Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

I need help with an Alureon Virus


  • Please log in to reply

#1
Himynameiskyle

Himynameiskyle

    Member

  • Member
  • PipPip
  • 18 posts
Hello everyone. My mom (probably like most of ours) is reckless on the Internet and got an Alureon ransomware virus. I cant seem to find anything about in the registry. I tried searching the forum and found some old stuff. She already paid them out of fear instead of letting me try to fix it, but I doubt it will just disappear. I have a thumb drive with an mbr checker, tdskiller, and hitman trial. They arent finding anything. Im no expert, but Ive been cleaning up her computer messes for a while now so sorry in advance if I come across as a total noob. Any help would be appreciated. I also have to travel back and forth to her computer as its at her apartment. I can/will provide any logs/any information needed just a little patience. I also saved the log from the tdskiller scan and can provide that ASAP. Thanks in advance!

Edited by Himynameiskyle, 29 November 2017 - 02:10 AM.

  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

Need your FRST log:

 

  • Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Check the Addition.txt box
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from.  
  • Please copy and paste log back here.
  • It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

Might as well try aswMBR:

Download aswMBR.exe  to your desktop.
The link is a direct download so the page won't change.

Right click the aswMBR.exe and select Run As Administrator to run it
Wait until the AV Scan shows up at the bottom left.
Change AV Scan: from Quick Scan to  C:\
Click the "Scan" button to start scan
If it asks you to allow the Avast engine to download then say Yes.  It will take a while to finish.  
On completion of the scan (Note if the Fix button is enabled and tell me but do not push any buttons) click save log, save it to your desktop and post in your next reply

If it crashes then try it again but uncheck Trace Disk IO Calls before hitting Scan.
 

and MBAR:

 

https://www.malwareb...om/antirootkit/

 

 

Make it easier on yourself and install TeamViewer the next time you visit.  Then you can control her PC from yours.

 

https://www.teamviewer.us/

 

When you set it up make sure you set a permanent password - otherwise you will have to call her and get the password of the day.


  • 0

#3
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Okay I am about to head over there. Thanks for the remote access software. That will save me a ton of time! Quick question, your last bullet point in the first section where you talk about the same directory. That part was a hyperlink like I was supposed to download something. It didn't work, but I don't think that was a second program you needed me to download, right? The page wouldn't load for that one and I was trying to download everything on my computer before I go over there. Thanks!
 


  • 0

#4
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

https://files.avast.com/files/rootkit-scanner/aswmbr.exe

https://www.malwarebytes.com/antirootkit/

All links work but the forum software likes to truncate them in the text so you can't just retype them.  Above are the full URLs.


  • 0

#5
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-11-2017
Ran by Owner (administrator) on HP-DESKTOP (01-12-2017 14:35:18)
Running from F:\
Loaded Profiles: Owner (Available Profiles: Owner)
Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Supra) C:\dKEYUSBCradle\SyncService.exe
() C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
() C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe
(VMware) C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\wsnm\wsnm.exe
(Supra) C:\dKEYUSBCradle\ProxyDaemon.exe
() C:\dKEYUSBCradle\stunnel-4.10.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\bin\vmware-view-usbd.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Supra) C:\dKEYUSBCradle\SyncInfoApp.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2014-01-05] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-01-05] (Hewlett-Packard )
HKLM\...\Run: [VMware Netlink 3 HV Install Utility] => C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnliu.exe [70080 2015-06-16] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [57446344 2017-11-16] (Skype Technologies S.A.)
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\MountPoints2: E - "E:\LaunchU3.exe" -a
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\MountPoints2: {fa696a82-d4c7-11e7-82d0-3010b326e15f} - "E:\LaunchU3.exe" -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DisplayKEY eSYNC Info.lnk [2016-11-16]
ShortcutTarget: DisplayKEY eSYNC Info.lnk -> C:\dKEYUSBCradle\SyncInfoApp.exe (Supra)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{86AD8D79-0E93-4DF3-B074-8F9C824C0DAE}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D65109DD-A864-4F63-834E-35604F19EAF5}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2017-01-03] (Eyeo GmbH)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2017-01-03] (Eyeo GmbH)
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient64.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://home.mynmg.com/dana-cached/sc/JuniperSetupClient.cab

FireFox:
========
FF DefaultProfile: p85zmb8q.default
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default [2017-11-29]
FF Homepage: Mozilla\Firefox\Profiles\p85zmb8q.default -> hxxps://www.msn.com/
hxxps://www.msn.com/
FF NewTab: Mozilla\Firefox\Profiles\p85zmb8q.default -> hxxp://search.searchinfast.com?uid=7f6cf28c-82ce-4522-9e81-0073053f3f3f&uc=20160830&ap=appfocus5&source=googledisplay-bb8&page=newtab&implementation_id=dm_0.2.1
FF NewTabOverride: Mozilla\Firefox\Profiles\p85zmb8q.default -> Disabled: @Converter
FF NewTabOverride: Mozilla\Firefox\Profiles\p85zmb8q.default -> Disabled: @DownloadManager
FF Extension: (Converter) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\@Converter.xpi [2017-11-19]
FF Extension: (Search Encrypt) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\@searchencrypt.xpi [2017-11-17]
FF Extension: (Adblock Plus Pop-up Addon) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\[email protected] [2016-08-17] [Lagacy]
FF Extension: (Adguard AdBlocker) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\[email protected] [2017-11-28]
FF Extension: (Disable Media WMF NV12 format) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\features\{fdceb2ea-817f-4945-8dff-be20c3e18c8a}\[email protected] [2017-11-22] [Lagacy]
FF SearchPlugin: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\searchplugins\yahoo! powered.xml [2017-11-18]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)

Chrome:
=======
CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2017-11-28]
CHR Extension: (Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-11-10]
CHR Extension: (Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-11-10]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-25]
CHR Extension: (Adguard AdBlocker) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2017-11-28]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-25]
CHR Extension: (Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-11-10]
CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-25]
CHR Extension: (Search Manager) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce [2017-11-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-10-01]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-06-25]
CHR Extension: (Chrome Media Router) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-11-28]
CHR HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 dKeySync; C:\dKEYUSBCradle\SyncService.exe [42496 2011-11-11] (Supra) [File not signed]
R2 ftnlsv3hv; C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe [226240 2015-06-16] ()
R2 ftscanmgr; C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe [6363792 2015-07-31] ()
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [135488 2017-11-29] (SurfRight B.V.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [340480 2014-01-05] (IDT, Inc.) [File not signed]
R2 vmware-view-usbd; C:\Program Files (x86)\VMware\VMware Horizon View Client\bin\vmware-view-usbd.exe [1156824 2015-10-13] (VMware, Inc.)
R2 vmwsprrdpwks; C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe [261776 2015-05-08] (VMware)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)
R2 wsnm; C:\Program Files (x86)\VMware\VMware Horizon View Client\wsnm\wsnm.exe [533208 2015-10-14] (VMware, Inc.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 MpKsl3a3443a0; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AEAEBECA-6400-44BD-9D30-F4EA56C8093E}\MpKsl3a3443a0.sys [58120 2017-11-29] (Microsoft Corporation)
S3 RTLU3E8023-W8-64; C:\Windows\system32\DRIVERS\rtu30x64w8.sys [92376 2013-10-11] (Realtek )
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-01 14:35 - 2017-12-01 14:35 - 000000000 ____D C:\FRST
2017-11-29 11:26 - 2017-11-29 11:27 - 000005308 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_11.26.51_log.txt
2017-11-29 00:22 - 2017-11-29 00:39 - 000141342 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.22.12_log.txt
2017-11-29 00:18 - 2017-11-29 00:20 - 000141342 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.18.20_log.txt
2017-11-29 00:15 - 2017-11-29 00:15 - 000012450 _____ C:\Users\Owner\Desktop\MBRCheck_11.29.17_00.15.25.txt
2017-11-29 00:11 - 2017-11-29 00:16 - 000141232 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.11.51_log.txt
2017-11-29 00:09 - 2017-11-29 00:30 - 000000000 ____D C:\TDSSKiller_Quarantine
2017-11-29 00:09 - 2017-11-29 00:10 - 000277994 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.09.13_log.txt
2017-11-29 00:08 - 2017-11-29 00:08 - 000001909 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2017-11-29 00:08 - 2017-11-29 00:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2017-11-29 00:08 - 2017-11-29 00:08 - 000000000 ____D C:\Program Files\HitmanPro
2017-11-29 00:07 - 2017-11-29 00:15 - 000000000 ____D C:\ProgramData\HitmanPro
2017-11-29 00:06 - 2017-11-29 00:07 - 000011126 _____ C:\Users\Owner\Desktop\MBRCheck_11.29.17_00.06.36.txt
2017-11-28 23:41 - 2017-11-29 00:09 - 000090582 _____ C:\Windows\ntbtlog.txt
2017-11-28 13:59 - 2017-11-28 13:59 - 000000000 ____D C:\Users\Owner\AppData\LocalLow\Adblock Plus for IE
2017-11-28 13:59 - 2017-11-28 13:59 - 000000000 ____D C:\Program Files\Adblock Plus for IE
2017-11-28 13:48 - 2017-11-28 14:13 - 000000000 ____D C:\Users\Owner\Documents\ConnectWiseControl
2017-11-28 12:46 - 2017-11-28 14:13 - 000000000 ____D C:\ProgramData\scre..tion_2c2536e5112611c9_0006.0004_82786dc597925baa
2017-11-28 12:45 - 2017-11-28 12:45 - 000085272 _____ C:\Users\Owner\Downloads\ConnectWiseControl.Client.exe
2017-11-28 12:37 - 2017-11-28 12:37 - 000352151 _____ C:\Users\Owner\Desktop\Computer Bill.pdf
2017-11-28 11:16 - 2017-11-28 12:46 - 000000000 ____D C:\ProgramData\scre..tion_2c2536e5112611c9_0006.0004_93709a72a0cf73c5
2017-11-28 10:43 - 2017-11-28 10:56 - 001204720 _____ (Adobe Systems Incorporated) C:\Users\Owner\Downloads\flashplayer27_ka_install.exe
2017-11-27 02:00 - 2017-11-27 02:00 - 000189114 _____ C:\Users\Owner\Desktop\soft experts.pdf
2017-11-22 11:08 - 2017-11-28 13:52 - 000000000 ____D C:\Windows\Minidump
2017-11-18 20:26 - 2017-11-18 20:26 - 000003230 _____ C:\Windows\System32\Tasks\{EE0246C1-3455-44FF-8A58-3CAADCD84D78}
2017-11-18 10:22 - 2017-11-18 10:22 - 000000000 ____D C:\Users\Owner\AppData\Roaming\Opera Software
2017-11-18 10:22 - 2017-11-18 10:22 - 000000000 ____D C:\Users\Owner\AppData\Local\Opera Software
2017-11-18 10:21 - 2017-11-18 10:21 - 000000065 _____ C:\Users\Owner\Downloads\Word_Setup [1].exe
2017-11-17 10:46 - 2017-11-17 10:47 - 140852175 _____ C:\Users\Owner\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_en-US(1).exe
2017-11-17 10:46 - 2017-11-17 10:46 - 140852175 _____ C:\Users\Owner\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_en-US.exe
2017-11-17 10:44 - 2017-11-17 10:44 - 001668448 _____ ( ) C:\Users\Owner\Downloads\Word_Setup.exe
2017-11-15 09:08 - 2017-10-16 12:38 - 002013016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-11-15 09:08 - 2017-10-14 02:38 - 025731584 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-11-15 09:08 - 2017-10-14 02:23 - 004168704 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-11-15 09:08 - 2017-10-14 02:13 - 002903552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-11-15 09:08 - 2017-10-14 02:09 - 005979648 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-11-15 09:08 - 2017-10-14 01:30 - 015266816 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-11-15 09:08 - 2017-10-14 01:21 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-11-15 09:08 - 2017-10-14 01:14 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-11-15 09:08 - 2017-10-14 01:05 - 015431680 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-11-15 09:08 - 2017-10-14 00:50 - 002293760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-11-15 09:08 - 2017-10-14 00:33 - 004542464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-11-15 09:08 - 2017-10-14 00:28 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-11-15 09:08 - 2017-10-14 00:14 - 013317632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-11-15 09:08 - 2017-10-14 00:10 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-11-15 09:08 - 2017-10-10 09:38 - 003631616 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-11-15 09:08 - 2017-09-08 11:14 - 003084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2017-11-15 09:08 - 2017-09-08 10:50 - 002471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2017-11-15 09:08 - 2017-08-10 19:39 - 002779136 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-11-15 09:08 - 2017-08-10 19:30 - 002464256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-11-15 09:07 - 2017-10-17 13:11 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-11-15 09:07 - 2017-10-14 07:04 - 001548624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-11-15 09:07 - 2017-10-14 02:11 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-11-15 09:07 - 2017-10-14 02:01 - 000816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-11-15 09:07 - 2017-10-14 01:36 - 001033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-11-15 09:07 - 2017-10-14 01:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-11-15 09:07 - 2017-10-14 01:30 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-11-15 09:07 - 2017-10-14 01:30 - 000380416 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-11-15 09:07 - 2017-10-14 01:29 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-11-15 09:07 - 2017-10-14 01:27 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-11-15 09:07 - 2017-10-14 01:09 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-11-15 09:07 - 2017-10-14 00:58 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-11-15 09:07 - 2017-10-14 00:53 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-11-15 09:07 - 2017-10-14 00:45 - 000662016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-11-15 09:07 - 2017-10-14 00:28 - 000880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2017-11-15 09:07 - 2017-10-14 00:25 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-11-15 09:07 - 2017-10-14 00:24 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-11-15 09:07 - 2017-10-14 00:24 - 000331776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-11-15 09:07 - 2017-10-14 00:23 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-11-15 09:07 - 2017-10-14 00:07 - 001314304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-11-15 09:07 - 2017-10-14 00:04 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-11-15 09:07 - 2017-10-10 10:36 - 000124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys
2017-11-15 09:07 - 2017-10-10 09:38 - 000425984 _____ (Microsoft Corporation) C:\Windows\system32\PCPTpm12.dll
2017-11-15 09:07 - 2017-10-10 09:11 - 002749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-11-15 09:07 - 2017-10-10 09:08 - 000367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCPTpm12.dll
2017-11-15 09:07 - 2017-10-05 01:17 - 000380248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-11-15 09:07 - 2017-09-14 17:52 - 000986968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-11-15 09:07 - 2017-09-07 21:31 - 000685440 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-11-15 09:07 - 2017-09-07 21:28 - 000507176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-11-15 09:07 - 2017-09-07 15:31 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\mgmtapi.dll
2017-11-15 09:07 - 2017-09-07 13:20 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mgmtapi.dll
2017-11-15 09:07 - 2017-09-07 11:20 - 000513456 _____ C:\Windows\SysWOW64\locale.nls
2017-11-15 09:07 - 2017-09-07 11:20 - 000513456 _____ C:\Windows\system32\locale.nls
2017-11-15 09:07 - 2017-09-07 07:40 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-11-15 09:07 - 2017-09-07 07:40 - 000922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-11-15 09:07 - 2017-09-06 17:07 - 000158552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-11-15 09:07 - 2017-09-06 15:17 - 000461144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-11-15 09:07 - 2017-09-06 15:17 - 000443224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-11-15 09:07 - 2017-09-06 08:14 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\regsvc.dll
2017-11-15 08:57 - 2017-10-11 01:35 - 000143016 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-11-15 08:57 - 2017-10-10 09:21 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 002023936 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-11-15 08:57 - 2017-10-10 07:18 - 001570304 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000670208 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000605184 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000603648 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000402944 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000370688 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000241664 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-11-14 15:47 - 2017-11-14 15:47 - 000092928 _____ C:\Users\Owner\Downloads\resume 2015 (Kyle McManaman).docx - Microsoft Word Online.htm
2017-11-14 15:47 - 2017-11-14 15:47 - 000000000 ____D C:\Users\Owner\Downloads\resume 2015 (Kyle McManaman).docx - Microsoft Word Online_files
2017-11-14 10:42 - 2017-11-14 10:42 - 053914496 _____ (Skype Technologies S.A. ) C:\Users\Owner\Downloads\Skype-8.10.0.9 (1).exe
2017-11-13 20:30 - 2017-11-13 20:30 - 053914496 _____ (Skype Technologies S.A. ) C:\Users\Owner\Downloads\Skype-8.10.0.9.exe
2017-11-13 20:26 - 2017-11-22 11:26 - 000001326 _____ C:\Users\Public\Desktop\Skype.lnk
2017-11-13 20:26 - 2017-11-22 11:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-11-13 20:26 - 2017-11-13 20:26 - 000000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2017-11-13 13:21 - 2017-11-13 13:21 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2017-11-13 10:15 - 2017-11-13 10:15 - 000123362 _____ C:\Users\Owner\Downloads\GACB_2015.pdf
2017-11-10 08:28 - 2017-11-10 08:28 - 000071441 _____ C:\Users\Owner\Downloads\patient-billing-flow.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-01 14:36 - 2014-11-21 02:44 - 000865068 _____ C:\Windows\system32\PerfStringBackup.INI
2017-12-01 14:33 - 2016-08-29 18:49 - 000000000 __RDO C:\Users\Owner\OneDrive
2017-11-29 11:29 - 2016-11-30 00:16 - 000000000 ____D C:\Users\Owner\AppData\LocalLow\Mozilla
2017-11-29 11:29 - 2013-08-22 07:36 - 000000000 ____D C:\Windows\Inf
2017-11-29 00:40 - 2013-08-22 08:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-11-29 00:39 - 2016-08-16 19:45 - 000065536 _____ C:\Windows\system32\spu_storage.bin
2017-11-29 00:39 - 2013-08-22 07:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2017-11-29 00:27 - 2016-08-16 19:11 - 000003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3592585487-3101742847-3297218791-1001
2017-11-28 18:17 - 2016-08-17 12:49 - 000003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{06EA9419-B131-4841-A5DD-11FDC460B3F6}
2017-11-28 13:52 - 2016-08-16 18:39 - 000000000 ____D C:\Windows\Panther
2017-11-28 13:45 - 2016-08-16 21:13 - 000000000 ____D C:\Users\Owner
2017-11-28 12:46 - 2017-06-25 07:10 - 000000000 ____D C:\Users\Owner\AppData\Local\Deployment
2017-11-28 11:12 - 2017-01-19 19:46 - 000000000 ____D C:\Users\Owner\AppData\Roaming\VMware
2017-11-24 09:52 - 2016-08-16 22:56 - 000000000 ____D C:\Windows\system32\MRT
2017-11-24 09:49 - 2017-10-15 09:32 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-11-24 09:49 - 2016-08-16 22:56 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-11-22 11:08 - 2017-03-28 15:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-22 11:08 - 2016-08-17 12:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-21 14:45 - 2013-08-22 09:36 - 000000000 ____D C:\Windows\system32\NDF
2017-11-20 14:32 - 2016-08-21 10:08 - 000545440 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-11-19 10:36 - 2016-08-17 12:50 - 000001175 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-19 10:36 - 2016-08-17 12:50 - 000000000 ____D C:\Users\Owner\AppData\Roaming\Mozilla
2017-11-18 10:37 - 2013-08-22 08:44 - 000337808 _____ C:\Windows\system32\FNTCACHE.DAT
2017-11-18 10:32 - 2016-08-16 23:01 - 000000000 ____D C:\Windows\system32\appraiser
2017-11-17 08:57 - 2013-08-22 09:36 - 000000000 ____D C:\Windows\AppReadiness
2017-11-17 08:56 - 2013-08-22 09:36 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-17 08:56 - 2013-08-22 09:20 - 000000000 ____D C:\Windows\CbsTemp
2017-11-14 13:49 - 2017-06-25 07:11 - 000002215 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-14 13:49 - 2017-06-25 07:11 - 000002203 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-11-13 15:43 - 2017-06-25 07:10 - 000003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-11-13 15:43 - 2017-06-25 07:10 - 000003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-11-03 18:41 - 2016-08-16 23:03 - 000835568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-11-03 18:41 - 2016-08-16 23:03 - 000177648 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Some files in TEMP:
====================
2017-11-29 00:39 - 2017-11-28 13:08 - 002237968 _____ (Kaspersky Lab ZAO) C:\Users\Owner\AppData\Local\Temp\5DCF14FB-B215-4626-A436-6A5976778928.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-27 11:31

