed to start due to the following error: 

%%1053

 

Error: (01/28/2015 09:00:53 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Assistant Service service to connect.

 

Error: (01/28/2015 08:57:01 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Superfetch service terminated with the following error: 

%%1062

 

Error: (01/28/2015 08:13:24 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (01/28/2015 07:00:25 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Windows Modules Installer service terminated with the following error: 

%%16389

 

Error: (01/28/2015 06:59:26 PM) (Source: Service Control Manager) (EventID: 7043) (User: )

Description: The Windows Update service did not shut down properly after receiving a preshutdown control.

 

Error: (01/28/2015 06:57:58 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80246013: Microsoft Office File Validation Add-in.

 

Error: (01/28/2015 06:49:09 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The Software Protection service hung on starting.

 

 

Microsoft Office Sessions:

=========================

 

CodeIntegrity Errors:

===================================

  Date: 2015-01-28 17:31:46.209

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\propsys.dll that did not meet the Windows signing level requirements.

 

  Date: 2014-08-15 21:54:10.057

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

Processor: AMD E1-2100 APU with Radeon™ HD Graphics 

Percentage of memory in use: 48%

Total physical RAM: 3546.26 MB

Available physical RAM: 1828.18 MB

Total Pagefile: 7130.26 MB

Available Pagefile: 5335.25 MB

Total Virtual: 131072 MB

Available Virtual: 131071.85 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:446.27 GB) (Free:363.99 GB) NTFS

Drive d: (RECOVERY) (Fixed) (Total:18.72 GB) (Free:1.85 GB) NTFS ==>[System with boot components (obtained from reading drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 2E0F7135)

 

Partition: GPT Partition Type.

 

==================== End Of Log ============================

 

The TDSS Killer Log :

 

08:43:17.0264 0x05a0  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04

08:43:17.0264 0x05a0  UEFI system

08:43:20.0905 0x05a0  ============================================================

08:43:20.0905 0x05a0  Current date / time: 2015/01/29 08:43:20.0905

08:43:20.0905 0x05a0  SystemInfo:

08:43:20.0905 0x05a0  

08:43:20.0905 0x05a0  OS Version: 6.3.9600 ServicePack: 0.0

08:43:20.0905 0x05a0  Product type: Workstation

08:43:20.0905 0x05a0  ComputerName: BRUNO

08:43:20.0905 0x05a0  UserName: Bruno Sanfacon

08:43:20.0905 0x05a0  Windows directory: C:\Windows

08:43:20.0905 0x05a0  System windows directory: C:\Windows

08:43:20.0905 0x05a0  Running under WOW64

08:43:20.0905 0x05a0  Processor architecture: Intel x64

08:43:20.0905 0x05a0  Number of processors: 2

08:43:20.0905 0x05a0  Page size: 0x1000

08:43:20.0905 0x05a0  Boot type: Normal boot

08:43:20.0905 0x05a0  ============================================================

08:43:21.0561 0x05a0  KLMD registered as C:\Windows\system32\drivers\89477418.sys

08:43:22.0577 0x05a0  System UUID: {A9B1EF18-3E26-5206-6B01-3EC5E00852A8}

08:43:24.0155 0x05a0  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

08:43:24.0186 0x05a0  ============================================================

08:43:24.0186 0x05a0  \Device\Harddisk0\DR0:

08:43:24.0186 0x05a0  GPT partitions:

08:43:24.0186 0x05a0  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {AD1C799F-69D5-4D7C-AE77-845B4F953988}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0xC8000

08:43:24.0186 0x05a0  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {40C61B19-E681-47F9-ACAA-0F508D4D5B3F}, Name: EFI system partition, StartLBA 0xC8800, BlocksNum 0x82000

08:43:24.0186 0x05a0  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {C29384D5-32D4-4F74-A5E7-BDA034998EA6}, Name: Microsoft reserved partition, StartLBA 0x14A800, BlocksNum 0x40000

08:43:24.0186 0x05a0  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {511972B3-6181-4DC2-B853-C6F359E9BA56}, Name: Basic data partition, StartLBA 0x18A800, BlocksNum 0x37C89000

08:43:24.0186 0x05a0  \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {B268F3B0-E230-4EEB-ADCB-AE6D59956A67}, Name: Basic data partition, StartLBA 0x37E13800, BlocksNum 0x2570000

08:43:24.0186 0x05a0  MBR partitions:

08:43:24.0186 0x05a0  ============================================================

08:43:24.0202 0x05a0  C: <-> \Device\Harddisk0\DR0\Partition4

08:43:24.0249 0x05a0  D: <-> \Device\Harddisk0\DR0\Partition5

08:43:24.0249 0x05a0  ============================================================

08:43:24.0249 0x05a0  Initialize success

08:43:24.0249 0x05a0  ============================================================

08:43:40.0995 0x0f10  ============================================================

08:43:40.0995 0x0f10  Scan started

08:43:40.0995 0x0f10  Mode: Manual; SigCheck; TDLFS; 

08:43:40.0995 0x0f10  ============================================================

08:43:40.0995 0x0f10  KSN ping started

08:43:43.0479 0x0f10  KSN ping finished: true

08:43:45.0448 0x0f10  ================ Scan system memory ========================

08:43:45.0448 0x0f10  System memory - ok

08:43:45.0464 0x0f10  ================ Scan services =============================

08:43:45.0667 0x0f10  [ E1832BD9FD7E0FC2DC9FA5935DE3E8C1, 41FF7418887AFC8B9C96EF21C5950DD342CC9E3C0D87AFD60A05B988C1D6CC23 ] 1394ohci        C:\Windows\System32\drivers\1394ohci.sys

08:43:45.0964 0x0f10  1394ohci - ok

08:43:46.0026 0x0f10  [ AD508A1A46EC21B740AB31C28EFDFDB1, 9B1046CF0B80723149BD359B55CC0B8B3ABBEAA9038469F542A4C345C503FB02 ] 3ware           C:\Windows\system32\drivers\3ware.sys

08:43:46.0120 0x0f10  3ware - ok

08:43:46.0245 0x0f10  [ 9539F7917B4B6D92C90F0FAA6B86C605, B4C284E8EECC2E7025053A3320EFDC9F47BCA9828853AD2A805DB826CA4AC27E ] ACPI            C:\Windows\system32\drivers\ACPI.sys

08:43:46.0417 0x0f10  ACPI - ok

08:43:46.0448 0x0f10  [ AC8279D229398BCF05C3154ADCA86813, 083E86CBE53244D24C334DB1511C77025133AE7875191845764B890A8CA5AFA9 ] acpiex          C:\Windows\system32\Drivers\acpiex.sys

08:43:46.0542 0x0f10  acpiex - ok

08:43:46.0573 0x0f10  [ A8970D9BF23CD309E0403978A1B58F3F, 9946C8477104EEC7DB197E2222F9905307F101C398CCED4B5FD0F86A5622C791 ] acpipagr        C:\Windows\System32\drivers\acpipagr.sys

08:43:46.0698 0x0f10  acpipagr - ok

08:43:46.0714 0x0f10  [ 111A89C99C5B4F1A7BCE5F643DD86F65, 41A2E49FF443927D05F7EF638518108227852984E68D4663C8761178C0B84A45 ] AcpiPmi         C:\Windows\System32\drivers\acpipmi.sys

08:43:46.0839 0x0f10  AcpiPmi - ok

08:43:46.0854 0x0f10  [ 5758387D68A20AE7D3245011B07E36E7, 77832E200E8B0D259552F6F60FE454A887E3EBBB9EA2F3590E6645289A04E293 ] acpitime        C:\Windows\System32\drivers\acpitime.sys

08:43:46.0948 0x0f10  acpitime - ok

08:43:47.0057 0x0f10  [ DC1A476AC0550B2060E78D9DB5E5ABFD, 9F43DF32C6F08654DBC8229E114528E3F2F07CBB423576E1EBE8338E7C372F3B ] AdaptiveSleepService C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe

08:43:47.0151 0x0f10  AdaptiveSleepService - detected UnsignedFile.Multi.Generic ( 1 )

08:43:49.0609 0x0f10  Detect skipped due to KSN trusted

08:43:49.0609 0x0f10  AdaptiveSleepService - ok

08:43:49.0718 0x0f10  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

08:43:49.0812 0x0f10  AdobeARMservice - ok

08:43:49.0953 0x0f10  [ A2A9C100FE1BE20A76C0B80D4CA44103, C34B4A31C8563E29EC6A3D318C40075F43C891C23D156F53EE2102C959B7887F ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

08:43:50.0062 0x0f10  AdobeFlashPlayerUpdateSvc - ok

08:43:50.0156 0x0f10  [ 7C1FDF1B48298CBA7CE4BDD4978951AD, 80F4D536E1231B30E836F72ADC8814AE6AA9FEC573FB5F3F965FAC8ABCCAF0F8 ] ADP80XX         C:\Windows\system32\drivers\ADP80XX.SYS

08:43:50.0359 0x0f10  ADP80XX - ok

08:43:50.0437 0x0f10  [ 0F17D49BE041B7EFF1D33BF1414E7AC6, F8B536B60903814DF88DAF535753288537EF0993E42AA4E734EDA8D68B24C7AB ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

08:43:50.0562 0x0f10  AeLookupSvc - ok

08:43:50.0609 0x0f10  [ D1E343BC00136CE03C4D403194D06A80, 94F2543164A2CEA179EDE53E1294EE24391A59CAEFF83BA5CE9385E8E686E89C ] AERTFilters     C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE

08:43:50.0687 0x0f10  AERTFilters - ok

08:43:50.0765 0x0f10  [ 374E27295F0A9DCAA8FC96370F9BEEA5, 51C394E0C2322D7D093941A1B8766171B5D1F47DF2FE0834209492891EA7D999 ] AFD             C:\Windows\system32\drivers\afd.sys

08:43:50.0937 0x0f10  AFD - ok

08:43:50.0984 0x0f10  [ 7DFAEBA9AD62D20102B576D5CAC45EC8, 9FA5207335303D1E8E9A3C9E1FB82C09AD21B04382F69D777A67E48EE91D2093 ] agp440          C:\Windows\system32\drivers\agp440.sys

08:43:51.0078 0x0f10  agp440 - ok

08:43:51.0109 0x0f10  [ F0CB6DB513CAC393D04A0FCE0A59E1BF, E6EE159D0E6B1F666946B1FE421874044E89BB2EB60A521BAA111A1229FA7B2D ] ahcache         C:\Windows\system32\DRIVERS\ahcache.sys

08:43:51.0203 0x0f10  ahcache - ok

08:43:51.0265 0x0f10  [ A91D8E1E433EFB32551BCE69037E1CE7, 41DFDD5B56918D19D09DFB3E4B07460AA85647A8647ABBBB906158D8D6653290 ] ALG             C:\Windows\System32\alg.exe

08:43:51.0359 0x0f10  ALG - ok

08:43:51.0421 0x0f10  [ CE2A98C4B34ED87C43D87F0D82BD79E7, E4356DD74D68992B3FDABA830999636D63B878FF03634C35FC2A16461E943236 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe

08:43:51.0578 0x0f10  AMD External Events Utility - ok

08:43:51.0609 0x0f10  AMD FUEL Service - ok

08:43:51.0624 0x0f10  [ C0A486A51FDE02E22E8D5E5544479825, 9C476AAAD4BE8C5D5AD9F90078ADDD7420D38F0B1901763CCFC0985DBC6FD5F4 ] AmdAS4          C:\Windows\System32\drivers\AmdAS4.sys

08:43:51.0703 0x0f10  AmdAS4 - ok

08:43:51.0749 0x0f10  [ 7589DE749DB6F71A68489DCE04158729, 5F35EDD50737985595C9D6703237CA2ADE49AA5443331020899698EB5114A0FB ] AmdK8           C:\Windows\System32\drivers\amdk8.sys

08:43:51.0828 0x0f10  AmdK8 - ok

08:43:52.0796 0x0f10  [ ECEE0A0E6E872101C8339C8C75D12326, CC4468A19475124160410F91BE00E2E66A52670CDA8B0EC41F8B325A0428A5E1 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys

08:43:54.0312 0x0f10  amdkmdag - ok

08:43:54.0468 0x0f10  [ ACE022C96AF60E8B4B34C72BD8AF926C, A718D0EFBA4D036E8E10427DE98626CDC1EC9178B81E533AF9A35C2AD3876C55 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys

08:43:54.0671 0x0f10  amdkmdap - ok

08:43:54.0749 0x0f10  [ B46D2D89AFF8A9490FA8C98C7A5616E3, BE0765B5423B690E0F097FECD9717FAA95BFDFFDC6CF1B93DE5A19A1B7797879 ] AmdPPM          C:\Windows\System32\drivers\amdppm.sys

08:43:54.0828 0x0f10  AmdPPM - ok

08:43:54.0906 0x0f10  [ D2BF2F94A47D332814910FD47C6BBCD2, FE273D77D119D958676E1197D9EA7B008E3B05C6192B1962A81D4223ED204C35 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

08:43:54.0968 0x0f10  amdsata - ok

08:43:55.0031 0x0f10  [ A8E04943C7BBA7219AA50400272C3C6E, 794C0BD12DF0392654E9A37AE4A24B5BE2D83F1F24F74DD48A1A0BF3AB8B1FF8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys

08:43:55.0124 0x0f10  amdsbs - ok

08:43:55.0156 0x0f10  [ CEA5F4F27CFC08E3A44D576811B35F50, 89DF64B81BD109BAABAE93A4603C1617241219F38DDAF325EFE6BD35FF6FD717 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

08:43:55.0234 0x0f10  amdxata - ok

08:43:55.0281 0x0f10  [ 9DCB42905F1EBF9CEC57EE5DF0BDA965, 4C888AAD0DDE01565FD7FBB6B70A500158CF2E4CECF9ADD4AFD302A993587269 ] AppHostSvc      C:\Windows\system32\inetsrv\apphostsvc.dll

08:43:55.0359 0x0f10  AppHostSvc - ok

08:43:55.0406 0x0f10  [ 04951A9A937CBE28A2D3FEEA360B6D1F, D8AAF000BE4FE4B203DC2EB2A64F780A542E5238CE3F9952FD03277379B11529 ] AppID           C:\Windows\system32\drivers\appid.sys

08:43:55.0484 0x0f10  AppID - ok

08:43:55.0546 0x0f10  [ C0DC3F58214A227980AEB091CFD2F973, 0C3E8453C9F65ADA3E74C38C0E3AC3E0CBFD807B827097046265B38839E151E3 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

08:43:55.0624 0x0f10  AppIDSvc - ok

08:43:55.0796 0x0f10  [ 034ED41F13D9C1845C1E081F05B640DB, E4E17BA0B22C464DE60A6BF68D4D035D1B838DE4F0361029DED1AE00503E135C ] Appinfo         C:\Windows\System32\appinfo.dll

08:43:55.0874 0x0f10  Appinfo - ok

08:43:56.0062 0x0f10  [ CB12C47647D8BDAFAA94C0856B14128B, 5590C98095357C92563EF94800107D3611AA6ECA1A70BE463C03B279E618A6C4 ] AppReadiness    C:\Windows\system32\AppReadiness.dll

08:43:56.0234 0x0f10  AppReadiness - ok

08:43:56.0406 0x0f10  [ F7529BD3FFAC9C33D15F6DE3B7353B03, 8EF0A84C9687A246B60939A326E498121039E9CC617A7ABBA933EDD327F3467E ] AppXSvc         C:\Windows\system32\appxdeploymentserver.dll

08:43:56.0703 0x0f10  AppXSvc - ok

08:43:56.0765 0x0f10  [ FE62EDC3C804974E6CECB471E1E80EF6, D2C293645BECF1153D94DA41632DBE5852DCA32124B01F047AB5E6887742DA41 ] APXACC          C:\Windows\system32\DRIVERS\appexDrv.sys

08:43:56.0890 0x0f10  APXACC - ok

08:43:56.0968 0x0f10  [ 65045784366F7EC5FB4E71BCF923187B, 53C215C64FF12E44B097F7CB88E8482438CE0ACBD3C68D8FD38BA0D0D8747FAA ] arcsas          C:\Windows\system32\drivers\arcsas.sys

08:43:57.0046 0x0f10  arcsas - ok

08:43:57.0171 0x0f10  [ AA2E8C6B8D7EA7BAF04C988801927F48, 4B82043F1B9C67CDCDC71102F7AEE05EEA8F9775A5CB33AE80F4DCDB42521C40 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

08:43:57.0249 0x0f10  aspnet_state - ok

08:43:57.0281 0x0f10  [ 9BE9F2B83DE80E2752B1405CC427E2EC, 6015CA66553B3B882083B33F24FB338249A110D9769831C3D3D3C681AAFA9411 ] aswHwid         C:\Windows\system32\drivers\aswHwid.sys

08:43:57.0343 0x0f10  aswHwid - ok

08:43:57.0390 0x0f10  [ 2DA1C1AEDF454F8E32A863A1AEACDD8C, F02E4D197AE00B9A9507CF6007A7B7BEA54AF0F255B752FBA7174FA2596D1CA9 ] aswMonFlt       C:\Windows\system32\drivers\aswMonFlt.sys

08:43:57.0468 0x0f10  aswMonFlt - ok

08:43:57.0499 0x0f10  [ 4750016EF9CC1DEC6DA3FE5AF9A7F095, C4CF46246D8A3FF9BD8D2FE899685654ADD45EB9B032F33804D0B8131882BC74 ] aswRdr          C:\Windows\system32\drivers\aswRdr2.sys

08:43:57.0578 0x0f10  aswRdr - ok

08:43:57.0609 0x0f10  [ 1323269A92645705DEFA053F3596829D, 83EC58E0577A1E45D1FCBC0C0AF182099FB70B9005B9F8161166EBB4E9F58F35 ] aswRvrt         C:\Windows\system32\drivers\aswRvrt.sys

08:43:57.0671 0x0f10  aswRvrt - ok

08:43:57.0781 0x0f10  [ E74FD717476B30E23F45354B8F3ACB30, 951D1655E1FA4CF0ACB29F2EEDDB3B42522D392F46DD826C63DCA8941E17ABA8 ] aswSnx          C:\Windows\system32\drivers\aswSnx.sys

08:43:57.0984 0x0f10  aswSnx - ok

08:43:58.0062 0x0f10  [ B1881A01E301990B671694CA1623F1B6, 5299C713EA7CF96F0550943DB37E963CDA09258F65C471CCEEAB44C4736B7A08 ] aswSP           C:\Windows\system32\drivers\aswSP.sys

08:43:58.0187 0x0f10  aswSP - ok

08:43:58.0234 0x0f10  [ 7509F07BA6F84C1E3B2C0D78A1F6F782, A90A36E8E23F58E430DE98B3623688DC09D34B62906EF7796DFC90F581FC385F ] aswStm          C:\Windows\system32\drivers\aswStm.sys

08:43:58.0328 0x0f10  aswStm - ok

08:43:58.0406 0x0f10  [ 1A5BDDE65B648DC3AD48B6ECAA3AE9C8, 858F674C3B775F9C8C782B7AFAC0B02AE9410C9F3B7F5B3AE1C4AD3BF6448C14 ] aswVmm          C:\Windows\system32\drivers\aswVmm.sys

08:43:58.0515 0x0f10  aswVmm - ok

08:43:58.0546 0x0f10  [ 74B14192CF79A72F7536B27CB8814FBD, 0CF6BBB63FFE0C12777664D80B2797923844C8392D0FD81D7962EE5EE2C3C3D9 ] atapi           C:\Windows\system32\drivers\atapi.sys

08:43:58.0624 0x0f10  atapi - ok

08:43:58.0687 0x0f10  [ AEB8BC801F11E436EBD8D347F866F7A1, 5C1DBFDD1D705E8CD8680DA3AC933EE47676FFB5FB0800CD0FCDAB5C379356B3 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdWB6.sys

08:43:58.0796 0x0f10  AtiHDAudioService - ok

08:43:58.0859 0x0f10  [ 8779FDAE68BC948B0FE152E758CC8DA7, 13070C2073F8E7546B48AE9CF54067B9BB75DFCD98F2987B90FFAD20D40D54CF ] AudioEndpointBuilder C:\Windows\System32\AudioEndpointBuilder.dll

08:43:59.0015 0x0f10  AudioEndpointBuilder - ok

08:43:59.0124 0x0f10  [ 61EA45A645854FE81D8A924E2D93DFFE, 34F79532297F609CA93C380B68BB8B7B0F027F9C8F4FB8E02A9A43EA3D155F1B ] Audiosrv        C:\Windows\System32\Audiosrv.dll

08:43:59.0343 0x0f10  Audiosrv - ok

08:43:59.0421 0x0f10  [ E3F7EC811923F3F1A77B185F22638E5E, 324041256314C1471B5F123FA8DECC8F374A6B497A6419D4CAF61E68E1733265 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe

08:43:59.0499 0x0f10  avast! Antivirus - ok

08:43:59.0546 0x0f10  [ 96E8CAF20FC4B6C31CAD7816A801EB78, E4870DB8FFBDCFEE98449338D0BDBF2DD0B5FEC75514E41C11A882BE6EB16833 ] AxInstSV        C:\Windows\System32\AxInstSV.dll

08:43:59.0656 0x0f10  AxInstSV - ok

08:43:59.0734 0x0f10  [ A4A73F631FE2AA2826FBE4A399B04DEF, 973AACE8DC8DA669D0DF20F17EFDEEABB90AA046AC980948D16A62D39A606A79 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys

08:43:59.0906 0x0f10  b06bdrv - ok

08:43:59.0937 0x0f10  [ 8CC7F7E4AFCBA605921B137ED7992C68, 71406E6D6E9964740A6D90B05329D5492BB90AF40E0630CF2FBF4BA4BA14F2DD ] BasicDisplay    C:\Windows\System32\drivers\BasicDisplay.sys

08:44:00.0062 0x0f10  BasicDisplay - ok

08:44:00.0124 0x0f10  [ 38A82F4EE8C416A6744B6D30381ED768, 9EAAE5F43BA09359130AC04B1DCA0F5D4DF32ED89C02DC5CEB640918948847F7 ] BasicRender     C:\Windows\System32\drivers\BasicRender.sys

08:44:00.0218 0x0f10  BasicRender - ok

08:44:00.0296 0x0f10  [ C1ABB0F7E3BEA48A0417BDF6FF14AB21, 1CAC63A1A0FB9855A27EE977794576A860F6650C9EF7667FFB27F2A2FF721857 ] bcmfn2          C:\Windows\System32\drivers\bcmfn2.sys

08:44:00.0374 0x0f10  bcmfn2 - ok

08:44:00.0468 0x0f10  [ E07C80468D0C599BFF01D9D4EC7AEDC3, F675F455924DEC3FF69AD816DFEB6E74C804AEC3D3BFF7515953DB9D79C9B2D0 ] BDESVC          C:\Windows\System32\bdesvc.dll

08:44:00.0671 0x0f10  BDESVC - ok

08:44:00.0718 0x0f10  [ EC19013E4CF87609534165DF897274D6, 8ED45537CF2D58D759A587CCBFDADD5580C7447B0C3B172CF19ECC7585E073FC ] Beep            C:\Windows\system32\drivers\Beep.sys

08:44:00.0843 0x0f10  Beep - ok

08:44:00.0999 0x0f10  [ 20FB137ADDE1255F15F265A7BD9579BE, 87B4D5C91EFEAD987AAC3491A4360F82824C46AFF958B6F4CAED7C12224EF159 ] BFE             C:\Windows\System32\bfe.dll

08:44:01.0312 0x0f10  BFE - ok

08:44:01.0781 0x0f10  [ 15225081966C785A9192782401643FD4, E2BA0C8D044556FDD9DD7A25F7F71553DE7A2924E78F9284413C2AC46F0BF4EB ] BITS            C:\Windows\System32\qmgr.dll

08:44:02.0031 0x0f10  BITS - ok

08:44:02.0187 0x0f10  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

08:44:02.0296 0x0f10  Bonjour Service - ok

08:44:02.0359 0x0f10  [ 6B4FFFDDC618FCF64473CAA86E305697, 29EA66071D5822920F5C50533673ADAB5204F8B25C11027AD27450D881F1142D ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

08:44:02.0468 0x0f10  bowser - ok

08:44:02.0546 0x0f10  [ E325BCD68EC0CF2E2EDD0AB7CC17C698, 4DEDEF91F6BD1CC8DBE118AC28CA6BD874449A053B9CDE9FFEB1C7B98501D938 ] BrokerInfrastructure C:\Windows\System32\bisrv.dll

08:44:02.0687 0x0f10  BrokerInfrastructure - ok

08:44:02.0749 0x0f10  [ 041A999E4FF9A7CDBE67357751881FB8, 356C52637EA715D6FA2B65BD311C9BF1635A582023434902EC2DE4A2448961F8 ] Browser         C:\Windows\System32\browser.dll

08:44:02.0859 0x0f10  Browser - ok

08:44:02.0906 0x0f10  [ A8F23D453A424FF4DE04989C4727ECC7, AE4A9081395C7379F1C947EF8243F7609F90C843E086B8E77E1A2C06E36D4381 ] BthAvrcpTg      C:\Windows\System32\drivers\BthAvrcpTg.sys

08:44:03.0046 0x0f10  BthAvrcpTg - ok

08:44:03.0078 0x0f10  [ 746B9F94214915AECDE4B7FEA5FF9664, EA2877D49DB4B7B9CE61653D63E8776DFF1CBCCAB12C14DB1D20DA44B8F06357 ] BthHFEnum       C:\Windows\System32\drivers\bthhfenum.sys

08:44:03.0171 0x0f10  BthHFEnum - ok

08:44:03.0203 0x0f10  [ 71FE2A48E4C93DDB9798C024880B6C07, 8E93DE29C61A5FA64216231228CB3C4A1A693FE87CAA2C070BCAD7BE2D8ED000 ] bthhfhid        C:\Windows\System32\drivers\BthHFHid.sys

08:44:03.0281 0x0f10  bthhfhid - ok

08:44:03.0312 0x0f10  [ 07E33226AD218A2A162662A05CAFB52F, 0AC3D8B79EDA6DA232FA4E1CAF6592420A9EDE96350D1F0504C2434261684F0B ] BTHMODEM        C:\Windows\System32\drivers\bthmodem.sys

08:44:03.0406 0x0f10  BTHMODEM - ok

08:44:03.0468 0x0f10  [ E5E48FEED73D463175EAB1542495191C, 0A8182F5BA7B694AB1DD3680F1194E4A568FE40DBA4BFDFF2EA09BAD045FFB29 ] bthserv         C:\Windows\system32\bthserv.dll

08:44:03.0562 0x0f10  bthserv - ok

08:44:03.0671 0x0f10  [ DEE40211AA700A0A9D7F95EC38DE0714, F3926D92D940311D7E1E7E656116B1B48C4D6B3AFC35017658C4EC3D0A33EF40 ] Cachedrv server C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

08:44:03.0781 0x0f10  Cachedrv server - detected UnsignedFile.Multi.Generic ( 1 )

08:44:06.0234 0x0f10  Detect skipped due to KSN trusted

08:44:06.0234 0x0f10  Cachedrv server - ok

08:44:06.0281 0x0f10  [ 2FA6510E33F7DEFEC03658B74101A9B9, 61C8C8E3F09B427711464C974EE22E1E01C48E10DB54A4EC9901F482FC36C978 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

08:44:06.0390 0x0f10  cdfs - ok

08:44:06.0421 0x0f10  [ C6796EA22B513E3457514D92DCDB1A3D, 2B893F3950C6B913B934C2089B69F3B0B77F229AE1820907E598455CBB78139C ] cdrom           C:\Windows\System32\drivers\cdrom.sys

08:44:06.0546 0x0f10  cdrom - ok

08:44:06.0593 0x0f10  [ AB285CE3431FF3D2ACE669245874C1C7, 6AF4C3E86EFA51F7FB6F8492CB2CCB807C7775EAE0508B87F07134FDAC679BD7 ] CertPropSvc     C:\Windows\System32\certprop.dll

08:44:06.0734 0x0f10  CertPropSvc - ok

08:44:06.0765 0x0f10  [ BE9936EDD3267FAAFF94A7835867F00B, 3CEEF2377D45ED38C7CD3CE4C746EC5EA7277EFEC728A5438F0EF5F62FC7C859 ] circlass        C:\Windows\System32\drivers\circlass.sys

08:44:06.0874 0x0f10  circlass - ok

08:44:06.0937 0x0f10  [ 179A41249055D5F039F1B6703F3B6D2B, 886CF715D9E85DB5C9B991EBCB9B12E27AA0EEE52528E222C80CA5B5B0A7AF52 ] CLFS            C:\Windows\system32\drivers\CLFS.sys

08:44:07.0078 0x0f10  CLFS - ok

08:44:07.0140 0x0f10  [ 3E76A1547F2448BCEE3D2F4AE3931AB5, 31B41723FAA4210A86B1AE02D6C052BD8B738C4B89FB0177C1AE997D24BA5B8C ] CLVirtualDrive  C:\Windows\system32\DRIVERS\CLVirtualDrive.sys

08:44:07.0218 0x0f10  CLVirtualDrive - ok

08:44:07.0265 0x0f10  [ 39F71BF21E7F8EBE9B4810BC95EE26D6, 6134013F918D41A1AA8C814217A272F2C428FA3FE97DB66501FA50A488B0C991 ] clwvd           C:\Windows\system32\DRIVERS\clwvd.sys

08:44:07.0328 0x0f10  clwvd - ok

08:44:07.0343 0x0f10  [ EF6EF85DADC3184A10D8F2F7159973CB, 42FCB286CED95A5DEBC5C0C894FCBC4818A2C818BB71087142FB51A08A0BE96B ] CmBatt          C:\Windows\System32\drivers\CmBatt.sys

08:44:07.0437 0x0f10  CmBatt - ok

08:44:07.0515 0x0f10  [ 4E1207CE16E615B0B7A70DC889F4500E, 1778D5AC0AF5F5DD1551192F4CDBCCB9878995155CF337EBB03460A6FD5C6B78 ] CNG             C:\Windows\system32\Drivers\cng.sys

08:44:07.0656 0x0f10  CNG - ok

08:44:07.0703 0x0f10  [ 03AAED827C36F35D70900558B8274905, 8E44A23C6013FFAE7769F99CAA3B1D6288DE00A38937F9056903AC265B503AFA ] CompositeBus    C:\Windows\System32\drivers\CompositeBus.sys

08:44:07.0781 0x0f10  CompositeBus - ok

08:44:07.0796 0x0f10  COMSysApp - ok

08:44:07.0828 0x0f10  [ A1FF7DFBFBE164CF92603C651D304DD2, 470ACE5A75E64FC62C950037201199857E974803625DC73BEDBCF6FA4DDD496C ] condrv          C:\Windows\system32\drivers\condrv.sys

08:44:07.0906 0x0f10  condrv - ok

08:44:07.0953 0x0f10  [ 0EFE4B5884A8032617826A4D76F80969, 083D296CC623C83D36A97AEE343ADF819B17E490F931DBE4D161BD1E8C289E02 ] CryptSvc        C:\Windows\system32\cryptsvc.dll

08:44:08.0062 0x0f10  CryptSvc - ok

08:44:08.0187 0x0f10  [ 398AA4D2401AF8C831C90B96415F1DE5, 891B9E15A103744EA74C970DC489B8CFD326CEA0C51244E8E52B51ADADE2C0E8 ] CyberLink PowerDVD 12 Media Server Monitor Service C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

08:44:08.0249 0x0f10  CyberLink PowerDVD 12 Media Server Monitor Service - ok

08:44:08.0281 0x0f10  [ FF250422744FC22839C4CD8D111AF95B, B48A8B536B4A217CA205279D8D64F9F8766AA19CAF41A345679C0192A107616F ] CyberLink PowerDVD 12 Media Server Service C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

08:44:08.0374 0x0f10  CyberLink PowerDVD 12 Media Server Service - ok

08:44:08.0406 0x0f10  [ 315BA4BC19316D72B2E037534E048B93, 69613635DB23E6A935673B1025C2010ED3E195473D25368CF74234C4C36910BE ] dam             C:\Windows\system32\drivers\dam.sys

08:44:08.0468 0x0f10  dam - ok

08:44:08.0578 0x0f10  [ 81979817943D830BF24571B7C1B28A1A, 9584D8F1FB3E6CF17BD465670B208C723A8E8B06775A3DA44F75D7710404EEA6 ] DcomLaunch      C:\Windows\system32\rpcss.dll

08:44:08.0765 0x0f10  DcomLaunch - ok

08:44:08.0843 0x0f10  [ D249C3A58A4FCF755EF4C94F7047E015, 68C044CE2DB93FB502F85F6E081EA164F6E6DCBA6B3EE2A5CBDA122065E522F8 ] defragsvc       C:\Windows\System32\defragsvc.dll

08:44:08.0984 0x0f10  defragsvc - ok

08:44:09.0062 0x0f10  [ 8F387C2C99EE09C6E2AC316205F86A17, EC9E8AE72A21992AA118964E17090BA4503EB051273AD18185C95172F57328CE ] DeviceAssociationService C:\Windows\system32\das.dll

08:44:09.0203 0x0f10  DeviceAssociationService - ok

08:44:09.0234 0x0f10  [ BC6849C62DB407573C6AD8CB1A4D2628, 5BDE0D60F85E4C27CEAD1B301155B54D841FB773BD5BB8AC5DDAEE31F8E94627 ] DeviceInstall   C:\Windows\system32\umpnpmgr.dll

08:44:09.0343 0x0f10  DeviceInstall - ok

08:44:09.0359 0x0f10  [ A03F362C5557E238CBFA914689C77248, BAD0A1124E6A384C15028FBE121ADF650F7716442555AD3737B9EA1F58A69246 ] Dfsc            C:\Windows\system32\Drivers\dfsc.sys

08:44:09.0453 0x0f10  Dfsc - ok

08:44:09.0515 0x0f10  [ 05DE04005CE0D84D0E6AD21CAEB369C6, E6704A2A685BCFD560796D7C328F8E53DF0793DBDA590598A492D9070D109298 ] Dhcp            C:\Windows\system32\dhcpcore.dll

08:44:09.0656 0x0f10  Dhcp - ok

08:44:09.0703 0x0f10  [ 4D40C9B33F738797CF50E77CB7C53E85, 7BA341342A47DEB15B51971C97A5237ACD8BDAD9033F63DF0000892BE43F8E13 ] disk            C:\Windows\system32\drivers\disk.sys

08:44:09.0781 0x0f10  disk - ok

08:44:09.0812 0x0f10  [ EB70A894708D1BC176AFD690FF06085F, 0DD2A97F5E1B38D1F7C0D44E50F09EA222B18B3B074CC9C8CD25A7526CB1A112 ] dmvsc           C:\Windows\System32\drivers\dmvsc.sys

08:44:09.0921 0x0f10  dmvsc - ok

08:44:09.0984 0x0f10  [ FE7656474448BE6A6C68E5C9BEB7CA94, 8B9F04CAA29A6EEFCA3D1E7BAFE340D5CCA8AF665474E69B1DF7E2A518B83A89 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

08:44:10.0109 0x0f10  Dnscache - ok

08:44:10.0171 0x0f10  [ 50288EA079BB520C2B8C8A154202D518, 8916A9180CA009D124FFDFB4CCF5FDFEF7FA2FD37CBCD49FAD4C68E051B4734D ] dot3svc         C:\Windows\System32\dot3svc.dll

08:44:10.0275 0x0f10  dot3svc - ok

08:44:10.0322 0x0f10  [ 281BEE07BA97E3E98D12A822D923D0D8, 6EB482B2D4D6048D145C3738B2B6FA27A90B5EA53E9167447820F9981B004E63 ] DPS             C:\Windows\system32\dps.dll

08:44:10.0431 0x0f10  DPS - ok

08:44:10.0478 0x0f10  [ DDC11A202207C0400CBE07315B8FDE5E, 3ED0CA3A714582D92001BA3BFF78BE082F4DC8021298D5A2632F3B2B0A1C09DC ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

08:44:10.0540 0x0f10  drmkaud - ok

08:44:10.0572 0x0f10  [ 5B074F14F5DD6418F46EE4CA2DEB7EA8, B8223D73C3DE123759101F7D5D45C60BD12B221F09D349575A1044CE3F43CBC5 ] DsmSvc          C:\Windows\System32\DeviceSetupManager.dll

08:44:10.0697 0x0f10  DsmSvc - ok

08:44:10.0822 0x0f10  [ 313DCE665B57000B18CB26C6B6A10DFE, 6C332D4AD13A316C192321AB7E7597E66AF8E1688101FFD851E06C52128DBA52 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

08:44:11.0134 0x0f10  DXGKrnl - ok

08:44:11.0165 0x0f10  [ 6073537F250B45E1CB2A02E97F0FE1B2, 653F3F2F2019168EDF225944A88AFDBF8393B62AA076BD19980691778F3DB67D ] Eaphost         C:\Windows\System32\eapsvc.dll

08:44:11.0259 0x0f10  Eaphost - ok

08:44:11.0509 0x0f10  [ 114BCFDF367FF37C3F1B0A96AF542E4D, D385BC1D91BC1406091C8C3691C07A90BD60EDE05B1384E5AA3506FCB909C857 ] ebdrv           C:\Windows\system32\drivers\evbda.sys

08:44:12.0025 0x0f10  ebdrv - ok

08:44:12.0072 0x0f10  [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] EFS             C:\Windows\System32\lsass.exe

08:44:12.0150 0x0f10  EFS - ok

08:44:12.0181 0x0f10  [ 43531A5993380CC5113242C29D265FD9, EE0076D96F7F3CF29884AC7A67C08A429115A7201354A1FB5DE45FD63ABB4960 ] EhStorClass     C:\Windows\system32\drivers\EhStorClass.sys

08:44:12.0244 0x0f10  EhStorClass - ok

08:44:12.0275 0x0f10  [ 6F8E738A9505A388B1157FDDE7B3101B, 3696CA634102B41EEA11EB9DCA0B24439D8636AED4A7190C138C5E64A2EFB514 ] EhStorTcgDrv    C:\Windows\system32\drivers\EhStorTcgDrv.sys

08:44:12.0353 0x0f10  EhStorTcgDrv - ok

08:44:12.0384 0x0f10  [ DFFFAE1442BA4076E18EED5E406FA0D3, 329FC6FB8D14BEACDBE2A5D4C496EDEA485E838B1DF27566E278F8F8E0D8E82E ] ErrDev          C:\Windows\System32\drivers\errdev.sys

08:44:12.0462 0x0f10  ErrDev - ok

08:44:12.0540 0x0f10  [ 030CE75B7D8F75FAA7BA1EC6FD0EB5A3, 5264734F0572FAEDCCB008221C9982CCB7922C4FFC358605424EA413CDCDAE99 ] EventSystem     C:\Windows\system32\es.dll

08:44:12.0665 0x0f10  EventSystem - ok

08:44:12.0712 0x0f10  [ 7729D294A555C7AEB281ED8E4D0E01E4, 7269E79D72CCE477AC108294D0DDFB59CF533B03C587599C5AB0507C43A0B6D4 ] exfat           C:\Windows\system32\drivers\exfat.sys

08:44:12.0822 0x0f10  exfat - ok

08:44:12.0869 0x0f10  [ 7C4E0D5900B2A1D11EDD626D6DDB937B, 732F310F8F6016C56F432A81636B13CE0124A802FE8DD91287B618EED22C9A1D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

08:44:12.0947 0x0f10  fastfat - ok

08:44:13.0025 0x0f10  [ 2BC8532ABF2B3756B78FA1DA54147DDE, DF65EE2AB0255A2CF3221085A6BE7C37E3DB6BFEED3BCADCDD69BB1049F6DCB1 ] Fax             C:\Windows\system32\fxssvc.exe

08:44:13.0181 0x0f10  Fax - ok

08:44:13.0212 0x0f10  [ 5D8402613E778B3BD45E687A8372710B, EE9EA10805168D309A609B9019AEC5961EE46D18207B5E0EA2DE4064A5770AF8 ] fdc             C:\Windows\System32\drivers\fdc.sys

08:44:13.0290 0x0f10  fdc - ok

08:44:13.0322 0x0f10  [ DC1A78BCCCB7EE53D6FD3BD615A8E222, EE16B6853185AAE779D7135035983938009901658F76A8856AAC12EBA15BB34E ] fdPHost         C:\Windows\system32\fdPHost.dll

08:44:13.0415 0x0f10  fdPHost - ok

08:44:13.0447 0x0f10  [ E5AD448F2DC84B1CF387FA7F2A3D1936, BBB29C79A085C503F5EFFB5144596D5DEC48A4EB34A049A4E7B38B27F6D92E0A ] FDResPub        C:\Windows\system32\fdrespub.dll

08:44:13.0556 0x0f10  FDResPub - ok

08:44:13.0603 0x0f10  [ 0046E0BD031213D37123876B0D0FA61C, A4FE17D56F0BAFB70D0D421ED9D1B6E50AF8ADAA4B59328A41AEC5B4C068A3CB ] fhsvc           C:\Windows\system32\fhsvc.dll

08:44:13.0712 0x0f10  fhsvc - ok

08:44:13.0775 0x0f10  [ BCFD8B149B3ADF92D0DB1E909CAF0265, 002B085C131473642450176B4B8359F3E5B04350AFB659B9C0F9EB587D1181E7 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

08:44:13.0837 0x0f10  FileInfo - ok

08:44:13.0853 0x0f10  [ A1A66C4FDAFD6B0289523232AFB7D8AF, 0F5832F626BB62190D5F3A088CE6E048D8A400CCF9EA527F06973CAD96D3A81C ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

08:44:13.0962 0x0f10  Filetrace - ok

08:44:13.0994 0x0f10  [ BE743083CF7063C486A4398E3AEFE59A, 85796D89943DD6FE3932C1ED6CF01470C1B4DFD243C390B07055FFDA3C231551 ] flpydisk        C:\Windows\System32\drivers\flpydisk.sys

08:44:14.0056 0x0f10  flpydisk - ok

08:44:14.0134 0x0f10  [ 6592D192E2823C043EDBC010E7774053, C025A0EC5517DC3BD5D6656DC0F0F19021FB3D2EE90EC6194E1BD74E638EBBDC ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

08:44:14.0244 0x0f10  FltMgr - ok

08:44:14.0369 0x0f10  [ 3FA6DC6B29717E32E211C1FD821F2C75, E467F3775427C93CC2B87327B0A45669631A5FC460C558F6796BA26002A8BBFC ] FontCache       C:\Windows\system32\FntCache.dll

08:44:14.0619 0x0f10  FontCache - ok

08:44:14.0697 0x0f10  [ 1C52387BF5A127F5F3BFB31288F30D93, 90D13F60170CD74304F3036A90D596AA3E1E134455A780310BDF67AC7815F2E7 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

08:44:14.0775 0x0f10  FontCache3.0.0.0 - ok

08:44:14.0822 0x0f10  [ 35005534E600E993A90B036E4E599F2B, DA56FA3776FBD3D50276CB7410E0CB6F137DD8FCA84C0F3FEF8B1FEA5F6CA592 ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

08:44:14.0884 0x0f10  FsDepends - ok

08:44:14.0915 0x0f10  [ 09F460AFEDCA03F3BF6E07D1CCC9AC42, B832091BC9B2C2FE38A4BCA132ABB58251E851F21EC6F39636E73777AB9A5791 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

08:44:14.0978 0x0f10  Fs_Rec - ok

08:44:15.0072 0x0f10  [ F152D55E497E12256290C43B31C7D0CE, FFC54B14CCFBC1548948C07FB3866E40A11D0C05AC352BD000E71CEF053F6A6E ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

08:44:15.0228 0x0f10  fvevol - ok

08:44:15.0259 0x0f10  [ 9591D0B9351ED489EAFD9D1CE52A8015, AC64C236C3AE545FCE8ED44A4A87FB86265A453BA60026EC9A4DE2B631E99996 ] FxPPM           C:\Windows\System32\drivers\fxppm.sys

08:44:15.0337 0x0f10  FxPPM - ok

08:44:15.0384 0x0f10  [ FC3EF65EE20D39F8749C2218DBA681CA, 12980F1DE99B25E6920A33556F3ABDA5EC9BFE4757BE602130B5E939D8D25CE3 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys

08:44:15.0447 0x0f10  gagp30kx - ok

08:44:15.0540 0x0f10  [ E976643CF97862F3408281E3EEBD5F7C, DBCAC28F3A309DB400DEB07658E073B9810AD0B92435047B711BD2965AF14FC5 ] GamesAppIntegrationService C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe

08:44:15.0619 0x0f10  GamesAppIntegrationService - ok

08:44:15.0650 0x0f10  [ A404AE536DD73FC8118A15BFF0BD4FC0, EA24D7866FEB40DD72713601E14DBDA60497324222196B8E0791DA656DBF5DA7 ] GamesAppService C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe

08:44:15.0728 0x0f10  GamesAppService - ok

08:44:15.0759 0x0f10  [ 0BF5CAD281E25F1418E5B8875DC5ADD1, 0929AD8437DD78234553D8B2CDF0D6838FD54ACDE1918AFEBE48684EB32A07A3 ] gencounter      C:\Windows\System32\drivers\vmgencounter.sys

08:44:15.0837 0x0f10  gencounter - ok

08:44:15.0884 0x0f10  [ 8DF1254093B5C354CE725EB6B9B0DE19, DE6C5661CC076DA44B8A5D044FDB7280EDCF38D322A98C14FDC82E25586B3014 ] GPIOClx0101     C:\Windows\system32\Drivers\msgpioclx.sys

08:44:15.0994 0x0f10  GPIOClx0101 - ok

08:44:16.0103 0x0f10  [ 69DB09F0263C637DA8568D404842466A, D042194266978AAD31E04DAF7018CD50754077212DC74A4D8AFF6BFEE80CDD20 ] gpsvc           C:\Windows\System32\gpsvc.dll

08:44:16.0400 0x0f10  gpsvc - ok

08:44:16.0462 0x0f10  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

08:44:16.0540 0x0f10  gupdate - ok

08:44:16.0556 0x0f10  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

08:44:16.0619 0x0f10  gupdatem - ok

08:44:16.0712 0x0f10  [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc           C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

08:44:16.0790 0x0f10  gusvc - ok

08:44:16.0869 0x0f10  [ 56F69F7C25FB67C970997D7066DBC593, 83E03A82237DCC5BCB3E722ACECACEF3510CAA619F33E0D7C4D902A482E90418 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

08:44:17.0009 0x0f10  HdAudAddService - ok

08:44:17.0056 0x0f10  [ D4B7ED39C7900384D9E5C1283F1E7926, F93F98858067B40F1C071EAD0F8E85442A78B95342BC692AF4D726540634923F ] HDAudBus        C:\Windows\System32\drivers\HDAudBus.sys