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2017
Ran by Owner (01-12-2017 14:37:03)
Running from F:\
Windows 8.1 (Update) (X64) (2016-08-17 03:13:17)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3592585487-3101742847-3297218791-500 - Administrator - Disabled)
Guest (S-1-5-21-3592585487-3101742847-3297218791-501 - Limited - Disabled)
Owner (S-1-5-21-3592585487-3101742847-3297218791-1001 - Administrator - Enabled) => C:\Users\Owner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{F6FCA281-09CC-4753-990C-937B93A52C94}) (Version: 1.6 - Eyeo GmbH)
Apple Application Support (32-bit) (HKLM-x32\...\{D2FE6376-E549-4F63-A2C5-CA24DA035DE4}) (Version: 5.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon MX330 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX330_series) (Version:  - )
DisplayKEY USB Cradle (HKLM\...\{BBA09DF4-4519-4BD0-B203-A58CACB92DFA}) (Version: 2.0.0.329 - Supra)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 62.0.3202.94 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.20.286 - SurfRight B.V.)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 57.0 (x64 en-US) (HKLM\...\Mozilla Firefox 57.0 (x64 en-US)) (Version: 57.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 57.0.0.6525 - Mozilla)
Pulse Secure Setup Client (HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\Juniper_Setup_Client) (Version: 8.1.6.61491 - Pulse Secure, LLC)
Pulse Secure Setup Client 64-bit Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC)
Skype version 8.11 (HKLM-x32\...\Skype_is1) (Version: 8.11 - Skype Technologies S.A.)
VMware Horizon Client (HKLM\...\{C7F8E8FA-0832-427E-B2B1-ABF6F8495C35}) (Version: 3.5.2.30397 - VMware, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {37E3E53A-7645-4BC9-A9E5-6AD32F4E1D7F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {B42061CE-B050-4D93-9898-FDC821CAFA75} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-06-25] (Google Inc.)
Task: {E1A5D9C1-B602-4879-92C3-A63534EF021E} - System32\Tasks\{EE0246C1-3455-44FF-8A58-3CAADCD84D78} => C:\Windows\system32\pcalua.exe -a C:\Users\Owner\AppData\Local\{8E00B85C-AAA8-D4E4-C730-F10CE3580D94}\uninst.exe -c -P=/Uninstall /s /noun /DelSelfDir
Task: {E26968CF-C91C-4ECD-8592-53C9462086F2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-06-25] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2016-09-01 17:12 - 2016-09-01 17:12 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 001353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-06-16 11:10 - 2015-06-16 11:10 - 000226240 _____ () C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
2015-07-31 15:42 - 2015-07-31 15:42 - 006363792 _____ () C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe
2011-11-11 14:27 - 2011-11-11 14:27 - 000073216 _____ () C:\dKEYUSBCradle\stunnel-4.10.exe
2015-06-16 11:04 - 2015-06-16 11:04 - 000239552 _____ () C:\Program Files (x86)\Common Files\VMware\DeviceRedirectionCommon\ftnlapi.dll
2005-03-29 00:58 - 2005-03-29 00:58 - 000847872 _____ () C:\dKEYUSBCradle\libeay32.dll
2010-03-16 09:52 - 2010-03-16 09:52 - 000159744 _____ () C:\dKEYUSBCradle\libssl32.dll
2017-11-13 20:26 - 2017-11-16 16:11 - 001551816 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\ffmpeg.dll
2017-11-13 20:26 - 2017-11-16 16:08 - 000088064 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node
2017-11-13 20:26 - 2017-11-16 16:08 - 002559608 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\libglesv2.dll
2017-11-13 20:26 - 2017-11-16 16:08 - 000031864 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\libegl.dll
2017-11-13 20:26 - 2017-11-16 16:08 - 000400896 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\@paulcbetts\spellchecker\build\Release\spellchecker.node
2017-11-13 20:26 - 2017-11-16 16:08 - 000129536 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node
2017-11-13 20:26 - 2017-11-16 16:08 - 002130944 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\slimcore\bin\skypert.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\42925105.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\67090335.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\72642326.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\99224798.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\42925105.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\67090335.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\72642326.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\99224798.sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 07:25 - 2017-11-28 13:54 - 000002514 _____ C:\Windows\system32\Drivers\etc\hosts

127.0.0.1  answers.microsoft.com
127.0.0.1    www.scamadviser.com
127.0.0.1    www.answers.microsoft.com
127.0.0.1    www.reddit.com
127.0.0.1    www.bbb.org
127.0.0.1    reportscam.com
127.0.0.1    it.findeen.com
127.0.0.1    secure.logmeinrescue.com
127.0.0.1    helpme.net
127.0.0.1    www.helpme.net
127.0.0.1    teamviewer.com
127.0.0.1    www.teamviewer.com
127.0.0.1    ammyy.com
127.0.0.1    www.ammyy.com
127.0.0.1    supremocontrol.com
127.0.0.1    www.supercontrol.com
127.0.0.1    anydesk.com
127.0.0.1    www.anydesk.com
127.0.0.1    aeroadmin.com
127.0.0.1    www.aeroadmin.com
127.0.0.1    remoteutilities.com
127.0.0.1    www.remoteutilities.com
127.0.0.1    remotepc.com
127.0.0.1    www.remotepc.com
127.0.0.1    litemanager.com
127.0.0.1    www.litemanager.com
127.0.0.1    get.gotomypc.com
127.0.0.1    get.gotomypc.com
127.0.0.1    showmypc.com
127.0.0.1    www.showmypc.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Theme2\img10.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B0F18B4F-919F-43AF-A627-9C194E0F3EA7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AA45BFFA-AF50-4204-936E-8298D71F48C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7DACB5A0-5615-411A-849C-65BF40578DC6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FAE5A5C7-FE13-40A9-AB2D-E05A72CF807B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{42DE9361-EAA2-4977-AC0A-B7F0B6C9F500}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9EAB687B-B006-41A3-9064-4C19CEC77E13}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6F5DD6F7-273C-4120-88F4-21075693C53D}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{653C3824-617F-428D-B923-667101E57C88}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{2F0DA2BF-4BC6-48F6-B1FE-526BEFBE03F2}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{06BE2CF4-D1FA-44D2-8E4A-7180A21CA29B}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{F3CECC4E-413A-4150-913D-3CFB88A0F371}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{8E917DD7-9FA7-48D9-BC8C-DE3C3F9818B5}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{72F5AA83-97BB-4815-AA2F-93BDB81022FF}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{AD42FE2C-FA6B-42E3-AC07-AA4D90ED436B}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{7349F58B-B9D1-4E0A-A317-53A03F2FF9AC}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{380A0B4C-5C08-493A-A13E-E90B145DF4C7}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{805B19D2-A89C-4037-BB86-AE3C567E2F5D}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{4B4FA0B1-B9A5-4F67-8736-C9DD5C9F37C1}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{7819CFC0-2C8D-4DBF-9C0C-536FE8552347}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{21B12A09-1673-4F5A-8A79-A7F0AFA5487A}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{6876DCAD-50FE-48DF-8E7C-585DB61594AC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{09E7FC8C-9F5A-41FE-988F-3F6484F09F07}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{EF7D00EF-4397-492D-98BF-800DEC16BB01}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{EF5B2034-9891-437F-83CE-FFF59CF4DBD4}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe

==================== Restore Points =========================

13-07-2017 19:01:45 Windows Update
23-07-2017 00:38:49 Windows Update
09-08-2017 07:06:25 Windows Modules Installer
12-08-2017 15:05:36 Windows Update
15-09-2017 04:39:34 Windows Update
15-10-2017 09:31:32 Windows Update
19-10-2017 04:49:09 Windows Update
17-11-2017 08:53:05 Windows Update
24-11-2017 09:48:48 Windows Update
28-11-2017 13:59:11 Installed Adblock Plus for IE (32-bit and 64-bit)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/29/2017 11:26:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 38712125

Error: (11/29/2017 11:26:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 38712125

Error: (11/29/2017 11:26:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/29/2017 12:05:25 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HP-DESKTOP)
Description: Activation of app Microsoft.Reader_6.4.9926.18860_x64__8wekyb3d8bbwe:Microsoft.Reader.AppXqwpk1t4bvqdvwhxhbyg53psw2e2hmdrd.mca failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (11/29/2017 12:05:21 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HP-DESKTOP)
Description: Activation of app Microsoft.Reader_6.4.9926.18860_x64__8wekyb3d8bbwe:Microsoft.Reader.AppXqwpk1t4bvqdvwhxhbyg53psw2e2hmdrd.mca failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (11/29/2017 12:05:07 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HP-DESKTOP)
Description: Activation of app Microsoft.Reader_6.4.9926.18860_x64__8wekyb3d8bbwe:Microsoft.Reader.AppXqwpk1t4bvqdvwhxhbyg53psw2e2hmdrd.mca failed with error: -2144927149 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (11/28/2017 11:40:58 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Event provider $Core attempted to register query "select * from __TimerEvent" whose target class "__TimerEvent" in //./root/subscription namespace does not exist. The query will be ignored.

Error: (11/28/2017 11:40:58 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Event provider $Core attempted to register query "select * from __SystemEvent" whose target class "__SystemEvent" in //./root/subscription namespace does not exist. The query will be ignored.

Error: (11/28/2017 11:40:58 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Event provider $Core attempted to register query "select * from __NamespaceOperationEvent" whose target class "__NamespaceOperationEvent" in //./root/subscription namespace does not exist. The query will be ignored.

Error: (11/28/2017 11:40:58 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Event provider $Core attempted to register query "select * from __ClassOperationEvent" whose target class "__ClassOperationEvent" in //./root/subscription namespace does not exist. The query will be ignored.


System errors:
=============
Error: (11/29/2017 12:10:24 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (11/29/2017 12:09:47 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (11/29/2017 12:09:11 AM) (Source: DCOM) (EventID: 10005) (User: HP-DESKTOP)
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server:
{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}


==================== Memory info ===========================

Processor: AMD A8-7600 Radeon R7, 10 Compute Cores 4C+6G
Percentage of memory in use: 19%
Total physical RAM: 7092.85 MB
Available physical RAM: 5714 MB
Total Virtual: 14260.85 MB
Available Virtual: 12851.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1862.5 GB) (Free:1819.22 GB) NTFS
Drive e: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive f: () (Removable) (Total:3.81 GB) (Free:1.24 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: D9D82C40)

Partition: GPT.

========================================================
Disk: 1 (Size: 3.8 GB) (Disk ID: E44A23EB)
Partition 1: (Not Active) - (Size=3.8 GB) - (Type=0B)

==================== End of Addition.txt ============================

 

Not sure if the MBR  scan finished. It was stuck for a while. If I need to run it again, just let me know! Also, fix button was disabled.

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-12-01 14:44:13
-----------------------------
14:44:13.681    OS Version: Windows x64 6.2.9200
14:44:13.681    Number of processors: 4 586 0x3001
14:44:13.681    ComputerName: HP-DESKTOP  UserName: Owner
14:44:15.087    Initialize success
14:44:15.087    VM: initialized successfully
14:44:15.087    VM: Amd CPU BiosDisabled
14:46:22.359    AVAST engine defs: 17030301
14:49:33.023    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000028
14:49:33.023    Disk 0 Vendor: ST2000DM001-1ER164 HP51 Size: 1907729MB BusType: 11
14:49:33.151    Disk 0 MBR read successfully
14:49:33.163    Disk 0 MBR scan
14:49:33.163    Disk 0 unknown MBR code
14:49:33.163    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
14:49:33.241    Disk 0 scanning C:\Windows\system32\drivers
14:49:50.530    Service scanning
14:50:20.265    Modules scanning
14:50:20.265    Disk 0 trace - called modules:
14:50:20.280    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
14:50:20.280    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000f36b5770]
14:50:20.296    3 CLASSPNP.SYS[fffff801e1a81170] -> nt!IofCallDriver -> \Device\00000028[0xffffe000f34fc060]
14:50:21.939    AVAST engine scan C:\
17:13:22.180    Disk 0 MBR has been saved successfully to "F:\MBR.dat"
17:13:22.259    The log file has been saved successfully to "F:\aswMBR.txt"
 


  • 0

#6
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

Uninstall:

Bonjour (your version is not working)

HitmanPro (not a very smart program.  Often leaves the PC unbootable)

 

Your hosts file has been tampered with so that teamviewer won't work.  Let's see if we can clear it up with a fixlist:

 

Download the attached fixlist.txt to the same location as FRST

Attached File  fixlist.txt   4.33KB   11 downloads

Run FRST and press Fix
A fix log will be generated please post that


Run FRST again as before.  Make sure Addition.txt is checked and hit Scan.  Post both logs.

 

Post your latest TDSSKiller log (C:\TDSSKiller.2.8.16.0_29.11.2017_11.26.51_log.txt )

 

Submit the mbr.dat file that aswMBR created for you to virustotal:

 

Easiest way to submit a file is to copy the path:

F:\MBR.dat

Then
Go to virustotal.com with your browser.  Click on Choose File then when the file chooser window opens, move down to the File Name: box and then Ctrl + v and the path should appear.  Hit Open and it should return to the main page with MBR.dat chosen.  Click on Scan it.  If it knows the file already it will tell you it's already been analyzed and offer you a choice of Reanalyze and View Last Analysis.  In that case click on View Last Analysis.  If it doesn't know the file it will take a minute to query 50+ different anti-virus companies.  In either case, If the Detection ratio: is not    0 / 50+ then copy the Analysis page and paste it into the forum.  You can just hit Ctrl + a then Ctrl + c to copy the page then go to a reply and Ctrl + v.

 

pen an elevated command prompt:

http://www.howtogeek...-in-windows-10/
http://www.eightforu...indows-8-a.html

If you open an elevated command prompt it will by default open in c:\Windows\system32

Once you have an elevated command prompt:

Type:

 DISM  /Online  /Cleanup-Image  /RestoreHealth

 (I use two spaces so you can be sure to see where one space goes.)
Hit Enter.  This will take a while (10-20 minutes) to complete.  Once the prompt returns:

Reboot.  Open an elevated Command Prompt again and type (with an Enter after the line):

sfc  /scannow



This will also take a few minutes.  

When it finishes it will say one of the following:

Windows did not find any integrity violations (a good thing)
Windows Resource Protection found corrupt files and repaired them (a good thing)
Windows Resource Protection found corrupt files but was unable to fix some (or all) of them (not a good thing)

If you get the last result then type:

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  \junk.txt

Hit Enter.  Then type::


notepad  \junk.txt

Hit Enter.

 Copy the text from notepad and paste it into a reply.


After you finish SFC, regardless of the result:



1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.  (Each time you run VEW it overwrites the log so copy the first one to a Reply or rename it before running it a second time.)
 




 


  • 0

#7
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Okay, I forgot to mention that Teamviewer did work from my laptop.  I am uinstalling Bonjour right now and will reply with everything you asked for. Let me know if I need to remove teamviewer, but I did want to let you know that it did work fine.


  • 0

#8
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Real quick too, I guess MBR is not finished. I went to apply the fix like you said and noticed it still scanning. I guess if you save the log, it just saves up to that point? I guess I figured that a warning message would pop up saying the scan is still in progress. I guess I should wait and post the log again once it has fully finished? Is there a way to tell that it has been completed? I guess the stop button will change to scan once it's done maybe? Thanks again for the help, I really appreciate this.


  • 0

#9
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Latest TDSKiller:

 