08:44:17.0181 0x0f10  HDAudBus - ok

08:44:17.0212 0x0f10  [ 10A70BC1871CD955D85CD88372724906, 2480A74854D0A89FF028EE9BA41224D4B2F9B0863066BFC43097920794FEE08D ] HidBatt         C:\Windows\System32\drivers\HidBatt.sys

08:44:17.0306 0x0f10  HidBatt - ok

08:44:17.0369 0x0f10  [ 1EA1B4FABB8CC348E73CA90DBA22E104, 5C18C6BD499272F216DD4626B5E8D38181AEAC9AD917FBEB614A75B70467B258 ] HidBth          C:\Windows\System32\drivers\hidbth.sys

08:44:17.0478 0x0f10  HidBth - ok

08:44:17.0540 0x0f10  [ C241A8BAFBBFC90176EA0F5240EACC17, 571E20B87818618BE9179986177D55739A240F04D1F740B3C1B7809B9427B767 ] hidi2c          C:\Windows\System32\drivers\hidi2c.sys

08:44:17.0619 0x0f10  hidi2c - ok

08:44:17.0665 0x0f10  [ 9BDDEE26255421017E161CCB9D5EDA95, B766FD5E31708F29384F69418FC33C4BCC6E3064AA553D5B1D30EE0B8B1BFB40 ] HidIr           C:\Windows\System32\drivers\hidir.sys

08:44:17.0775 0x0f10  HidIr - ok

08:44:17.0900 0x0f10  [ 449A20A674AA3FAA7F0DD4E33EE2DC20, 28B9BDA306456E8640C355718DE3477537B0FAF8C37F633C709129AAB64D9873 ] hidserv         C:\Windows\system32\hidserv.dll

08:44:17.0994 0x0f10  hidserv - ok

08:44:18.0103 0x0f10  [ 8DB8EAB9D0C6A5DF0BDCADEA239220B4, EDA23E6909EB83E5E148816DFB16CC29EA01BD6BD2F73AA46B3D820B85FB9C83 ] HidUsb          C:\Windows\System32\drivers\hidusb.sys

08:44:18.0197 0x0f10  HidUsb - ok

08:44:18.0259 0x0f10  [ 7BF3ADCBD021D4F4A84CF40EB49C71B5, 5758A51FD2EBE67E6DBE3A298D714D351910F9E01C428D0C1359457C9242B298 ] hkmsvc          C:\Windows\system32\kmsvc.dll

08:44:18.0369 0x0f10  hkmsvc - ok

08:44:18.0415 0x0f10  [ 6CD9C3819BE8C0A3DACC82AE5D3C4F18, 46BF4A968E506DE17CA401401D716B444CDC10A5C60EB081890DD4B886AEDF5F ] HomeGroupListener C:\Windows\system32\ListSvc.dll

08:44:18.0525 0x0f10  HomeGroupListener - ok

08:44:18.0603 0x0f10  [ 1A4DA1D6287B99033D144B436C23B656, D4D1EEB372E61512EA36A33F095E68C225B8E6C72CC57ED8BD00533F88012F40 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

08:44:19.0212 0x0f10  HomeGroupProvider - ok

08:44:19.0337 0x0f10  [ 9C9943220F8F94B917D8C4C9618074CC, DA0229C8718B4CF90F885270B38E1C9833CDF9F00141B899450C155DF3281E36 ] HP Support Assistant Service C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

08:44:19.0400 0x0f10  HP Support Assistant Service - detected UnsignedFile.Multi.Generic ( 1 )

08:44:22.0134 0x0f10  Detect skipped due to KSN trusted

08:44:22.0134 0x0f10  HP Support Assistant Service - ok

08:44:22.0306 0x0f10  [ D2946D9F020AE76E9CEF9B4A6DF838C0, C29CE594879385DA12B8EAA90B258905827B613839CCD820DE49215B68676995 ] hpqwmiex        C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

08:44:22.0525 0x0f10  hpqwmiex - ok

08:44:22.0556 0x0f10  [ A6AACEA4C785789BDA5912AD1FEDA80D, D197012A5DA6AB3F76FF298336DF0CF027C07ECC71267BAEF5912DE12893E096 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

08:44:22.0665 0x0f10  HpSAMD - ok

08:44:22.0790 0x0f10  [ F5F3F27E5823A4DF0193CC2534029742, F0126009F8CE9B85A2E9CFC257D1A3117B1CD5A739369502576B1CDF49E1DF85 ] HPWMISVC        C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

08:44:22.0994 0x0f10  HPWMISVC - ok

08:44:23.0103 0x0f10  [ 9DDCA7F18983C5410DEFF79F819DF93C, CE97B4440377BFC5CA81BB600C3BD1DD9FB3951CA1EB70735F5E2050EBB74223 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

08:44:23.0306 0x0f10  HTTP - ok

08:44:23.0353 0x0f10  [ 90656C0B3864804B090434EFC582404F, BDB60050B729AACB9E009AC7129BEBD6298BBD8A9DB14B817D02E8E13669BD6E ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

08:44:23.0431 0x0f10  hwpolicy - ok

08:44:23.0462 0x0f10  [ 6D6F9E3BF0484967E52F7E846BFF1CA1, C982966BDE6A3E6773D9441ADA7A3B08D13511DFC68D04DF303248B942423F38 ] hyperkbd        C:\Windows\System32\drivers\hyperkbd.sys

08:44:23.0525 0x0f10  hyperkbd - ok

08:44:23.0619 0x0f10  [ 907C870F8C31F8DDD6F090857B46AB25, 308664A31717383D06185875E76C6612407A9F04E7DB28404F574A5706C6715D ] HyperVideo      C:\Windows\system32\DRIVERS\HyperVideo.sys

08:44:23.0697 0x0f10  HyperVideo - ok

08:44:23.0775 0x0f10  [ 84CFC5EFA97D0C965EDE1D56F116A541, 0155EA62BF07D99D98D1C9B6559C8E3301B016A20D03DF1EF64B2FAB8C37403B ] i8042prt        C:\Windows\System32\drivers\i8042prt.sys

08:44:23.0869 0x0f10  i8042prt - ok

08:44:24.0009 0x0f10  [ 5D90E32E36CE5D4C535D17CE08AEAF05, 976A463343E8C8308AFBE9E64DF56C430D2241DE002430D00318AB065EB72E4A ] iaLPSSi_GPIO    C:\Windows\System32\drivers\iaLPSSi_GPIO.sys

08:44:24.0072 0x0f10  iaLPSSi_GPIO - ok

08:44:24.0103 0x0f10  [ DD05E7E80F52ADE9AEB292819920F32C, E71AB6A50B0F90C8F94569CE89F66F915A0A4A00D4AC091B2E5E750D88CFC334 ] iaLPSSi_I2C     C:\Windows\System32\drivers\iaLPSSi_I2C.sys

08:44:24.0165 0x0f10  iaLPSSi_I2C - ok

08:44:24.0244 0x0f10  [ 08BFE413B0B4AA8DFA4B5684CE06D3DC, 95DEEBB203E12EE6E191F5247A74C04AEC0E16DE981FADDC4D6C42EE41D8D079 ] iaStorAV        C:\Windows\system32\drivers\iaStorAV.sys

08:44:24.0369 0x0f10  iaStorAV - ok

08:44:24.0447 0x0f10  [ A2200C3033FA4EF249FC096A7A7D02A2, 5819F5C2020DE2EEE339B0C08CD4B1E3490EAFBBEA1277CE649DB5A5150986B0 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

08:44:24.0572 0x0f10  iaStorV - ok

08:44:24.0587 0x0f10  IEEtwCollectorService - ok

08:44:24.0759 0x0f10  [ DEA76F90F9777E3427D70E380222B23B, B917BA423896A12E45623E3D494CA03317A6FC612CA433C62C897524DC3E756B ] IKEEXT          C:\Windows\System32\ikeext.dll

08:44:25.0025 0x0f10  IKEEXT - ok

08:44:25.0369 0x0f10  [ E39307AB89491751020D5FBD9E080926, A78A0ECF3DA005A76B0895FA0EEE3EC66AA9518307E1FFC59162D2E5308189E2 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys

08:44:25.0884 0x0f10  IntcAzAudAddService - ok

08:44:25.0962 0x0f10  [ 4E448FCFFD00E8D657CD9E48D3E47157, 4A958CF0BF8DAEAE5E008500BA67CE89B21388592811274331EE39CAC1043A00 ] intelide        C:\Windows\system32\drivers\intelide.sys

08:44:26.0025 0x0f10  intelide - ok

08:44:26.0056 0x0f10  [ A770340FC02B999EF0DE6C2A6BC8437C, 214567BE706B21BEA7EC13AF6B10FBFF658000511DBBA79BAA28D1D4EFD029A7 ] intelpep        C:\Windows\system32\drivers\intelpep.sys

08:44:26.0134 0x0f10  intelpep - ok

08:44:26.0165 0x0f10  [ 47E74A8E53C7C24DCE38311E1451C1D9, 79B06E37A552C8A847404D4C572CDB8CF525354D8AE3BEBC06892B7C3B330761 ] intelppm        C:\Windows\System32\drivers\intelppm.sys

08:44:26.0244 0x0f10  intelppm - ok

08:44:26.0478 0x0f10  [ 9DB76D7F9E4E53EFE5DD8C53DE837514, 07BA4EDA9BE9139A689A2C3EFC1D1A4F3D1216625ED145F313398292A2CD5703 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

08:44:26.0681 0x0f10  IpFilterDriver - ok

08:44:26.0947 0x0f10  [ ACFEE9487693C2BD573DFCA71D98E17C, A347FD476147CD3568EEE6993B46AFC05A66A4269094CA51572D0FD013FCB535 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

08:44:27.0212 0x0f10  iphlpsvc - ok

08:44:27.0525 0x0f10  [ 9C096BF5E10CA8BFA56F32522A89FAF1, 6C1151160799338DA351C7237AB049926C6C15F24F5E154BBF5929B4A96C0B8D ] IPMIDRV         C:\Windows\System32\drivers\IPMIDrv.sys

08:44:27.0634 0x0f10  IPMIDRV - ok

08:44:27.0697 0x0f10  [ B7342B3C58E91107F6E946A93D9D4EFD, D5DA3C02C5C5A343785745EF6983CC9B5FBD3FB8D49FE9B450523E50212D1A32 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

08:44:27.0806 0x0f10  IPNAT - ok

08:44:27.0869 0x0f10  [ AE44C526AB5F8A487D941CEB57B10C97, A783A2EAF7A6FF450FB3F189A5930036FA60D125C42171AC44B6FE2E3DBD6F7A ] IRENUM          C:\Windows\system32\drivers\irenum.sys

08:44:27.0962 0x0f10  IRENUM - ok

08:44:28.0134 0x0f10  [ 8AFEEA3955AA43616A60F133B1D25F21, E99359A4F1D653790133F145CF7C9F97399FD75C5E135AA7E5F989BB660789AF ] isapnp          C:\Windows\system32\drivers\isapnp.sys

08:44:28.0197 0x0f10  isapnp - ok

08:44:28.0275 0x0f10  [ D90AB68D0FAC9F357F663670FDBB511E, A82AAA5DF1B38EFBDCF834535A0C520D1BB2D7A4A906C18CFDD22BCF16BDB97D ] iScsiPrt        C:\Windows\System32\drivers\msiscsi.sys

08:44:28.0369 0x0f10  iScsiPrt - ok

08:44:28.0415 0x0f10  [ 8BE92376799B6B44D543E8D07CDCF885, 425B8BB1BAF62F735B3CB5A002E6055879F02E7207E55942BFD37F1784F5F368 ] kbdclass        C:\Windows\System32\drivers\kbdclass.sys

08:44:28.0478 0x0f10  kbdclass - ok

08:44:28.0509 0x0f10  [ FB6E47E569D4872ABEB506BE03A45FBA, 5C4056CADA8F67587A119D9AE2A0EFAB30387CF6298F4019FF68AC92E2F6F54B ] kbdhid          C:\Windows\System32\drivers\kbdhid.sys

08:44:28.0619 0x0f10  kbdhid - ok

08:44:28.0650 0x0f10  [ 813871C7D402A05F2E3A7075F9584A05, FF0C2F87EB083F8CE74C679D80C845CDFBFBBC70BE818F899F3336BBB54A3FFB ] kdnic           C:\Windows\system32\DRIVERS\kdnic.sys

08:44:28.0759 0x0f10  kdnic - ok

08:44:29.0009 0x0f10  [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] KeyIso          C:\Windows\system32\lsass.exe

08:44:29.0087 0x0f10  KeyIso - ok

08:44:29.0165 0x0f10  [ ADDECBCC777665BD113BED437E602AB0, B6283475A1219CE44E9F683DD3BEB8C42DA0943297E5C4699B22176AD8A6A7ED ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

08:44:29.0244 0x0f10  KSecDD - ok

08:44:29.0275 0x0f10  [ 6D2EE96150E35B9EA49F2B481DE0369A, AC5915219FD81D89E444F6E86D71F7C495108FC35E7BD683321FC7006161AFE1 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

08:44:29.0369 0x0f10  KSecPkg - ok

08:44:29.0415 0x0f10  [ 11AFB527AA370B1DAFD5C36F35F6D45F, 757AD234284467ADB826F7CA0251F58D48866B91995BC867DEA4BAF676947163 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

08:44:29.0509 0x0f10  ksthunk - ok

08:44:29.0587 0x0f10  [ 32B1A8351160F307A8C66BCB0F94A9C2, 52F1DEC2BBD4D5DDBB85ED20B99D96BBA7EB83304D76F183A11FDAFDA364E873 ] KtmRm           C:\Windows\system32\msdtckrm.dll

08:44:29.0775 0x0f10  KtmRm - ok

08:44:29.0837 0x0f10  [ 793EACA6BAE9F481C2059BCB3743EB4A, 2624905C6B6A1227BD1CAC7D4FE55A5F6543E1278DAB31EC553748472D180D1D ] LanmanServer    C:\Windows\system32\srvsvc.dll

08:44:29.0978 0x0f10  LanmanServer - ok

08:44:30.0197 0x0f10  [ D0D9C2ECA4D03A8F06DCD91236B90C98, E2D1144DC8040EA5FEB0602A20BA4CB920B4BC86AD5AD05FC0DF7D74DC95DC66 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

08:44:30.0369 0x0f10  LanmanWorkstation - ok

08:44:30.0447 0x0f10  [ 626D19F1771E1AE72208AE9A8F3082F7, 78FDB64545ED2EAE9F51C08120E21D2C3285208F6846BD8BBA08CAA839E7A0C4 ] lfsvc           C:\Windows\System32\GeofenceMonitorService.dll

08:44:30.0603 0x0f10  lfsvc - ok

08:44:30.0681 0x0f10  [ C09010B3680860131631F53E8FE7BAD8, 35F2A06D5F29478D22ABDCC20DA893EF9D96504C65594A0CEA674D1C21B04FF8 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

08:44:30.0759 0x0f10  lltdio - ok

08:44:31.0119 0x0f10  [ 00E070FC0C673311AFD4B068D1242780, 50B0E0E625361145332C849709498FF444E46578DCAD2536E6D0289E0125580F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

08:44:31.0275 0x0f10  lltdsvc - ok

08:44:31.0572 0x0f10  [ D113FAD71A5E67AA94B32A0F8828D265, 08DDB4BBDB570C59926DBF5E27FCF46DCDF8B8212BB9251E97837E0504516FB3 ] lmhosts         C:\Windows\System32\lmhsvc.dll

08:44:31.0697 0x0f10  lmhosts - ok

08:44:31.0962 0x0f10  [ C755AE4635457AA2A11F79C0DF857ABC, E03D1ACAC155287291FE1BD0B653953ADC94279A74D0152088D698FAA796460F ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys

08:44:32.0072 0x0f10  LSI_SAS - ok

08:44:32.0103 0x0f10  [ ADAC09CBE7A2040B7F68B5E5C9A75141, 7865DA7E91404F3642BC444B97F6B7AA42B9523D5EDD7F6365DA236B8EC3410F ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys

08:44:32.0181 0x0f10  LSI_SAS2 - ok

08:44:32.0228 0x0f10  [ 04D1274BB9BBCCF12BD12374002AA191, 4B9618F8D25F2278DE1610A70ACAADB074D171D162C3AF27D464F5DC800A8E60 ] LSI_SAS3        C:\Windows\system32\drivers\lsi_sas3.sys

08:44:32.0306 0x0f10  LSI_SAS3 - ok

08:44:32.0353 0x0f10  [ 327469EEF3833D0C584B7E88A76AEC0C, 3D88B5A2D68F93F01B39C6E3D8D5C7A2A20686EFC756086E66AFFF1BC3019B85 ] LSI_SSS         C:\Windows\system32\drivers\lsi_sss.sys

08:44:32.0431 0x0f10  LSI_SSS - ok

08:44:32.0525 0x0f10  [ 8EBB271E4588D835784A3FF7E80076A8, A508BE95F6F5063A76F4C8726D9425BB1F00DE803EFE73A0BE145DD9AB82FF0A ] LSM             C:\Windows\System32\lsm.dll

08:44:32.0744 0x0f10  LSM - ok

08:44:32.0806 0x0f10  [ DDEE191AB32DFC22C6465002ECDF5EE4, 190C3930A8449118F9FEDF43C482837EF1C255E6D67F9651156E66A1E2BC6553 ] luafv           C:\Windows\system32\drivers\luafv.sys

08:44:32.0931 0x0f10  luafv - ok

08:44:33.0306 0x0f10  [ EB5C03A070F30D64A6DF80E53B22F53F, 12051B6AEBDEE1E28F24364F25A52BA3A6E282ECF86D6290E34BD38E6D4E066D ] megasas         C:\Windows\system32\drivers\megasas.sys

08:44:33.0384 0x0f10  megasas - ok

08:44:33.0447 0x0f10  [ F6F13533196DE7A582D422B0241E4363, B3CD9B08937AFFF12141B38634AF3A56F5AC5FF3EF03941802B9841DEC559469 ] megasr          C:\Windows\system32\drivers\megasr.sys

08:44:33.0587 0x0f10  megasr - ok

08:44:33.0665 0x0f10  [ FD788C2D96EA91469A3C1D13E80D7473, 7B14D4BFDE18CECC19FBFFAA5AFF5FD78BFB7FCDA6613990740A8A7DD9873D26 ] MMCSS           C:\Windows\system32\mmcss.dll

08:44:33.0790 0x0f10  MMCSS - ok

08:44:33.0962 0x0f10  [ 8B38C44F69259987C95135C9627E2378, E698B82D4EFFF56D66C7FC9866369BA5736FDBDBE2028CC421C51E70DEA74727 ] Modem           C:\Windows\system32\drivers\modem.sys

08:44:34.0072 0x0f10  Modem - ok

08:44:34.0150 0x0f10  [ 601589000CC90F0DF8DA2CC254A3CCC9, D1238A386C41B6C368D9A44B7C112C943995B5403E2A5B4B7346B266DDB0C5A0 ] monitor         C:\Windows\System32\drivers\monitor.sys

08:44:34.0275 0x0f10  monitor - ok

08:44:34.0290 0x0f10  [ CEAC6D40FE887CE8406C2393CF97DE06, 34E76908B802764FF0D7AB3AF89BE77BD35B44787983343FAD89891891C0A045 ] mouclass        C:\Windows\System32\drivers\mouclass.sys

08:44:34.0353 0x0f10  mouclass - ok

08:44:34.0384 0x0f10  [ 02D98BF804084E9A0D69D1C69B02CCA9, EC5BC5D87043DFFD035FD4DD27B3D94E03119063519E4151BCC3522B613E2D7F ] mouhid          C:\Windows\System32\drivers\mouhid.sys

08:44:34.0462 0x0f10  mouhid - ok

08:44:34.0509 0x0f10  [ 515549560D481138E6E21AF7C6998E56, C7E4B38D8CCAF15B9BDA63C8C8209F6193AD220DA02E1264F1B687AACD8F409F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

08:44:34.0572 0x0f10  mountmgr - ok

08:44:34.0728 0x0f10  [ 9E587AFE2AD4873C809F1E0C598AB435, 0B0ECFF265120BCBAC37CF9B53B18462725AB991D00B90DBEE8DD9375121DA4F ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

08:44:34.0884 0x0f10  MozillaMaintenance - ok

08:44:34.0900 0x0f10  [ F170510BE94CF45E3C6274578F6204B2, 344C3DDE1D622607CA2ABECB2C47CB0166D2D258BD94A7960C45A5ADBB640566 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

08:44:34.0994 0x0f10  mpsdrv - ok

08:44:35.0197 0x0f10  [ D186C5844393252147BE934F3871DB7A, 30160F8268B9F46E82C5CB536867E0CF280DC98074A481595072E3320200E343 ] MpsSvc          C:\Windows\system32\mpssvc.dll

08:44:35.0415 0x0f10  MpsSvc - ok

08:44:35.0540 0x0f10  [ DB32958F0E704EFBF7F15161A569E39F, 8A26448B954F8A16EE9BA72EF47F6C549A75B30BD13FEB5A29EB099A74D8F678 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

08:44:35.0650 0x0f10  MRxDAV - ok

08:44:35.0775 0x0f10  [ 7A1A3F213CDB3363D179D5014272025D, 6756F5B7D9FBF6839DB1FF4E94EA45B5499D7DF925E75581C96FBBA4BE131542 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

08:44:35.0931 0x0f10  mrxsmb - ok

08:44:35.0994 0x0f10  [ 3E28B99198B514DFEB152EACF913025E, 6C1D8353DCD5F811F39C0C3CB5DF3D2457F0D17EE80FB06196AA169E3D19E9B2 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

08:44:36.0119 0x0f10  mrxsmb10 - ok

08:44:36.0290 0x0f10  [ C910E5D18958914A66F0E45689D0B40A, AD7C91DD8A60A511E580DD56BACC97F85075A539E7C5D95040A8F870A621DAF4 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

08:44:36.0431 0x0f10  mrxsmb20 - ok

08:44:36.0540 0x0f10  [ E0927EFA25D473367C3341B9F5969779, B77A162BD3334557623674373D8EC2BE7CC0B359DF06304E467ABFFEE0530271 ] MsBridge        C:\Windows\system32\DRIVERS\bridge.sys

08:44:36.0869 0x0f10  MsBridge - ok

08:44:36.0900 0x0f10  [ A082C17D14D0790E27D064EA4B138AE1, 9A565ED885782D9D5135C8399C11C356DBF9EBF3B8EB4B4504BD2604AD0B45E6 ] MSDTC           C:\Windows\System32\msdtc.exe

08:44:48.0603 0x0f10  MSDTC - ok

08:44:48.0665 0x0f10  [ D13329FBF8345B28AB30F44CC247DC08, 9C7EC2D4D65E6510EB5B9E61BB0D14F725D7E8FE98D65161C3971E43EF1AB6EB ] Msfs            C:\Windows\system32\drivers\Msfs.sys

08:44:48.0775 0x0f10  Msfs - ok

08:44:48.0806 0x0f10  [ C6B474E46F9E543B875981ED3FFE6ADD, E16687E52FB649C23D92159A1F036CB662202C1E58D961EECDAA528AA4FA669A ] msgpiowin32     C:\Windows\System32\drivers\msgpiowin32.sys

08:44:48.0869 0x0f10  msgpiowin32 - ok

08:44:48.0900 0x0f10  [ 65C92EB9D08DB5C69F28C7FFD4E84E31, D709BA4723225321F665B1157A33A4AE230420752308EF535DA9A41CAC164628 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

08:44:48.0978 0x0f10  mshidkmdf - ok

08:44:49.0525 0x0f10  [ 52299F086AC2DAFD100DD5DC4A8614BA, B36BE0FC96798E5EB8C193C318970E3906961E3ABC3BFAAD73138C76D9A95B0B ] mshidumdf       C:\Windows\System32\drivers\mshidumdf.sys

08:44:49.0665 0x0f10  mshidumdf - ok

08:44:50.0806 0x0f10  [ 36D92AF3343C3A3E57FEF11C449AEA4C, ECC85AA1E530DF55B4A4545798219F87F0FCA66DDD2E37BCEF0850D3C9129DD2 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

08:44:50.0900 0x0f10  msisadrv - ok

08:44:51.0009 0x0f10  [ 810F8A0A0680662BB0CE44D0E2CEF90C, 5631B07911B7EF378CB1583A480A3C5715E59A5488B33A528F4D7A2F849B9113 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

08:44:51.0197 0x0f10  MSiSCSI - ok

08:44:51.0212 0x0f10  msiserver - ok

08:44:51.0244 0x0f10  [ A9BBBD2BAE6142253B9195E949AC2E8D, 599D2952D4E0B0B3E02D91E38A30F4900B1ADA330716B887B156A1CB9A3E6EE9 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

08:44:51.0337 0x0f10  MSKSSRV - ok

08:44:51.0415 0x0f10  [ 375E44168F2DFB91A68B8A3F619C5A7C, AC243E02E9A39D0B4DE9571F196941700EE6EB5E94F5B0BA8994FB551E73A7A8 ] MsLldp          C:\Windows\system32\DRIVERS\mslldp.sys

08:44:51.0525 0x0f10  MsLldp - ok

08:44:51.0790 0x0f10  [ 7B2128EB875DCBC006E6A913211006D6, 97BBD7FF770741FBFC0F181A609AD0954EA926DA203B742E8F08C89AD8FE476E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

08:44:51.0884 0x0f10  MSPCLOCK - ok

08:44:52.0025 0x0f10  [ 1E88171579B218115C7A772F8DE04BD8, B9EAA835D0BF8F9C4DF8403D95EF1400E8AE38F28F9DBA87657DE2129FEF02D2 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

08:44:52.0103 0x0f10  MSPQM - ok

08:44:52.0181 0x0f10  [ BBE2A455053E63BECBF42C2F9B21FAE0, 7C5DF563499DF59DF9895A1581E47ADF5FD54C94ECEF6C886CDB60E5E95A6DAE ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

08:44:52.0353 0x0f10  MsRPC - ok

08:44:52.0400 0x0f10  [ 8D6B7D515C5CBCDB75B928A0B73C3C5E, 1EB4DC3DD21D2627C78EC3F9931D9E5D033169087E43B5D7C17BF1FF2A0028CD ] mssmbios        C:\Windows\System32\drivers\mssmbios.sys

08:44:52.0462 0x0f10  mssmbios - ok

08:44:52.0478 0x0f10  [ 115019AE01E0EB9C048530D2928AB4A2, 6E2275E85EACF2D0FC784792E0D72A165589D33CBAB3BCFA8E271CA09566C925 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

08:44:52.0572 0x0f10  MSTEE - ok

08:44:52.0619 0x0f10  [ 96D604A35070360F0DD4A7A8AF410B5E, F94DD1A3566C7C8D0A76D6E1E2530552A9B7F99C5DA0DE11829325EAB9F8B7ED ] MTConfig        C:\Windows\System32\drivers\MTConfig.sys

08:44:52.0697 0x0f10  MTConfig - ok

08:44:52.0869 0x0f10  [ 619CA29326B82372621DB2C0964D8365, 4091F08E266DB45A6E33A4A8B1CE9FA78BB294B3111526AA9E3868620F30AFDF ] Mup             C:\Windows\system32\Drivers\mup.sys

08:44:52.0947 0x0f10  Mup - ok

08:44:52.0962 0x0f10  [ B8C35C94DCB2DFEAF03BB42131F2F77F, F0FCF367CA8F722D6ABCF7F363CD406D890D71452E91C3FC6677B47AD74D6324 ] mvumis          C:\Windows\system32\drivers\mvumis.sys

08:44:53.0040 0x0f10  mvumis - ok

08:44:53.0103 0x0f10  [ 41A45D2A75494EABF2806EA051E00376, EB2497561C8E33A4297C044604C717FF854C7F046882A9E4A400AE7679BF5467 ] napagent        C:\Windows\system32\qagentRT.dll

08:44:53.0275 0x0f10  napagent - ok

08:44:53.0353 0x0f10  [ 26ACA481FAFEC59FE311D719E3027BBA, 16A24CCA95A38BDFE970580159F6ACAA13FF1B74CF2290B1B020D909F90D3347 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

08:44:53.0494 0x0f10  NativeWifiP - ok

08:44:53.0556 0x0f10  [ 71E3C0100AA19D11373CCEB2F51A6008, 58FBF35F5FE19BEABE483C11E9996BE93D76721C8C34465350FA98B465CA3672 ] NcaSvc          C:\Windows\System32\ncasvc.dll

08:44:53.0665 0x0f10  NcaSvc - ok

08:44:53.0712 0x0f10  [ 51DF09CAB2CAC64FEE3E371D9028ED01, 9B81604D0D0359AF8F54FED6DA7116FFD2F40407895028EAD99FF1D7CFDC2D14 ] NcbService      C:\Windows\System32\ncbservice.dll

08:44:53.0822 0x0f10  NcbService - ok

08:44:53.0915 0x0f10  [ 2586C4C167499210DCBF3ECFD8CCE210, D8129FEDE9918BF4FB0057CC58700D4E08457060E810B9CC25CA0F598506ADB8 ] NcdAutoSetup    C:\Windows\System32\NcdAutoSetup.dll

08:44:54.0040 0x0f10  NcdAutoSetup - ok

08:44:54.0181 0x0f10  [ E4B4BE2D7750849C07589DA0B0AABA01, BB5AA727BA018A94B5DE2C4E0B594DD2E7A2B3457885446EE568F3A1E18AB3B0 ] NDIS            C:\Windows\system32\drivers\ndis.sys

08:44:54.0431 0x0f10  NDIS - ok

08:44:54.0478 0x0f10  [ C6BB12BC35D1637CA17AE16D3A4725EB, 01C1D9FA738886A195166F88207EEB6715A1DE0608978ED6C5DC738AF5C02513 ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

08:44:54.0650 0x0f10  NdisCap - ok

08:44:54.0697 0x0f10  [ B1AA3B19A2E596A59224F893E01A5A75, E08696CA5E087E51AC3E64D4FB8490EEADD612DDF30C9A94DD1BD1BA124B71B7 ] NdisImPlatform  C:\Windows\system32\DRIVERS\NdisImPlatform.sys

08:44:54.0900 0x0f10  NdisImPlatform - ok

08:44:54.0978 0x0f10  [ 9423421E735BD5394351E0C47C76BB92, 763E5D06F896C0EF8AD52515464F28BA85DB7A1560E451857AC9AA68FAFCBC66 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

08:44:55.0056 0x0f10  NdisTapi - ok

08:44:55.0103 0x0f10  [ B832B35055BA2B7B4181861FF94D8E59, 2E60E5D503E88D27E35ECFEE265D51328E93A9C7B9B931F86D9CBC947636BB00 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

08:44:55.0197 0x0f10  Ndisuio - ok

08:44:55.0322 0x0f10  [ 1F58E48EF75F34C35D8E93A0DC535CFE, D65619A6C4B1747F8B05DA08A44EF0E46B5CC384880E04E4755A2BA6CDB3C4EA ] NdisVirtualBus  C:\Windows\System32\drivers\NdisVirtualBus.sys

08:44:55.0415 0x0f10  NdisVirtualBus - ok

08:44:55.0525 0x0f10  [ DEC29080202D4F9F17F55E18BCFCC41A, F7E543741B1F4F637A99C40543D6AEC6EBF893F74359BBA769D1F882E0AFB571 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

08:44:55.0619 0x0f10  NdisWan - ok

08:44:55.0915 0x0f10  [ DEC29080202D4F9F17F55E18BCFCC41A, F7E543741B1F4F637A99C40543D6AEC6EBF893F74359BBA769D1F882E0AFB571 ] NdisWanLegacy   C:\Windows\system32\DRIVERS\ndiswan.sys

08:44:56.0056 0x0f10  NdisWanLegacy - ok

08:44:56.0087 0x0f10  [ A5BD69A8812FA79D1A487691DD3FB244, 67B5EDE101943E0E8B8041DB2353D20C8B9F2D253E77964761CFE8F136C0BBC7 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

08:44:56.0212 0x0f10  NDProxy - ok

08:44:56.0244 0x0f10  [ 5A072F0B90C29C5233D78BE33EF5ED78, B32ED76A674B1FC743361FB7BBD4C915A78B14132AB056AADD445D5995AD4F32 ] Ndu             C:\Windows\system32\drivers\Ndu.sys

08:44:56.0353 0x0f10  Ndu - ok

08:44:56.0369 0x0f10  [ A83D67D347A684F10B7D3019C8A6380C, 2B86832967981C8C786BF24C1CF8E13E01745ACE3333CF5C821DD93D623B96E4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

08:44:56.0462 0x0f10  NetBIOS - ok

08:44:56.0525 0x0f10  [ 0217532E19A748F0E5D569307363D5FD, C40C2E7AFA276057E7327A7BB173122689D6CEC9AE443C3850C3F94AF03DFBF5 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

08:44:56.0634 0x0f10  NetBT - ok

08:44:56.0665 0x0f10  [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] Netlogon        C:\Windows\system32\lsass.exe

08:44:56.0744 0x0f10  Netlogon - ok

08:44:56.0790 0x0f10  [ B7AD851A21FEBA3BA214972627614207, 29605320CCC3DAAD062CAECF0009DACBC2F6D28ED4E8AF7CE76132129F5572A0 ] Netman          C:\Windows\System32\netman.dll

08:44:56.0915 0x0f10  Netman - ok

08:44:56.0962 0x0f10  [ F0F0A372C2EF6358399C4936F91B6131, CE596C71EB4D1A5E104D3148F2D0D8789882C59FD198DCF33CCAC7A08B50E4EE ] netprofm        C:\Windows\System32\netprofmsvc.dll

08:44:57.0103 0x0f10  netprofm - ok

08:44:57.0181 0x0f10  [ 1092B3190E69E0C5ECBCE90F171DE047, C16106EEFC324EE80E5F659CB71A5DD69FA800D36D829F5B0E6AD3393BD1BAF7 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

08:44:57.0306 0x0f10  NetTcpPortSharing - ok

08:44:57.0353 0x0f10  [ 70414DB660BFBB7BD58FCE8EA4364E1B, 6DFB3897CD55E22BA1EDF0AE672F4D7A6A1F512F8A0A26AF106765E6B1CF65AC ] netvsc          C:\Windows\system32\DRIVERS\netvsc63.sys

08:44:57.0462 0x0f10  netvsc - ok

08:44:57.0603 0x0f10  [ E94EB2A95D7D016E119C4D6868788831, 3E4A925D23262FBA0A6432DD635FBE94B0CEF76BD9BB323254B66977497FEE2A ] NlaSvc          C:\Windows\System32\nlasvc.dll

08:44:57.0759 0x0f10  NlaSvc - ok

08:44:58.0009 0x0f10  [ 8F44A2F57C9F1A19AC9C6288C10FB351, 310274DDBAC0FE4BE54ECD3B90C97D82A0F9F5CFCA7A35711A36164DE4B94074 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

08:44:58.0103 0x0f10  Npfs - ok

08:44:58.0228 0x0f10  [ CBDB4F0871C88DF930FC0E8588CA67FC, 7E4AA3EA81A9D532F236FD7896744F07ED07CA9B37A9F18A9778BCCCC67490F2 ] npsvctrig       C:\Windows\System32\drivers\npsvctrig.sys

08:44:58.0322 0x0f10  npsvctrig - ok

08:44:58.0353 0x0f10  [ 6E2271ED0C3E95B8E29F3752B91B9E84, 44026AD9757EA82967D7F7578455802FAD7FE0057EAC088E0AE207C15F594B86 ] nsi             C:\Windows\system32\nsisvc.dll

08:44:58.0462 0x0f10  nsi - ok

08:44:58.0619 0x0f10  [ E490B459978CB87779E84C761D22B827, 1E5CA38626E41618E4CA16DD0C70EB2FA86E986F0CF21A749BDE2A17015DEEC6 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

08:44:58.0697 0x0f10  nsiproxy - ok

08:44:59.0150 0x0f10  [ 038C77D577900EE39410662478BB0D50, A33AAFD5750245C17A47EC71F3C6EAD2E0925CAD34C65AB3E6CEE44756C668E6 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

08:44:59.0603 0x0f10  Ntfs - ok

08:44:59.0650 0x0f10  [ EF1B290FC9F0E47CC0B537292BEE5904, DBC07BBC54EBC2D2E576B23A4CE116B3DA988577AD0D96CB7289A6748A60F9EA ] Null            C:\Windows\system32\drivers\Null.sys

08:44:59.0728 0x0f10  Null - ok

08:44:59.0884 0x0f10  [ BC6B5942AFF25EBAF62DE43C3807EDF8, CB0FA194084B8C309039D571B5760FDA800E9531B8660C499B4F9977BA5C36D5 ] nvraid          C:\Windows\system32\drivers\nvraid.sys

08:45:00.0009 0x0f10  nvraid - ok

08:45:00.0040 0x0f10  [ 1F43ABFFAC3D6CA356851D517392966E, 6FD7621F67BA94B0E1D8F43BEC2951DBCDEEA1E848BB265AC169E27C01DA68F2 ] nvstor          C:\Windows\system32\drivers\nvstor.sys

08:45:00.0134 0x0f10  nvstor - ok

08:45:00.0150 0x0f10  [ 6934A936A7369DFE37B7DBA93F5E5E49, 0900FEEB0CE8D09F0FC60630B5B986034A8BCD3882ED66E47170810C32492892 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

08:45:00.0228 0x0f10  nv_agp - ok

08:45:00.0353 0x0f10  [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

08:45:00.0478 0x0f10  odserv - ok

08:45:00.0494 0x0f10  [ 1300D100EF891C98504DE38624D3F639, 3F7D5A1BB725DC224E08EFC0D6A7F579FC78C64554BAF02D58A6624B91D6384E ] omniserv        C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

08:45:00.0587 0x0f10  omniserv - detected UnsignedFile.Multi.Generic ( 1 )

08:45:04.0150 0x0f10  Detect skipped due to KSN trusted

08:45:04.0150 0x0f10  omniserv - ok

08:45:04.0228 0x0f10  [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

08:45:04.0353 0x0f10  ose - ok

08:45:04.0447 0x0f10  [ E287F157F7A0011D93179C64EF8ADCF2, C16FB92C7B18D634BB1344238D35B3111494C243FBD5853F05376F5051480D83 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

08:45:04.0603 0x0f10  p2pimsvc - ok

08:45:04.0915 0x0f10  [ 2A57A937BC5B1B2D6AFE6A8C5925F50B, 00D84EFED5A7129AAD86945940030474795905C32D65CBD5B1A3EBADCED8F873 ] p2psvc          C:\Windows\system32\p2psvc.dll

08:45:05.0134 0x0f10  p2psvc - ok

08:45:05.0181 0x0f10  [ 764B1121867B2D9B31C491668AC72B2B, 32C04B6FCE1DDD09697B81473A23BDCED8BEEFBCD0D2D58DDC9A11A33C756967 ] Parport         C:\Windows\System32\drivers\parport.sys

08:45:05.0259 0x0f10  Parport - ok

08:45:05.0509 0x0f10  [ EF0C1749C9A8CEE9A457473D433CC00F, A5FDAB5AD47471640D697C6CFBA6C67730878ABBA47D394EAA47C9733EDCE1F3 ] partmgr         C:\Windows\system32\drivers\partmgr.sys

08:45:05.0619 0x0f10  partmgr - ok

08:45:05.0697 0x0f10  [ 9A5309EF92F39346CFD5A4C2C3D1BFAD, 5908E0C9562F9CB24784491BD9AE7983A33A6BDF81AFA0A08045518A0C9BB2B1 ] PcaSvc          C:\Windows\System32\pcasvc.dll

08:45:05.0962 0x0f10  PcaSvc - ok

08:45:06.0306 0x0f10  [ 91ED124E261EA8FAA1C0FFDF2A71B0C4, 20E41A38067395D03184938983A9BE459717A1941352972DBC28D83D542319EC ] pci             C:\Windows\system32\drivers\pci.sys

08:45:06.0462 0x0f10  pci - ok

08:45:06.0509 0x0f10  [ 346E38FCC6859A727DD28AFAD1F0AFF4, FF3DA26F79B3BC3A5B8A8AA0B9139B9EF70297F4EA1203B1E68FB5A212C3AA58 ] pciide          C:\Windows\system32\drivers\pciide.sys

08:45:06.0572 0x0f10  pciide - ok

08:45:06.0619 0x0f10  [ 4D3BDCC1C7B40C9D7B6AD990E6DEC397, 27A7AF2127B699F4579CB77936F38DC102211E26E5E2947DB808756FE06FC98E ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys

08:45:06.0697 0x0f10  pcmcia - ok

08:45:06.0728 0x0f10  [ BF28771D1436C88BE1D297D3098B0F7D, 5F7630916A76A8CF31289E9C577F522B999C74C39E541CD40E62BD53004BEF74 ] pcw             C:\Windows\system32\drivers\pcw.sys

08:45:06.0790 0x0f10  pcw - ok

08:45:06.0837 0x0f10  [ 24A8DFC07E4BAF29AEA26E383D4CC886, 1B903FE52CD816662D37A8113930B4B7019B6996D49F1982D8F42933A3525A67 ] pdc             C:\Windows\system32\drivers\pdc.sys

08:45:06.0915 0x0f10  pdc - ok

08:45:06.0994 0x0f10  [ 0ECEE590F2E2EF969FB74A6FC583A1E6, 1C611D9225C863CF32125F684B324C58BDE1942F4F283F5674133200AC505D44 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

08:45:07.0212 0x0f10  PEAUTH - ok

08:45:07.0400 0x0f10  [ 8E3C640FFF5A963F570233AE99C0FFF3, 3DE978B005BF2E88BA858CE37D9E27BD3584642B8412E22C300A1E739743838A ] PerfHost        C:\Windows\SysWow64\perfhost.exe

08:45:07.0540 0x0f10  PerfHost - ok

08:45:08.0072 0x0f10  [ 928061178CD9856CA6B67FFFCE6BA766, 71DE3C7CA7F83EAAA550CD8A68FB67DE042B0AE51BFACB1ECB8852D502E11F50 ] pla             C:\Windows\system32\pla.dll

08:45:08.0415 0x0f10  pla - ok

08:45:08.0462 0x0f10  [ BC6849C62DB407573C6AD8CB1A4D2628, 5BDE0D60F85E4C27CEAD1B301155B54D841FB773BD5BB8AC5DDAEE31F8E94627 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

08:45:08.0603 0x0f10  PlugPlay - ok

08:45:08.0619 0x0f10  [ 045EB4F260606A03BE340D09DEAF3BA4, 6F34B8D414F7F69F4388F2F8A86E0F3AD179E423126990AF3E1EC4DCCB8E7693 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

08:45:08.0712 0x0f10  PNRPAutoReg - ok

08:45:08.0869 0x0f10  [ E287F157F7A0011D93179C64EF8ADCF2, C16FB92C7B18D634BB1344238D35B3111494C243FBD5853F05376F5051480D83 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

08:45:08.0994 0x0f10  PNRPsvc - ok

08:45:09.0072 0x0f10  [ C16097D77A232A288D65F299E2E01105, 5CE4B44B06FD26569C0F92FF1D3991D0128D8444AE7BC9EBEF5A33811D721BE8 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

08:45:09.0259 0x0f10  PolicyAgent - ok

08:45:09.0322 0x0f10  [ 00E08B30E7F7C13ECE2CDF4F46A77311, 1807C0A64C1794E572C86730816C01DCF4D8F773ADE9CAEA3AC0658F7BD71A4E ] Power           C:\Windows\system32\umpo.dll

08:45:09.0415 0x0f10  Power - ok

08:45:09.0712 0x0f10  [ 3C96A45CA3403A276B0F045C448EC27B, C0011DB8C5A85817CAF815CC0095EE2C1CDD5964DCD8EAF4C35A2495D6A873CC ] PrintNotify     C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll

08:45:10.0275 0x0f10  PrintNotify - ok

08:45:10.0384 0x0f10  [ ECD373F9571C745894367CC2635EA44F, E08B2A1017DAE1BF10B986DAFAD14BDE20D79703E0EF3A8C700A3753908C1392 ] Processor       C:\Windows\System32\drivers\processr.sys

08:45:10.0494 0x0f10  Processor - ok

08:45:10.0603 0x0f10  [ 19424364D8C03B990C4281BE53963FD0, 958FC8436E6B754858E20BC48B0D4B269991E8CA94C15C2761BF04ED52591907 ] ProfSvc         C:\Windows\system32\profsvc.dll

08:45:10.0744 0x0f10  ProfSvc - ok

08:45:10.0837 0x0f10  [ 8528BB05E4D4E25945F78B00B2555FB7, FF8E0D4580F93CD348080967F52FE6C2C68B56DAEACAE2EAEF04E19412A953AE ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

08:45:10.0962 0x0f10  Psched - ok

08:45:11.0025 0x0f10  [ AF90BB44C99D6820BE52C9BBAA523283, 9772D9CC1666959EC8EE4ED740A5179473CE4F38762109F1123DD68010D20EA1 ] QWAVE           C:\Windows\system32\qwave.dll

08:45:11.0165 0x0f10  QWAVE - ok

08:45:11.0244 0x0f10  [ 3FB466684609A4329858CF2EBD62E0FD, CFC8FBAB1436948F9D34CE6A2D6DE2F86F3E93E50B86851CED979C8CCE609798 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

08:45:11.0384 0x0f10  QWAVEdrv - ok

08:45:11.0400 0x0f10  [ 2C56F0EE27E4EF70CA4B4983D3638905, AFFDD686886CE982424B644D9168D61C6F86A5244FF97BC644DF75B321E415E5 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

08:45:11.0494 0x0f10  RasAcd - ok

08:45:11.0634 0x0f10  [ 5F061AC45266841A2860C1858ED863B8, 9E0D52BAC8A50225C32D0397C35350601B996443E2481C808CC59D3B0763FEF0 ] RasAuto         C:\Windows\System32\rasauto.dll

08:45:11.0759 0x0f10  RasAuto - ok

08:45:11.0947 0x0f10  [ 5C7B86EE33505E36026AFAAB62DA6364, 903BB1A355AC746BF09C2A7C87B068168648DB79DEF39AB1DC710B6A7A5F6556 ] RasMan          C:\Windows\System32\rasmans.dll

08:45:12.0150 0x0f10  RasMan - ok

08:45:12.0197 0x0f10  [ 5247F308C4103CDC4FE12AE1D235800A, E567CD33CA1897D53795E071B7AFBAF98B2C8F725F8BED0BA90F5EF611520E48 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

08:45:12.0290 0x0f10  RasPppoe - ok

08:45:12.0369 0x0f10  [ A1A5E79C0D1352AFDC08328A623DA051, 01546DDE6F1FF159A7EB7F2BF104910445D3D863F1F37DEA695579BA60D84280 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