19:17:26.0437 3460  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
19:17:26.0437 3460  UEFI system
19:17:28.0454 3460  ============================================================
19:17:28.0454 3460  Current date / time: 2017/12/01 19:17:28.0454
19:17:28.0454 3460  SystemInfo:
19:17:28.0454 3460  
19:17:28.0454 3460  OS Version: 6.2.9200 ServicePack: 0.0
19:17:28.0454 3460  Product type: Workstation
19:17:28.0454 3460  ComputerName: HP-DESKTOP
19:17:28.0454 3460  UserName: Owner
19:17:28.0454 3460  Windows directory: C:\Windows
19:17:28.0454 3460  System windows directory: C:\Windows
19:17:28.0454 3460  Running under WOW64
19:17:28.0454 3460  Processor architecture: Intel x64
19:17:28.0454 3460  Number of processors: 4
19:17:28.0454 3460  Page size: 0x1000
19:17:28.0454 3460  Boot type: Normal boot
19:17:28.0454 3460  ============================================================
19:17:29.0127 3460  BG loaded
19:17:29.0391 3460  Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:17:29.0407 3460  Drive \Device\Harddisk1\DR1 - Size: 0xF49D1C00 (3.82 Gb), SectorSize: 0x200, Cylinders: 0x1F2, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
19:17:29.0407 3460  ============================================================
19:17:29.0407 3460  \Device\Harddisk0\DR0:
19:17:29.0407 3460  GPT partitions:
19:17:29.0407 3460  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {D247555E-D39B-464F-A1A6-73D996B00567}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0x96000
19:17:29.0407 3460  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {76457BAD-1730-4F8E-A20E-8F4A7D9F447B}, Name: EFI system partition, StartLBA 0x96800, BlocksNum 0x32000
19:17:29.0407 3460  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {4F195DDA-4FA4-42B0-92A4-E9039210EB80}, Name: Microsoft reserved partition, StartLBA 0xC8800, BlocksNum 0x40000
19:17:29.0407 3460  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {9B4C8972-8B43-485B-94C6-1B4881B9DE50}, Name: Basic data partition, StartLBA 0x108800, BlocksNum 0xE8D00000
19:17:29.0407 3460  MBR partitions:
19:17:29.0407 3460  \Device\Harddisk1\DR1:
19:17:29.0407 3460  MBR partitions:
19:17:29.0407 3460  \Device\Harddisk1\DR1\Partition1: MBR, Type 0xB, StartLBA 0x22, BlocksNum 0x79D48F
19:17:29.0407 3460  ============================================================
19:17:29.0422 3460  C: <-> \Device\Harddisk0\DR0\Partition4
19:17:29.0422 3460  ============================================================
19:17:29.0422 3460  Initialize success
19:17:29.0422 3460  ============================================================
19:17:31.0157 6208  ============================================================
19:17:31.0157 6208  Scan started
19:17:31.0157 6208  Mode: Manual;
19:17:31.0157 6208  ============================================================
19:17:31.0970 6208  ================ Scan system memory ========================
19:17:31.0970 6208  System memory - ok
19:17:31.0970 6208  ================ Scan services =============================
19:17:32.0110 6208  [ E1832BD9FD7E0FC2DC9FA5935DE3E8C1 ] 1394ohci        C:\Windows\System32\drivers\1394ohci.sys
19:17:32.0110 6208  1394ohci - ok
19:17:32.0126 6208  [ AD508A1A46EC21B740AB31C28EFDFDB1 ] 3ware           C:\Windows\system32\drivers\3ware.sys
19:17:32.0126 6208  3ware - ok
19:17:32.0157 6208  [ E796AE43DDD1844281DB4D57294D17C0 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
19:17:32.0157 6208  ACPI - ok
19:17:32.0173 6208  [ AC8279D229398BCF05C3154ADCA86813 ] acpiex          C:\Windows\system32\Drivers\acpiex.sys
19:17:32.0173 6208  acpiex - ok
19:17:32.0189 6208  [ A8970D9BF23CD309E0403978A1B58F3F ] acpipagr        C:\Windows\System32\drivers\acpipagr.sys
19:17:32.0189 6208  acpipagr - ok
19:17:32.0221 6208  [ 111A89C99C5B4F1A7BCE5F643DD86F65 ] AcpiPmi         C:\Windows\System32\drivers\acpipmi.sys
19:17:32.0221 6208  AcpiPmi - ok
19:17:32.0236 6208  [ 5758387D68A20AE7D3245011B07E36E7 ] acpitime        C:\Windows\System32\drivers\acpitime.sys
19:17:32.0236 6208  acpitime - ok
19:17:32.0267 6208  [ 7C1FDF1B48298CBA7CE4BDD4978951AD ] ADP80XX         C:\Windows\system32\drivers\ADP80XX.SYS
19:17:32.0282 6208  ADP80XX - ok
19:17:32.0345 6208  [ BCD58DACAA1EAAADC115EDD940478F6D ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
19:17:32.0345 6208  AeLookupSvc - ok
19:17:32.0376 6208  [ A460C3AF3755A2A79A3C8EFE72E147B5 ] AFD             C:\Windows\system32\drivers\afd.sys
19:17:32.0392 6208  AFD - ok
19:17:32.0392 6208  [ 7DFAEBA9AD62D20102B576D5CAC45EC8 ] agp440          C:\Windows\system32\drivers\agp440.sys
19:17:32.0392 6208  agp440 - ok
19:17:32.0424 6208  [ FE14D249D39368CA62D8DA6BC94AC694 ] ahcache         C:\Windows\system32\DRIVERS\ahcache.sys
19:17:32.0424 6208  ahcache - ok
19:17:32.0439 6208  [ 14A45BE6F5678339F0EC5752D9849410 ] ALG             C:\Windows\System32\alg.exe
19:17:32.0439 6208  ALG - ok
19:17:32.0470 6208  [ BC54D9830300C8B4F2B483CD6E0FC4CB ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
19:17:32.0470 6208  AMD External Events Utility - ok
19:17:32.0501 6208  [ 7589DE749DB6F71A68489DCE04158729 ] AmdK8           C:\Windows\System32\drivers\amdk8.sys
19:17:32.0501 6208  AmdK8 - ok
19:17:32.0642 6208  [ 6398021B262BD1531E8523CF5DEFD600 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
19:17:32.0784 6208  amdkmdag - ok
19:17:32.0815 6208  [ BB4A8E585178DDAE35875D670C41C981 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
19:17:32.0815 6208  amdkmdap - ok
19:17:32.0831 6208  [ B46D2D89AFF8A9490FA8C98C7A5616E3 ] AmdPPM          C:\Windows\System32\drivers\amdppm.sys
19:17:32.0831 6208  AmdPPM - ok
19:17:32.0831 6208  [ D2BF2F94A47D332814910FD47C6BBCD2 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
19:17:32.0846 6208  amdsata - ok
19:17:32.0846 6208  [ A8E04943C7BBA7219AA50400272C3C6E ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
19:17:32.0846 6208  amdsbs - ok
19:17:32.0862 6208  [ CEA5F4F27CFC08E3A44D576811B35F50 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
19:17:32.0862 6208  amdxata - ok
19:17:32.0893 6208  [ 415DD71628795197F7AFC176CBADC74E ] AppID           C:\Windows\system32\drivers\appid.sys
19:17:32.0893 6208  AppID - ok
19:17:32.0909 6208  [ 942C8297400FCFB13CEE3F3CD89C5CE5 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
19:17:32.0909 6208  AppIDSvc - ok
19:17:32.0942 6208  [ 734622FBA766DBD65B1803549B24A04A ] Appinfo         C:\Windows\System32\appinfo.dll
19:17:32.0942 6208  Appinfo - ok
19:17:33.0034 6208  [ 7D811EA7A2AAA49B0446D42CBC1CD338 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
19:17:33.0034 6208  Apple Mobile Device Service - ok
19:17:33.0065 6208  [ 35E28923A23ADABAA5A1B43256D0AB58 ] AppReadiness    C:\Windows\system32\AppReadiness.dll
19:17:33.0065 6208  AppReadiness - ok
19:17:33.0098 6208  [ E0F846ADE7DED88981D0908DE56FF160 ] AppXSvc         C:\Windows\system32\appxdeploymentserver.dll
19:17:33.0112 6208  AppXSvc - ok
19:17:33.0128 6208  [ 65045784366F7EC5FB4E71BCF923187B ] arcsas          C:\Windows\system32\drivers\arcsas.sys
19:17:33.0128 6208  arcsas - ok
19:17:33.0143 6208  [ 74B14192CF79A72F7536B27CB8814FBD ] atapi           C:\Windows\system32\drivers\atapi.sys
19:17:33.0159 6208  atapi - ok
19:17:33.0207 6208  [ 2C7676F892E88FD190F08D98048C7C6C ] athr            C:\Windows\system32\DRIVERS\athw8x.sys
19:17:33.0253 6208  athr - ok
19:17:33.0284 6208  [ 431FE56F5A2F5937994CB2DA330B47DB ] AudioEndpointBuilder C:\Windows\System32\AudioEndpointBuilder.dll
19:17:33.0284 6208  AudioEndpointBuilder - ok
19:17:33.0315 6208  [ 0F03CC00645D7F841879A048787D6AC7 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
19:17:33.0315 6208  Audiosrv - ok
19:17:33.0347 6208  [ 3C6ED74AF41DD1A5585CE5EF3D00915F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
19:17:33.0347 6208  AxInstSV - ok
19:17:33.0362 6208  [ A4A73F631FE2AA2826FBE4A399B04DEF ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
19:17:33.0362 6208  b06bdrv - ok
19:17:33.0378 6208  [ 8CC7F7E4AFCBA605921B137ED7992C68 ] BasicDisplay    C:\Windows\System32\drivers\BasicDisplay.sys
19:17:33.0378 6208  BasicDisplay - ok
19:17:33.0409 6208  [ 195BD339B4B782B42C19489DCFB4D110 ] BasicRender     C:\Windows\System32\drivers\BasicRender.sys
19:17:33.0409 6208  BasicRender - ok
19:17:33.0409 6208  [ C1ABB0F7E3BEA48A0417BDF6FF14AB21 ] bcmfn2          C:\Windows\System32\drivers\bcmfn2.sys
19:17:33.0409 6208  bcmfn2 - ok
19:17:33.0442 6208  [ 174394F4EF93C117BF7BE3878046A1B1 ] BDESVC          C:\Windows\System32\bdesvc.dll
19:17:33.0442 6208  BDESVC - ok
19:17:33.0456 6208  [ EC19013E4CF87609534165DF897274D6 ] Beep            C:\Windows\system32\drivers\Beep.sys
19:17:33.0456 6208  Beep - ok
19:17:33.0487 6208  [ 5059D93764340D4EAEDF49C47133118F ] BFE             C:\Windows\System32\bfe.dll
19:17:33.0503 6208  BFE - ok
19:17:33.0534 6208  [ 48554994279BFE17A3D2B00076D0CB1A ] BITS            C:\Windows\System32\qmgr.dll
19:17:33.0534 6208  BITS - ok
19:17:33.0565 6208  [ 4938A9236300A356F97E378491EE4844 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
19:17:33.0565 6208  bowser - ok
19:17:33.0597 6208  [ FA601515FF2B59F25FDD8EDB1D2A1104 ] BrokerInfrastructure C:\Windows\System32\bisrv.dll
19:17:33.0597 6208  BrokerInfrastructure - ok
19:17:33.0612 6208  [ BC111AADACD0BF59D56547461D13AB6E ] Browser         C:\Windows\System32\browser.dll
19:17:33.0612 6208  Browser - ok
19:17:33.0629 6208  [ A8F23D453A424FF4DE04989C4727ECC7 ] BthAvrcpTg      C:\Windows\System32\drivers\BthAvrcpTg.sys
19:17:33.0629 6208  BthAvrcpTg - ok
19:17:33.0645 6208  [ 272A62B660A48AEF366F8A1836CED19F ] BthHFEnum       C:\Windows\System32\drivers\bthhfenum.sys
19:17:33.0645 6208  BthHFEnum - ok
19:17:33.0660 6208  [ 71FE2A48E4C93DDB9798C024880B6C07 ] bthhfhid        C:\Windows\System32\drivers\BthHFHid.sys
19:17:33.0660 6208  bthhfhid - ok
19:17:33.0677 6208  [ 9307A4B743D277C499CDA8E19E5687AC ] BthHFSrv        C:\Windows\System32\BthHFSrv.dll
19:17:33.0677 6208  BthHFSrv - ok
19:17:33.0690 6208  [ EF4B9E7C9AD88C00C18A12B0D22D1894 ] BTHMODEM        C:\Windows\System32\drivers\bthmodem.sys
19:17:33.0690 6208  BTHMODEM - ok
19:17:33.0706 6208  [ 043A0F37631BF453F16D478B71320F46 ] bthserv         C:\Windows\system32\bthserv.dll
19:17:33.0706 6208  bthserv - ok
19:17:33.0721 6208  [ 2FA6510E33F7DEFEC03658B74101A9B9 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
19:17:33.0721 6208  cdfs - ok
19:17:33.0753 6208  [ C6796EA22B513E3457514D92DCDB1A3D ] cdrom           C:\Windows\System32\drivers\cdrom.sys
19:17:33.0753 6208  cdrom - ok
19:17:33.0786 6208  [ ACFDC4EE40EC6E4A0AB91D923B8288C8 ] CertPropSvc     C:\Windows\System32\certprop.dll
19:17:33.0786 6208  CertPropSvc - ok
19:17:33.0800 6208  [ BE9936EDD3267FAAFF94A7835867F00B ] circlass        C:\Windows\System32\drivers\circlass.sys
19:17:33.0800 6208  circlass - ok
19:17:33.0832 6208  [ 39D72BA91AFE3C81C1AB0DE41AA07EF3 ] CLFS            C:\Windows\system32\drivers\CLFS.sys
19:17:33.0832 6208  CLFS - ok
19:17:33.0862 6208  [ EF6EF85DADC3184A10D8F2F7159973CB ] CmBatt          C:\Windows\System32\drivers\CmBatt.sys
19:17:33.0862 6208  CmBatt - ok
19:17:33.0909 6208  [ C8823A6ECE66B997C8E9F413D1D671E7 ] CNG             C:\Windows\system32\Drivers\cng.sys
19:17:33.0909 6208  CNG - ok
19:17:33.0926 6208  [ 03AAED827C36F35D70900558B8274905 ] CompositeBus    C:\Windows\System32\drivers\CompositeBus.sys
19:17:33.0926 6208  CompositeBus - ok
19:17:33.0926 6208  COMSysApp - ok
19:17:33.0940 6208  [ A1FF7DFBFBE164CF92603C651D304DD2 ] condrv          C:\Windows\system32\drivers\condrv.sys
19:17:33.0940 6208  condrv - ok
19:17:33.0956 6208  [ 6324F0D18FB52833BA64BC828E29054C ] CryptSvc        C:\Windows\system32\cryptsvc.dll
19:17:33.0971 6208  CryptSvc - ok
19:17:33.0971 6208  [ 315BA4BC19316D72B2E037534E048B93 ] dam             C:\Windows\system32\drivers\dam.sys
19:17:33.0987 6208  dam - ok
19:17:34.0018 6208  [ 20CC6E9FE25ACD34BE4FCDDB7B08364D ] DcomLaunch      C:\Windows\system32\rpcss.dll
19:17:34.0018 6208  DcomLaunch - ok
19:17:34.0050 6208  [ 95E1ABFB27F8A62ED764805775F0D2F3 ] defragsvc       C:\Windows\System32\defragsvc.dll
19:17:34.0050 6208  defragsvc - ok
19:17:34.0082 6208  [ FF086DEF5995558CCB1B5AAC2110195D ] DeviceAssociationService C:\Windows\system32\das.dll
19:17:34.0082 6208  DeviceAssociationService - ok
19:17:34.0096 6208  [ 2C02AFF8383D893F8DBEB07A84F6E77C ] DeviceInstall   C:\Windows\system32\umpnpmgr.dll
19:17:34.0096 6208  DeviceInstall - ok
19:17:34.0129 6208  [ 4FED6AD69C9EE1EE7FD3C88437138855 ] Dfsc            C:\Windows\system32\Drivers\dfsc.sys
19:17:34.0129 6208  Dfsc - ok
19:17:34.0143 6208  [ 3EEAADA3125431980E5804ED7143458A ] Dhcp            C:\Windows\system32\dhcpcore.dll
19:17:34.0143 6208  Dhcp - ok
19:17:34.0190 6208  [ 0AC9F83A5508935DE89C447473085EEA ] DiagTrack       C:\Windows\system32\diagtrack.dll
19:17:34.0206 6208  DiagTrack - ok
19:17:34.0221 6208  [ BF6D8575DDF30384939B2D5251F27C1F ] disk            C:\Windows\system32\drivers\disk.sys
19:17:34.0221 6208  disk - ok
19:17:34.0269 6208  [ CAF3719E7EBB5CAC650F72330D9C5BBE ] dKeySync        C:\dKEYUSBCradle\SyncService.exe
19:17:34.0269 6208  dKeySync - ok
19:17:34.0285 6208  [ EB70A894708D1BC176AFD690FF06085F ] dmvsc           C:\Windows\System32\drivers\dmvsc.sys
19:17:34.0285 6208  dmvsc - ok
19:17:34.0315 6208  [ D9F407D006C916B7EC167858F88F13EB ] Dnscache        C:\Windows\System32\dnsrslvr.dll
19:17:34.0331 6208  Dnscache - ok
19:17:34.0362 6208  [ 811EACBCC7C51A03AE11F13CC27B2AB6 ] dot3svc         C:\Windows\System32\dot3svc.dll
19:17:34.0362 6208  dot3svc - ok
19:17:34.0379 6208  [ B99CB575986789A93A683DCF292A43A1 ] DPS             C:\Windows\system32\dps.dll
19:17:34.0379 6208  DPS - ok
19:17:34.0393 6208  [ 00C594D5A1DBD22AD8B2902B9F6EFF94 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
19:17:34.0393 6208  drmkaud - ok
19:17:34.0409 6208  [ 263625A4F616538EB867B6306A6590DB ] DsmSvc          C:\Windows\System32\DeviceSetupManager.dll
19:17:34.0409 6208  DsmSvc - ok
19:17:34.0456 6208  [ 670E7F15CEEA22C34CED8F4D0EC161BF ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
19:17:34.0471 6208  DXGKrnl - ok
19:17:34.0490 6208  [ E253530BD5EDE28F1FF6AF93C4D8034D ] Eaphost         C:\Windows\System32\eapsvc.dll
19:17:34.0503 6208  Eaphost - ok
19:17:34.0550 6208  [ 114BCFDF367FF37C3F1B0A96AF542E4D ] ebdrv           C:\Windows\system32\drivers\evbda.sys
19:17:34.0581 6208  ebdrv - ok
19:17:34.0596 6208  [ 382100E75B6F4668AEAEF228C6CEFFAD ] EFS             C:\Windows\System32\lsass.exe
19:17:34.0612 6208  EFS - ok
19:17:34.0612 6208  [ 43531A5993380CC5113242C29D265FD9 ] EhStorClass     C:\Windows\system32\drivers\EhStorClass.sys
19:17:34.0612 6208  EhStorClass - ok
19:17:34.0643 6208  [ 6F8E738A9505A388B1157FDDE7B3101B ] EhStorTcgDrv    C:\Windows\system32\drivers\EhStorTcgDrv.sys
19:17:34.0643 6208  EhStorTcgDrv - ok
19:17:34.0659 6208  [ DFFFAE1442BA4076E18EED5E406FA0D3 ] ErrDev          C:\Windows\System32\drivers\errdev.sys
19:17:34.0659 6208  ErrDev - ok
19:17:34.0675 6208  [ F00C593994D57C75273F820653440536 ] EventSystem     C:\Windows\system32\es.dll
19:17:34.0690 6208  EventSystem - ok
19:17:34.0707 6208  [ 7729D294A555C7AEB281ED8E4D0E01E4 ] exfat           C:\Windows\system32\drivers\exfat.sys
19:17:34.0707 6208  exfat - ok
19:17:34.0723 6208  [ 7C4E0D5900B2A1D11EDD626D6DDB937B ] fastfat         C:\Windows\system32\drivers\fastfat.sys
19:17:34.0723 6208  fastfat - ok
19:17:34.0753 6208  [ 304B6AEC4639A7CCCCF544C6BA6177B2 ] Fax             C:\Windows\system32\fxssvc.exe
19:17:34.0753 6208  Fax - ok
19:17:34.0753 6208  [ 5D8402613E778B3BD45E687A8372710B ] fdc             C:\Windows\System32\drivers\fdc.sys
19:17:34.0768 6208  fdc - ok
19:17:34.0768 6208  [ 020D2F29009F893ADEFF4405B4B44565 ] fdPHost         C:\Windows\system32\fdPHost.dll
19:17:34.0768 6208  fdPHost - ok
19:17:34.0784 6208  [ E80D2EDD2F88B6E20076A0A4F5A5A245 ] FDResPub        C:\Windows\system32\fdrespub.dll
19:17:34.0784 6208  FDResPub - ok
19:17:34.0800 6208  [ 47AB7D16EDE434B934AA4D661456C2D5 ] fhsvc           C:\Windows\system32\fhsvc.dll
19:17:34.0815 6208  fhsvc - ok
19:17:34.0815 6208  [ BCFD8B149B3ADF92D0DB1E909CAF0265 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
19:17:34.0815 6208  FileInfo - ok
19:17:34.0815 6208  [ A1A66C4FDAFD6B0289523232AFB7D8AF ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
19:17:34.0815 6208  Filetrace - ok
19:17:34.0833 6208  [ BE743083CF7063C486A4398E3AEFE59A ] flpydisk        C:\Windows\System32\drivers\flpydisk.sys
19:17:34.0833 6208  flpydisk - ok
19:17:34.0846 6208  [ C1FB505A73FA2E9019D32444AB33B75A ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
19:17:34.0846 6208  FltMgr - ok
19:17:34.0893 6208  [ 223CD19D2F84B7B42081F4FB530B658F ] FontCache       C:\Windows\system32\FntCache.dll
19:17:34.0893 6208  FontCache - ok
19:17:35.0005 6208  [ 1C52387BF5A127F5F3BFB31288F30D93 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:17:35.0018 6208  FontCache3.0.0.0 - ok
19:17:35.0018 6208  [ A7C31B168F371E8E6796219F23E354DB ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
19:17:35.0018 6208  FsDepends - ok