08:45:12.0540 0x0f10  rdbss - ok

08:45:12.0619 0x0f10  [ 6B21EBF892CD8CACB71669B35AB5DE32, 0AD8E14FEF16FB2559F5FC8AFBC9D49E4E24F43CF65F480DBF9FAB593269B419 ] rdpbus          C:\Windows\System32\drivers\rdpbus.sys

08:45:12.0712 0x0f10  rdpbus - ok

08:45:12.0822 0x0f10  [ 680C1DAE268B6FB67FA21B389A8B79EF, 856911F77BDD8830C3D683EBE8AF399FB3A54C7D8D0B34EA37D903377F0A39BD ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys

08:45:12.0994 0x0f10  RDPDR - ok

08:45:13.0087 0x0f10  [ 9F08A6608F98B5407E7DDBCF306573EF, 92812F97CFDB2EC128BC48143DE215B7D012B15D3FB4D2199222AD8C31DA5016 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

08:45:13.0165 0x0f10  RdpVideoMiniport - ok

08:45:13.0228 0x0f10  [ A26AEC49F318FEE141DDDB2C5F99B3E6, 246AD79FF27E79DEDCB0AAA7C22A8EA6349DEDAC863413A1E378E68FD94C9C4F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

08:45:13.0322 0x0f10  rdyboost - ok

08:45:13.0431 0x0f10  [ E515A287C8FAE901EB8FB42F168E14F2, 9AE8D608587713FD18BB728BADD402C86FFF06A67359B22ED9431705522BC310 ] ReFS            C:\Windows\system32\drivers\ReFS.sys

08:45:13.0634 0x0f10  ReFS - ok

08:45:13.0697 0x0f10  [ BFFB40FBE6D2C3469F8D06EE5E4934AB, 5B6763F973A740DCD53CEA75156926457BED8B075965033C484877DDA8B97F39 ] RemoteAccess    C:\Windows\System32\mprdim.dll

08:45:13.0822 0x0f10  RemoteAccess - ok

08:45:13.0884 0x0f10  [ 4DCCABE03D06955ED61BABBD8EF9F30F, 531CD60315AAF283B73E0F6CF77D4DE093B809E73C44D2AC43B7247500B3485E ] RemoteRegistry  C:\Windows\system32\regsvc.dll

08:45:14.0025 0x0f10  RemoteRegistry - ok

08:45:14.0087 0x0f10  [ D894CBD7DA753C881EE8D5E33B583225, DA4472A85F10A3DF8CE969F731E67FE7C75EE6095908AB8AC2C44851DC5A3F8B ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

08:45:14.0212 0x0f10  RpcEptMapper - ok

08:45:14.0259 0x0f10  [ 5CAE8F47B31D5CFC322B5B898C19E0FE, FDB5F0B6EA36403E031D9147AB0519011FAAD3AC8190DE5B1F17FB5472D79D47 ] RpcLocator      C:\Windows\system32\locator.exe

08:45:14.0369 0x0f10  RpcLocator - ok

08:45:14.0478 0x0f10  [ 81979817943D830BF24571B7C1B28A1A, 9584D8F1FB3E6CF17BD465670B208C723A8E8B06775A3DA44F75D7710404EEA6 ] RpcSs           C:\Windows\system32\rpcss.dll

08:45:14.0650 0x0f10  RpcSs - ok

08:45:14.0712 0x0f10  [ 04080F8C8FBCF3F269348B92AEA7A30D, 872DAB903D92519256059DC97626D29BE83C8681A063F38A260AB71E0CADD254 ] RSP2STOR        C:\Windows\system32\DRIVERS\RtsP2Stor.sys

08:45:14.0853 0x0f10  RSP2STOR - ok

08:45:14.0900 0x0f10  [ 2D05A5508F4685412F2B89E8C2189ABC, 82F12B4E0E73411A121EFD35FBD3B44CBBC0AE96ACFBB45D8C3C3777E2EA320D ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

08:45:15.0025 0x0f10  rspndr - ok

08:45:15.0091 0x0f10  [ 9CF8593B62102545CB1652A1D8748FDD, 818639795720A7567CCE01EBC24A0119BFDCEA1B7A5ED4A11B5012D763C1B5CC ] RSUSBSTOR       C:\Windows\System32\Drivers\RtsUStor.sys

08:45:15.0169 0x0f10  RSUSBSTOR - ok

08:45:15.0279 0x0f10  [ 884FFC0F5D925AED8FAEA4118FD9ECB2, 9A7579480C2CD1096450D926E7EDFD740DC4FDB797C105E5E517656415DBA70F ] RtkAudioService C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

08:45:15.0372 0x0f10  RtkAudioService - ok

08:45:15.0482 0x0f10  [ CFE738C524F35B6E523A4D0F54840C30, 73E051DEA744EEC5202693C11EDABB36DE2D086160648D4E41F1F299CBAD8409 ] RTL8168         C:\Windows\system32\DRIVERS\Rt630x64.sys

08:45:15.0669 0x0f10  RTL8168 - ok

08:45:15.0966 0x0f10  [ 79F9D44C9022BE848C8862518B9E7866, C3616F7F3EF763E6E5F5B4EDC068A1D71C68FE110F5137271AB6875BBFEAFDF2 ] RTWlanE         C:\Windows\system32\DRIVERS\rtwlane.sys

08:45:16.0404 0x0f10  RTWlanE - ok

08:45:16.0466 0x0f10  [ 1A063730F221B2746FF00457AE17E4F0, 39A3C258CBFE3BC566C63528C9020A3BC9409736AE5289C08A7BA471D8409263 ] s3cap           C:\Windows\System32\drivers\vms3cap.sys

08:45:16.0544 0x0f10  s3cap - ok

08:45:16.0591 0x0f10  [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] SamSs           C:\Windows\system32\lsass.exe

08:45:16.0669 0x0f10  SamSs - ok

08:45:16.0794 0x0f10  [ C624A1B32211C3166EDB3F4AB02A30B7, 6B2A4607DB52D74242787ED9DF9067058983D310431D8612D2B0236E6201E681 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

08:45:16.0872 0x0f10  sbp2port - ok

08:45:16.0935 0x0f10  [ 47C497FA4DDEA908633CAA60CEBE6805, 4DF5742D4C99D3F7B6A5671AEDB1E5E47D3399D36B28BA19C105FA604D8D5A1C ] SCardSvr        C:\Windows\System32\SCardSvr.dll

08:45:17.0310 0x0f10  SCardSvr - ok

08:45:17.0357 0x0f10  [ E76C4E98302AE39CC6FA5D20FC8B5438, B6B6B59CF427515087689285797F4A5763103440EBE5D87A61FA74F80F895BD0 ] ScDeviceEnum    C:\Windows\System32\ScDeviceEnum.dll

08:45:17.0529 0x0f10  ScDeviceEnum - ok

08:45:17.0622 0x0f10  [ ABD0237B15DBD2B4695F4B7D734A58F7, D6831921F0CD3E03CBF1CA3ED5824EE0C75127842D12D4E897E74EC72B0792EB ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

08:45:17.0763 0x0f10  scfilter - ok

08:45:17.0904 0x0f10  [ D3AE5DB16EAF913860EC28654CE00E6B, AD76B6044F7247C6E86F6DCB7CFD6B25BCA2B9F09A97A419F043A999E66726A2 ] Schedule        C:\Windows\system32\schedsvc.dll

08:45:18.0357 0x0f10  Schedule - ok

08:45:18.0451 0x0f10  [ AB285CE3431FF3D2ACE669245874C1C7, 6AF4C3E86EFA51F7FB6F8492CB2CCB807C7775EAE0508B87F07134FDAC679BD7 ] SCPolicySvc     C:\Windows\System32\certprop.dll

08:45:18.0560 0x0f10  SCPolicySvc - ok

08:45:18.0669 0x0f10  [ 7B7C482CF48E6EE33664340D1A78E6FE, CE5077C4B0372F4F9F02B0B37AE58C0DAEFCA9D242065731A23F072506430575 ] sdbus           C:\Windows\System32\drivers\sdbus.sys

08:45:18.0779 0x0f10  sdbus - ok

08:45:18.0841 0x0f10  [ 0B1E929D11A8E358106955603FAC65E8, A5EC91BFC0873EC6AB1D0DB4E91654BD35339BD680E7E82DA2DC64996B4AE515 ] sdstor          C:\Windows\System32\drivers\sdstor.sys

08:45:18.0919 0x0f10  sdstor - ok

08:45:18.0951 0x0f10  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys

08:45:19.0060 0x0f10  secdrv - ok

08:45:19.0091 0x0f10  [ C49009F897BA4F2F4F31043663AA1485, 48C8BE1E3A4F150662AD012AF4E0357ABA792AD1147AB90EFF6CB2630E2501B6 ] seclogon        C:\Windows\system32\seclogon.dll

08:45:19.0201 0x0f10  seclogon - ok

08:45:19.0544 0x0f10  [ A88882E64BDC1D8E8D6E727B71CCCC53, 12D2235F54D0CEEED8AA268C17CDE44020269F4FEFC70CE957DBBF99AF7F553D ] SENS            C:\Windows\System32\sens.dll

08:45:19.0669 0x0f10  SENS - ok

08:45:19.0779 0x0f10  [ E66A7C8CE7ED22DED6DF1CA479FB4790, ADEB076F131E7A8C3AD96022B09BB33EB9AB26C9C831503B8C6960AA763B8975 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

08:45:19.0935 0x0f10  SensrSvc - ok

08:45:19.0982 0x0f10  [ DB2FF24CE0BDD15FE75870AFE312BA89, 7DB0D978C92CD0A0A81F7AB46FE323B4929CEA01585B0F330921E6DFA7DE1B85 ] SerCx           C:\Windows\system32\drivers\SerCx.sys

08:45:20.0091 0x0f10  SerCx - ok

08:45:20.0154 0x0f10  [ 0044B31F93946D5D41982314381FE431, 95B8A94BA9EF770F29ACD5B23D447EC2B6CF1CB3D0030343BA1550AC31F6E2A5 ] SerCx2          C:\Windows\system32\drivers\SerCx2.sys

08:45:20.0279 0x0f10  SerCx2 - ok

08:45:20.0294 0x0f10  [ 3CD600C089C1251BEEB4CD4CD5164F9E, D9F81951B4454B24E821E33ACA53A851A61F3135E8EC6FBE6761A1A3E1CDCBE2 ] Serenum         C:\Windows\System32\drivers\serenum.sys

08:45:20.0388 0x0f10  Serenum - ok

08:45:20.0513 0x0f10  [ D864381BC9C725FAB01D94C060660166, 132FED95222BBE3B0B25B3F1F0EFC5903D04564BD047BA4D2042AD51E3FDA724 ] Serial          C:\Windows\System32\drivers\serial.sys

08:45:20.0622 0x0f10  Serial - ok

08:45:20.0638 0x0f10  [ 0BD2B65DCE756FDE95A2E5CCCBF7705D, F13FAFEC8FCF3E796196562717C433CE359A74A3E5876AB070647C717AF74028 ] sermouse        C:\Windows\System32\drivers\sermouse.sys

08:45:20.0716 0x0f10  sermouse - ok

08:45:20.0826 0x0f10  [ D5C3776CBD8BC307DCCA3FD4CE667A37, 98E4253B770C25914C91A6148E2EA15ED0EF37ADCB042A47252DBA135972BF74 ] SessionEnv      C:\Windows\system32\sessenv.dll

08:45:20.0951 0x0f10  SessionEnv - ok

08:45:20.0982 0x0f10  [ 472B7A5AC181C050888DB454663DD764, C950A8615D57BFD455E18880398350642B2E1D6B951EC9754FD8D429F3418835 ] sfloppy         C:\Windows\System32\drivers\sfloppy.sys

08:45:21.0060 0x0f10  sfloppy - ok

08:45:21.0138 0x0f10  [ F4414F57DF2CECB8FC969AA43A6B0D50, AD09A6E1294721507DD6BE82B91F2EEB0FF0151B9BC14A75840CD657DBFDECEC ] SharedAccess    C:\Windows\System32\ipnathlp.dll

08:45:21.0294 0x0f10  SharedAccess - ok

08:45:21.0388 0x0f10  [ 0D190D8B4B20446BE6299AC734DFADF1, 6551095971F99820BBFC5FED8FAB9591A3F8ABFA0F027887F3B71B79325FF6D9 ] ShellHWDetection C:\Windows\System32\shsvcs.dll

08:45:21.0622 0x0f10  ShellHWDetection - ok

08:45:21.0654 0x0f10  [ 2F518D13DD6F3053837FE606F1A2EA1F, 64109296CE95BD233525688A350D575CF97B9464659AA07CF78B307B6ADBC835 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys

08:45:21.0732 0x0f10  SiSRaid2 - ok

08:45:21.0763 0x0f10  [ 1AC9A200A9C49C4508F04AAFFCA34A3F, 972BCB2A39169155F74111FAC74ACCD8F50E34EADCF087833B0980827627BBF4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys

08:45:21.0841 0x0f10  SiSRaid4 - ok

08:45:21.0888 0x0f10  [ 1C429BC6FC2BE9D2158EC9D0FAAC041B, E49869D630055ADCE987857569C546E02BEFC08DFBC58E894BABDBC112C662AC ] SmbDrv          C:\Windows\System32\drivers\Smb_driver_AMDASF.sys

08:45:21.0951 0x0f10  SmbDrv - ok

08:45:21.0982 0x0f10  [ BAB947E6E0665EFACDDA2723268227FD, 6D52308E9DFA13B67607F99743B6332CE2DA00AF961A067E3F1313738D2BA7C5 ] SmbDrvI         C:\Windows\System32\drivers\Smb_driver_Intel.sys

08:45:22.0044 0x0f10  SmbDrvI - ok

08:45:22.0091 0x0f10  [ 587ACA15210D1B01FBF272E07A08F91A, 1F3C13C218C5EA329C6E33E4AE7CFE88DAD59DA40F59FDE09D733AFD2E489000 ] smphost         C:\Windows\System32\smphost.dll

08:45:22.0201 0x0f10  smphost - ok

08:45:22.0247 0x0f10  [ 49EEB92DE930B8566EF615D600781DB4, 0B7C929D24FAFC34F95BB4AA77DCBA29DDD8F1977EB42713B64228677D1FBFD3 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

08:45:22.0357 0x0f10  SNMPTRAP - ok

08:45:22.0404 0x0f10  [ 240C5C3793206725AA05665851E8C214, 96ADFB85EB1623EB00C251C1C6A1F441A1795F0EBFD10B17DD1CA58E3AE8A90D ] spaceport       C:\Windows\system32\drivers\spaceport.sys

08:45:22.0544 0x0f10  spaceport - ok

08:45:22.0638 0x0f10  [ F337BE11071818FC3F5DC2940B6BDE34, D5CFF00E5DF37045F71AEE101AC9B270EBB29F372F404757B58600E9966C7E4D ] SpbCx           C:\Windows\system32\drivers\SpbCx.sys

08:45:22.0716 0x0f10  SpbCx - ok

08:45:22.0810 0x0f10  [ 42FEA9E0BA9761D9E65A4F167D91515B, 9A34CE83F3ACD50608671BDABE5E475F8E0C8335D3B8B7B3D7E84B2A319FA29F ] Spooler         C:\Windows\System32\spoolsv.exe

08:45:23.0060 0x0f10  Spooler - ok

08:45:23.0576 0x0f10  [ C993A0B97BECD3AAF5158E3869878465, 8B86F37DEFCBE55DE507D830EC4980EBB39B3CCA30C2B3E76B588AAB282A50FC ] sppsvc          C:\Windows\system32\sppsvc.exe

08:45:24.0607 0x0f10  sppsvc - ok

08:45:24.0701 0x0f10  [ 6416E79A58A8FCC33A447A4DDDD3BF04, 839E3107ACCD520C309BD6C8324DF7A8EB724EAD442AB1F1CACB0D83F84BE488 ] srv             C:\Windows\system32\DRIVERS\srv.sys

08:45:24.0841 0x0f10  srv - ok

08:45:24.0951 0x0f10  [ 5BED3AB69797C8786EF70AEA8C33748B, 0474EE6C43D437CBA9848BCF25D1341B122D7E9F371A0FF3C62C83D14B2CB095 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

08:45:25.0154 0x0f10  srv2 - ok

08:45:25.0232 0x0f10  [ D047CD668E6277FD80F0C613946F034C, BD0209E7FD89F9295D4DE48C9652DF2A2990277C16AFA473B96704B1CBD2F338 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

08:45:25.0341 0x0f10  srvnet - ok

08:45:25.0404 0x0f10  [ BB9ED3EDD8E85008215A7250D325A72E, D3404E31B7706B25CDEA7CB4260C343B5F090E8CCB9A5FA203B0F94A9112F1B3 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

08:45:25.0529 0x0f10  SSDPSRV - ok

08:45:25.0544 0x0f10  [ 3911418AFDE10EA6823B7799E4815524, A73517C4C1271E666B2B3A747756070098E923742B41572AA16573170440AA07 ] SstpSvc         C:\Windows\system32\sstpsvc.dll

08:45:25.0669 0x0f10  SstpSvc - ok

08:45:25.0701 0x0f10  [ 366DEA74BBA65B362BCCFC6FC2ADFD8B, 4D28122AB9D8DAB724021E6513B4474BD34FCEDF47769B1D27AC7551FCA002F8 ] stexstor        C:\Windows\system32\drivers\stexstor.sys

08:45:25.0794 0x0f10  stexstor - ok

08:45:25.0888 0x0f10  [ D638904FE86A5FE542A1BA13A9D68E5C, 89A956F932316BC50DD99B54BAF4E2809DCAA084DBB04CB84D11E5470BEAF251 ] stisvc          C:\Windows\System32\wiaservc.dll

08:45:26.0091 0x0f10  stisvc - ok

08:45:26.0138 0x0f10  [ 0ED2E318ABB68C1A35A8B8038BDB4C90, 5C3ABC245F4BCFE64E646D9C0E2F5E211244956C84D03084C71FF6A7E0CDED30 ] storahci        C:\Windows\system32\drivers\storahci.sys

08:45:26.0232 0x0f10  storahci - ok

08:45:26.0263 0x0f10  [ 7A08CEE1535F5A448215634C5EA74E50, 41529CDC08A3956F8FE9D5759B147E2E56E3305149EA415EB200249F7CD32094 ] storflt         C:\Windows\system32\DRIVERS\vmstorfl.sys

08:45:26.0341 0x0f10  storflt - ok

08:45:26.0404 0x0f10  [ 6B06E2D11E604BE2B1A406C4CB3B90DE, 2DDEA1568A85AD64FCE5D10D348304FCD9BE6E96C2313353EF70A2933306D188 ] stornvme        C:\Windows\system32\drivers\stornvme.sys

08:45:26.0466 0x0f10  stornvme - ok

08:45:26.0497 0x0f10  [ 3118058E3D07021A55324A943C6D722B, 0B255DF1977DADD2B9766EEEA814B464F0ABFA34D6439F3C453083850C121F16 ] StorSvc         C:\Windows\system32\storsvc.dll

08:45:26.0607 0x0f10  StorSvc - ok

08:45:26.0638 0x0f10  [ 548759755BC73DAD663250239D7E0B9F, D31A05A8CE800B539420B6E545F1F4BF6E4B02EAF8366DE89CAF13A83C6CA48D ] storvsc         C:\Windows\system32\drivers\storvsc.sys

08:45:26.0701 0x0f10  storvsc - ok

08:45:26.0732 0x0f10  [ D8E1AE075AB3E8AD56F69C44AA978596, CAFF5116DE7F0EEFFEBE38724BCEE7D11B44153AD35EE43E314C56D5E210758A ] svsvc           C:\Windows\system32\svsvc.dll

08:45:26.0841 0x0f10  svsvc - ok

08:45:26.0857 0x0f10  [ 84E0F5D41C138C5CC975137A2A98F6D3, 1E36CED05E4F4365C2AB020CAF920E3959995D7F89F3FABD7B2FB05985F85F38 ] swenum          C:\Windows\System32\drivers\swenum.sys

08:45:26.0935 0x0f10  swenum - ok

08:45:27.0013 0x0f10  [ 850EBB87584484DC16F917E7B6F4A304, C253D1DFFCDFB018432063602FB01DBCBDDD6E03458E5C366AABD4670F114B0C ] swprv           C:\Windows\System32\swprv.dll

08:45:27.0201 0x0f10  swprv - ok

08:45:27.0279 0x0f10  [ 5591FBDC2278E7DE20BF6E7E0E24AEEF, 47883703837206DC4E84B4870BFE9F8D989DDD3204F74435DC8A966BBDC88524 ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys

08:45:27.0388 0x0f10  SynTP - ok

08:45:27.0513 0x0f10  [ 3DA26652B12E9AB43FD04976AC6DFD33, DEFE220D86197949E97342FE3487CD6A07DD2FFAF6D17A7C65419C2C1B9D1AB5 ] SysMain         C:\Windows\system32\sysmain.dll

08:45:27.0747 0x0f10  SysMain - ok

08:45:27.0810 0x0f10  [ FD4EA8E9232ADD51DC31C295DDEF2768, 3EA40D7376AB5AA5DA2BCF4745C79F7BF819363466967ECC3CD15ADECBFD7244 ] SystemEventsBroker C:\Windows\System32\SystemEventsBrokerServer.dll

08:45:27.0919 0x0f10  SystemEventsBroker - ok

08:45:27.0982 0x0f10  [ BA6DD39266A5E15515C8C14DA2DA3E5C, 5BC917BA4E7281A67CC6CEF2F4D1972DF04DECBEFB6DED0B08FFBD06E15D4B4F ] TabletInputService C:\Windows\System32\TabSvc.dll

08:45:28.0091 0x0f10  TabletInputService - ok

08:45:28.0138 0x0f10  [ B517410F157693043DACA21B19B258A6, 2224EECEB575CEA811036C43BB5B0A408DE5F59BC97235AB948968E4C3E438F2 ] TapiSrv         C:\Windows\System32\tapisrv.dll

08:45:28.0310 0x0f10  TapiSrv - ok

08:45:28.0529 0x0f10  [ CCB3A2BB60FE5073F2DEA63FE83CF8FE, 02982136236DD595D8974E6645A008D663B4DD3BC3824721E4DE4377B97887C7 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

08:45:29.0091 0x0f10  Tcpip - ok

08:45:29.0341 0x0f10  [ CCB3A2BB60FE5073F2DEA63FE83CF8FE, 02982136236DD595D8974E6645A008D663B4DD3BC3824721E4DE4377B97887C7 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

08:45:29.0779 0x0f10  TCPIP6 - ok

08:45:29.0826 0x0f10  [ 41CF802064F72E55F50CA0A221FD36D4, 70ABCDF9E96611E8C83042C581575E26649FE479475E8E118CD3FF6CB1C84C3F ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

08:45:29.0935 0x0f10  tcpipreg - ok

08:45:29.0982 0x0f10  [ FFF28F9F6823EB1756C60F1649560BBF, 208DFF8BF0329D0D4761C7E31527AEED7FF5F3C36C5005953D01477F35408D5C ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

08:45:30.0091 0x0f10  tdx - ok

08:45:30.0122 0x0f10  [ 232D185D2337F141311D0CF1983E1431, 02EB56D3F26174AF1741C1A444CE30DE84D5BAF583C1A52C7A953BCC52445547 ] terminpt        C:\Windows\System32\drivers\terminpt.sys

08:45:30.0216 0x0f10  terminpt - ok

08:45:30.0326 0x0f10  [ 3D748E5558FD9A9F03182CB2330698DC, 70B2069AB7912EB49AB3ABD18D4B42CB94AC99CA6DE3F63F4888B8EAAC78AAA2 ] TermService     C:\Windows\System32\termsrv.dll