19:17:35.0050 6208  [ 09F460AFEDCA03F3BF6E07D1CCC9AC42 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
19:17:35.0050 6208  Fs_Rec - ok
19:17:35.0065 6208  [ 9540C57068902DAA6F272D70E922C090 ] ftnlsv3hv       C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
19:17:35.0081 6208  ftnlsv3hv - ok
19:17:35.0190 6208  [ AFC4552FB7F8A1C04FA0EE57A78933FC ] ftscanmgr       C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe
19:17:35.0253 6208  ftscanmgr - ok
19:17:35.0286 6208  [ D4AB6EE3D715BC44C00277FD934FAACF ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
19:17:35.0286 6208  fvevol - ok
19:17:35.0300 6208  [ 9591D0B9351ED489EAFD9D1CE52A8015 ] FxPPM           C:\Windows\System32\drivers\fxppm.sys
19:17:35.0300 6208  FxPPM - ok
19:17:35.0315 6208  [ FC3EF65EE20D39F8749C2218DBA681CA ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
19:17:35.0315 6208  gagp30kx - ok
19:17:35.0332 6208  [ 0BF5CAD281E25F1418E5B8875DC5ADD1 ] gencounter      C:\Windows\System32\drivers\vmgencounter.sys
19:17:35.0346 6208  gencounter - ok
19:17:35.0346 6208  [ 8DF1254093B5C354CE725EB6B9B0DE19 ] GPIOClx0101     C:\Windows\system32\Drivers\msgpioclx.sys
19:17:35.0346 6208  GPIOClx0101 - ok
19:17:35.0393 6208  [ 2DAFF4F76A90E3C523C2FE50338537E9 ] gpsvc           C:\Windows\System32\gpsvc.dll
19:17:35.0409 6208  gpsvc - ok
19:17:35.0471 6208  [ 0545A3EB959CFA4790D267BFB8C1ACA4 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:17:35.0471 6208  gupdate - ok
19:17:35.0471 6208  [ 0545A3EB959CFA4790D267BFB8C1ACA4 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:17:35.0471 6208  gupdatem - ok
19:17:35.0487 6208  [ FA4AC219AA758EA46D7148059BB9D36E ] hcmon           C:\Windows\system32\drivers\hcmon.sys
19:17:35.0487 6208  hcmon - ok
19:17:35.0518 6208  [ 56F69F7C25FB67C970997D7066DBC593 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
19:17:35.0518 6208  HdAudAddService - ok
19:17:35.0534 6208  [ D4B7ED39C7900384D9E5C1283F1E7926 ] HDAudBus        C:\Windows\System32\drivers\HDAudBus.sys
19:17:35.0534 6208  HDAudBus - ok
19:17:35.0550 6208  [ 10A70BC1871CD955D85CD88372724906 ] HidBatt         C:\Windows\System32\drivers\HidBatt.sys
19:17:35.0550 6208  HidBatt - ok
19:17:35.0565 6208  [ 42F88B57CAE42FC10059C887B3FCFCEA ] HidBth          C:\Windows\System32\drivers\hidbth.sys
19:17:35.0565 6208  HidBth - ok
19:17:35.0581 6208  [ C241A8BAFBBFC90176EA0F5240EACC17 ] hidi2c          C:\Windows\System32\drivers\hidi2c.sys
19:17:35.0581 6208  hidi2c - ok
19:17:35.0597 6208  [ 9BDDEE26255421017E161CCB9D5EDA95 ] HidIr           C:\Windows\System32\drivers\hidir.sys
19:17:35.0597 6208  HidIr - ok
19:17:35.0612 6208  [ EA85B5093DF7B5C3E80362B053740AE2 ] hidserv         C:\Windows\system32\hidserv.dll
19:17:35.0612 6208  hidserv - ok
19:17:35.0644 6208  [ 49676FEC898AB2A11B157F848269A56E ] HidUsb          C:\Windows\System32\drivers\hidusb.sys
19:17:35.0644 6208  HidUsb - ok
19:17:35.0675 6208  [ A6FFE56E72D6C500A0D2AA0843630D40 ] HitmanProScheduler C:\Program Files\HitmanPro\hmpsched.exe
19:17:35.0675 6208  HitmanProScheduler - ok
19:17:35.0691 6208  [ 93C4315F47F8D635C6DB0DF49FCE10EE ] hkmsvc          C:\Windows\system32\kmsvc.dll
19:17:35.0691 6208  hkmsvc - ok
19:17:35.0721 6208  [ AC49522ED106BD4B545D6614D71C2445 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
19:17:35.0721 6208  HomeGroupListener - ok
19:17:35.0753 6208  [ 99932E30CE0283B73BB6E5019E150394 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
19:17:35.0753 6208  HomeGroupProvider - ok
19:17:35.0769 6208  [ A6AACEA4C785789BDA5912AD1FEDA80D ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
19:17:35.0769 6208  HpSAMD - ok
19:17:35.0800 6208  [ 0821D9404151398E43B794828DFBFB07 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
19:17:35.0800 6208  HTTP - ok
19:17:35.0832 6208  [ 90656C0B3864804B090434EFC582404F ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
19:17:35.0832 6208  hwpolicy - ok
19:17:35.0846 6208  [ 6D6F9E3BF0484967E52F7E846BFF1CA1 ] hyperkbd        C:\Windows\System32\drivers\hyperkbd.sys
19:17:35.0846 6208  hyperkbd - ok
19:17:35.0846 6208  [ 907C870F8C31F8DDD6F090857B46AB25 ] HyperVideo      C:\Windows\system32\DRIVERS\HyperVideo.sys
19:17:35.0846 6208  HyperVideo - ok
19:17:35.0880 6208  [ 49EE0AE9E5B64FFBBD06D55C4984B598 ] i8042prt        C:\Windows\System32\drivers\i8042prt.sys
19:17:35.0880 6208  i8042prt - ok
19:17:35.0893 6208  [ 5D90E32E36CE5D4C535D17CE08AEAF05 ] iaLPSSi_GPIO    C:\Windows\System32\drivers\iaLPSSi_GPIO.sys
19:17:35.0893 6208  iaLPSSi_GPIO - ok
19:17:35.0893 6208  [ DD05E7E80F52ADE9AEB292819920F32C ] iaLPSSi_I2C     C:\Windows\System32\drivers\iaLPSSi_I2C.sys
19:17:35.0893 6208  iaLPSSi_I2C - ok
19:17:35.0925 6208  [ 08BFE413B0B4AA8DFA4B5684CE06D3DC ] iaStorAV        C:\Windows\system32\drivers\iaStorAV.sys
19:17:35.0925 6208  iaStorAV - ok
19:17:35.0956 6208  [ A2200C3033FA4EF249FC096A7A7D02A2 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
19:17:35.0956 6208  iaStorV - ok
19:17:35.0956 6208  IEEtwCollectorService - ok
19:17:35.0987 6208  [ 02211401EFFC4965C014C8F9696539A2 ] IKEEXT          C:\Windows\System32\ikeext.dll
19:17:36.0004 6208  IKEEXT - ok
19:17:36.0004 6208  [ 4E448FCFFD00E8D657CD9E48D3E47157 ] intelide        C:\Windows\system32\drivers\intelide.sys
19:17:36.0004 6208  intelide - ok
19:17:36.0035 6208  [ A770340FC02B999EF0DE6C2A6BC8437C ] intelpep        C:\Windows\system32\drivers\intelpep.sys
19:17:36.0035 6208  intelpep - ok
19:17:36.0050 6208  [ 47E74A8E53C7C24DCE38311E1451C1D9 ] intelppm        C:\Windows\System32\drivers\intelppm.sys
19:17:36.0050 6208  intelppm - ok
19:17:36.0159 6208  [ 9DB76D7F9E4E53EFE5DD8C53DE837514 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:17:36.0159 6208  IpFilterDriver - ok
19:17:36.0193 6208  [ B452623C1DE60544054E784D94A7AA47 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
19:17:36.0206 6208  iphlpsvc - ok
19:17:36.0223 6208  [ C800DCD904016B2BF6AB541083770A3A ] IPMIDRV         C:\Windows\System32\drivers\IPMIDrv.sys
19:17:36.0223 6208  IPMIDRV - ok
19:17:36.0253 6208  [ B7342B3C58E91107F6E946A93D9D4EFD ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
19:17:36.0253 6208  IPNAT - ok
19:17:36.0284 6208  [ 97C9EBB84A761D48DC17E0E6B913C164 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
19:17:36.0284 6208  iPod Service - ok
19:17:36.0300 6208  [ AE44C526AB5F8A487D941CEB57B10C97 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
19:17:36.0300 6208  IRENUM - ok
19:17:36.0315 6208  [ 8AFEEA3955AA43616A60F133B1D25F21 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
19:17:36.0315 6208  isapnp - ok
19:17:36.0346 6208  [ C378ED678D1316721A40E1F60FB76184 ] iScsiPrt        C:\Windows\System32\drivers\msiscsi.sys
19:17:36.0346 6208  iScsiPrt - ok
19:17:36.0379 6208  [ 5917AFE4A3F695A54B99C1849C8207FE ] kbdclass        C:\Windows\System32\drivers\kbdclass.sys
19:17:36.0379 6208  kbdclass - ok
19:17:36.0393 6208  [ 8CD840A062F6BDF41DDE3ACB96164B72 ] kbdhid          C:\Windows\System32\drivers\kbdhid.sys
19:17:36.0393 6208  kbdhid - ok
19:17:36.0393 6208  [ 813871C7D402A05F2E3A7075F9584A05 ] kdnic           C:\Windows\system32\DRIVERS\kdnic.sys
19:17:36.0393 6208  kdnic - ok
19:17:36.0426 6208  [ 382100E75B6F4668AEAEF228C6CEFFAD ] KeyIso          C:\Windows\system32\lsass.exe
19:17:36.0426 6208  KeyIso - ok
19:17:36.0441 6208  [ 304DA394D958BC3B62AF6DF514005B01 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
19:17:36.0441 6208  KSecDD - ok
19:17:36.0487 6208  [ 3D4AE520CD6F6FFE549DD195C1F515BE ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
19:17:36.0487 6208  KSecPkg - ok
19:17:36.0503 6208  [ 11AFB527AA370B1DAFD5C36F35F6D45F ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
19:17:36.0503 6208  ksthunk - ok
19:17:36.0535 6208  [ C1591A66028C71147A3E2EAB0B1CCB7E ] KtmRm           C:\Windows\system32\msdtckrm.dll
19:17:36.0535 6208  KtmRm - ok
19:17:36.0581 6208  [ B75ADC97905F43C7C946F1465A8697BD ] LanmanServer    C:\Windows\system32\srvsvc.dll
19:17:36.0581 6208  LanmanServer - ok
19:17:36.0614 6208  [ 3DBD9100745F9B8506B8FEC6FE6CCDE3 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
19:17:36.0614 6208  LanmanWorkstation - ok
19:17:36.0659 6208  [ 8B9F3796EC1762CF255BDB324E5529C8 ] lfsvc           C:\Windows\System32\GeofenceMonitorService.dll
19:17:36.0659 6208  lfsvc - ok
19:17:36.0675 6208  [ C09010B3680860131631F53E8FE7BAD8 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
19:17:36.0675 6208  lltdio - ok
19:17:36.0706 6208  [ DAE98CC96C5EE308BF4EA7B18F226CB8 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
19:17:36.0722 6208  lltdsvc - ok
19:17:36.0738 6208  [ 1E2662D847B7D9995C65D90D254A7E0F ] lmhosts         C:\Windows\System32\lmhsvc.dll
19:17:36.0738 6208  lmhosts - ok
19:17:36.0769 6208  [ C755AE4635457AA2A11F79C0DF857ABC ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
19:17:36.0769 6208  LSI_SAS - ok
19:17:36.0785 6208  [ ADAC09CBE7A2040B7F68B5E5C9A75141 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
19:17:36.0785 6208  LSI_SAS2 - ok
19:17:36.0800 6208  [ 04D1274BB9BBCCF12BD12374002AA191 ] LSI_SAS3        C:\Windows\system32\drivers\lsi_sas3.sys
19:17:36.0800 6208  LSI_SAS3 - ok
19:17:36.0831 6208  [ 327469EEF3833D0C584B7E88A76AEC0C ] LSI_SSS         C:\Windows\system32\drivers\lsi_sss.sys
19:17:36.0831 6208  LSI_SSS - ok
19:17:36.0847 6208  [ 9A7A7E45DAED2E8C2816716D8D28236A ] LSM             C:\Windows\System32\lsm.dll
19:17:36.0863 6208  LSM - ok
19:17:36.0895 6208  [ B0AF753AF28303BB69C67BD85F06FFC9 ] luafv           C:\Windows\system32\drivers\luafv.sys
19:17:36.0895 6208  luafv - ok
19:17:36.0956 6208  [ EB5C03A070F30D64A6DF80E53B22F53F ] megasas         C:\Windows\system32\drivers\megasas.sys
19:17:36.0956 6208  megasas - ok
19:17:36.0972 6208  [ F6F13533196DE7A582D422B0241E4363 ] megasr          C:\Windows\system32\drivers\megasr.sys
19:17:36.0972 6208  megasr - ok
19:17:36.0988 6208  [ 4C5179DB61B9E14BEC15CDC4B152B2E9 ] MMCSS           C:\Windows\system32\mmcss.dll
19:17:37.0003 6208  MMCSS - ok
19:17:37.0036 6208  [ 8B38C44F69259987C95135C9627E2378 ] Modem           C:\Windows\system32\drivers\modem.sys
19:17:37.0036 6208  Modem - ok
19:17:37.0036 6208  [ 601589000CC90F0DF8DA2CC254A3CCC9 ] monitor         C:\Windows\System32\drivers\monitor.sys
19:17:37.0036 6208  monitor - ok
19:17:37.0050 6208  [ 08374E4E5B8914DE6067CBA99F61E930 ] mouclass        C:\Windows\System32\drivers\mouclass.sys
19:17:37.0050 6208  mouclass - ok
19:17:37.0066 6208  [ 5FCBAB60598AE119E02B4C27DE6B99EA ] mouhid          C:\Windows\System32\drivers\mouhid.sys
19:17:37.0066 6208  mouhid - ok
19:17:37.0097 6208  [ E5E8665272EBCD87A0A632314F0D221D ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
19:17:37.0097 6208  mountmgr - ok
19:17:37.0145 6208  [ 30813D30C0F03BB6D2B584C665C83F25 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
19:17:37.0145 6208  MozillaMaintenance - ok
19:17:37.0222 6208  [ BF2513029E231BE96D82F7C3ABFF87F4 ] MpKslc5795e0e   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A4C5EC7D-7B65-4CAD-9630-D1D3FE65AF28}\MpKslc5795e0e.sys
19:17:37.0222 6208  MpKslc5795e0e - ok
19:17:37.0253 6208  [ 6FC047578785B0435F4E2660946D1ADC ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
19:17:37.0253 6208  mpsdrv - ok
19:17:37.0269 6208  [ D1418745A5472F3930A288E05B9E2C05 ] MpsSvc          C:\Windows\system32\mpssvc.dll
19:17:37.0285 6208  MpsSvc - ok
19:17:37.0312 6208  [ 3F818C1518DA702C8F10259095C9BDE0 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
19:17:37.0313 6208  MRxDAV - ok
19:17:37.0345 6208  [ E2FC654EC895E92A022794329BFC53EC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
19:17:37.0345 6208  mrxsmb - ok
19:17:37.0393 6208  [ AFE6DC2E57E876175BA074AD2CB5594F ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:17:37.0393 6208  mrxsmb10 - ok
19:17:37.0423 6208  [ B37B58F9F80A51098C42663D5FA5F2BA ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:17:37.0423 6208  mrxsmb20 - ok
19:17:37.0439 6208  [ F3C060444777A59FC63D920719E43CCD ] MsBridge        C:\Windows\system32\DRIVERS\bridge.sys
19:17:37.0439 6208  MsBridge - ok
19:17:37.0470 6208  [ 915747E010A9414B069173284A9B93F4 ] MSDTC           C:\Windows\System32\msdtc.exe
19:17:37.0470 6208  MSDTC - ok
19:17:37.0485 6208  [ D13329FBF8345B28AB30F44CC247DC08 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
19:17:37.0485 6208  Msfs - ok
19:17:37.0501 6208  [ C6B474E46F9E543B875981ED3FFE6ADD ] msgpiowin32     C:\Windows\System32\drivers\msgpiowin32.sys
19:17:37.0501 6208  msgpiowin32 - ok
19:17:37.0516 6208  [ 65C92EB9D08DB5C69F28C7FFD4E84E31 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
19:17:37.0516 6208  mshidkmdf - ok
19:17:37.0516 6208  [ 52299F086AC2DAFD100DD5DC4A8614BA ] mshidumdf       C:\Windows\System32\drivers\mshidumdf.sys
19:17:37.0516 6208  mshidumdf - ok
19:17:37.0532 6208  [ 36D92AF3343C3A3E57FEF11C449AEA4C ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
19:17:37.0532 6208  msisadrv - ok
19:17:37.0563 6208  [ A06142B3850B06972F1C89748FAA2C02 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
19:17:37.0563 6208  MSiSCSI - ok
19:17:37.0563 6208  msiserver - ok
19:17:37.0579 6208  [ A9BBBD2BAE6142253B9195E949AC2E8D ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
19:17:37.0579 6208  MSKSSRV - ok
19:17:37.0595 6208  [ 51B3AC0560848CD6D65AC2033E293113 ] MsLldp          C:\Windows\system32\DRIVERS\mslldp.sys
19:17:37.0595 6208  MsLldp - ok
19:17:37.0595 6208  [ 7B2128EB875DCBC006E6A913211006D6 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
19:17:37.0595 6208  MSPCLOCK - ok
19:17:37.0595 6208  [ 1E88171579B218115C7A772F8DE04BD8 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
19:17:37.0595 6208  MSPQM - ok
19:17:37.0641 6208  [ BBE2A455053E63BECBF42C2F9B21FAE0 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
19:17:37.0641 6208  MsRPC - ok
19:17:37.0658 6208  [ 8D6B7D515C5CBCDB75B928A0B73C3C5E ] mssmbios        C:\Windows\System32\drivers\mssmbios.sys
19:17:37.0658 6208  mssmbios - ok
19:17:37.0673 6208  [ 115019AE01E0EB9C048530D2928AB4A2 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
19:17:37.0673 6208  MSTEE - ok
19:17:37.0673 6208  [ 96D604A35070360F0DD4A7A8AF410B5E ] MTConfig        C:\Windows\System32\drivers\MTConfig.sys
19:17:37.0673 6208  MTConfig - ok
19:17:37.0704 6208  [ 438EA7A2D8D4F9B8AFB64748ACA70BA8 ] Mup             C:\Windows\system32\Drivers\mup.sys
19:17:37.0704 6208  Mup - ok
19:17:37.0720 6208  [ B8C35C94DCB2DFEAF03BB42131F2F77F ] mvumis          C:\Windows\system32\drivers\mvumis.sys
19:17:37.0720 6208  mvumis - ok
19:17:37.0752 6208  [ 8DF30698BDD9492A9D45A4B94FB4A82A ] napagent        C:\Windows\system32\qagentRT.dll
19:17:37.0752 6208  napagent - ok
19:17:37.0784 6208  [ BB78990894F14D725EBD301E1945BF0F ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
19:17:37.0784 6208  NativeWifiP - ok
19:17:37.0798 6208  [ BFCE1225D10619029E68946929CEB64C ] NcaSvc          C:\Windows\System32\ncasvc.dll
19:17:37.0798 6208  NcaSvc - ok
19:17:37.0813 6208  [ 267C97373110B7AFD3B46DF60B6CBB85 ] NcbService      C:\Windows\System32\ncbservice.dll
19:17:37.0813 6208  NcbService - ok
19:17:37.0846 6208  [ 0813B71EAF097208DC76CE0605B48AF0 ] NcdAutoSetup    C:\Windows\System32\NcdAutoSetup.dll
19:17:37.0846 6208  NcdAutoSetup - ok
19:17:37.0892 6208  [ FFAA6C6E798FBA448FA7628A1B277F5C ] NDIS            C:\Windows\system32\drivers\ndis.sys
19:17:37.0892 6208  NDIS - ok
19:17:37.0907 6208  [ 8CECC8DA55F3274181FD1EA28AD76664 ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
19:17:37.0923 6208  NdisCap - ok
19:17:37.0923 6208  [ 269882812E9A68FFF1AFE1283D428322 ] NdisImPlatform  C:\Windows\system32\DRIVERS\NdisImPlatform.sys
19:17:37.0923 6208  NdisImPlatform - ok
19:17:37.0954 6208  [ 82821F4EEC776B4CF11695A38F3ABA46 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
19:17:37.0954 6208  NdisTapi - ok
19:17:37.0970 6208  [ B832B35055BA2B7B4181861FF94D8E59 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
19:17:37.0970 6208  Ndisuio - ok
19:17:37.0985 6208  [ 1F58E48EF75F34C35D8E93A0DC535CFE ] NdisVirtualBus  C:\Windows\System32\drivers\NdisVirtualBus.sys
19:17:37.0985 6208  NdisVirtualBus - ok
19:17:38.0001 6208  [ C3755FCF9A0B5C6FE8ED9E873B85D3CE ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
19:17:38.0001 6208  NdisWan - ok
19:17:38.0001 6208  [ C3755FCF9A0B5C6FE8ED9E873B85D3CE ] NdisWanLegacy   C:\Windows\system32\DRIVERS\ndiswan.sys
19:17:38.0001 6208  NdisWanLegacy - ok
19:17:38.0016 6208  [ DDD7F92A83F74D1476B71FBA9530A8DC ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
19:17:38.0016 6208  NDProxy - ok
19:17:38.0048 6208  [ 3083926D1CC5B56EA0786527B557DD1B ] Ndu             C:\Windows\system32\drivers\Ndu.sys
19:17:38.0048 6208  Ndu - ok
19:17:38.0063 6208  [ 42FF4975D032CAE558AE4BB8448F6E5A ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
19:17:38.0079 6208  NetBIOS - ok
19:17:38.0110 6208  [ 0FE750800DEEE91D22399D081371BA79 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
19:17:38.0110 6208  NetBT - ok
19:17:38.0126 6208  [ 382100E75B6F4668AEAEF228C6CEFFAD ] Netlogon        C:\Windows\system32\lsass.exe
19:17:38.0126 6208  Netlogon - ok
19:17:38.0142 6208  [ 8F074B62E66B6117D9598C62A12069C5 ] Netman          C:\Windows\System32\netman.dll
19:17:38.0157 6208  Netman - ok
19:17:38.0188 6208  [ 4A04B1CD5BFB4A978C5F60E86D6C3E45 ] netprofm        C:\Windows\System32\netprofmsvc.dll
19:17:38.0188 6208  netprofm - ok
19:17:38.0235 6208  [ 10D5997E2F5F16FE3BC3BD1A4BF31EA8 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:17:38.0235 6208  NetTcpPortSharing - ok
19:17:38.0251 6208  [ D4DCE03870314D3354F3501F9DDD4123 ] netvsc          C:\Windows\System32\drivers\netvsc63.sys
19:17:38.0251 6208  netvsc - ok
19:17:38.0266 6208  [ E94EB2A95D7D016E119C4D6868788831 ] NlaSvc          C:\Windows\System32\nlasvc.dll
19:17:38.0282 6208  NlaSvc - ok
19:17:38.0299 6208  [ 8F44A2F57C9F1A19AC9C6288C10FB351 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
19:17:38.0299 6208  Npfs - ok
19:17:38.0313 6208  [ CBDB4F0871C88DF930FC0E8588CA67FC ] npsvctrig       C:\Windows\System32\drivers\npsvctrig.sys
19:17:38.0313 6208  npsvctrig - ok
19:17:38.0329 6208  [ 0F12A72A753CFD7FB0631EE8D08FE983 ] nsi             C:\Windows\system32\nsisvc.dll
19:17:38.0345 6208  nsi - ok
19:17:38.0360 6208  [ 018510D88536798852DAE12F9BA6E138 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
19:17:38.0360 6208  nsiproxy - ok
19:17:38.0423 6208  [ 9907FCC207E470F94B9DB6BD037E79C4 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
19:17:38.0423 6208  Ntfs - ok
19:17:38.0454 6208  [ EF1B290FC9F0E47CC0B537292BEE5904 ] Null            C:\Windows\system32\drivers\Null.sys
19:17:38.0454 6208  Null - ok
19:17:38.0470 6208  [ BC6B5942AFF25EBAF62DE43C3807EDF8 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
19:17:38.0470 6208  nvraid - ok
19:17:38.0485 6208  [ 1F43ABFFAC3D6CA356851D517392966E ] nvstor          C:\Windows\system32\drivers\nvstor.sys
19:17:38.0485 6208  nvstor - ok
19:17:38.0502 6208  [ 6934A936A7369DFE37B7DBA93F5E5E49 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
19:17:38.0502 6208  nv_agp - ok
19:17:38.0534 6208  [ 26657F3B4F39A0E64AF859278B599C4E ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
19:17:38.0534 6208  p2pimsvc - ok
19:17:38.0565 6208  [ FD8F61F0D1F64BBB3D835F39A3F979C9 ] p2psvc          C:\Windows\system32\p2psvc.dll
19:17:38.0565 6208  p2psvc - ok
19:17:38.0595 6208  [ 57DCE4FB0467986AE78E1C6FC5240D32 ] Parport         C:\Windows\System32\drivers\parport.sys
19:17:38.0595 6208  Parport - ok
19:17:38.0628 6208  [ BAFF6122CFC9F95CA175AD8C348179A4 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
19:17:38.0628 6208  partmgr - ok
19:17:38.0660 6208  [ C37AFACC6F809061A9CB5A8A863894F2 ] PcaSvc          C:\Windows\System32\pcasvc.dll
19:17:38.0673 6208  PcaSvc - ok
19:17:38.0690 6208  [ 91ED124E261EA8FAA1C0FFDF2A71B0C4 ] pci             C:\Windows\system32\drivers\pci.sys
19:17:38.0704 6208  pci - ok
19:17:38.0720 6208  [ 346E38FCC6859A727DD28AFAD1F0AFF4 ] pciide          C:\Windows\system32\drivers\pciide.sys
19:17:38.0720 6208  pciide - ok
19:17:38.0737 6208  [ 4D3BDCC1C7B40C9D7B6AD990E6DEC397 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
19:17:38.0737 6208  pcmcia - ok
19:17:38.0737 6208  [ BF28771D1436C88BE1D297D3098B0F7D ] pcw             C:\Windows\system32\drivers\pcw.sys
19:17:38.0737 6208  pcw - ok
19:17:38.0766 6208  [ E6B3ACBA06BAF48594557FCCBFA66FD2 ] pdc             C:\Windows\system32\drivers\pdc.sys
19:17:38.0766 6208  pdc - ok
19:17:38.0799 6208  [ 0ECEE590F2E2EF969FB74A6FC583A1E6 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
19:17:38.0799 6208  PEAUTH - ok
19:17:38.0861 6208  [ 8E3C640FFF5A963F570233AE99C0FFF3 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
19:17:38.0861 6208  PerfHost - ok
19:17:38.0907 6208  [ 70B39E7241F750A248798CE82C44596D ] pla             C:\Windows\system32\pla.dll
19:17:38.0907 6208  pla - ok
19:17:38.0939 6208  [ 2C02AFF8383D893F8DBEB07A84F6E77C ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
19:17:38.0939 6208  PlugPlay - ok
19:17:39.0016 6208  [ 4570F8A37D221660F3A09D6F4DD4BA94 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
19:17:39.0016 6208  PNRPAutoReg - ok
19:17:39.0032 6208  [ 26657F3B4F39A0E64AF859278B599C4E ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
19:17:39.0032 6208  PNRPsvc - ok
19:17:39.0079 6208  [ 0FF8507A8B901B904E98EB36B9E347EE ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
19:17:39.0079 6208  PolicyAgent - ok
19:17:39.0095 6208  [ C8DD82C3035E60D671B8CC5DF128D3A9 ] Power           C:\Windows\system32\umpo.dll
19:17:39.0095 6208  Power - ok
19:17:39.0188 6208  [ F6EA63145C20A23732AD2CA1EBA65FA1 ] PrintNotify     C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
19:17:39.0221 6208  PrintNotify - ok
19:17:39.0253 6208  [ ECD373F9571C745894367CC2635EA44F ] Processor       C:\Windows\System32\drivers\processr.sys
19:17:39.0253 6208  Processor - ok
19:17:39.0282 6208  [ 6E409D818C6B342544EAE741B1422B85 ] ProfSvc         C:\Windows\system32\profsvc.dll
19:17:39.0282 6208  ProfSvc - ok
19:17:39.0298 6208  [ FC0141B4A5AD6D637D883C1A89FC45C5 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
19:17:39.0313 6208  Psched - ok
19:17:39.0345 6208  [ DAA9DEE0A5D5F238C4EE54C2C7FB67C5 ] QWAVE           C:\Windows\system32\qwave.dll
19:17:39.0345 6208  QWAVE - ok
19:17:39.0376 6208  [ 83868EB2924E6BC21A54337C65D614D1 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
19:17:39.0376 6208  QWAVEdrv - ok
19:17:39.0396 6208  [ B337B1F1E82A83E20A1743E008E25C0F ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
19:17:39.0396 6208  RasAcd - ok
19:17:39.0409 6208  [ 044638489B4A5FE5334F46C5314A0826 ] RasAuto         C:\Windows\System32\rasauto.dll
19:17:39.0409 6208  RasAuto - ok
19:17:39.0455 6208  [ 0A655DD285E4E1E2975CEAB8FDE75295 ] RasMan          C:\Windows\System32\rasmans.dll
19:17:39.0470 6208  RasMan - ok
19:17:39.0501 6208  [ 5247F308C4103CDC4FE12AE1D235800A ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
19:17:39.0501 6208  RasPppoe - ok
19:17:39.0532 6208  [ D67ED4AB59D1EF66B05AD1A81AC28B26 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
19:17:39.0532 6208  rdbss - ok
19:17:39.0563 6208  [ 6B21EBF892CD8CACB71669B35AB5DE32 ] rdpbus          C:\Windows\System32\drivers\rdpbus.sys
19:17:39.0563 6208  rdpbus - ok
19:17:39.0563 6208  [ 680C1DAE268B6FB67FA21B389A8B79EF ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
19:17:39.0580 6208  RDPDR - ok
19:17:39.0610 6208  [ BC8A79C625568DDB7DCA49D0C2741A64 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
19:17:39.0627 6208  RdpVideoMiniport - ok
19:17:39.0641 6208  [ A26AEC49F318FEE141DDDB2C5F99B3E6 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
19:17:39.0641 6208  rdyboost - ok
19:17:39.0676 6208  [ 2D39BCFA4DD1081B8F282B623456B858 ] ReFS            C:\Windows\system32\drivers\ReFS.sys
19:17:39.0688 6208  ReFS - ok
19:17:39.0706 6208  [ DF78648AC3C8DC9D70E6714AF785382F ] RemoteAccess    C:\Windows\System32\mprdim.dll
19:17:39.0706 6208  RemoteAccess - ok
19:17:39.0738 6208  [ 7594FEFBAD6BA4645CE7AA175C19BAD0 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
19:17:39.0738 6208  RemoteRegistry - ok
19:17:39.0770 6208  [ 65B9FDE300A6DECC03BA44C4616DCAD6 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
19:17:39.0770 6208  RpcEptMapper - ok
19:17:39.0800 6208  [ A737B433ABAF3F2DCB2BD7B4CC582B26 ] RpcLocator      C:\Windows\system32\locator.exe
19:17:39.0800 6208  RpcLocator - ok
19:17:39.0831 6208  [ 20CC6E9FE25ACD34BE4FCDDB7B08364D ] RpcSs           C:\Windows\system32\rpcss.dll
19:17:39.0846 6208  RpcSs - ok
19:17:39.0846 6208  [ 2D05A5508F4685412F2B89E8C2189ABC ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
19:17:39.0846 6208  rspndr - ok
19:17:39.0878 6208  [ 3AB1AA5155684F40E2F5215A258D2471 ] RTL8168         C:\Windows\system32\DRIVERS\Rt630x64.sys
19:17:39.0893 6208  RTL8168 - ok
19:17:39.0909 6208  [ AAC76DA735718DB96E95509BCFCD75CB ] RTLU3E8023-W8-64 C:\Windows\system32\DRIVERS\rtu30x64w8.sys
19:17:39.0909 6208  RTLU3E8023-W8-64 - ok
19:17:39.0925 6208  [ 1A063730F221B2746FF00457AE17E4F0 ] s3cap           C:\Windows\System32\drivers\vms3cap.sys
19:17:39.0925 6208  s3cap - ok
19:17:39.0940 6208  [ 382100E75B6F4668AEAEF228C6CEFFAD ] SamSs           C:\Windows\system32\lsass.exe
19:17:39.0940 6208  SamSs - ok
19:17:39.0973 6208  [ C624A1B32211C3166EDB3F4AB02A30B7 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
19:17:39.0973 6208  sbp2port - ok
19:17:40.0128 6208  [ 74A3B67F03877D06B09B1B40C5ED582E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
19:17:40.0143 6208  SCardSvr - ok
19:17:40.0175 6208  [ 92D2FA1870F4EB4A9BA767DB6E0DEF6F ] ScDeviceEnum    C:\Windows\System32\ScDeviceEnum.dll
19:17:40.0175 6208  ScDeviceEnum - ok
19:17:40.0207 6208  [ FA7ABD857DEB0FE3C94CC39A4C845E66 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
19:17:40.0207 6208  scfilter - ok
19:17:40.0253 6208  [ 3151A020E03DDE31AAC49F35C5EFB4DB ] Schedule        C:\Windows\system32\schedsvc.dll
19:17:40.0269 6208  Schedule - ok
19:17:40.0300 6208  [ ACFDC4EE40EC6E4A0AB91D923B8288C8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
19:17:40.0300 6208  SCPolicySvc - ok
19:17:40.0315 6208  [ C54B6B2170BF628FD42F799A66956D75 ] sdbus           C:\Windows\System32\drivers\sdbus.sys
19:17:40.0315 6208  sdbus - ok
19:17:40.0346 6208  [ 0B1E929D11A8E358106955603FAC65E8 ] sdstor          C:\Windows\System32\drivers\sdstor.sys
19:17:40.0346 6208  sdstor - ok
19:17:40.0362 6208  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
19:17:40.0362 6208  secdrv - ok
19:17:40.0394 6208  [ 6627154693B6C2B8A59727F5B38728E8 ] seclogon        C:\Windows\system32\seclogon.dll
19:17:40.0394 6208  seclogon - ok
19:17:40.0428 6208  [ 81FE9A81EDF8016816C9E91FBFBF7D35 ] SENS            C:\Windows\System32\sens.dll
19:17:40.0428 6208  SENS - ok
19:17:40.0440 6208  [ 6E4012AE67F09F867EF620C8D5524C0B ] SensrSvc        C:\Windows\system32\sensrsvc.dll
19:17:40.0440 6208  SensrSvc - ok
19:17:40.0456 6208  [ DB2FF24CE0BDD15FE75870AFE312BA89 ] SerCx           C:\Windows\system32\drivers\SerCx.sys
19:17:40.0456 6208  SerCx - ok
19:17:40.0473 6208  [ 0044B31F93946D5D41982314381FE431 ] SerCx2          C:\Windows\system32\drivers\SerCx2.sys
19:17:40.0473 6208  SerCx2 - ok
19:17:40.0487 6208  [ 1F0135949A6AD6025F363F80FE268251 ] Serenum         C:\Windows\System32\drivers\serenum.sys
19:17:40.0503 6208  Serenum - ok
19:17:40.0519 6208  [ 81633C87B42B63BA484A6177179AC750 ] Serial          C:\Windows\System32\drivers\serial.sys
19:17:40.0519 6208  Serial - ok
19:17:40.0534 6208  [ 148195AE95D9BC7375A08846439FDAC1 ] sermouse        C:\Windows\System32\drivers\sermouse.sys
19:17:40.0550 6208  sermouse - ok
19:17:40.0581 6208  [ 624BB76941938B9F5776DEA56004D33E ] SessionEnv      C:\Windows\system32\sessenv.dll
19:17:40.0581 6208  SessionEnv - ok
19:17:40.0596 6208  [ 472B7A5AC181C050888DB454663DD764 ] sfloppy         C:\Windows\System32\drivers\sfloppy.sys
19:17:40.0596 6208  sfloppy - ok
19:17:40.0628 6208  [ 8081FF3DAE8159FE8956B09BC29CE983 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
19:17:40.0628 6208  SharedAccess - ok
19:17:40.0660 6208  [ 7FD9A61A3523A61FC135D61D6E160314 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
19:17:40.0675 6208  ShellHWDetection - ok
19:17:40.0690 6208  [ 693C0C1A4F89BED4CEA1FA291638C02B ] silabenm        C:\Windows\system32\DRIVERS\silabenm.sys
19:17:40.0690 6208  silabenm - ok
19:17:40.0707 6208  [ CD54DDA4898439ADB7A2E26EB9133028 ] silabser        C:\Windows\system32\DRIVERS\silabser.sys
19:17:40.0707 6208  silabser - ok
19:17:40.0721 6208  [ 2F518D13DD6F3053837FE606F1A2EA1F ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
19:17:40.0721 6208  SiSRaid2 - ok
19:17:40.0741 6208  [ 1AC9A200A9C49C4508F04AAFFCA34A3F ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
19:17:40.0741 6208  SiSRaid4 - ok
19:17:40.0769 6208  [ 3C84DCCE5B322F745A75CA8BA3A0F6B3 ] smphost         C:\Windows\System32\smphost.dll
19:17:40.0769 6208  smphost - ok
19:17:40.0801 6208  [ 961507DB02D7AC0B7A7828D457143B8E ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
19:17:40.0801 6208  SNMPTRAP - ok
19:17:40.0831 6208  [ F6AF6499C3788105EA7AF1DA27769A77 ] spaceport       C:\Windows\system32\drivers\spaceport.sys
19:17:40.0831 6208  spaceport - ok
19:17:40.0848 6208  [ F337BE11071818FC3F5DC2940B6BDE34 ] SpbCx           C:\Windows\system32\drivers\SpbCx.sys
19:17:40.0848 6208  SpbCx - ok
19:17:40.0894 6208  [ FCB156A6745631A67DEA61827061D483 ] Spooler         C:\Windows\System32\spoolsv.exe
19:17:40.0894 6208  Spooler - ok
19:17:40.0987 6208  [ F264662C057A54AA2DE41B3C7551712F ] sppsvc          C:\Windows\system32\sppsvc.exe
19:17:41.0034 6208  sppsvc - ok
19:17:41.0065 6208  [ 3D0CA97EA01210E0BC032EB6FDCCF03D ] srv             C:\Windows\system32\DRIVERS\srv.sys
19:17:41.0081 6208  srv - ok
19:17:41.0112 6208  [ FD4A645C5BA587257A97D7AC46212F4A ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
19:17:41.0112 6208  srv2 - ok
19:17:41.0144 6208  [ D3EAE998706531157CBEA3F5218435BC ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
19:17:41.0144 6208  srvnet - ok
19:17:41.0177 6208  [ CF6C3037839CF78421A94F9060C2886F ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
19:17:41.0177 6208  SSDPSRV - ok
19:17:41.0206 6208  [ 198A737DBA666F4808D62E9A8277A6B7 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
19:17:41.0206 6208  SstpSvc - ok
19:17:41.0285 6208  [ 857693A4DA826BCD422C48114AA72B10 ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe
19:17:41.0285 6208  STacSV - ok
19:17:41.0300 6208  [ 366DEA74BBA65B362BCCFC6FC2ADFD8B ] stexstor        C:\Windows\system32\drivers\stexstor.sys
19:17:41.0300 6208  stexstor - ok
19:17:41.0331 6208  [ A73F13903345464F04D463B84890A271 ] STHDA           C:\Windows\system32\DRIVERS\stwrt64.sys
19:17:41.0331 6208  STHDA - ok
19:17:41.0362 6208  [ 63E9CE568CF1192771A5F0460DE7D2B9 ] stisvc          C:\Windows\System32\wiaservc.dll
19:17:41.0362 6208  stisvc - ok
19:17:41.0378 6208  [ 0ED2E318ABB68C1A35A8B8038BDB4C90 ] storahci        C:\Windows\system32\drivers\storahci.sys
19:17:41.0378 6208  storahci - ok
19:17:41.0393 6208  [ 8B9486B64E5FC17FB9CC04CA10B77A34 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
19:17:41.0393 6208  storflt - ok
19:17:41.0425 6208  [ 1D5A045F59D216448FCDE3A8D69970E2 ] stornvme        C:\Windows\system32\drivers\stornvme.sys
19:17:41.0425 6208  stornvme - ok
19:17:41.0440 6208  [ A45F5AC9D8069D0EC66E3CA73103073B ] StorSvc         C:\Windows\system32\storsvc.dll
19:17:41.0440 6208  StorSvc - ok
19:17:41.0456 6208  [ 548759755BC73DAD663250239D7E0B9F ] storvsc         C:\Windows\system32\drivers\storvsc.sys
19:17:41.0456 6208  storvsc - ok
19:17:41.0471 6208  [ E395BE02F80A79A6CF973BA38DBB8135 ] svsvc           C:\Windows\system32\svsvc.dll
19:17:41.0471 6208  svsvc - ok
19:17:41.0471 6208  [ 65454187E0F8B6C0DCECB0287D06EC43 ] swenum          C:\Windows\System32\drivers\swenum.sys
19:17:41.0471 6208  swenum - ok
19:17:41.0503 6208  [ 1C71D72D4997A284128FBEE770726330 ] swprv           C:\Windows\System32\swprv.dll
19:17:41.0503 6208  swprv - ok
19:17:41.0535 6208  [ 7E85DB0463AD2403AE84AD162B162279 ] SysMain         C:\Windows\system32\sysmain.dll
19:17:41.0550 6208  SysMain - ok
19:17:41.0581 6208  [ D73DBBB96CEE90C2856164AAD8543425 ] SystemEventsBroker C:\Windows\System32\SystemEventsBrokerServer.dll
19:17:41.0581 6208  SystemEventsBroker - ok
19:17:41.0613 6208  [ 54A1F83B166F1062000A0D816CB3B43A ] TabletInputService C:\Windows\System32\TabSvc.dll
19:17:41.0613 6208  TabletInputService - ok
19:17:41.0629 6208  [ 5A5BAB1CA9621E73E25EE4744B67CDA6 ] TapiSrv         C:\Windows\System32\tapisrv.dll
19:17:41.0629 6208  TapiSrv - ok
19:17:41.0675 6208  [ 4C58B60C1E6A2946D6E3D67A36E5E03E ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
19:17:41.0690 6208  Tcpip - ok
19:17:41.0737 6208  [ 4C58B60C1E6A2946D6E3D67A36E5E03E ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
19:17:41.0737 6208  TCPIP6 - ok
19:17:41.0770 6208  [ 41CF802064F72E55F50CA0A221FD36D4 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
19:17:41.0770 6208  tcpipreg - ok
19:17:41.0802 6208  [ 576FA545FAB846B06E79B324160DE25C ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
19:17:41.0802 6208  tdx - ok
19:17:42.0143 6208  [ F38A3CBCB78CBEF1E986A626D3F46943 ] TeamViewer      C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
19:17:42.0206 6208  TeamViewer - ok
19:17:42.0240 6208  [ 232D185D2337F141311D0CF1983E1431 ] terminpt        C:\Windows\System32\drivers\terminpt.sys
19:17:42.0240 6208  terminpt - ok
19:17:42.0284 6208  [ 76938862B2674EFED79E814CD36E6A08 ] TermService     C:\Windows\System32\termsrv.dll
19:17:42.0284 6208  TermService - ok
19:17:42.0315 6208  [ 2180DBCE75B914E5E5BBFFFAAE97AA21 ] Themes          C:\Windows\system32\themeservice.dll
19:17:42.0331 6208  Themes - ok
19:17:42.0346 6208  [ 4C5179DB61B9E14BEC15CDC4B152B2E9 ] THREADORDER     C:\Windows\system32\mmcss.dll
19:17:42.0346 6208  THREADORDER - ok
19:17:42.0410 6208  [ B5ED9CC61798C7D44BD535D40B89EFB5 ] TimeBroker      C:\Windows\System32\TimeBrokerServer.dll
19:17:42.0410 6208  TimeBroker - ok