08:45:30.0529 0x0f10  TermService - ok

08:45:30.0576 0x0f10  [ 05FBE1F7C13E87AF7A414CDF288B1F62, 24079E1A6B2E33A1A8E76A77F73473B93DD6B379E44C982CE50D6CEED9747838 ] Themes          C:\Windows\system32\themeservice.dll

08:45:30.0685 0x0f10  Themes - ok

08:45:30.0732 0x0f10  [ FD788C2D96EA91469A3C1D13E80D7473, 7B14D4BFDE18CECC19FBFFAA5AFF5FD78BFB7FCDA6613990740A8A7DD9873D26 ] THREADORDER     C:\Windows\system32\mmcss.dll

08:45:30.0826 0x0f10  THREADORDER - ok

08:45:30.0872 0x0f10  [ 347A3E49CE18402305B8119A6EC7CFEB, 6768B20EE577880B0353FE84B980D4A18D323929A63FAE41F7A55123BBFC8DBA ] TimeBroker      C:\Windows\System32\TimeBrokerServer.dll

08:45:31.0029 0x0f10  TimeBroker - ok

08:45:31.0076 0x0f10  [ 82F909359600D3603FE852DB7F135626, 2EB2BB9D81AC9A2E432B2628E296B7B21F1C82EAE8009300EEF1B8596A9F418D ] TPM             C:\Windows\system32\drivers\tpm.sys

08:45:31.0154 0x0f10  TPM - ok

08:45:31.0185 0x0f10  [ C97E14BB6A196B0554D6EB67D8818175, C00588C94988F10507F84584DFA4C0A43B8648AD1AD35E9BAE14CDD21FCF7B90 ] TrkWks          C:\Windows\System32\trkwks.dll

08:45:31.0279 0x0f10  TrkWks - ok

08:45:31.0357 0x0f10  [ 887CC44830D3F367CAD17A0CA7CCA5C8, D4022A76433A11FD66D0F41A1EB4D6893BC5B22317E7E9E021739109EB493B44 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

08:45:31.0451 0x0f10  TrustedInstaller - ok

08:45:31.0482 0x0f10  [ BF8F54CA37E9C9D6582C31C5761F8C93, 337C566792F6FB9B7FD5D1D4384B767CFE4CF5DBB2E4688CCC36CBB018A0DD0F ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

08:45:31.0560 0x0f10  TsUsbFlt - ok

08:45:31.0591 0x0f10  [ E0088068DCE2EE82897027DDB8E05254, FA9C201D3C885DAD2ABE6A23343EDCC83CFB342EFF9E3005FA50B1D88B21D203 ] TsUsbGD         C:\Windows\System32\drivers\TsUsbGD.sys

08:45:31.0669 0x0f10  TsUsbGD - ok

08:45:31.0701 0x0f10  [ C8E0E78B5D284C2FF59BDFFDAF997242, BA1576C491A1246EF9866762426D110F4570F9DB42A68C174943C7D5020FE3E2 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

08:45:31.0810 0x0f10  tunnel - ok

08:45:31.0841 0x0f10  [ F6EEAD052943B5A3104C1405BB856C54, FE422813E6C1012E9F392EFF2AE4C6D3A4DBD9CB2BD5E6A5CAB57D4E89A29468 ] uagp35          C:\Windows\system32\drivers\uagp35.sys

08:45:31.0919 0x0f10  uagp35 - ok

08:45:31.0966 0x0f10  [ FE6067B1FD4E63650C667B33D080565B, 2C330ED00E49BA55E25564230E0DFB8A35F2B5320EB18D4AF7CAACFA9A449044 ] UASPStor        C:\Windows\System32\drivers\uaspstor.sys

08:45:32.0029 0x0f10  UASPStor - ok

08:45:32.0107 0x0f10  [ B034A41891A36457B994307DFA772293, CA5E6500764A9777AE0E15B2AFB6F05982C90F01374E3F6DDC6DF3852282C66B ] UCX01000        C:\Windows\System32\drivers\ucx01000.sys

08:45:32.0232 0x0f10  UCX01000 - ok

08:45:32.0310 0x0f10  [ 1EC649F112896FAE33250F0B97AC5D0B, 0C0A1C2C7615DEB298AD3073340FD1BF91FEBE611F133E3B48D994A6EAA8369F ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

08:45:32.0498 0x0f10  udfs - ok

08:45:32.0529 0x0f10  [ 9578691F297E1B1F519970FE6D47CB21, 080C352AAF22A16A4F3C4AB4DCEA5BFA656457C73F735CEBA30516FDACCF6301 ] UEFI            C:\Windows\System32\drivers\UEFI.sys

08:45:32.0607 0x0f10  UEFI - ok

08:45:32.0701 0x0f10  [ 320878AFECDBBD61BBE98624A6CAAC08, 15C090EA32A24D976B5FCB1373B1281DCC2295C075299C814345D694AEB47CB9 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

08:45:32.0857 0x0f10  UI0Detect - ok

08:45:32.0888 0x0f10  [ 5EAB5117DDB24FC4D39E6FFFCF1837B9, 2BC709240867F161E94BE6625A04F478EAAA3EEE7BC7C37ED0DFA9EEA5928E98 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

08:45:32.0982 0x0f10  uliagpkx - ok

08:45:33.0013 0x0f10  [ DA34C39A18E60E7C3FA0630566408034, 2F162504214053894C72760D9933D01DBF3578609FE5E2376C3272818599FE32 ] umbus           C:\Windows\System32\drivers\umbus.sys

08:45:33.0122 0x0f10  umbus - ok

08:45:33.0169 0x0f10  [ AE8294875E5446E359B1E8035D40C05E, AE0357BAB47C07C3576BC76951CD258C009BC5A1B93259D2122A841BD9CDA8FA ] UmPass          C:\Windows\System32\drivers\umpass.sys

08:45:33.0263 0x0f10  UmPass - ok

08:45:33.0326 0x0f10  [ E3DDF7D43E05784FAA5E042605EEE528, 8E20E880FAB09AF4FF5C438BF9EAE9970D46C05167870110869B744E498FD761 ] UmRdpService    C:\Windows\System32\umrdp.dll

08:45:33.0466 0x0f10  UmRdpService - ok

08:45:33.0544 0x0f10  [ 4A2FFDAC45F317E17DF642C7160EB633, F1AB762912FAA5F469F322407DA37C91556086C42D1643AD27516C12A84F74D0 ] upnphost        C:\Windows\System32\upnphost.dll

08:45:33.0701 0x0f10  upnphost - ok

08:45:33.0763 0x0f10  [ FF78D053A05E5A394F4E3C1816CC65A8, 5DAE02414271231F5FDBB751AFEB99874779B467947020815D4AE54432D4269D ] usbccgp         C:\Windows\System32\drivers\usbccgp.sys

08:45:33.0841 0x0f10  usbccgp - ok

08:45:33.0888 0x0f10  [ B3D6457D841A0CAEF4C52D88621715F2, CBDD76A8A28379B107B1FB530757B477B8AB74CD01F9F3CEDC7B1BA0C6E5A990 ] usbcir          C:\Windows\System32\drivers\usbcir.sys

08:45:33.0997 0x0f10  usbcir - ok

08:45:34.0044 0x0f10  [ 48BA326A3DBA5B5BEB5F2777F4618696, B9EC8155F11A3A7644BD9DC8910681B46AE44AE3BF53F052DF50E9C5555E3229 ] usbehci         C:\Windows\System32\drivers\usbehci.sys

08:45:34.0122 0x0f10  usbehci - ok

08:45:34.0216 0x0f10  [ FEF0BC107812B36849741C3211BA6B60, B3EF738BE1E6B6027F29C9713CD3F367EA067D2BE46580AFBC0FB58046EF6BBD ] usbhub          C:\Windows\System32\drivers\usbhub.sys

08:45:34.0341 0x0f10  usbhub - ok

08:45:34.0435 0x0f10  [ 65392F3F3F65E4C6CC82A0F4F8A0B051, C11B662A28D95820717DFFC6B76DBB755E4876009A2342E5E3992DE32D6BFF61 ] USBHUB3         C:\Windows\System32\drivers\UsbHub3.sys

08:45:34.0591 0x0f10  USBHUB3 - ok

08:45:34.0654 0x0f10  [ 3019097FB6C985EF24C058090FF3BDBD, 24AC518D34E338D94BF3D5B3F72E53F8A1369BAA7F32FEA3EDBCF928C4FF1D17 ] usbohci         C:\Windows\System32\drivers\usbohci.sys

08:45:34.0857 0x0f10  usbohci - ok

08:45:34.0888 0x0f10  [ 4D655E3B684BE9B0F7FFD8A2935C348C, 3A7FC1748C5AEA8CFE0E7C22ADC77E3DCA475455FC16D9C6A5C16EB5E949A516 ] usbprint        C:\Windows\System32\drivers\usbprint.sys

08:45:34.0997 0x0f10  usbprint - ok

08:45:35.0060 0x0f10  [ 66732C13628BDB1AB0D6FD46027327C2, B582C0F348D8F79419CA5A58F10CA151E06D7CA3BE162344CADA46D9D7FED97C ] USBSTOR         C:\Windows\System32\drivers\USBSTOR.SYS

08:45:35.0154 0x0f10  USBSTOR - ok

08:45:35.0201 0x0f10  [ 064260B3A5868AC894A4943543BC7AB7, D3534E98B34C4AC9A430D7E0AB301A0E5E1511E3117C2FEA392636B0DE2C38E2 ] usbuhci         C:\Windows\System32\drivers\usbuhci.sys

08:45:35.0294 0x0f10  usbuhci - ok

08:45:35.0372 0x0f10  [ 18F744E8CCEB2670040EBAF7AD77B8C6, C5E2DF4EA0D946B4DA67DE29FA9D0F079DED35EC59B98E532C4C2D5F8E86DA0A ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys

08:45:35.0497 0x0f10  usbvideo - ok

08:45:35.0576 0x0f10  [ 48430B0313FC1CFE3D2400553F1A93CD, 92994DE6B131E904AFF2C9C4FBB4E6B0D58525A1539763327373DA18C9F08193 ] USBXHCI         C:\Windows\System32\drivers\USBXHCI.SYS

08:45:35.0716 0x0f10  USBXHCI - ok

08:45:35.0732 0x0f10  [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] VaultSvc        C:\Windows\system32\lsass.exe

08:45:35.0810 0x0f10  VaultSvc - ok

08:45:35.0826 0x0f10  [ FEB26E3B8345A7E8D62F945C4AE86562, 3AAFE87C402FC8E92542DFE60EC9540559863065F88D429A16D7B1BF829223FF ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

08:45:35.0904 0x0f10  vdrvroot - ok

08:45:36.0029 0x0f10  [ E3EF58D4123B5AA29C8E19825AF84A5E, FB1046722BC643E955DBC3B1459DBF2A6D575EBA2BCF7B20A0FA51E3993835E2 ] vds             C:\Windows\System32\vds.exe

08:45:36.0294 0x0f10  vds - ok

08:45:36.0341 0x0f10  [ A026EDEAA5EECAE0B08E2748B616D4BD, 2525A54DC7F49DDFBB999C22BF3FAB6D9E9F70C0806E58D81E90AC59F9F46089 ] VerifierExt     C:\Windows\system32\drivers\VerifierExt.sys

08:45:36.0435 0x0f10  VerifierExt - ok

08:45:36.0513 0x0f10  [ 52E483A3701A5A61A75A06993720347D, 689E812755E485DF6960D1E049740FBAFB812467D23B673DCAA40C03FEBB544F ] vhdmp           C:\Windows\System32\drivers\vhdmp.sys

08:45:36.0654 0x0f10  vhdmp - ok

08:45:36.0701 0x0f10  [ 06D38968028E9AB19DE9B618C7B6D199, 62022297A47F440D1C82CA0B0E57C0C8E9D5033D83DD3B40492B218DF65EBF68 ] viaide          C:\Windows\system32\drivers\viaide.sys

08:45:36.0747 0x0f10  viaide - ok

08:45:36.0779 0x0f10  [ C6305BDFC4F7CE51F72BB072C03D4ACE, 73E62869CA3104F48CC3B0C45E69CE9BF4F8D7D06E29C2F049B9347ABB50554D ] vmbus           C:\Windows\system32\drivers\vmbus.sys

08:45:36.0857 0x0f10  vmbus - ok

08:45:36.0872 0x0f10  [ DA40BEA0A863CE768C940CA9723BF81F, 567C0C3F422325635808B0CF76E05D3B6187F96845C33F85F92F98C9FE53A5B8 ] VMBusHID        C:\Windows\System32\drivers\VMBusHID.sys

08:45:36.0951 0x0f10  VMBusHID - ok

08:45:37.0013 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicguestinterface C:\Windows\System32\ICSvc.dll

08:45:37.0185 0x0f10  vmicguestinterface - ok

08:45:37.0247 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicheartbeat   C:\Windows\System32\ICSvc.dll

08:45:37.0435 0x0f10  vmicheartbeat - ok

08:45:37.0482 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmickvpexchange C:\Windows\System32\ICSvc.dll

08:45:37.0669 0x0f10  vmickvpexchange - ok

08:45:37.0732 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicrdv         C:\Windows\System32\ICSvc.dll

08:45:37.0904 0x0f10  vmicrdv - ok

08:45:37.0966 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicshutdown    C:\Windows\System32\ICSvc.dll

08:45:38.0154 0x0f10  vmicshutdown - ok

08:45:38.0201 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmictimesync    C:\Windows\System32\ICSvc.dll

08:45:38.0388 0x0f10  vmictimesync - ok

08:45:38.0451 0x0f10  [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicvss         C:\Windows\System32\ICSvc.dll

08:45:38.0622 0x0f10  vmicvss - ok

08:45:38.0685 0x0f10  [ 55D7D963DE85162F1C49721E502F9744, 5AD34D6DB707EF3E5242BD8CA67B21D6258EE7E7FC477D5227BD15500AE7F45F ] volmgr          C:\Windows\system32\drivers\volmgr.sys

08:45:38.0779 0x0f10  volmgr - ok

08:45:38.0826 0x0f10  [ CCB9E901F7254BF96D28EB1B0E5329B7, F0E3CA4EFA544CDAEF4092284CF3EC7DF07F806A770285E281816457AD8813F5 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

08:45:38.0966 0x0f10  volmgrx - ok

08:45:39.0013 0x0f10  [ 64CA2B4A49A8EAF495E435623ECCE7DB, 81151F295A54DE2B8B88C7F48C86BF58CDFF96F98493509C06D6F41484594386 ] volsnap         C:\Windows\system32\drivers\volsnap.sys

08:45:39.0154 0x0f10  volsnap - ok

08:45:39.0201 0x0f10  [ 01355C98B5C3ED1EC446743CDA848FCE, B9FCF558C20E05DD0F53FFB70BBEF873EA57801E13A16701E636128D625C4B67 ] vpci            C:\Windows\System32\drivers\vpci.sys

08:45:39.0294 0x0f10  vpci - ok

08:45:39.0357 0x0f10  [ 4539F45F9F4C9757A86A56C949421E07, DEC362314B2C66414F39354AFE79C02B18BF4EEF90787FB58307F6EB62237E2C ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys

08:45:39.0451 0x0f10  vsmraid - ok

08:45:39.0587 0x0f10  [ E369C59F2C0852DDD090C07E0DDE0051, 4FAC94458EAAEED4F84A86FBAB8FBB332D0AF85BD528E63C0C058A2DA8E3011D ] VSS             C:\Windows\system32\vssvc.exe

08:45:39.0947 0x0f10  VSS - ok

08:45:40.0025 0x0f10  [ 0849B7260F26FE05EA56DED0672E2F4B, 7EAC0E7988F45CB4133A15932955B7B03CE715C967A3BAC9999D81543EBCAEC5 ] VSTXRAID        C:\Windows\system32\drivers\vstxraid.sys

08:45:40.0166 0x0f10  VSTXRAID - ok

08:45:40.0228 0x0f10  [ BE970C369E43B509C1EDA2B8FA7CECB0, 18951F2AA842A0795AA79A4E164EE925A35E6270EBE4C4CDB19D0A891830E383 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys

08:45:40.0337 0x0f10  vwifibus - ok

08:45:40.0384 0x0f10  [ 35BF5C5F5E3C9902C98978C7640574DA, C61E50B04000DCEC72365723F0C0725C2E005529DAF2777A59E624C14DA29E55 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys

08:45:40.0525 0x0f10  vwififlt - ok

08:45:40.0572 0x0f10  [ 65ED7B9CFEA893DF7748D5FF692690DE, 73AB9D8BB928B3247BDFC7BB47AD7FCA763B375DC250C251DB4E0573531040E8 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys

08:45:40.0650 0x0f10  vwifimp - ok

08:45:40.0744 0x0f10  [ 7599E582CA3A6AAA95A18FFE1172D339, A0410778FBBC4302EA91CF24B944427410B4706535F1192504D4F34C3ED4503E ] W32Time         C:\Windows\system32\w32time.dll

08:45:40.0916 0x0f10  W32Time - ok

08:45:40.0978 0x0f10  [ 8E553C859C83784DEC08B10AFC3EAC92, 41D8DBA1500DBD3AC9783169ACF545805EF05069F12866238992A30794369254 ] w3logsvc        C:\Windows\system32\inetsrv\w3logsvc.dll

08:45:41.0119 0x0f10  w3logsvc - ok

08:45:41.0166 0x0f10  [ 0910AB9ED404C1434E2D0376C2AD5D8B, 62585CA5F1375BDA440D28D5DF1ADDC9DE3DDFA196D49BBFF3456A5A09EE1C6B ] WacomPen        C:\Windows\System32\drivers\wacompen.sys

08:45:41.0259 0x0f10  WacomPen - ok

08:45:41.0337 0x0f10  [ 9BAE40BD31E3EE0B0C70BEF167E0A2BC, 2419AC815C95F2629E1832973501983D06F788728755605D42D6C8565C3CBBF1 ] WAS             C:\Windows\system32\inetsrv\iisw3adm.dll

08:45:41.0525 0x0f10  WAS - ok

08:45:41.0697 0x0f10  [ 61692DB39AD3DF2F29392D68EAA7BB93, 854D4B9C7DD1676968598ED973500650ECEC02C420E44C0B3957C24F073AA5FB ] wbengine        C:\Windows\system32\wbengine.exe

08:45:42.0041 0x0f10  wbengine - ok

08:45:42.0119 0x0f10  [ 3BC1D1D56637A32CD91C8AE08E2484AA, 9EE1BD3FB0D289E25F3DDD0D8F67DC1C701A6B1D5418FADF348D0E642B1DEBEB ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

08:45:42.0244 0x0f10  WbioSrvc - ok

08:45:42.0322 0x0f10  [ A07CFC4B593D15B6BF06813C3B5B33BF, B57BD918E2AFF9943B51A24B95E0C4D3482B4DF73C0E2421E8CC67C2BC7A4C70 ] Wcmsvc          C:\Windows\System32\wcmsvc.dll

08:45:42.0462 0x0f10  Wcmsvc - ok

08:45:42.0509 0x0f10  [ D2726823DF7E19F213F4805A9D6D145F, A7F582C99918D204264D3B374F70D75984BDA5805203041E3DECB8153D16E102 ] wcncsvc         C:\Windows\System32\wcncsvc.dll

08:45:42.0666 0x0f10  wcncsvc - ok

08:45:42.0728 0x0f10  [ 846C02A8B48CBD921A3D6AB521AA0DC4, B07573A774A6C65D24E5718DC25DF378270EB5B40221CA5A53B21D47838381D3 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

08:45:42.0837 0x0f10  WcsPlugInService - ok

08:45:42.0884 0x0f10  [ 0359607177E5E9F6041136CC0A5CB0B6, 16687BE2639648CF46E8768BA1798030472C525612C629BF134D053240E2195B ] WdBoot          C:\Windows\system32\drivers\WdBoot.sys

08:45:42.0947 0x0f10  WdBoot - ok

08:45:43.0041 0x0f10  [ CB6C63FF8342B467E2EF76E98D5B934D, BE017CE91E3BAB293DE6ECF143797CCE3F33CC63024437472B4E38C6961AD884 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

08:45:43.0197 0x0f10  Wdf01000 - ok

08:45:43.0244 0x0f10  [ DE8D12B4C3F55FA2C5E9774314F6C58A, C3E835DC066A94E1431BCDC90D7EA27AAC6F82826F4A5527B37D865241D7A366 ] WdFilter        C:\Windows\system32\drivers\WdFilter.sys

08:45:43.0337 0x0f10  WdFilter - ok

08:45:43.0369 0x0f10  [ 40C67D1A4891120874767F6E6604D6C5, 4D9DD658566DE711ADF4D6C33FCB31DA351EE050E3ED188664D04526CCAAEEF5 ] WdiServiceHost  C:\Windows\system32\wdi.dll

08:45:43.0478 0x0f10  WdiServiceHost - ok

08:45:43.0494 0x0f10  [ 40C67D1A4891120874767F6E6604D6C5, 4D9DD658566DE711ADF4D6C33FCB31DA351EE050E3ED188664D04526CCAAEEF5 ] WdiSystemHost   C:\Windows\system32\wdi.dll

08:45:43.0619 0x0f10  WdiSystemHost - ok

08:45:43.0650 0x0f10  [ 4AD874CDC812EC156265E451B6B09DAB, 6E3E05B8301841425E9BB0D54B35EF386B78EEB307B5A6153FD1F366D30F23FA ] WdNisDrv        C:\Windows\system32\Drivers\WdNisDrv.sys

08:45:43.0712 0x0f10  WdNisDrv - ok

08:45:43.0853 0x0f10  WdNisSvc - ok

08:45:43.0884 0x0f10  [ 91B18D7A1702ED589E67C6C81052B955, 5D1DA8B86106A28E50BBCCB36527CC130D41201F5BE1D3DC5F1D6F7ECCF807BA ] WebClient       C:\Windows\System32\webclnt.dll

08:45:44.0072 0x0f10  WebClient - ok

08:45:44.0166 0x0f10  [ 3274312F263882B51B964329FAF49734, 99A020377ACF0762BE5ECD2D68EB5E1497B9D59963247E725F7F96FB5DF41FAD ] Wecsvc          C:\Windows\system32\wecsvc.dll

08:45:44.0306 0x0f10  Wecsvc - ok

08:45:44.0337 0x0f10  [ 7CDD84E0023A0C5C230B06A7965EC65E, 6EC7DC18C76D66CF9A893C3DD20F9BE3ADD76546F9A9BA42CE4F24854709F9D9 ] WEPHOSTSVC      C:\Windows\system32\wephostsvc.dll

08:45:44.0478 0x0f10  WEPHOSTSVC - ok

08:45:44.0541 0x0f10  [ 959534ACF085C137D2D094384EF89C45, D029F440789FE170A1C46217C6DE6D78DC0188A5CF33FCCC17FA65D3BC80C2B7 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

08:45:44.0650 0x0f10  wercplsupport - ok

08:45:44.0712 0x0f10  [ 82BCCF5FBE47AC9E8CBA2020994DFB3F, EA96C6BD98A701B465D0780EC10BDA92E45FE636D60C1385813AA3B456D8B931 ] WerSvc          C:\Windows\System32\WerSvc.dll

08:45:44.0837 0x0f10  WerSvc - ok

08:45:44.0869 0x0f10  [ BFBE1C5F57FE7A885673A1962D5532B7, F0BD05B257108699FE6AB32EF11F927C31932F27062A705B3FEFA4F5B4C0D8C3 ] WFPLWFS         C:\Windows\system32\DRIVERS\wfplwfs.sys