19:17:42.0444 6208  [ 80A2FC1A089A71F2DBE5D8394FFB009F ] TPM             C:\Windows\system32\drivers\tpm.sys
19:17:42.0444 6208  TPM - ok
19:17:42.0456 6208  [ 884113C2BB703FE806C8608B75F34831 ] TrkWks          C:\Windows\System32\trkwks.dll
19:17:42.0456 6208  TrkWks - ok
19:17:42.0487 6208  [ 44A94FB4C76528D2382FFE04B05827C3 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
19:17:42.0487 6208  TrustedInstaller - ok
19:17:42.0487 6208  [ BF8F54CA37E9C9D6582C31C5761F8C93 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
19:17:42.0487 6208  TsUsbFlt - ok
19:17:42.0503 6208  [ 20185BEB7512EDE4EFECDFA148AC9F99 ] TsUsbGD         C:\Windows\System32\drivers\TsUsbGD.sys
19:17:42.0503 6208  TsUsbGD - ok
19:17:42.0518 6208  [ E85916632CD3B9E9B546968DB950BF42 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
19:17:42.0518 6208  tunnel - ok
19:17:42.0534 6208  [ F6EEAD052943B5A3104C1405BB856C54 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
19:17:42.0534 6208  uagp35 - ok
19:17:42.0550 6208  [ FE6067B1FD4E63650C667B33D080565B ] UASPStor        C:\Windows\System32\drivers\uaspstor.sys
19:17:42.0550 6208  UASPStor - ok
19:17:42.0565 6208  [ 807F8CF3E973305FC435C61CBBEE2A49 ] UCX01000        C:\Windows\System32\drivers\ucx01000.sys
19:17:42.0565 6208  UCX01000 - ok
19:17:42.0597 6208  [ C61EAF8E1E4B2F62BA4FDF457440B2C6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
19:17:42.0597 6208  udfs - ok
19:17:42.0614 6208  [ 9578691F297E1B1F519970FE6D47CB21 ] UEFI            C:\Windows\System32\drivers\UEFI.sys
19:17:42.0614 6208  UEFI - ok
19:17:42.0643 6208  [ A867F0F978EE64C87FADC3B100869EE4 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
19:17:42.0643 6208  UI0Detect - ok
19:17:42.0659 6208  [ 5EAB5117DDB24FC4D39E6FFFCF1837B9 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
19:17:42.0659 6208  uliagpkx - ok
19:17:42.0675 6208  [ DA34C39A18E60E7C3FA0630566408034 ] umbus           C:\Windows\System32\drivers\umbus.sys
19:17:42.0675 6208  umbus - ok
19:17:42.0690 6208  [ AE8294875E5446E359B1E8035D40C05E ] UmPass          C:\Windows\System32\drivers\umpass.sys
19:17:42.0690 6208  UmPass - ok
19:17:42.0722 6208  [ 87743CF5FF2FB3F2B424F0D8DFF8FD8C ] UmRdpService    C:\Windows\System32\umrdp.dll
19:17:42.0722 6208  UmRdpService - ok
19:17:42.0753 6208  [ C98493DD8E6A50154FAC75C15E1C36BB ] upnphost        C:\Windows\System32\upnphost.dll
19:17:42.0753 6208  upnphost - ok
19:17:42.0784 6208  [ F957092C63CD71D85903CA0D8370F473 ] USBAAPL64       C:\Windows\System32\Drivers\usbaapl64.sys
19:17:42.0784 6208  USBAAPL64 - ok
19:17:42.0815 6208  [ 621317D14B93CBFBD5694767EFB6B40A ] usbccgp         C:\Windows\System32\drivers\usbccgp.sys
19:17:42.0815 6208  usbccgp - ok
19:17:42.0847 6208  [ 0139248F6B95CF0D837B5B46A2722D40 ] usbcir          C:\Windows\System32\drivers\usbcir.sys
19:17:42.0847 6208  usbcir - ok
19:17:42.0880 6208  [ C996CBEF922B5653A01E3F50DDCE2F86 ] usbehci         C:\Windows\System32\drivers\usbehci.sys
19:17:42.0880 6208  usbehci - ok
19:17:42.0894 6208  [ E30B159760053C5A1297D2CD08046CD7 ] usbhub          C:\Windows\System32\drivers\usbhub.sys
19:17:42.0894 6208  usbhub - ok
19:17:42.0926 6208  [ 5C90D5379B53590FBB24BBAD4FA682EE ] USBHUB3         C:\Windows\System32\drivers\UsbHub3.sys
19:17:42.0926 6208  USBHUB3 - ok
19:17:42.0988 6208  [ A0F0484C97D6441ED6A75D7426ECCC9E ] usbohci         C:\Windows\System32\drivers\usbohci.sys
19:17:42.0988 6208  usbohci - ok
19:17:43.0003 6208  [ 4D655E3B684BE9B0F7FFD8A2935C348C ] usbprint        C:\Windows\System32\drivers\usbprint.sys
19:17:43.0003 6208  usbprint - ok
19:17:43.0019 6208  [ 0F030491BA4A27BD46F8B8ACEEE83F1A ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
19:17:43.0019 6208  usbscan - ok
19:17:43.0065 6208  [ 9D168BFA334D47BE404367EB58D4E130 ] USBSTOR         C:\Windows\System32\drivers\USBSTOR.SYS
19:17:43.0065 6208  USBSTOR - ok
19:17:43.0083 6208  [ FC974B03C8B87455F44F734C8F31A3C8 ] usbuhci         C:\Windows\System32\drivers\usbuhci.sys
19:17:43.0083 6208  usbuhci - ok
19:17:43.0112 6208  [ 44603DA5A87FB491EF59C889EBBB4DDB ] USBXHCI         C:\Windows\System32\drivers\USBXHCI.SYS
19:17:43.0112 6208  USBXHCI - ok
19:17:43.0129 6208  [ 382100E75B6F4668AEAEF228C6CEFFAD ] VaultSvc        C:\Windows\system32\lsass.exe
19:17:43.0129 6208  VaultSvc - ok
19:17:43.0144 6208  [ FEB26E3B8345A7E8D62F945C4AE86562 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
19:17:43.0144 6208  vdrvroot - ok
19:17:43.0175 6208  [ 8A4D808D1EC7C1C47B2C8BF488A9A07A ] vds             C:\Windows\System32\vds.exe
19:17:43.0190 6208  vds - ok
19:17:43.0208 6208  [ A026EDEAA5EECAE0B08E2748B616D4BD ] VerifierExt     C:\Windows\system32\drivers\VerifierExt.sys
19:17:43.0208 6208  VerifierExt - ok
19:17:43.0237 6208  [ 8ABB4BABF59F092DF0B43778D8FD1884 ] vhdmp           C:\Windows\System32\drivers\vhdmp.sys
19:17:43.0237 6208  vhdmp - ok
19:17:43.0253 6208  [ 06D38968028E9AB19DE9B618C7B6D199 ] viaide          C:\Windows\system32\drivers\viaide.sys
19:17:43.0253 6208  viaide - ok
19:17:43.0253 6208  [ 511AD3FF957A0127E6BD336FF6F89C38 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
19:17:43.0269 6208  vmbus - ok
19:17:43.0269 6208  [ DA40BEA0A863CE768C940CA9723BF81F ] VMBusHID        C:\Windows\System32\drivers\VMBusHID.sys
19:17:43.0269 6208  VMBusHID - ok
19:17:43.0300 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicguestinterface C:\Windows\System32\ICSvc.dll
19:17:43.0300 6208  vmicguestinterface - ok
19:17:43.0300 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicheartbeat   C:\Windows\System32\ICSvc.dll
19:17:43.0315 6208  vmicheartbeat - ok
19:17:43.0315 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmickvpexchange C:\Windows\System32\ICSvc.dll
19:17:43.0315 6208  vmickvpexchange - ok
19:17:43.0331 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicrdv         C:\Windows\System32\ICSvc.dll
19:17:43.0331 6208  vmicrdv - ok
19:17:43.0347 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicshutdown    C:\Windows\System32\ICSvc.dll
19:17:43.0347 6208  vmicshutdown - ok
19:17:43.0362 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmictimesync    C:\Windows\System32\ICSvc.dll
19:17:43.0362 6208  vmictimesync - ok
19:17:43.0378 6208  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicvss         C:\Windows\System32\ICSvc.dll
19:17:43.0378 6208  vmicvss - ok
19:17:43.0456 6208  [ 0E068DF0796A33D2922EC69652A2C043 ] VMUSBArbService C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
19:17:43.0456 6208  VMUSBArbService - ok
19:17:43.0550 6208  [ 6DBA40D936A02CDE219D43FD47C845F8 ] vmware-view-usbd C:\Program Files (x86)\VMware\VMware Horizon View Client\bin\vmware-view-usbd.exe
19:17:43.0550 6208  vmware-view-usbd - ok
19:17:43.0581 6208  [ 771D3F512B2738338E321556D9D4690F ] vmwsprrdpwks    C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe
19:17:43.0581 6208  vmwsprrdpwks - ok
19:17:43.0612 6208  [ 436E1A724E7E683F6B612D3D58F04241 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
19:17:43.0612 6208  volmgr - ok
19:17:43.0628 6208  [ 7DD4EAE2E680948D9AFF3E1B5234C1D3 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
19:17:43.0645 6208  volmgrx - ok
19:17:43.0675 6208  [ 17F7B0F2298D97F4B6C7A69511033D3D ] volsnap         C:\Windows\system32\drivers\volsnap.sys
19:17:43.0690 6208  volsnap - ok
19:17:43.0708 6208  [ DAC438FB5FF85A9E72806E2341D5D732 ] vpci            C:\Windows\System32\drivers\vpci.sys
19:17:43.0708 6208  vpci - ok
19:17:43.0725 6208  [ 4539F45F9F4C9757A86A56C949421E07 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
19:17:43.0737 6208  vsmraid - ok
19:17:43.0769 6208  [ D0CBA7B3531CCF2ADB985856D5F92434 ] VSS             C:\Windows\system32\vssvc.exe
19:17:43.0784 6208  VSS - ok
19:17:43.0800 6208  [ 0849B7260F26FE05EA56DED0672E2F4B ] VSTXRAID        C:\Windows\system32\drivers\vstxraid.sys
19:17:43.0800 6208  VSTXRAID - ok
19:17:43.0817 6208  [ 71066FF95C487327E44C8AF1B72EBE8B ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
19:17:43.0817 6208  vwifibus - ok
19:17:43.0831 6208  [ 29AB43937FFDA0B0FB56984226E698C6 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
19:17:43.0831 6208  vwififlt - ok
19:17:43.0847 6208  [ 8B8624A93E3F88CB923AEB05B6313227 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
19:17:43.0862 6208  vwifimp - ok
19:17:43.0878 6208  [ DC821E811EFBB65CDD77FBB8B6ECA385 ] W32Time         C:\Windows\system32\w32time.dll
19:17:43.0894 6208  W32Time - ok
19:17:43.0911 6208  [ 0910AB9ED404C1434E2D0376C2AD5D8B ] WacomPen        C:\Windows\System32\drivers\wacompen.sys
19:17:43.0911 6208  WacomPen - ok
19:17:43.0925 6208  [ 841345442390953CBC8801B95D3D0540 ] wbengine        C:\Windows\system32\wbengine.exe
19:17:43.0940 6208  wbengine - ok
19:17:43.0973 6208  [ 0F1DFA2FED73FA78B8C3CDE332A870F6 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
19:17:43.0973 6208  WbioSrvc - ok
19:17:43.0987 6208  [ 0EAEC313B24837613621B4A2536ED382 ] Wcmsvc          C:\Windows\System32\wcmsvc.dll
19:17:43.0987 6208  Wcmsvc - ok
19:17:44.0019 6208  [ F6B4C2280FF7C7156AC8A4687B9DA35E ] wcncsvc         C:\Windows\System32\wcncsvc.dll
19:17:44.0019 6208  wcncsvc - ok
19:17:44.0034 6208  [ B7BF1D783F5B2484E8CE1C0C78257F16 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
19:17:44.0034 6208  WcsPlugInService - ok
19:17:44.0067 6208  [ F2E08D1C067FEFC3A42D21FD4810F1D3 ] WdBoot          C:\Windows\system32\drivers\WdBoot.sys
19:17:44.0067 6208  WdBoot - ok
19:17:44.0081 6208  [ CB6C63FF8342B467E2EF76E98D5B934D ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
19:17:44.0097 6208  Wdf01000 - ok
19:17:44.0112 6208  [ E234820E6B84ABA5E84E00227F505AE8 ] WdFilter        C:\Windows\system32\drivers\WdFilter.sys
19:17:44.0128 6208  WdFilter - ok
19:17:44.0128 6208  [ F581F9C9D6953FABFA24E67105F0B614 ] WdiServiceHost  C:\Windows\system32\wdi.dll
19:17:44.0128 6208  WdiServiceHost - ok
19:17:44.0144 6208  [ F581F9C9D6953FABFA24E67105F0B614 ] WdiSystemHost   C:\Windows\system32\wdi.dll
19:17:44.0144 6208  WdiSystemHost - ok
19:17:44.0161 6208  [ A74AD6D80AC26E1B5DD276FC927F2BAC ] WdNisDrv        C:\Windows\system32\Drivers\WdNisDrv.sys
19:17:44.0161 6208  WdNisDrv - ok
19:17:44.0176 6208  WdNisSvc - ok
19:17:44.0206 6208  [ A70CAF5EA36CBA5FCA24244306D4D5C6 ] WebClient       C:\Windows\System32\webclnt.dll
19:17:44.0206 6208  WebClient - ok
19:17:44.0223 6208  [ 384E1D04FE20845B2559D292F17A9FA1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
19:17:44.0223 6208  Wecsvc - ok
19:17:44.0239 6208  [ 455014F4E48B67EBE0F032E2B0E06BF2 ] WEPHOSTSVC      C:\Windows\system32\wephostsvc.dll
19:17:44.0239 6208  WEPHOSTSVC - ok
19:17:44.0253 6208  [ F13DBA57CEA9B7074B95EDCA6AD2635E ] wercplsupport   C:\Windows\System32\wercplsupport.dll
19:17:44.0253 6208  wercplsupport - ok
19:17:44.0270 6208  [ FD7E58B6AA3EABF2D12B9762A20E11E4 ] WerSvc          C:\Windows\System32\WerSvc.dll
19:17:44.0270 6208  WerSvc - ok
19:17:44.0301 6208  [ 715ABA3DD164D06457A2A3C92F6EA9D5 ] WFPLWFS         C:\Windows\system32\DRIVERS\wfplwfs.sys
19:17:44.0301 6208  WFPLWFS - ok
19:17:44.0317 6208  [ 8C840E1FD7584E74BD0CC1EA581EC187 ] WiaRpc          C:\Windows\System32\wiarpc.dll
19:17:44.0317 6208  WiaRpc - ok
19:17:44.0364 6208  [ 5F66B7BB330AA80067FC66149A692620 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
19:17:44.0364 6208  WIMMount - ok
19:17:44.0364 6208  WinDefend - ok
19:17:44.0394 6208  [ 0E70990EC2E5D2331AA5E88DB0CFB826 ] WinHttpAutoProxySvc C:\Windows\system32\winhttp.dll
19:17:44.0409 6208  WinHttpAutoProxySvc - ok
19:17:44.0456 6208  [ FC8BD690321216C32BB58B035B6D5674 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
19:17:44.0456 6208  Winmgmt - ok
19:17:44.0519 6208  [ B56BFFFB740D76E634DB7B4802E36E4E ] WinRM           C:\Windows\system32\WsmSvc.dll
19:17:44.0534 6208  WinRM - ok
19:17:44.0581 6208  [ 3AF1FA17F1C4ACBDB660D8F98B1A9C13 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
19:17:44.0581 6208  WinUsb - ok
19:17:44.0612 6208  [ F6F13FB009D43CE75FDBC35A5A46F9BB ] WlanSvc         C:\Windows\System32\wlansvc.dll
19:17:44.0628 6208  WlanSvc - ok
19:17:44.0675 6208  [ 06BF5897949A8F24893F792E876B71F5 ] wlidsvc         C:\Windows\system32\wlidsvc.dll
19:17:44.0690 6208  wlidsvc - ok
19:17:44.0706 6208  [ 2834D9D3B4F554A39C72F00EA3F0E128 ] WmiAcpi         C:\Windows\System32\drivers\wmiacpi.sys
19:17:44.0706 6208  WmiAcpi - ok
19:17:44.0737 6208  [ B96F7A1236C3F21212DE2C40A3DDB005 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
19:17:44.0737 6208  wmiApSrv - ok
19:17:44.0753 6208  WMPNetworkSvc - ok
19:17:44.0753 6208  [ 7FC5667DF73D4B04AA457CC3A4180E09 ] Wof             C:\Windows\system32\drivers\Wof.sys
19:17:44.0770 6208  Wof - ok
19:17:44.0815 6208  [ EDFA5CEDBE174FAAA4A09A6B297AEA42 ] workfolderssvc  C:\Windows\system32\workfolderssvc.dll
19:17:44.0815 6208  workfolderssvc - ok
19:17:44.0847 6208  [ A2468CC3509394A33C4C32F99563D845 ] wpcfltr         C:\Windows\system32\DRIVERS\wpcfltr.sys
19:17:44.0847 6208  wpcfltr - ok
19:17:44.0862 6208  [ 19F4DF69876DA7E9C4965351560FE6B7 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
19:17:44.0862 6208  WPCSvc - ok
19:17:44.0894 6208  [ 25BE82B325AC22FE563A58A1AC29F4C1 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
19:17:44.0894 6208  WPDBusEnum - ok
19:17:44.0894 6208  [ 9F2904B55F6CECCD1A8D986B5CE2609A ] WpdUpFltr       C:\Windows\system32\drivers\WpdUpFltr.sys
19:17:44.0894 6208  WpdUpFltr - ok
19:17:44.0925 6208  [ AE072B0339D0A18E455DC21666CAD572 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
19:17:44.0925 6208  ws2ifsl - ok
19:17:44.0940 6208  [ 501D5EFAB9711039479AE48401386D2B ] wscsvc          C:\Windows\System32\wscsvc.dll
19:17:44.0940 6208  wscsvc - ok
19:17:44.0956 6208  WSearch - ok
19:17:44.0972 6208  [ 552BD369EF502489AF40899BDBFF35C6 ] wsnm            C:\Program Files (x86)\VMware\VMware Horizon View Client\wsnm\wsnm.exe
19:17:44.0988 6208  wsnm - ok
19:17:45.0034 6208  [ 6B2D71124C1EA86B74412F414C42431D ] WSService       C:\Windows\System32\WSService.dll
19:17:45.0050 6208  WSService - ok
19:17:45.0112 6208  [ F8AAE8C41092D195C470EE7EF2D0BB01 ] wuauserv        C:\Windows\system32\wuaueng.dll
19:17:45.0128 6208  wuauserv - ok
19:17:45.0144 6208  [ 481286719402E4BAEFEA0604AB1B5113 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
19:17:45.0144 6208  WudfPf - ok
19:17:45.0159 6208  [ D7B4859227B02BCC1055B279A63C937F ] WUDFRd          C:\Windows\System32\drivers\WUDFRd.sys
19:17:45.0159 6208  WUDFRd - ok
19:17:45.0159 6208  [ D7B4859227B02BCC1055B279A63C937F ] WUDFSensorLP    C:\Windows\system32\DRIVERS\WUDFRd.sys
19:17:45.0159 6208  WUDFSensorLP - ok
19:17:45.0175 6208  [ 51D28F7F1F888DDCF2C67DCF3B79A5D3 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
19:17:45.0175 6208  wudfsvc - ok
19:17:45.0191 6208  [ D7B4859227B02BCC1055B279A63C937F ] WUDFWpdFs       C:\Windows\system32\DRIVERS\WUDFRd.sys
19:17:45.0191 6208  WUDFWpdFs - ok
19:17:45.0206 6208  [ D7B4859227B02BCC1055B279A63C937F ] WUDFWpdMtp      C:\Windows\system32\DRIVERS\WUDFRd.sys
19:17:45.0206 6208  WUDFWpdMtp - ok
19:17:45.0237 6208  [ A0900F8F628B5AF6841414EB3CF11E50 ] WwanSvc         C:\Windows\System32\wwansvc.dll
19:17:45.0237 6208  WwanSvc - ok
19:17:45.0253 6208  ================ Scan global ===============================
19:17:45.0285 6208  [ 3500AF0BA2EF095BF313EEB75D2366C6 ] C:\Windows\system32\basesrv.dll
19:17:45.0300 6208  [ EAB311B0A7A8EA0346F14F08D4BC8F46 ] C:\Windows\system32\winsrv.dll
19:17:45.0315 6208  [ 3600ED7EA8AED849E20700551C0BD63B ] C:\Windows\system32\sxssrv.dll
19:17:45.0347 6208  [ E0C7813A97CA7947FF5C18A8F3B61A45 ] C:\Windows\system32\services.exe
19:17:45.0362 6208  [Global] - ok
19:17:45.0362 6208  ================ Scan MBR ==================================
19:17:45.0362 6208  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
19:17:45.0378 6208  \Device\Harddisk0\DR0 - ok
19:17:45.0378 6208  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1
19:17:45.0411 6208  \Device\Harddisk1\DR1 - ok
19:17:45.0426 6208  ================ Scan VBR ==================================
19:17:45.0426 6208  [ 7B6E0BBDB7BB60CBDAC4EA9DBBCFB1D1 ] \Device\Harddisk0\DR0\Partition1
19:17:45.0426 6208  \Device\Harddisk0\DR0\Partition1 - ok
19:17:45.0440 6208  [ 725FF3117B2345BE9DDD1B451FCC0501 ] \Device\Harddisk0\DR0\Partition2
19:17:45.0457 6208  \Device\Harddisk0\DR0\Partition2 - ok
19:17:45.0457 6208  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk0\DR0\Partition3
19:17:45.0472 6208  \Device\Harddisk0\DR0\Partition3 - ok
19:17:45.0472 6208  [ 9A46419798180A728FEAE1618C879082 ] \Device\Harddisk0\DR0\Partition4
19:17:45.0488 6208  \Device\Harddisk0\DR0\Partition4 - ok
19:17:45.0488 6208  [ 2C53E5B3F10C385F7AEFC58C957A3377 ] \Device\Harddisk1\DR1\Partition1
19:17:45.0488 6208  \Device\Harddisk1\DR1\Partition1 - ok
19:17:45.0488 6208  ============================================================
19:17:45.0488 6208  Scan finished
19:17:45.0488 6208  ============================================================
19:17:45.0504 6248  Detected object count: 0
19:17:45.0504 6248  Actual detected object count: 0
 

*Finished MBR Scan:

00:22:12.0381 1476  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
00:22:12.0381 1476  UEFI system
00:22:12.0491 1476  ============================================================
00:22:12.0491 1476  Current date / time: 2017/11/29 00:22:12.0491
00:22:12.0491 1476  SystemInfo:
00:22:12.0491 1476  
00:22:12.0491 1476  OS Version: 6.2.9200 ServicePack: 0.0
00:22:12.0491 1476  Product type: Workstation
00:22:12.0491 1476  ComputerName: HP-DESKTOP
00:22:12.0491 1476  UserName: Owner
00:22:12.0491 1476  Windows directory: C:\Windows
00:22:12.0491 1476  System windows directory: C:\Windows
00:22:12.0491 1476  Running under WOW64
00:22:12.0491 1476  Processor architecture: Intel x64
00:22:12.0491 1476  Number of processors: 4
00:22:12.0491 1476  Page size: 0x1000
00:22:12.0491 1476  Boot type: Normal boot
00:22:12.0491 1476  ============================================================
00:22:12.0868 1476  BG loaded
00:22:13.0602 1476  Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
00:22:13.0696 1476  Drive \Device\Harddisk1\DR1 - Size: 0xF49D1C00 (3.82 Gb), SectorSize: 0x200, Cylinders: 0x1F2, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
00:22:13.0696 1476  ============================================================
00:22:13.0696 1476  \Device\Harddisk0\DR0:
00:22:13.0696 1476  GPT partitions:
00:22:13.0711 1476  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {D247555E-D39B-464F-A1A6-73D996B00567}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0x96000
00:22:13.0711 1476  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {76457BAD-1730-4F8E-A20E-8F4A7D9F447B}, Name: EFI system partition, StartLBA 0x96800, BlocksNum 0x32000
00:22:13.0711 1476  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {4F195DDA-4FA4-42B0-92A4-E9039210EB80}, Name: Microsoft reserved partition, StartLBA 0xC8800, BlocksNum 0x40000
00:22:13.0711 1476  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {9B4C8972-8B43-485B-94C6-1B4881B9DE50}, Name: Basic data partition, StartLBA 0x108800, BlocksNum 0xE8D00000
00:22:13.0711 1476  MBR partitions:
00:22:13.0711 1476  \Device\Harddisk1\DR1:
00:22:13.0711 1476  MBR partitions:
00:22:13.0711 1476  \Device\Harddisk1\DR1\Partition1: MBR, Type 0xB, StartLBA 0x22, BlocksNum 0x79D48F
00:22:13.0711 1476  ============================================================
00:22:13.0742 1476  C: <-> \Device\Harddisk0\DR0\Partition4
00:22:13.0742 1476  ============================================================
00:22:13.0742 1476  Initialize success
00:22:13.0742 1476  ============================================================
00:22:20.0885 3488  ============================================================
00:22:20.0885 3488  Scan started
00:22:20.0885 3488  Mode: Manual;
00:22:20.0885 3488  ============================================================
00:22:22.0464 3488  ================ Scan system memory ========================
00:22:22.0464 3488  System memory - ok
00:22:22.0464 3488  ================ Scan services =============================
00:22:23.0120 3488  [ E1832BD9FD7E0FC2DC9FA5935DE3E8C1 ] 1394ohci        C:\Windows\System32\drivers\1394ohci.sys
00:22:23.0135 3488  1394ohci - ok
00:22:23.0167 3488  [ AD508A1A46EC21B740AB31C28EFDFDB1 ] 3ware           C:\Windows\system32\drivers\3ware.sys
00:22:23.0167 3488  3ware - ok
00:22:23.0167 3488  Suspicious service (Hidden): 99224798
00:22:23.0182 3488  99224798 ( HiddenService.Multi.Generic ) - warning
00:22:23.0182 3488  99224798 - detected HiddenService.Multi.Generic (1)
00:22:23.0229 3488  [ E796AE43DDD1844281DB4D57294D17C0 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
00:22:23.0229 3488  ACPI - ok
00:22:23.0245 3488  [ AC8279D229398BCF05C3154ADCA86813 ] acpiex          C:\Windows\system32\Drivers\acpiex.sys
00:22:23.0245 3488  acpiex - ok
00:22:23.0276 3488  [ A8970D9BF23CD309E0403978A1B58F3F ] acpipagr        C:\Windows\System32\drivers\acpipagr.sys
00:22:23.0276 3488  acpipagr - ok
00:22:23.0292 3488  [ 111A89C99C5B4F1A7BCE5F643DD86F65 ] AcpiPmi         C:\Windows\System32\drivers\acpipmi.sys
00:22:23.0292 3488  AcpiPmi - ok
00:22:23.0292 3488  [ 5758387D68A20AE7D3245011B07E36E7 ] acpitime        C:\Windows\System32\drivers\acpitime.sys
00:22:23.0307 3488  acpitime - ok
00:22:23.0323 3488  [ 7C1FDF1B48298CBA7CE4BDD4978951AD ] ADP80XX         C:\Windows\system32\drivers\ADP80XX.SYS
00:22:23.0323 3488  ADP80XX - ok
00:22:23.0356 3488  [ BCD58DACAA1EAAADC115EDD940478F6D ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
00:22:23.0356 3488  AeLookupSvc - ok
00:22:23.0370 3488  [ A460C3AF3755A2A79A3C8EFE72E147B5 ] AFD             C:\Windows\system32\drivers\afd.sys
00:22:23.0385 3488  AFD - ok
00:22:23.0401 3488  [ 7DFAEBA9AD62D20102B576D5CAC45EC8 ] agp440          C:\Windows\system32\drivers\agp440.sys
00:22:23.0417 3488  agp440 - ok
00:22:23.0435 3488  [ FE14D249D39368CA62D8DA6BC94AC694 ] ahcache         C:\Windows\system32\DRIVERS\ahcache.sys
00:22:23.0435 3488  ahcache - ok
00:22:23.0448 3488  [ 14A45BE6F5678339F0EC5752D9849410 ] ALG             C:\Windows\System32\alg.exe
00:22:23.0465 3488  ALG - ok
00:22:23.0479 3488  [ BC54D9830300C8B4F2B483CD6E0FC4CB ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
00:22:23.0479 3488  AMD External Events Utility - ok
00:22:23.0495 3488  [ 7589DE749DB6F71A68489DCE04158729 ] AmdK8           C:\Windows\System32\drivers\amdk8.sys
00:22:23.0495 3488  AmdK8 - ok
00:22:23.0870 3488  [ 6398021B262BD1531E8523CF5DEFD600 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
00:22:24.0010 3488  amdkmdag - ok
00:22:24.0058 3488  [ BB4A8E585178DDAE35875D670C41C981 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
00:22:24.0058 3488  amdkmdap - ok
00:22:24.0089 3488  [ B46D2D89AFF8A9490FA8C98C7A5616E3 ] AmdPPM          C:\Windows\System32\drivers\amdppm.sys
00:22:24.0089 3488  AmdPPM - ok
00:22:24.0105 3488  [ D2BF2F94A47D332814910FD47C6BBCD2 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
00:22:24.0105 3488  amdsata - ok
00:22:24.0120 3488  [ A8E04943C7BBA7219AA50400272C3C6E ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
00:22:24.0120 3488  amdsbs - ok
00:22:24.0152 3488  [ CEA5F4F27CFC08E3A44D576811B35F50 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
00:22:24.0152 3488  amdxata - ok
00:22:24.0167 3488  [ 415DD71628795197F7AFC176CBADC74E ] AppID           C:\Windows\system32\drivers\appid.sys
00:22:24.0214 3488  AppID - ok
00:22:24.0245 3488  [ 942C8297400FCFB13CEE3F3CD89C5CE5 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
00:22:24.0245 3488  AppIDSvc - ok
00:22:24.0278 3488  [ 734622FBA766DBD65B1803549B24A04A ] Appinfo         C:\Windows\System32\appinfo.dll
00:22:24.0278 3488  Appinfo - ok
00:22:24.0434 3488  [ 7D811EA7A2AAA49B0446D42CBC1CD338 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
00:22:24.0434 3488  Apple Mobile Device Service - ok
00:22:24.0510 3488  [ 35E28923A23ADABAA5A1B43256D0AB58 ] AppReadiness    C:\Windows\system32\AppReadiness.dll
00:22:24.0557 3488  AppReadiness - ok
00:22:24.0589 3488  [ E0F846ADE7DED88981D0908DE56FF160 ] AppXSvc         C:\Windows\system32\appxdeploymentserver.dll
00:22:24.0604 3488  AppXSvc - ok
00:22:24.0621 3488  [ 65045784366F7EC5FB4E71BCF923187B ] arcsas          C:\Windows\system32\drivers\arcsas.sys
00:22:24.0621 3488  arcsas - ok
00:22:24.0651 3488  [ 74B14192CF79A72F7536B27CB8814FBD ] atapi           C:\Windows\system32\drivers\atapi.sys
00:22:24.0651 3488  atapi - ok
00:22:24.0698 3488  [ 2C7676F892E88FD190F08D98048C7C6C ] athr            C:\Windows\system32\DRIVERS\athw8x.sys
00:22:24.0761 3488  athr - ok
00:22:24.0778 3488  [ 431FE56F5A2F5937994CB2DA330B47DB ] AudioEndpointBuilder C:\Windows\System32\AudioEndpointBuilder.dll
00:22:24.0778 3488  AudioEndpointBuilder - ok
00:22:24.0856 3488  [ 0F03CC00645D7F841879A048787D6AC7 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
00:22:24.0856 3488  Audiosrv - ok
00:22:24.0917 3488  [ 3C6ED74AF41DD1A5585CE5EF3D00915F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
00:22:24.0933 3488  AxInstSV - ok
00:22:24.0950 3488  [ A4A73F631FE2AA2826FBE4A399B04DEF ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
00:22:24.0950 3488  b06bdrv - ok
00:22:24.0964 3488  [ 8CC7F7E4AFCBA605921B137ED7992C68 ] BasicDisplay    C:\Windows\System32\drivers\BasicDisplay.sys
00:22:24.0964 3488  BasicDisplay - ok
00:22:25.0027 3488  [ 195BD339B4B782B42C19489DCFB4D110 ] BasicRender     C:\Windows\System32\drivers\BasicRender.sys
00:22:25.0027 3488  BasicRender - ok
00:22:25.0042 3488  [ C1ABB0F7E3BEA48A0417BDF6FF14AB21 ] bcmfn2          C:\Windows\System32\drivers\bcmfn2.sys
00:22:25.0042 3488  bcmfn2 - ok
00:22:25.0073 3488  [ 174394F4EF93C117BF7BE3878046A1B1 ] BDESVC          C:\Windows\System32\bdesvc.dll
00:22:25.0073 3488  BDESVC - ok
00:22:25.0089 3488  [ EC19013E4CF87609534165DF897274D6 ] Beep            C:\Windows\system32\drivers\Beep.sys
00:22:25.0089 3488  Beep - ok
00:22:25.0120 3488  [ 5059D93764340D4EAEDF49C47133118F ] BFE             C:\Windows\System32\bfe.dll
00:22:25.0120 3488  BFE - ok
00:22:25.0229 3488  [ 48554994279BFE17A3D2B00076D0CB1A ] BITS            C:\Windows\System32\qmgr.dll
00:22:25.0261 3488  BITS - ok
00:22:25.0292 3488  [ B5C2F92EE1106DFE7BB1CCE4D35B6037 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
00:22:25.0292 3488  Bonjour Service - ok
00:22:25.0308 3488  [ 4938A9236300A356F97E378491EE4844 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
00:22:25.0308 3488  bowser - ok
00:22:25.0355 3488  [ FA601515FF2B59F25FDD8EDB1D2A1104 ] BrokerInfrastructure C:\Windows\System32\bisrv.dll
00:22:25.0355 3488  BrokerInfrastructure - ok
00:22:25.0417 3488  [ BC111AADACD0BF59D56547461D13AB6E ] Browser         C:\Windows\System32\browser.dll
00:22:25.0417 3488  Browser - ok
00:22:25.0433 3488  [ A8F23D453A424FF4DE04989C4727ECC7 ] BthAvrcpTg      C:\Windows\System32\drivers\BthAvrcpTg.sys
00:22:25.0433 3488  BthAvrcpTg - ok
00:22:25.0464 3488  [ 272A62B660A48AEF366F8A1836CED19F ] BthHFEnum       C:\Windows\System32\drivers\bthhfenum.sys
00:22:25.0479 3488  BthHFEnum - ok
00:22:25.0479 3488  [ 71FE2A48E4C93DDB9798C024880B6C07 ] bthhfhid        C:\Windows\System32\drivers\BthHFHid.sys
00:22:25.0479 3488  bthhfhid - ok
00:22:25.0511 3488  [ 9307A4B743D277C499CDA8E19E5687AC ] BthHFSrv        C:\Windows\System32\BthHFSrv.dll
00:22:25.0511 3488  BthHFSrv - ok
00:22:25.0526 3488  [ EF4B9E7C9AD88C00C18A12B0D22D1894 ] BTHMODEM        C:\Windows\System32\drivers\bthmodem.sys
00:22:25.0526 3488  BTHMODEM - ok
00:22:25.0542 3488  [ 043A0F37631BF453F16D478B71320F46 ] bthserv         C:\Windows\system32\bthserv.dll
00:22:25.0542 3488  bthserv - ok
00:22:25.0558 3488  [ 2FA6510E33F7DEFEC03658B74101A9B9 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
00:22:25.0574 3488  cdfs - ok
00:22:25.0590 3488  [ C6796EA22B513E3457514D92DCDB1A3D ] cdrom           C:\Windows\System32\drivers\cdrom.sys
00:22:25.0604 3488  cdrom - ok
00:22:25.0636 3488  [ ACFDC4EE40EC6E4A0AB91D923B8288C8 ] CertPropSvc     C:\Windows\System32\certprop.dll
00:22:25.0636 3488  CertPropSvc - ok
00:22:25.0667 3488  [ BE9936EDD3267FAAFF94A7835867F00B ] circlass        C:\Windows\System32\drivers\circlass.sys
00:22:25.0667 3488  circlass - ok
00:22:25.0698 3488  [ 39D72BA91AFE3C81C1AB0DE41AA07EF3 ] CLFS            C:\Windows\system32\drivers\CLFS.sys
00:22:25.0714 3488  CLFS - ok
00:22:25.0729 3488  [ EF6EF85DADC3184A10D8F2F7159973CB ] CmBatt          C:\Windows\System32\drivers\CmBatt.sys
00:22:25.0729 3488  CmBatt - ok
00:22:25.0776 3488  [ C8823A6ECE66B997C8E9F413D1D671E7 ] CNG             C:\Windows\system32\Drivers\cng.sys
00:22:25.0823 3488  CNG - ok
00:22:25.0870 3488  [ 03AAED827C36F35D70900558B8274905 ] CompositeBus    C:\Windows\System32\drivers\CompositeBus.sys
00:22:25.0870 3488  CompositeBus - ok
00:22:25.0870 3488  COMSysApp - ok
00:22:25.0886 3488  [ A1FF7DFBFBE164CF92603C651D304DD2 ] condrv          C:\Windows\system32\drivers\condrv.sys
00:22:25.0886 3488  condrv - ok
00:22:25.0934 3488  [ 6324F0D18FB52833BA64BC828E29054C ] CryptSvc        C:\Windows\system32\cryptsvc.dll
00:22:25.0934 3488  CryptSvc - ok
00:22:25.0948 3488  [ 315BA4BC19316D72B2E037534E048B93 ] dam             C:\Windows\system32\drivers\dam.sys
00:22:25.0964 3488  dam - ok
00:22:26.0012 3488  [ 20CC6E9FE25ACD34BE4FCDDB7B08364D ] DcomLaunch      C:\Windows\system32\rpcss.dll
00:22:26.0026 3488  DcomLaunch - ok
00:22:26.0104 3488  [ 95E1ABFB27F8A62ED764805775F0D2F3 ] defragsvc       C:\Windows\System32\defragsvc.dll
00:22:26.0120 3488  defragsvc - ok
00:22:26.0292 3488  [ FF086DEF5995558CCB1B5AAC2110195D ] DeviceAssociationService C:\Windows\system32\das.dll
00:22:26.0292 3488  DeviceAssociationService - ok
00:22:26.0324 3488  [ 2C02AFF8383D893F8DBEB07A84F6E77C ] DeviceInstall   C:\Windows\system32\umpnpmgr.dll
00:22:26.0339 3488  DeviceInstall - ok
00:22:26.0370 3488  [ 4FED6AD69C9EE1EE7FD3C88437138855 ] Dfsc            C:\Windows\system32\Drivers\dfsc.sys
00:22:26.0370 3488  Dfsc - ok
00:22:26.0386 3488  [ 3EEAADA3125431980E5804ED7143458A ] Dhcp            C:\Windows\system32\dhcpcore.dll
00:22:26.0401 3488  Dhcp - ok
00:22:26.0433 3488  [ 0AC9F83A5508935DE89C447473085EEA ] DiagTrack       C:\Windows\system32\diagtrack.dll
00:22:26.0448 3488  DiagTrack - ok
00:22:26.0479 3488  [ BF6D8575DDF30384939B2D5251F27C1F ] disk            C:\Windows\system32\drivers\disk.sys
00:22:26.0479 3488  disk - ok
00:22:26.0526 3488  [ CAF3719E7EBB5CAC650F72330D9C5BBE ] dKeySync        C:\dKEYUSBCradle\SyncService.exe
00:22:26.0683 3488  dKeySync - ok
00:22:26.0699 3488  [ EB70A894708D1BC176AFD690FF06085F ] dmvsc           C:\Windows\System32\drivers\dmvsc.sys
00:22:26.0699 3488  dmvsc - ok
00:22:26.0730 3488  [ D9F407D006C916B7EC167858F88F13EB ] Dnscache        C:\Windows\System32\dnsrslvr.dll
00:22:26.0730 3488  Dnscache - ok
00:22:26.0777 3488  [ 811EACBCC7C51A03AE11F13CC27B2AB6 ] dot3svc         C:\Windows\System32\dot3svc.dll
00:22:26.0777 3488  dot3svc - ok
00:22:26.0810 3488  [ B99CB575986789A93A683DCF292A43A1 ] DPS             C:\Windows\system32\dps.dll
00:22:26.0810 3488  DPS - ok
00:22:26.0824 3488  [ 00C594D5A1DBD22AD8B2902B9F6EFF94 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
00:22:26.0824 3488  drmkaud - ok
00:22:26.0860 3488  [ 263625A4F616538EB867B6306A6590DB ] DsmSvc          C:\Windows\System32\DeviceSetupManager.dll
00:22:26.0870 3488  DsmSvc - ok
00:22:26.0980 3488  [ 670E7F15CEEA22C34CED8F4D0EC161BF ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
00:22:26.0997 3488  DXGKrnl - ok
00:22:27.0027 3488  [ E253530BD5EDE28F1FF6AF93C4D8034D ] Eaphost         C:\Windows\System32\eapsvc.dll
00:22:27.0027 3488  Eaphost - ok
00:22:27.0153 3488  [ 114BCFDF367FF37C3F1B0A96AF542E4D ] ebdrv           C:\Windows\system32\drivers\evbda.sys
00:22:27.0199 3488  ebdrv - ok
00:22:27.0230 3488  [ 382100E75B6F4668AEAEF228C6CEFFAD ] EFS             C:\Windows\System32\lsass.exe
00:22:27.0230 3488  EFS - ok
00:22:27.0292 3488  [ 43531A5993380CC5113242C29D265FD9 ] EhStorClass     C:\Windows\system32\drivers\EhStorClass.sys
00:22:27.0308 3488  EhStorClass - ok
00:22:27.0324 3488  [ 6F8E738A9505A388B1157FDDE7B3101B ] EhStorTcgDrv    C:\Windows\system32\drivers\EhStorTcgDrv.sys
00:22:27.0324 3488  EhStorTcgDrv - ok
00:22:27.0339 3488  [ DFFFAE1442BA4076E18EED5E406FA0D3 ] ErrDev          C:\Windows\System32\drivers\errdev.sys
00:22:27.0339 3488  ErrDev - ok
00:22:27.0370 3488  [ F00C593994D57C75273F820653440536 ] EventSystem     C:\Windows\system32\es.dll
00:22:27.0386 3488  EventSystem - ok
00:22:27.0403 3488  [ 7729D294A555C7AEB281ED8E4D0E01E4 ] exfat           C:\Windows\system32\drivers\exfat.sys
00:22:27.0403 3488  exfat - ok
00:22:27.0433 3488  [ 7C4E0D5900B2A1D11EDD626D6DDB937B ] fastfat         C:\Windows\system32\drivers\fastfat.sys
00:22:27.0433 3488  fastfat - ok
00:22:27.0480 3488  [ 304B6AEC4639A7CCCCF544C6BA6177B2 ] Fax             C:\Windows\system32\fxssvc.exe
00:22:27.0495 3488  Fax - ok
00:22:27.0495 3488  [ 5D8402613E778B3BD45E687A8372710B ] fdc             C:\Windows\System32\drivers\fdc.sys
00:22:27.0495 3488  fdc - ok
00:22:27.0511 3488  [ 020D2F29009F893ADEFF4405B4B44565 ] fdPHost         C:\Windows\system32\fdPHost.dll
00:22:27.0527 3488  fdPHost - ok
00:22:27.0542 3488  [ E80D2EDD2F88B6E20076A0A4F5A5A245 ] FDResPub        C:\Windows\system32\fdrespub.dll
00:22:27.0542 3488  FDResPub - ok
00:22:27.0542 3488  [ 47AB7D16EDE434B934AA4D661456C2D5 ] fhsvc           C:\Windows\system32\fhsvc.dll
00:22:27.0558 3488  fhsvc - ok
00:22:27.0558 3488  [ BCFD8B149B3ADF92D0DB1E909CAF0265 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
00:22:27.0558 3488  FileInfo - ok
00:22:27.0574 3488  [ A1A66C4FDAFD6B0289523232AFB7D8AF ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
00:22:27.0574 3488  Filetrace - ok
00:22:27.0574 3488  [ BE743083CF7063C486A4398E3AEFE59A ] flpydisk        C:\Windows\System32\drivers\flpydisk.sys
00:22:27.0589 3488  flpydisk - ok
00:22:27.0589 3488  [ C1FB505A73FA2E9019D32444AB33B75A ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
00:22:27.0605 3488  FltMgr - ok
00:22:27.0716 3488  [ 223CD19D2F84B7B42081F4FB530B658F ] FontCache       C:\Windows\system32\FntCache.dll
00:22:27.0730 3488  FontCache - ok
00:22:27.0824 3488  [ 1C52387BF5A127F5F3BFB31288F30D93 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
00:22:27.0840 3488  FontCache3.0.0.0 - ok
00:22:27.0855 3488  [ A7C31B168F371E8E6796219F23E354DB ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
00:22:27.0855 3488  FsDepends - ok
00:22:27.0886 3488  [ 09F460AFEDCA03F3BF6E07D1CCC9AC42 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
00:22:27.0902 3488  Fs_Rec - ok
00:22:27.0996 3488  [ 9540C57068902DAA6F272D70E922C090 ] ftnlsv3hv       C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
00:22:27.0996 3488  ftnlsv3hv - ok
00:22:28.0183 3488  [ AFC4552FB7F8A1C04FA0EE57A78933FC ] ftscanmgr       C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe
00:22:28.0214 3488  ftscanmgr - ok
00:22:28.0277 3488  [ D4AB6EE3D715BC44C00277FD934FAACF ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