08:45:44.0978 0x0f10  WFPLWFS - ok

08:45:45.0025 0x0f10  [ E06AFE2F94BA7CFA2FE4FD2A449E60E2, 99A81E16366E9E77905D873B0246E4C11B383FE1E99E0E1D9A07FAD4E52EA9E4 ] WiaRpc          C:\Windows\System32\wiarpc.dll

08:45:45.0134 0x0f10  WiaRpc - ok

08:45:45.0166 0x0f10  [ 867BCC69ED9C31C501465EB0E8BA9DFA, 678B7FF4D4E8624514301956CDA7FB451159BBFC83FF2E4E5E7DADAE3C7AB2EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

08:45:45.0244 0x0f10  WIMMount - ok

08:45:45.0244 0x0f10  WinDefend - ok

08:45:45.0353 0x0f10  [ DD079EC8F44DCA3A176B345C6ADEFB66, 6CD9371B83EA23D2181891FAE1DB285BC111A78C35F374E57666ED09860C91A9 ] WinHttpAutoProxySvc C:\Windows\system32\winhttp.dll

08:45:45.0541 0x0f10  WinHttpAutoProxySvc - ok

08:45:45.0619 0x0f10  [ 9DB490F3E823C5C3C070644B96CB9D59, 81937D0B331E43C7C61514E60B3AD51370C5201F7B4D12F8534840D91EDC32DD ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

08:45:45.0759 0x0f10  Winmgmt - ok

08:45:45.0962 0x0f10  [ 9CE162EB9057CF079736F4DD00FC0D6C, 412C34557866D2A3B3CDAFA5A03B87C01AACF75E349802E511098B20137028D9 ] WinRM           C:\Windows\system32\WsmSvc.dll

08:45:46.0337 0x0f10  WinRM - ok

08:45:46.0416 0x0f10  [ AC263C2F66405589528995AA41040599, 81B46E551D6130A2C3D113EC3B563CEDB5A06BB340986C0E03136CE5BE729481 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

08:45:46.0509 0x0f10  WinUsb - ok

08:45:46.0541 0x0f10  [ 4F2A80D65AE6F845776E2F06AE6782ED, 2455537C048115435D9EDE4B18F9F54C43912076AEF36BDEFEC35AF2140B8B2E ] WirelessButtonDriver C:\Windows\System32\drivers\WirelessButtonDriver64.sys

08:45:46.0603 0x0f10  WirelessButtonDriver - ok

08:45:46.0736 0x0f10  [ 3F5EF31C6AA204B099EE76497DF80A26, CBE648A4E7E1D98A3D8C72582C1CB3C2FD2329EAA24EE4DCAD271AAA6F4D82CE ] WlanSvc         C:\Windows\System32\wlansvc.dll

08:45:46.0990 0x0f10  WlanSvc - ok

08:45:47.0146 0x0f10  [ 5F56C0DE776C7AE43AF749845BFAA1EF, 837993C5853B7E682C7FB8401B7F5D951FFD15E5659EBB1B01DC3F5719ACEE19 ] wlidsvc         C:\Windows\system32\wlidsvc.dll

08:45:47.0474 0x0f10  wlidsvc - ok

08:45:47.0537 0x0f10  [ 2834D9D3B4F554A39C72F00EA3F0E128, D10124343C67FE9A0B711AD569BB8080495FCEA0ECEF9AC3F3FBD6865F436A44 ] WmiAcpi         C:\Windows\System32\drivers\wmiacpi.sys

08:45:47.0599 0x0f10  WmiAcpi - ok

08:45:47.0662 0x0f10  [ 7AFAC828F52D62F304A911EC32F42EEE, 4EDCF4149069413A166169F2E23F7505F47B39B7EC319E1EF6D2C46CD140AA24 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

08:45:47.0771 0x0f10  wmiApSrv - ok

08:45:47.0802 0x0f10  WMPNetworkSvc - ok

08:45:47.0849 0x0f10  [ 7FC5667DF73D4B04AA457CC3A4180E09, CB7B014945DCA16B6D120DBE0E5876C4C867A4ACD3C3536AEADC14B908613D4E ] Wof             C:\Windows\system32\drivers\Wof.sys

08:45:47.0927 0x0f10  Wof - ok

08:45:48.0068 0x0f10  [ 61BF52E9FFAB27A0B6D621BE26088373, 81291D52C381360E69D51E7DEB05CFAC651A7E9EF781CA23062C0583D0C94708 ] workfolderssvc  C:\Windows\system32\workfolderssvc.dll

08:45:48.0334 0x0f10  workfolderssvc - ok

08:45:48.0365 0x0f10  [ 182561A14F2E93E81E66FE3700D17A5A, FB9A06058A8BCCEDCDC5BF8899D9B2FBA5752C262C5FC6D2B8338884F3303D12 ] wpcfltr         C:\Windows\system32\DRIVERS\wpcfltr.sys

08:45:48.0459 0x0f10  wpcfltr - ok

08:45:48.0490 0x0f10  [ 4E6A0F60DA7EF050D3D26417CD4D24E9, E6B3BFB007B641D41F8532ED086F92CB3D86E210023DBFAA9AD8152A9FD33CCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

08:45:48.0615 0x0f10  WPCSvc - ok

08:45:48.0677 0x0f10  [ 618A19EB31ECA7B7F2AA0207BAF598A5, CB18CF9B781EAB3D775F8201F294A7135E058D6C963D2CC759DCA14D95EED538 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

08:45:48.0802 0x0f10  WPDBusEnum - ok

08:45:48.0834 0x0f10  [ 9F2904B55F6CECCD1A8D986B5CE2609A, E19ED4DD3CEF3A22C058FC324824604FB3FC98A029C94E6C2A3389F938D680B6 ] WpdUpFltr       C:\Windows\system32\drivers\WpdUpFltr.sys

08:45:48.0912 0x0f10  WpdUpFltr - ok

08:45:48.0943 0x0f10  [ AE072B0339D0A18E455DC21666CAD572, AB1DAEA25E2C7AD610818D4B4783F6D4190D85EBB3963BBAD410E8CEA7899EDB ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

08:45:49.0052 0x0f10  ws2ifsl - ok

08:45:49.0099 0x0f10  [ 9654DE19551093CD73874281E1573C94, 5E3513EC0CB180D90904BE8970AB64A4434279E8C467AE2CF693254E47B1D11E ] wscsvc          C:\Windows\System32\wscsvc.dll

08:45:49.0224 0x0f10  wscsvc - ok

08:45:49.0240 0x0f10  WSearch - ok

08:45:49.0521 0x0f10  [ 95B6670E6933E1DEE19686C55BE709A0, 4B9EB8F1712B7959A71F6DA445D29BD09B25EEFC6B30D736EFE30163D79B233E ] WSService       C:\Windows\System32\WSService.dll

08:45:50.0068 0x0f10  WSService - ok

08:45:50.0427 0x0f10  [ DCD090318EC800CF6275C6835900B0C6, 9E72762EEE46CC0606B909850E6D22E9C8E5C88E82F7C974B2B7C1E5160BEBA7 ] wuauserv        C:\Windows\system32\wuaueng.dll

08:45:51.0021 0x0f10  wuauserv - ok

08:45:51.0099 0x0f10  [ D537815E450A149752C15868392AD1F3, 8788CE493349299DB36E409C8CC3C6EA08301FA492C95D9D556E00BC13A05F13 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

08:45:51.0209 0x0f10  WudfPf - ok

08:45:51.0255 0x0f10  [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFRd          C:\Windows\System32\drivers\WUDFRd.sys

08:45:51.0380 0x0f10  WUDFRd - ok

08:45:51.0412 0x0f10  [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFSensorLP    C:\Windows\System32\drivers\WUDFRd.sys

08:45:51.0537 0x0f10  WUDFSensorLP - ok

08:45:51.0568 0x0f10  [ 9CDC2059A23E3C9B57696178508777E7, B680A2E2EDA5C8C6A547E7D9B2F2F8E6407C3EA0A01B82A4B88D48A27913A597 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

08:45:51.0724 0x0f10  wudfsvc - ok

08:45:51.0771 0x0f10  [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFWpdFs       C:\Windows\system32\DRIVERS\WUDFRd.sys

08:45:51.0896 0x0f10  WUDFWpdFs - ok

08:45:51.0927 0x0f10  [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFWpdMtp      C:\Windows\system32\DRIVERS\WUDFRd.sys

08:45:52.0052 0x0f10  WUDFWpdMtp - ok

08:45:52.0130 0x0f10  [ 2FA9794CA36147756F3FDFD6CA29B46F, 4B86DC38C2411C281686E9A4E64DA6FB2992E39391371F78E012D6D8BB85123F ] WwanSvc         C:\Windows\System32\wwansvc.dll

08:45:52.0318 0x0f10  WwanSvc - ok

08:45:52.0365 0x0f10  ================ Scan global ===============================

08:45:52.0427 0x0f10  [ C89780A6F58D113C28A96D85D1261DC5, 185114F33A60916C7904E4A0F278CA43258454343E614F01F0DAFA98BAC981B1 ] C:\Windows\system32\basesrv.dll

08:45:52.0490 0x0f10  [ 00DD4D2ACC2E72155A8AAA82018BEC0D, 9D7CA68B4A81240477FCC85A3CC11EF986093F9D6228A6C5AC608EDAD664068C ] C:\Windows\system32\winsrv.dll

08:45:52.0568 0x0f10  [ 9C1833ABD62876856836C5AE55C7CE86, 0A21E2C8B2FF3B0438C86DA7151A548F9C6F5C62CD402CBBEDB435994C8508F1 ] C:\Windows\system32\sxssrv.dll

08:45:52.0677 0x0f10  [ 067CB90C277DB4A737D5DEABA3055972, C681BF013170F2D92A3FC4D783FC3F200CDC0C8173373B7ECC27FCF32A03CCBD ] C:\Windows\system32\services.exe

08:45:52.0724 0x0f10  [ Global ] - ok

08:45:52.0740 0x0f10  ================ Scan MBR ==================================

08:45:52.0755 0x0f10  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0

08:45:52.0865 0x0f10  \Device\Harddisk0\DR0 - ok

08:45:52.0865 0x0f10  ================ Scan VBR ==================================

08:45:52.0896 0x0f10  [ A129A71CA93F20DECDB1F5F0E2465144 ] \Device\Harddisk0\DR0\Partition1

08:45:52.0912 0x0f10  \Device\Harddisk0\DR0\Partition1 - ok

08:45:52.0943 0x0f10  [ 4F20F73293D50DCCDE9666B1EF655EC0 ] \Device\Harddisk0\DR0\Partition2

08:45:52.0943 0x0f10  \Device\Harddisk0\DR0\Partition2 - ok

08:45:52.0959 0x0f10  [ 5EAFB1C3923C26CF6EFDF05335A59D6A ] \Device\Harddisk0\DR0\Partition3

08:45:52.0959 0x0f10  \Device\Harddisk0\DR0\Partition3 - ok

08:45:52.0974 0x0f10  [ 92B3E11ECB06B73B1A2B77355C708A64 ] \Device\Harddisk0\DR0\Partition4

08:45:52.0990 0x0f10  \Device\Harddisk0\DR0\Partition4 - ok

08:45:53.0037 0x0f10  [ A621B367713ECFF4932550E1966E8561 ] \Device\Harddisk0\DR0\Partition5

08:45:53.0052 0x0f10  \Device\Harddisk0\DR0\Partition5 - ok

08:45:53.0052 0x0f10  ================ Scan generic autorun ======================

08:45:53.0615 0x0f10  [ 572A377D5E5E4EE874B1423BCAACCEAA, 141719C91588A4D9936B3E38AC0AE6346029BA94585BD6F059AA51EE19C39223 ] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

08:45:54.0459 0x0f10  RTHDVCPL - ok

08:45:54.0709 0x0f10  [ 88DA2E50CBCD4C062632EE34923C5913, A0EEFC404049798B2319C90F8FB3A9A42323204DB89182F7A968B8723F913B79 ] C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe

08:45:55.0052 0x0f10  SimplePass - ok

08:45:55.0084 0x0f10  [ B5F08FCC816B933D8EC1FACCE62B2A12, 950A1764E90EE11BCC033C30BD823855AA92E62479AF6ECA762F491FF670A125 ] C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

08:45:55.0146 0x0f10  OPBHOBroker - ok

08:45:55.0162 0x0f10  [ 1C8F76268DE368A288C6AFB2F00F348F, CB25D1332C694CD460038FC2A5CD1D223AEECBBEDD1768B0F6727219EEF16ABA ] C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

08:45:55.0240 0x0f10  OPBHOBrokerDesktop - ok

08:45:55.0240 0x0f10  SynTPEnh - ok

08:45:55.0412 0x0f10  [ CFC75E5C9245F740E84E5787E1958810, 728365B4A00E4AB56F3F1D2F27188DC3DD0C84B357A3240FFC4B0074F96CCD39 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe

08:45:55.0552 0x0f10  StartCCC - ok

08:45:55.0646 0x0f10  [ 33040C4D7902CF7FB7C54311B17FB1F3, D803FFC394219B984DBF84C759AE6B56F4F04D4C6CBF593A4FEEAF9ADCE99138 ] C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

08:45:55.0740 0x0f10  YouCam Service - ok

08:45:55.0880 0x0f10  [ E2043ABD9E13E1B7BF74B1D05E15AA47, B59953E4F2392858601551A4FA2024742B99E6AF48D71C3155548C97E25A1FA9 ] C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

08:45:56.0084 0x0f10  HPMessageService - ok

08:45:56.0490 0x0f10  [ 44ADDA5FB88EE14F57A246285775AC2F, 2776225BA9F22C553453541DA0285E093B4F2019DB6FE640D033BA45045299C8 ] C:\Program Files\AVAST Software\Avast\AvastUI.exe

08:45:57.0130 0x0f10  AvastUI.exe - ok

08:45:57.0146 0x0f10  Waiting for KSN requests completion. In queue: 261

08:45:58.0162 0x0f10  Waiting for KSN requests completion. In queue: 261

08:45:59.0177 0x0f10  Waiting for KSN requests completion. In queue: 261

08:46:00.0193 0x0f10  Waiting for KSN requests completion. In queue: 86

08:46:01.0271 0x0f10  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.6.305.0 ), 0x60100 ( disabled : updated )

08:46:01.0271 0x0f10  AV detected via SS2: avast! Antivirus, C:\Program Files\AVAST Software\Avast\VisthAux.exe ( 10.0.2208.712 ), 0x41000 ( enabled : updated )

08:46:01.0287 0x0f10  Win FW state via NFP2: enabled

08:46:03.0865 0x0f10  ============================================================

08:46:03.0865 0x0f10  Scan finished

08:46:03.0865 0x0f10  ============================================================

08:46:03.0896 0x17e8  Detected object count: 0

08:46:03.0896 0x17e8  Actual detected object count: 0

08:46:44.0763 0x0c94  Deinitialize success

 

[brunos]

Here's the attached TDSSKiller log.

Attached Files

•  TDSSKiller.3.0.0.44_29.01.2015_08.43.17_log.txt   215.2KB   190 downloads

[LiquidTension]

Hello, 
 
Please do the following. Let me know if the avast! warnings stop after STEP 1. 
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key  + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  CreateRestorePoint:
  Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
  2015-01-27 21:13 - 2015-01-28 21:04 - 00000000 ___HD () C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}
  2015-01-27 21:13 - 2015-01-27 21:15 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
  C:\Users\Bruno Sanfacon\AppData\Local\Temp\ICReinstall_AcrobatReaderSetup(2).exe
  CustomCLSID: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002_Classes\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}\InprocServer32 -> C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\propsys.dll (Microsoft Corporation)
  CMD: ipconfig /flushdns
  EmptyTemp:
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 2
 Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Create a System Restore Point. For instructions, please refer to the following link (W8).
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select  Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

STEP 3
 AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select  Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this tool. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 
 
======================================================

STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Fixlog.txt
• JRT.txt
• AdwCleaner[S0].txt

[brunos]

Good morning Adam...  So far so good, no popups yet !!!

 

Here's the fixlog :

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-01-2015

Ran by Bruno Sanfacon at 2015-01-30 06:12:27 Run:1

Running from C:\Users\Bruno Sanfacon\Desktop

Loaded Profiles: Bruno Sanfacon (Available profiles: Bruno Sanfacon)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

start

CreateRestorePoint:

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

2015-01-27 21:13 - 2015-01-28 21:04 - 00000000 ___HD () C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}

2015-01-27 21:13 - 2015-01-27 21:15 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage

C:\Users\Bruno Sanfacon\AppData\Local\Temp\ICReinstall_AcrobatReaderSetup(2).exe

CustomCLSID: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002_Classes\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}\InprocServer32 -> C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\propsys.dll (Microsoft Corporation)

CMD: ipconfig /flushdns

EmptyTemp:

end

 

*****************

 

Restore point was successfully created.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.

HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found. 

 

"C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}" directory move:

 

Could not move "C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\081edf227c5b9b5" => Scheduled to move on reboot.

Could not move "C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\mqc.tmp" => Scheduled to move on reboot.

Could not move "C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\propsys.dll" => Scheduled to move on reboot.

Could not move "C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}" directory. => Scheduled to move on reboot.

 

C:\ProgramData\Windows Genuine Advantage => Moved successfully.

C:\Users\Bruno Sanfacon\AppData\Local\Temp\ICReinstall_AcrobatReaderSetup(2).exe => Moved successfully.

"HKU\S-1-5-21-3923409957-1760440807-4282318547-1002_Classes\CLSID\{2D349E57-23E4-4A67-9624-F1DC6B65AABF}" => Key deleted successfully.

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

EmptyTemp: => Removed 34.6 GB temporary data.

 

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-01-30 06:26:10)<=

 

C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\081edf227c5b9b5 => Is moved successfully.

C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\mqc.tmp => Is moved successfully.

C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0}\propsys.dll => Is moved successfully.

C:\ProgramData\{F66CB4EE-546F-4D54-9332-216DE189AAB0} => Is moved successfully.

 

==== End of Fixlog 06:26:10 ====

 

 

The JRT Log :

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.1 (12.28.2014:1)

OS: Windows 8.1 x64

Ran by Bruno Sanfacon on 2015-01-30 at  7:14:43,81

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARMANAGER_8CA8B414-D855646C.pf

Successfully deleted: [File] C:\Windows\prefetch\GOOGLETOOLBARNOTIFIER.EXE-B25C45A8.pf

 

 

 

~~~ Folders

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 2015-01-30 at  7:41:42,46

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

And the AdwCleaner log :

 

# AdwCleaner v4.109 - Report created 30/01/2015 at 08:40:24

# Updated 24/01/2015 by Xplode

# Database : 2015-01-26.1 [Live]

# Operating System : Windows 8.1  (64 bits)

# Username : Bruno Sanfacon - BRUNO

# Running from : C:\Users\Bruno Sanfacon\Desktop\AdwCleaner (2).exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17416

 

 

-\\ Mozilla Firefox v35.0.1 (x86 en-US)

 

 

-\\ Google Chrome v40.0.2214.93

 

[C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

 

*************************

 

AdwCleaner[R0].txt - [952 octets] - [28/01/2015 17:56:12]

AdwCleaner[R1].txt - [902 octets] - [30/01/2015 08:10:23]

AdwCleaner[R2].txt - [961 octets] - [30/01/2015 08:20:00]

AdwCleaner[R3].txt - [1230 octets] - [30/01/2015 08:32:57]

AdwCleaner[S0].txt - [1018 octets] - [28/01/2015 18:06:17]

AdwCleaner[S1].txt - [1021 octets] - [30/01/2015 08:27:52]

AdwCleaner[S2].txt - [1154 octets] - [30/01/2015 08:40:24]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1214 octets] ##########

 

 

Thank you so much for your help !

 

Bruno

[LiquidTension]

So far so good, no popups yet !!!

Excellent.
 
You'll notice you have an extra ~35GB of free space on your hard drive. Over time, temporary files build up. 35GBs worth of temporary files is a lot. 

EmptyTemp: => Removed 34.6 GB temporary data.

I can recommend a useful temp file cleaner that's easy to use, and will prevent this from happening again. Let me know if you're interested, and we can discuss this further towards the end. 
 
For now - please let me know if you have any outstanding issues or concerns after doing the following. 
 
STEP 1
 Malwarebytes Anti-Malware (MBAM)

• Please download the Malwarebytes Anti-Malware setup file to your Desktop.
• Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme. 
• Open Malwarebytes Anti-Malware and click Update Now.
• Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply. 
   

STEP 2
 ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click . If no threats were found, skip the next two bullet points. 
• Click  and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to  and click .
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
   

STEP 3
 Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

======================================================
 
STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• MBAM Scan log
• ESET Online Scan log
• FRST.txt
• Addition.txt

[brunos]

Here's the Malwarebytes Log

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 2015-01-30

Scan Time: 16:08:58

Logfile: 

Administrator: Yes

 

Version: 2.00.4.1028

Malware Database: v2015.01.30.08

Rootkit Database: v2015.01.14.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Bruno Sanfacon

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 332618

Time Elapsed: 46 min, 39 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 4

PUP.Optional.Supercool, C:\Users\Bruno Sanfacon\Downloads\AcrobatReaderSetup(1).exe, Quarantined, [bd949661f29726108cfdea2a90750cf4], 

PUP.Optional.Supercool, C:\Users\Bruno Sanfacon\Downloads\AcrobatReaderSetup(2).exe, Quarantined, [db76de193257ba7c1f6a24f0c243aa56], 

PUP.Optional.Supercool, C:\Users\Bruno Sanfacon\Downloads\AcrobatReaderSetup.exe, Quarantined, [7dd41bdcfb8ef73f61287b99c73ebf41], 

PUP.Optional.AppsInstall, C:\Users\Bruno Sanfacon\Downloads\Adobe%20Reader.exe, Quarantined, [11409d5ac0c96bcb1a6a65afa362f10f], 

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[LiquidTension]

Hello,

 

Please post the ESET and FRST logs when ready. 

 

Thanks!

[brunos]

Good morning Adam,

 

After 6+ hours of scan, here's the Eset Log :

 

C:\FRST\Quarantine\C\Users\Bruno Sanfacon\AppData\Local\Temp\ICReinstall_AcrobatReaderSetup(2).exe.xBAD a variant of Win32/InstallCore.BY potentially unwanted application

 

The Frst Log :

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-01-2015

Ran by Bruno Sanfacon (administrator) on BRUNO on 31-01-2015 06:35:43

Running from C:\Users\Bruno Sanfacon\Desktop

Loaded Profiles: Bruno Sanfacon (Available profiles: Bruno Sanfacon)

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-02] (Realtek Semiconductor)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2758200 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [155704 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [155704 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-20] (Synaptics Incorporated)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-01] (CyberLink Corp.)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-08] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-28] (AVAST Software)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON14/4

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPCON14/4

HKU\S-1-5-21-3923409957-1760440807-4282318547-1002\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/

HKU\S-1-5-21-3923409957-1760440807-4282318547-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON14/4

SearchScopes: HKLM -> {BC8EC301-16E1-451F-B70B-7C3DB0090AB4} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...56705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {BC8EC301-16E1-451F-B70B-7C3DB0090AB4} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...56705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002 -> {BC8EC301-16E1-451F-B70B-7C3DB0090AB4} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKU\S-1-5-21-3923409957-1760440807-4282318547-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...56705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

 

FireFox:

========

FF ProfilePath: C:\Users\Bruno Sanfacon\AppData\Roaming\Mozilla\Firefox\Profiles\gys9npyc.default-1422561313382

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-03-09]

 

Chrome: 

=======

CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR Profile: C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-16]

CHR Extension: (Google Drive) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-16]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-16]

CHR Extension: (YouTube) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-16]

CHR Extension: (Google Search) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-16]

CHR Extension: (Avast Online Security) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-16]

CHR Extension: (Google Wallet) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-16]

CHR Extension: (Gmail) - C:\Users\Bruno Sanfacon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-16]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-28]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [99328 2013-09-25] () [File not signed]

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-09-25] (Advanced Micro Devices, Inc.) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-28] (AVAST Software)

R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-10-14] () [File not signed]

R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-10-18] (CyberLink)

R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-10-18] (CyberLink)

R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [255040 2014-08-25] (WildTangent)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-08-29] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-10-14] (Softex Inc.) [File not signed]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-08-23] (Realtek Semiconductor)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-26] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17504 2013-11-19] (Advanced Micro Devices, INC.)

R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [219360 2013-04-18] (AppEx Networks Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-28] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-28] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-28] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-28] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-28] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-28] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-28] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-28] ()

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [138240 2013-11-19] (Advanced Micro Devices)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290520 2013-08-27] (Realtek Semiconductor Corp.)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation                           )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-20] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [34544 2013-09-20] (Synaptics Incorporated)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-31 06:35 - 2015-01-31 06:35 - 02130944 _____ (Farbar) C:\Users\Bruno Sanfacon\Desktop\FRST64.exe

2015-01-31 06:35 - 2015-01-31 06:35 - 00000000 ____D () C:\Users\Bruno Sanfacon\Desktop\FRST-OlderVersion

2015-01-30 17:05 - 2015-01-30 17:05 - 00000000 ____D () C:\Program Files (x86)\ESET

2015-01-30 17:05 - 2015-01-30 17:04 - 02347384 _____ (ESET) C:\Users\Bruno Sanfacon\Desktop\esetsmartinstaller_enu.exe

2015-01-30 17:04 - 2015-01-30 17:04 - 02347384 _____ (ESET) C:\Users\Bruno Sanfacon\Downloads\esetsmartinstaller_enu.exe

2015-01-30 16:07 - 2015-01-30 17:01 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-30 16:07 - 2015-01-30 16:07 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-30 16:07 - 2015-01-30 16:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-30 16:06 - 2015-01-30 16:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-30 16:06 - 2015-01-30 16:06 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-30 16:06 - 2015-01-30 16:05 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Bruno Sanfacon\Desktop\mbam-setup-2.0.4.1028.exe

2015-01-30 16:06 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-30 16:06 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-30 16:06 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-30 16:04 - 2015-01-30 16:05 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Bruno Sanfacon\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-30 08:09 - 2015-01-30 08:09 - 02194432 _____ () C:\Users\Bruno Sanfacon\Downloads\AdwCleaner (2).exe

2015-01-30 08:09 - 2015-01-30 08:09 - 02194432 _____ () C:\Users\Bruno Sanfacon\Desktop\AdwCleaner (2).exe

2015-01-30 07:41 - 2015-01-30 07:41 - 00000805 _____ () C:\Users\Bruno Sanfacon\Desktop\JRT.txt

2015-01-30 07:14 - 2015-01-30 07:14 - 00000000 ____D () C:\Windows\ERUNT

2015-01-30 07:10 - 2015-01-30 07:09 - 01707939 _____ (Thisisu) C:\Users\Bruno Sanfacon\Desktop\JRT.exe

2015-01-30 07:09 - 2015-01-30 07:09 - 01707939 _____ (Thisisu) C:\Users\Bruno Sanfacon\Downloads\JRT.exe

2015-01-30 06:56 - 2015-01-30 06:56 - 00001413 _____ () C:\Users\Bruno Sanfacon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-01-29 14:55 - 2015-01-29 14:55 - 00000000 ____D () C:\Users\Bruno Sanfacon\Desktop\Old Firefox Data

2015-01-29 08:41 - 2015-01-29 08:41 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Bruno Sanfacon\Downloads\tdsskiller.exe

2015-01-29 08:41 - 2015-01-29 08:41 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Bruno Sanfacon\Desktop\tdsskiller.exe

2015-01-29 08:32 - 2015-01-29 08:34 - 00025723 _____ () C:\Users\Bruno Sanfacon\Desktop\Addition.txt

2015-01-29 08:26 - 2015-01-31 06:36 - 00015171 _____ () C:\Users\Bruno Sanfacon\Desktop\FRST.txt

2015-01-29 08:22 - 2015-01-29 08:22 - 02130432 _____ (Farbar) C:\Users\Bruno Sanfacon\Downloads\FRST64 (1).exe

2015-01-28 19:17 - 2015-01-28 19:19 - 00025382 _____ () C:\Users\Bruno Sanfacon\Downloads\Addition.txt

2015-01-28 19:12 - 2015-01-31 06:35 - 00000000 ____D () C:\FRST

2015-01-28 19:12 - 2015-01-28 19:19 - 00026548 _____ () C:\Users\Bruno Sanfacon\Downloads\FRST.txt

2015-01-28 19:11 - 2015-01-28 19:11 - 02130432 _____ (Farbar) C:\Users\Bruno Sanfacon\Downloads\FRST64.exe

2015-01-28 18:42 - 2015-01-28 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software

2015-01-28 18:39 - 2015-01-28 18:18 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2015-01-28 18:30 - 2015-01-28 18:30 - 05006864 _____ (AVAST Software) C:\Users\Bruno Sanfacon\Downloads\avast_free_antivirus_setup_online.exe

2015-01-28 18:22 - 2015-01-28 18:22 - 563087693 _____ () C:\Windows\MEMORY.DMP

2015-01-28 18:22 - 2015-01-28 18:22 - 00281104 _____ () C:\Windows\Minidump\012815-49765-01.dmp

2015-01-28 18:22 - 2015-01-28 18:22 - 00000000 ____D () C:\Windows\Minidump

2015-01-28 18:20 - 2015-01-28 18:42 - 00001947 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-01-28 18:18 - 2015-01-28 18:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2015-01-28 17:56 - 2015-01-30 08:40 - 00000000 ____D () C:\AdwCleaner

2015-01-28 17:55 - 2015-01-28 17:55 - 02194432 _____ () C:\Users\Bruno Sanfacon\Downloads\AdwCleaner (1).exe

2015-01-28 17:54 - 2015-01-28 17:55 - 02194432 _____ () C:\Users\Bruno Sanfacon\Downloads\AdwCleaner.exe

2015-01-14 19:03 - 2015-01-28 18:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-13 18:04 - 2014-12-19 01:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-13 18:04 - 2014-12-11 21:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-13 18:04 - 2014-12-11 19:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys

2015-01-13 18:04 - 2014-12-08 20:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2015-01-13 18:04 - 2014-12-08 14:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe

2015-01-13 18:04 - 2014-12-08 14:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe

2015-01-13 18:04 - 2014-12-05 22:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll

2015-01-13 18:04 - 2014-12-05 20:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-13 18:04 - 2014-12-05 20:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll

2015-01-13 18:04 - 2014-10-28 23:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe

2015-01-13 18:04 - 2014-10-28 23:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe

2015-01-13 18:04 - 2014-10-28 22:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2015-01-13 18:04 - 2014-10-28 22:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2015-01-13 18:04 - 2014-10-28 22:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2015-01-13 18:04 - 2014-10-28 22:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe

2015-01-13 18:04 - 2014-10-28 22:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe

2015-01-13 18:04 - 2014-10-28 22:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe

2015-01-13 18:04 - 2014-10-28 22:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2015-01-13 18:04 - 2014-10-28 22:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2015-01-13 18:04 - 2014-10-28 22:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2015-01-13 18:04 - 2014-10-28 21:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll

2015-01-13 18:04 - 2014-10-28 20:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll

2015-01-13 18:04 - 2014-10-28 20:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll

2015-01-13 18:04 - 2014-10-28 20:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2015-01-13 18:04 - 2014-10-28 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-01-31 06:28 - 2014-03-19 18:16 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-31 06:28 - 2014-03-09 12:15 - 01997982 _____ () C:\Windows\WindowsUpdate.log

2015-01-31 06:09 - 2014-08-16 05:48 - 00001088 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-31 05:00 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\sru

2015-01-31 03:26 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\rescache

2015-01-30 23:53 - 2014-03-09 12:23 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3923409957-1760440807-4282318547-1002

2015-01-30 21:49 - 2014-02-08 12:29 - 00065536 _____ () C:\Windows\system32\spu_storage.bin

2015-01-30 17:00 - 2014-05-11 17:35 - 00000000 ___DO () C:\Users\Bruno Sanfacon\SkyDrive

2015-01-30 16:59 - 2014-08-16 05:48 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-30 16:58 - 2013-08-26 01:01 - 00036232 _____ () C:\Windows\PFRO.log

2015-01-30 16:58 - 2013-08-22 09:46 - 00029182 _____ () C:\Windows\setupact.log

2015-01-30 16:58 - 2013-08-22 09:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-30 16:57 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\L2Schemas

2015-01-30 16:57 - 2013-08-22 08:25 - 00524288 ___SH () C:\Windows\system32\config\BBI

2015-01-30 08:50 - 2013-12-06 14:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office

2015-01-30 06:30 - 2013-08-22 10:20 - 00000000 ____D () C:\Windows\CbsTemp

2015-01-30 06:27 - 2014-06-06 16:49 - 00054784 ___SH () C:\Users\Bruno Sanfacon\Desktop\Thumbs.db

2015-01-30 06:25 - 2014-08-16 05:51 - 00000000 ____D () C:\Program Files\Google

2015-01-30 06:25 - 2014-08-16 05:48 - 00000000 ____D () C:\Program Files (x86)\Google

2015-01-29 14:47 - 2014-08-16 05:48 - 00000000 ____D () C:\Users\Bruno Sanfacon\AppData\Local\Google

2015-01-29 09:14 - 2014-08-16 05:50 - 00002210 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-28 19:33 - 2014-06-06 16:49 - 00004094 _____ () C:\Users\Bruno Sanfacon\Desktop\Films - Shortcut.lnk

2015-01-28 18:53 - 2013-12-06 14:48 - 00844692 _____ () C:\Windows\system32\perfh00C.dat

2015-01-28 18:53 - 2013-12-06 14:48 - 00174132 _____ () C:\Windows\system32\perfc00C.dat

2015-01-28 18:53 - 2013-08-26 01:09 - 01966994 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-28 18:40 - 2014-03-09 13:00 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-01-28 18:40 - 2014-03-09 12:59 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2015-01-28 18:18 - 2014-08-15 19:23 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-01-28 18:18 - 2014-03-09 12:59 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2015-01-27 21:13 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\system32\migwiz

2015-01-25 21:27 - 2014-03-09 12:17 - 00000000 ____D () C:\Users\Bruno Sanfacon

2015-01-24 15:28 - 2014-03-19 18:16 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-24 15:20 - 2014-12-18 10:00 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-01-24 15:20 - 2014-12-18 10:00 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-24 07:01 - 2013-08-22 10:36 - 00000000 ____D () C:\Windows\AppReadiness

2015-01-18 20:59 - 2014-03-09 12:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-01-15 18:13 - 2014-03-19 15:47 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-15 17:57 - 2014-03-19 15:47 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-14 21:09 - 2014-12-10 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak

 

Some content of TEMP:

====================

C:\Users\Bruno Sanfacon\AppData\Local\Temp\Quarantine.exe

C:\Users\Bruno Sanfacon\AppData\Local\Temp\sqlite3.dll

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-01-30 07:47

 

==================== End Of Log ============================

 

The Addition Log :

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-01-2015

Ran by Bruno Sanfacon at 2015-01-31 06:38:38

Running from C:\Users\Bruno Sanfacon\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)

Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden

Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden

AMD Catalyst Install Manager (HKLM\...\{301D3AA1-5DCC-FCFD-622E-3C7CBA87C80F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.4.2 - AppEx Networks)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden

CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6902 - CyberLink Corp.)

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3303 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3416 - CyberLink Corp.)

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3418 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.2.3302 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden

DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden

Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden

Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden

HP Documentation (HKLM-x32\...\{71D55970-20A4-43F2-BECD-8F315DEB64F1}) (Version: 1.1.1.0 - Hewlett-Packard)

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7127.4628 - Hewlett-Packard)

HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.00.57 - Hewlett-Packard)

HP Support Assistant (HKLM-x32\...\{3AF15EEA-8EDF-4393-BB6C-CF8A9986486A}) (Version: 7.3.35.20 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}) (Version: 1.0.10 - Hewlett-Packard Company)

HP Utility Center (HKLM\...\{D72E8F9D-1FB1-4816-93DA-19B4E45604BF}) (Version: 2.3.3 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

Inst5675 (Version: 8.00.57 - Softex Inc.) Hidden

Inst5676 (Version: 8.00.57 - Softex Inc.) Hidden

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden

Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden

Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Mise à jour Microsoft Office Excel 2007 Help  (KB963678) (HKLM-x32\...\{90120000-0016-040C-0000-0000000FF1CE}_PROPLUS_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version:  - Microsoft)

Mise à jour Microsoft Office Outlook 2007 Help  (KB963677) (HKLM-x32\...\{90120000-001A-040C-0000-0000000FF1CE}_PROPLUS_{51EFB347-1F3D-4BAC-8B79-F056B904FE21}) (Version:  - Microsoft)

Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669) (HKLM-x32\...\{90120000-0018-040C-0000-0000000FF1CE}_PROPLUS_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version:  - Microsoft)

Mise à jour Microsoft Office Word 2007 Help  (KB963665) (HKLM-x32\...\{90120000-001B-040C-0000-0000000FF1CE}_PROPLUS_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version:  - Microsoft)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

OEM Application Profile (HKLM-x32\...\{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)

Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Pinger (HKLM-x32\...\Pinger 1.4.0.1) (Version: 1.4.0.1 - Pinger Inc.)

Pinger (x32 Version: 1.4.0.1 - Pinger Inc.) Hidden

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29070 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 8.20.815.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7032 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)

Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)

The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden

Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden

WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)

WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

 

==================== Restore Points  =========================

 

30-01-2015 07:11:48 before jrt

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {03A5163C-756B-4133-A8EB-9BB8F6C7E90F} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)

Task: {2C129AEF-829A-429A-9E04-E09B4555F7AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-16] (Google Inc.)

Task: {2F9BFCA8-C17C-4F66-90EE-4F073270DB26} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-28] (AVAST Software)

Task: {3E6C785E-24CD-4462-946D-397923F14CD3} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)

Task: {429C9F84-42F6-4A51-9DCA-5F1F6E67A397} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard)

Task: {6B2E0615-41B4-4F7B-8A46-24CFE68E4CEB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)

Task: {70553B94-D124-4B6C-9E8A-B51746E75A7C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {98583E30-C303-455E-B5CD-64196BF21CC3} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-20] (Synaptics Incorporated)

Task: {9C927CD0-7F09-4D2D-82D1-B2140F36048A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)

Task: {B36E4C6F-1823-47FB-8FB2-C9F96EBF489C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-24] (Adobe Systems Incorporated)

Task: {C1B705AA-0B5D-4D92-BDA9-27AA46C0C334} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-16] (Google Inc.)

Task: {DA56DFD7-80BB-4B20-AF52-427773C8866A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)

Task: {F321FC54-BE93-436C-AFFF-07CD26FE2F01} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-15] (Microsoft Corporation)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2013-10-14 14:23 - 2013-10-14 14:23 - 00109568 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

2013-10-14 14:24 - 2013-10-14 14:24 - 00627200 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cachedrv.dll

2013-10-14 14:25 - 2013-10-14 14:25 - 02541056 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll

2013-10-14 14:22 - 2013-10-14 14:22 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll

2013-10-14 14:22 - 2013-10-14 14:22 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll

2013-10-14 14:22 - 2013-10-14 14:22 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll

2013-10-14 14:35 - 2013-10-14 14:35 - 00306064 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll

2013-10-14 14:35 - 2013-10-14 14:35 - 01297296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll

2013-09-25 09:49 - 2013-09-25 09:49 - 00099328 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe

2013-09-25 09:48 - 2013-09-25 09:48 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2013-10-14 14:30 - 2013-10-14 14:30 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

2015-01-30 16:10 - 2015-01-30 16:10 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15013000\algo.dll

2014-02-08 12:53 - 2013-08-05 02:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2013-08-05 18:48 - 2013-08-05 18:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

2015-01-29 09:14 - 2015-01-25 16:08 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libglesv2.dll

2015-01-29 09:14 - 2015-01-25 16:08 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libegl.dll

2015-01-28 18:18 - 2015-01-28 18:18 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2015-01-29 09:14 - 2015-01-25 16:08 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

AlternateDataStreams: C:\Users\Bruno Sanfacon\SkyDrive:ms-properties

AlternateDataStreams: C:\Users\Bruno Sanfacon\SkyDrive (2).old:ms-properties

AlternateDataStreams: C:\Users\Bruno Sanfacon\SkyDrive.old:ms-properties

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-3923409957-1760440807-4282318547-500 - Administrator - Disabled)

Bruno Sanfacon (S-1-5-21-3923409957-1760440807-4282318547-1002 - Administrator - Enabled) => C:\Users\Bruno Sanfacon

Guest (S-1-5-21-3923409957-1760440807-4282318547-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3923409957-1760440807-4282318547-1004 - Limited - Enabled)

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (01/31/2015 03:23:08 AM) (Source: VSS) (EventID: 12305) (User: )

Description: Volume Shadow Copy Service error: Volume/disk not connected or not found.

Error context: CreateFileW(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy4,0x00000000,0x00000003,...).

 

 

Operation:

   Delete Shadow Copies

   Execution Context

 

Context:

   Volume Name: \\?\Volume{511972b3-6181-4dc2-b853-c6f359e9ba56}\

 

Error: (01/31/2015 03:23:08 AM) (Source: VSS) (EventID: 12305) (User: )

Description: Volume Shadow Copy Service error: Volume/disk not connected or not found.

Error context: DeviceIoControl(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3 - 000000000000018C,0x00530194,0000000000000000,0,000000CE6F47BEE0,4096,[0]).

 

 

Operation:

   Delete Shadow Copies

   Execution Context

 

Context:

   Volume Name: \\?\Volume{511972b3-6181-4dc2-b853-c6f359e9ba56}\

 

Error: (01/31/2015 02:31:14 AM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

 

Error: (01/31/2015 00:07:33 AM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

 

Error: (01/30/2015 11:57:14 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

 

Error: (01/30/2015 07:09:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2222828

 

Error: (01/30/2015 07:09:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 2222828

 

Error: (01/30/2015 07:09:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

Error: (01/30/2015 06:32:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1547

 

Error: (01/30/2015 06:32:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1547

 

 

System errors:

=============

Error: (01/30/2015 09:49:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 8 time(s).

 

Error: (01/30/2015 09:39:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 7 time(s).

 

Error: (01/30/2015 09:17:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 6 time(s).

 

Error: (01/30/2015 08:29:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 5 time(s).

 

Error: (01/30/2015 07:53:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 4 time(s).

 

Error: (01/30/2015 07:09:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 3 time(s).

 

Error: (01/30/2015 06:32:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 2 time(s).

 

Error: (01/30/2015 05:22:28 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (01/30/2015 03:47:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 6 time(s).

 

Error: (01/30/2015 11:29:39 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 5 time(s).

 

 

Microsoft Office Sessions:

=========================

 

==================== Memory info =========================== 

 

Processor: AMD E1-2100 APU with Radeon™ HD Graphics 

Percentage of memory in use: 36%

Total physical RAM: 3546.26 MB

Available physical RAM: 2234.61 MB

Total Pagefile: 7130.26 MB

Available Pagefile: 5488.89 MB

Total Virtual: 131072 MB

Available Virtual: 131071.85 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:446.27 GB) (Free:396.81 GB) NTFS

Drive d: (RECOVERY) (Fixed) (Total:18.72 GB) (Free:1.85 GB) NTFS ==>[System with boot components (obtained from reading drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 2E0F7135)

 

Partition: GPT Partition Type.

 

==================== End Of Log ============================

 

Thanks again for all you do !!!

 

Bruno

[LiquidTension]

Hello, 
 
Those logs look good. 
Lets update your vulnerable software to reduce the risk of reinfection. 
 
STEP 1
 Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

•  Adobe Shockwave Player
•  Google Chrome
•  Follow these instructions to check for and download the latest Windows Updates.
   

STEP 2
 Remove Outdated Software

• Press the Windows Key  + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall one at a time.
• Note: The programmes below may not be present. If this is the case, please skip to the next step.
  • Adobe Shockwave Player 12.0 
• Follow the prompts, and reboot if necessary.
   

STEP 3
 Security Check

• Please download SecurityCheck and save the file to your Desktop.
• Double-click SecurityCheck.exe and follow the onscreen instructions inside the black box.
• A log (checkup.txt) will automatically open on your Desktop.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• checkup.txt
• How is your computer performing? Are there any outstanding issues?

[brunos]

Here's the checkup log :

 

 Results of screen317's Security Check version 0.99.96  

   x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

Windows Defender   

avast! Antivirus   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

  Java 64-bit 8 Update 31  

 Adobe Flash Player 16.0.0.296  

 Adobe Reader XI  

 Mozilla Firefox (35.0.1) 

 Google Chrome (40.0.2214.93) 

 Google Chrome (40.0.2214.94) 

````````Process Check: objlist.exe by Laurent````````  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 

````````````````````End of Log`````````````````````` 

 

 

So far my computer is running great.  Thanks for your help !!!

[LiquidTension]

So far my computer is running great.  Thanks for your help !!!

Excellent. 
With this in mind - 
 
All Clean!
Congratulations, your computer appears clean! 
I no longer see signs of malware on your computer, and feel satisfied that our work here is done. The steps below will remove the tools we have used, and reset any settings changed. I have also provided a list of resources and tools that you may find useful. 
 
My help will always be free. But if you are happy with the help provided, and would like to support my fight against malware and/or buy me a beer, please consider a donation. 
 
 DelFix

• Please download DelFix and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset system settings
• Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
 
--- Malwarebytes Anti-Malware will still be present on your computer. I recommend keeping this programme, updating and scanning with it once a week to maintain security on your computer. If you do not wish to keep this programme on your computer, you can uninstall it by pressing the Windows Key  + r on your keyboard at the same time, typing appwiz.cpl, clicking OK and searching for Malwarebytes.
 
======================================================
 
I have compiled below a list of resources you may find useful. The articles document information on computer security, common infection vectors and how you can stay safe on the Internet.

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
   

The following programmes come highly recommended in the security community.

•  AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware. 
•  Emsisoft Antimalware (free) acts as an additional on-demand scanner, and can be used in conjunction with your Anti-Virus. 
•  Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
•  Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
•  NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology. 
•  Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you. 
•  Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
•  SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
•  Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs. 
•  Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website. 
   

Need a second opinion on a file or website? Scan the file/URL before clicking by using one of the following free online scanner services.

•  VirusTotal (File & URL)
•  Jotti's Malware Scan (File)
•  Dr.Web Online Check (URL)
•  Trend Micro Site Safety Center (URL)
•  Norton Safe Web (URL)

-- Please feel free to ask if you have any questions or concerns on computer security or the programmes above.
 
======================================================
 
Please confirm you have no outstanding issues, and are happy with the state of your computer. Once I have confirmation things are in order, we can wrap things up and I will close this thread. 
 
Thank you for using Geeks to Go.
 
Safe Surfing. 
Adam

[LiquidTension]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.