00:22:28.0292 3488  fvevol - ok
00:22:28.0324 3488  [ 9591D0B9351ED489EAFD9D1CE52A8015 ] FxPPM           C:\Windows\System32\drivers\fxppm.sys
00:22:28.0324 3488  FxPPM - ok
00:22:28.0339 3488  [ FC3EF65EE20D39F8749C2218DBA681CA ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
00:22:28.0339 3488  gagp30kx - ok
00:22:28.0370 3488  [ 0BF5CAD281E25F1418E5B8875DC5ADD1 ] gencounter      C:\Windows\System32\drivers\vmgencounter.sys
00:22:28.0370 3488  gencounter - ok
00:22:28.0386 3488  [ 8DF1254093B5C354CE725EB6B9B0DE19 ] GPIOClx0101     C:\Windows\system32\Drivers\msgpioclx.sys
00:22:28.0386 3488  GPIOClx0101 - ok
00:22:28.0417 3488  [ 2DAFF4F76A90E3C523C2FE50338537E9 ] gpsvc           C:\Windows\System32\gpsvc.dll
00:22:28.0434 3488  gpsvc - ok
00:22:28.0511 3488  [ 0545A3EB959CFA4790D267BFB8C1ACA4 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
00:22:28.0511 3488  gupdate - ok
00:22:28.0527 3488  [ 0545A3EB959CFA4790D267BFB8C1ACA4 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
00:22:28.0527 3488  gupdatem - ok
00:22:28.0559 3488  [ FA4AC219AA758EA46D7148059BB9D36E ] hcmon           C:\Windows\system32\drivers\hcmon.sys
00:22:28.0559 3488  hcmon - ok
00:22:28.0574 3488  [ 56F69F7C25FB67C970997D7066DBC593 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
00:22:28.0574 3488  HdAudAddService - ok
00:22:28.0605 3488  [ D4B7ED39C7900384D9E5C1283F1E7926 ] HDAudBus        C:\Windows\System32\drivers\HDAudBus.sys
00:22:28.0620 3488  HDAudBus - ok
00:22:28.0620 3488  [ 10A70BC1871CD955D85CD88372724906 ] HidBatt         C:\Windows\System32\drivers\HidBatt.sys
00:22:28.0620 3488  HidBatt - ok
00:22:28.0652 3488  [ 42F88B57CAE42FC10059C887B3FCFCEA ] HidBth          C:\Windows\System32\drivers\hidbth.sys
00:22:28.0668 3488  HidBth - ok
00:22:28.0685 3488  [ C241A8BAFBBFC90176EA0F5240EACC17 ] hidi2c          C:\Windows\System32\drivers\hidi2c.sys
00:22:28.0685 3488  hidi2c - ok
00:22:28.0701 3488  [ 9BDDEE26255421017E161CCB9D5EDA95 ] HidIr           C:\Windows\System32\drivers\hidir.sys
00:22:28.0701 3488  HidIr - ok
00:22:28.0732 3488  [ EA85B5093DF7B5C3E80362B053740AE2 ] hidserv         C:\Windows\system32\hidserv.dll
00:22:28.0732 3488  hidserv - ok
00:22:28.0780 3488  [ 49676FEC898AB2A11B157F848269A56E ] HidUsb          C:\Windows\System32\drivers\hidusb.sys
00:22:28.0780 3488  HidUsb - ok
00:22:28.0843 3488  [ A6FFE56E72D6C500A0D2AA0843630D40 ] HitmanProScheduler C:\Program Files\HitmanPro\hmpsched.exe
00:22:28.0843 3488  HitmanProScheduler - ok
00:22:28.0875 3488  [ 93C4315F47F8D635C6DB0DF49FCE10EE ] hkmsvc          C:\Windows\system32\kmsvc.dll
00:22:28.0875 3488  hkmsvc - ok
00:22:28.0935 3488  [ AC49522ED106BD4B545D6614D71C2445 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
00:22:28.0952 3488  HomeGroupListener - ok
00:22:29.0030 3488  [ 99932E30CE0283B73BB6E5019E150394 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
00:22:29.0030 3488  HomeGroupProvider - ok
00:22:29.0249 3488  [ A6AACEA4C785789BDA5912AD1FEDA80D ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
00:22:29.0249 3488  HpSAMD - ok
00:22:29.0671 3488  [ 0821D9404151398E43B794828DFBFB07 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
00:22:29.0685 3488  HTTP - ok
00:22:29.0763 3488  [ 90656C0B3864804B090434EFC582404F ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
00:22:29.0763 3488  hwpolicy - ok
00:22:29.0873 3488  [ 6D6F9E3BF0484967E52F7E846BFF1CA1 ] hyperkbd        C:\Windows\System32\drivers\hyperkbd.sys
00:22:29.0873 3488  hyperkbd - ok
00:22:29.0888 3488  [ 907C870F8C31F8DDD6F090857B46AB25 ] HyperVideo      C:\Windows\system32\DRIVERS\HyperVideo.sys
00:22:29.0888 3488  HyperVideo - ok
00:22:30.0013 3488  [ 49EE0AE9E5B64FFBBD06D55C4984B598 ] i8042prt        C:\Windows\System32\drivers\i8042prt.sys
00:22:30.0029 3488  i8042prt - ok
00:22:30.0092 3488  [ 5D90E32E36CE5D4C535D17CE08AEAF05 ] iaLPSSi_GPIO    C:\Windows\System32\drivers\iaLPSSi_GPIO.sys
00:22:30.0123 3488  iaLPSSi_GPIO - ok
00:22:30.0154 3488  [ DD05E7E80F52ADE9AEB292819920F32C ] iaLPSSi_I2C     C:\Windows\System32\drivers\iaLPSSi_I2C.sys
00:22:30.0154 3488  iaLPSSi_I2C - ok
00:22:30.0529 3488  [ 08BFE413B0B4AA8DFA4B5684CE06D3DC ] iaStorAV        C:\Windows\system32\drivers\iaStorAV.sys
00:22:30.0529 3488  iaStorAV - ok
00:22:30.0685 3488  [ A2200C3033FA4EF249FC096A7A7D02A2 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
00:22:30.0719 3488  iaStorV - ok
00:22:30.0719 3488  IEEtwCollectorService - ok
00:22:30.0810 3488  [ 02211401EFFC4965C014C8F9696539A2 ] IKEEXT          C:\Windows\System32\ikeext.dll
00:22:30.0841 3488  IKEEXT - ok
00:22:30.0857 3488  [ 4E448FCFFD00E8D657CD9E48D3E47157 ] intelide        C:\Windows\system32\drivers\intelide.sys
00:22:30.0873 3488  intelide - ok
00:22:30.0889 3488  [ A770340FC02B999EF0DE6C2A6BC8437C ] intelpep        C:\Windows\system32\drivers\intelpep.sys
00:22:30.0889 3488  intelpep - ok
00:22:30.0936 3488  [ 47E74A8E53C7C24DCE38311E1451C1D9 ] intelppm        C:\Windows\System32\drivers\intelppm.sys
00:22:30.0936 3488  intelppm - ok
00:22:30.0968 3488  [ 9DB76D7F9E4E53EFE5DD8C53DE837514 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
00:22:30.0968 3488  IpFilterDriver - ok
00:22:31.0138 3488  [ B452623C1DE60544054E784D94A7AA47 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
00:22:31.0154 3488  iphlpsvc - ok
00:22:31.0216 3488  [ C800DCD904016B2BF6AB541083770A3A ] IPMIDRV         C:\Windows\System32\drivers\IPMIDrv.sys
00:22:31.0216 3488  IPMIDRV - ok
00:22:31.0279 3488  [ B7342B3C58E91107F6E946A93D9D4EFD ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
00:22:31.0279 3488  IPNAT - ok
00:22:31.0279 3488  [ 97C9EBB84A761D48DC17E0E6B913C164 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
00:22:31.0295 3488  iPod Service - ok
00:22:31.0295 3488  [ AE44C526AB5F8A487D941CEB57B10C97 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
00:22:31.0295 3488  IRENUM - ok
00:22:31.0373 3488  [ 8AFEEA3955AA43616A60F133B1D25F21 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
00:22:31.0373 3488  isapnp - ok
00:22:31.0466 3488  [ C378ED678D1316721A40E1F60FB76184 ] iScsiPrt        C:\Windows\System32\drivers\msiscsi.sys
00:22:31.0482 3488  iScsiPrt - ok
00:22:31.0513 3488  [ 5917AFE4A3F695A54B99C1849C8207FE ] kbdclass        C:\Windows\System32\drivers\kbdclass.sys
00:22:31.0513 3488  kbdclass - ok
00:22:31.0545 3488  [ 8CD840A062F6BDF41DDE3ACB96164B72 ] kbdhid          C:\Windows\System32\drivers\kbdhid.sys
00:22:31.0545 3488  kbdhid - ok
00:22:31.0591 3488  [ 813871C7D402A05F2E3A7075F9584A05 ] kdnic           C:\Windows\system32\DRIVERS\kdnic.sys
00:22:31.0591 3488  kdnic - ok
00:22:31.0623 3488  [ 382100E75B6F4668AEAEF228C6CEFFAD ] KeyIso          C:\Windows\system32\lsass.exe
00:22:31.0623 3488  KeyIso - ok
00:22:31.0701 3488  [ 304DA394D958BC3B62AF6DF514005B01 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
00:22:31.0701 3488  KSecDD - ok
00:22:31.0748 3488  [ 3D4AE520CD6F6FFE549DD195C1F515BE ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
00:22:31.0763 3488  KSecPkg - ok
00:22:31.0806 3488  [ 11AFB527AA370B1DAFD5C36F35F6D45F ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
00:22:31.0806 3488  ksthunk - ok
00:22:31.0869 3488  [ C1591A66028C71147A3E2EAB0B1CCB7E ] KtmRm           C:\Windows\system32\msdtckrm.dll
00:22:31.0884 3488  KtmRm - ok
00:22:31.0947 3488  [ B75ADC97905F43C7C946F1465A8697BD ] LanmanServer    C:\Windows\system32\srvsvc.dll
00:22:31.0947 3488  LanmanServer - ok
00:22:32.0026 3488  [ 3DBD9100745F9B8506B8FEC6FE6CCDE3 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
00:22:32.0103 3488  LanmanWorkstation - ok
00:22:32.0166 3488  [ 8B9F3796EC1762CF255BDB324E5529C8 ] lfsvc           C:\Windows\System32\GeofenceMonitorService.dll
00:22:32.0166 3488  lfsvc - ok
00:22:32.0212 3488  [ C09010B3680860131631F53E8FE7BAD8 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
00:22:32.0212 3488  lltdio - ok
00:22:32.0244 3488  [ DAE98CC96C5EE308BF4EA7B18F226CB8 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
00:22:32.0244 3488  lltdsvc - ok
00:22:32.0275 3488  [ 1E2662D847B7D9995C65D90D254A7E0F ] lmhosts         C:\Windows\System32\lmhsvc.dll
00:22:32.0275 3488  lmhosts - ok
00:22:32.0290 3488  [ C755AE4635457AA2A11F79C0DF857ABC ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
00:22:32.0290 3488  LSI_SAS - ok
00:22:32.0306 3488  [ ADAC09CBE7A2040B7F68B5E5C9A75141 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
00:22:32.0306 3488  LSI_SAS2 - ok
00:22:32.0322 3488  [ 04D1274BB9BBCCF12BD12374002AA191 ] LSI_SAS3        C:\Windows\system32\drivers\lsi_sas3.sys
00:22:32.0322 3488  LSI_SAS3 - ok
00:22:32.0353 3488  [ 327469EEF3833D0C584B7E88A76AEC0C ] LSI_SSS         C:\Windows\system32\drivers\lsi_sss.sys
00:22:32.0353 3488  LSI_SSS - ok
00:22:32.0509 3488  [ 9A7A7E45DAED2E8C2816716D8D28236A ] LSM             C:\Windows\System32\lsm.dll
00:22:32.0509 3488  LSM - ok
00:22:32.0557 3488  [ B0AF753AF28303BB69C67BD85F06FFC9 ] luafv           C:\Windows\system32\drivers\luafv.sys
00:22:32.0681 3488  luafv - ok
00:22:32.0744 3488  [ EB5C03A070F30D64A6DF80E53B22F53F ] megasas         C:\Windows\system32\drivers\megasas.sys
00:22:32.0744 3488  megasas - ok
00:22:32.0806 3488  [ F6F13533196DE7A582D422B0241E4363 ] megasr          C:\Windows\system32\drivers\megasr.sys
00:22:32.0806 3488  megasr - ok
00:22:32.0853 3488  [ 4C5179DB61B9E14BEC15CDC4B152B2E9 ] MMCSS           C:\Windows\system32\mmcss.dll
00:22:32.0853 3488  MMCSS - ok
00:22:32.0884 3488  [ 8B38C44F69259987C95135C9627E2378 ] Modem           C:\Windows\system32\drivers\modem.sys
00:22:32.0884 3488  Modem - ok
00:22:32.0915 3488  [ 601589000CC90F0DF8DA2CC254A3CCC9 ] monitor         C:\Windows\System32\drivers\monitor.sys
00:22:32.0915 3488  monitor - ok
00:22:32.0947 3488  [ 08374E4E5B8914DE6067CBA99F61E930 ] mouclass        C:\Windows\System32\drivers\mouclass.sys
00:22:32.0947 3488  mouclass - ok
00:22:33.0009 3488  [ 5FCBAB60598AE119E02B4C27DE6B99EA ] mouhid          C:\Windows\System32\drivers\mouhid.sys
00:22:33.0009 3488  mouhid - ok
00:22:33.0087 3488  [ E5E8665272EBCD87A0A632314F0D221D ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
00:22:33.0087 3488  mountmgr - ok
00:22:33.0119 3488  [ 30813D30C0F03BB6D2B584C665C83F25 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
00:22:33.0134 3488  MozillaMaintenance - ok
00:22:33.0150 3488  [ 6FC047578785B0435F4E2660946D1ADC ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
00:22:33.0150 3488  mpsdrv - ok
00:22:33.0181 3488  [ D1418745A5472F3930A288E05B9E2C05 ] MpsSvc          C:\Windows\system32\mpssvc.dll
00:22:33.0181 3488  MpsSvc - ok
00:22:33.0212 3488  [ 3F818C1518DA702C8F10259095C9BDE0 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
00:22:33.0212 3488  MRxDAV - ok
00:22:33.0290 3488  [ E2FC654EC895E92A022794329BFC53EC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
00:22:33.0322 3488  mrxsmb - ok
00:22:33.0353 3488  [ AFE6DC2E57E876175BA074AD2CB5594F ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
00:22:33.0634 3488  mrxsmb10 - ok
00:22:33.0744 3488  [ B37B58F9F80A51098C42663D5FA5F2BA ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
00:22:33.0775 3488  mrxsmb20 - ok
00:22:33.0790 3488  [ F3C060444777A59FC63D920719E43CCD ] MsBridge        C:\Windows\system32\DRIVERS\bridge.sys
00:22:33.0807 3488  MsBridge - ok
00:22:33.0825 3488  [ 915747E010A9414B069173284A9B93F4 ] MSDTC           C:\Windows\System32\msdtc.exe
00:22:33.0838 3488  MSDTC - ok
00:22:33.0869 3488  [ D13329FBF8345B28AB30F44CC247DC08 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
00:22:33.0869 3488  Msfs - ok
00:22:33.0931 3488  [ C6B474E46F9E543B875981ED3FFE6ADD ] msgpiowin32     C:\Windows\System32\drivers\msgpiowin32.sys
00:22:33.0931 3488  msgpiowin32 - ok
00:22:33.0947 3488  [ 65C92EB9D08DB5C69F28C7FFD4E84E31 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
00:22:33.0947 3488  mshidkmdf - ok
00:22:33.0947 3488  [ 52299F086AC2DAFD100DD5DC4A8614BA ] mshidumdf       C:\Windows\System32\drivers\mshidumdf.sys
00:22:33.0962 3488  mshidumdf - ok
00:22:33.0980 3488  [ 36D92AF3343C3A3E57FEF11C449AEA4C ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
00:22:33.0980 3488  msisadrv - ok
00:22:34.0040 3488  [ A06142B3850B06972F1C89748FAA2C02 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
00:22:34.0056 3488  MSiSCSI - ok
00:22:34.0056 3488  msiserver - ok
00:22:34.0088 3488  [ A9BBBD2BAE6142253B9195E949AC2E8D ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
00:22:34.0088 3488  MSKSSRV - ok
00:22:34.0103 3488  [ 51B3AC0560848CD6D65AC2033E293113 ] MsLldp          C:\Windows\system32\DRIVERS\mslldp.sys
00:22:34.0103 3488  MsLldp - ok
00:22:34.0103 3488  [ 7B2128EB875DCBC006E6A913211006D6 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
00:22:34.0103 3488  MSPCLOCK - ok
00:22:34.0134 3488  [ 1E88171579B218115C7A772F8DE04BD8 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
00:22:34.0134 3488  MSPQM - ok
00:22:34.0197 3488  [ BBE2A455053E63BECBF42C2F9B21FAE0 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
00:22:34.0228 3488  MsRPC - ok
00:22:34.0262 3488  [ 8D6B7D515C5CBCDB75B928A0B73C3C5E ] mssmbios        C:\Windows\System32\drivers\mssmbios.sys
00:22:34.0262 3488  mssmbios - ok
00:22:34.0290 3488  [ 115019AE01E0EB9C048530D2928AB4A2 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
00:22:34.0290 3488  MSTEE - ok
00:22:34.0290 3488  [ 96D604A35070360F0DD4A7A8AF410B5E ] MTConfig        C:\Windows\System32\drivers\MTConfig.sys
00:22:34.0306 3488  MTConfig - ok
00:22:34.0354 3488  [ 438EA7A2D8D4F9B8AFB64748ACA70BA8 ] Mup             C:\Windows\system32\Drivers\mup.sys
00:22:34.0354 3488  Mup - ok
00:22:34.0384 3488  [ B8C35C94DCB2DFEAF03BB42131F2F77F ] mvumis          C:\Windows\system32\drivers\mvumis.sys
00:22:34.0400 3488  mvumis - ok
00:22:34.0478 3488  [ 8DF30698BDD9492A9D45A4B94FB4A82A ] napagent        C:\Windows\system32\qagentRT.dll
00:22:34.0478 3488  napagent - ok
00:22:34.0526 3488  [ BB78990894F14D725EBD301E1945BF0F ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
00:22:34.0603 3488  NativeWifiP - ok
00:22:34.0619 3488  [ BFCE1225D10619029E68946929CEB64C ] NcaSvc          C:\Windows\System32\ncasvc.dll
00:22:34.0634 3488  NcaSvc - ok
00:22:34.0681 3488  [ 267C97373110B7AFD3B46DF60B6CBB85 ] NcbService      C:\Windows\System32\ncbservice.dll
00:22:34.0697 3488  NcbService - ok
00:22:34.0729 3488  [ 0813B71EAF097208DC76CE0605B48AF0 ] NcdAutoSetup    C:\Windows\System32\NcdAutoSetup.dll
00:22:34.0729 3488  NcdAutoSetup - ok
00:22:34.0807 3488  [ FFAA6C6E798FBA448FA7628A1B277F5C ] NDIS            C:\Windows\system32\drivers\ndis.sys
00:22:34.0827 3488  NDIS - ok
00:22:34.0838 3488  [ 8CECC8DA55F3274181FD1EA28AD76664 ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
00:22:34.0854 3488  NdisCap - ok
00:22:34.0885 3488  [ 269882812E9A68FFF1AFE1283D428322 ] NdisImPlatform  C:\Windows\system32\DRIVERS\NdisImPlatform.sys
00:22:34.0885 3488  NdisImPlatform - ok
00:22:34.0932 3488  [ 82821F4EEC776B4CF11695A38F3ABA46 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
00:22:34.0932 3488  NdisTapi - ok
00:22:34.0947 3488  [ B832B35055BA2B7B4181861FF94D8E59 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
00:22:34.0947 3488  Ndisuio - ok
00:22:34.0980 3488  [ 1F58E48EF75F34C35D8E93A0DC535CFE ] NdisVirtualBus  C:\Windows\System32\drivers\NdisVirtualBus.sys
00:22:34.0980 3488  NdisVirtualBus - ok
00:22:35.0057 3488  [ C3755FCF9A0B5C6FE8ED9E873B85D3CE ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
00:22:35.0057 3488  NdisWan - ok
00:22:35.0057 3488  [ C3755FCF9A0B5C6FE8ED9E873B85D3CE ] NdisWanLegacy   C:\Windows\system32\DRIVERS\ndiswan.sys
00:22:35.0073 3488  NdisWanLegacy - ok
00:22:35.0073 3488  [ DDD7F92A83F74D1476B71FBA9530A8DC ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
00:22:35.0073 3488  NDProxy - ok
00:22:35.0121 3488  [ 3083926D1CC5B56EA0786527B557DD1B ] Ndu             C:\Windows\system32\drivers\Ndu.sys
00:22:35.0121 3488  Ndu - ok
00:22:35.0135 3488  [ 42FF4975D032CAE558AE4BB8448F6E5A ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
00:22:35.0135 3488  NetBIOS - ok
00:22:35.0182 3488  [ 0FE750800DEEE91D22399D081371BA79 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
00:22:35.0276 3488  NetBT - ok
00:22:35.0291 3488  [ 382100E75B6F4668AEAEF228C6CEFFAD ] Netlogon        C:\Windows\system32\lsass.exe
00:22:35.0291 3488  Netlogon - ok
00:22:35.0338 3488  [ 8F074B62E66B6117D9598C62A12069C5 ] Netman          C:\Windows\System32\netman.dll
00:22:35.0338 3488  Netman - ok
00:22:35.0448 3488  [ 4A04B1CD5BFB4A978C5F60E86D6C3E45 ] netprofm        C:\Windows\System32\netprofmsvc.dll
00:22:35.0448 3488  netprofm - ok
00:22:35.0526 3488  [ 10D5997E2F5F16FE3BC3BD1A4BF31EA8 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:22:35.0541 3488  NetTcpPortSharing - ok
00:22:35.0573 3488  [ D4DCE03870314D3354F3501F9DDD4123 ] netvsc          C:\Windows\System32\drivers\netvsc63.sys
00:22:35.0573 3488  netvsc - ok
00:22:35.0604 3488  [ E94EB2A95D7D016E119C4D6868788831 ] NlaSvc          C:\Windows\System32\nlasvc.dll
00:22:35.0604 3488  NlaSvc - ok
00:22:35.0620 3488  [ 8F44A2F57C9F1A19AC9C6288C10FB351 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
00:22:35.0620 3488  Npfs - ok
00:22:35.0650 3488  [ CBDB4F0871C88DF930FC0E8588CA67FC ] npsvctrig       C:\Windows\System32\drivers\npsvctrig.sys
00:22:35.0650 3488  npsvctrig - ok
00:22:35.0666 3488  [ 0F12A72A753CFD7FB0631EE8D08FE983 ] nsi             C:\Windows\system32\nsisvc.dll
00:22:35.0713 3488  nsi - ok
00:22:35.0744 3488  [ 018510D88536798852DAE12F9BA6E138 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
00:22:35.0760 3488  nsiproxy - ok
00:22:35.0807 3488  [ 9907FCC207E470F94B9DB6BD037E79C4 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
00:22:35.0822 3488  Ntfs - ok
00:22:35.0839 3488  [ EF1B290FC9F0E47CC0B537292BEE5904 ] Null            C:\Windows\system32\drivers\Null.sys
00:22:35.0854 3488  Null - ok
00:22:35.0885 3488  [ BC6B5942AFF25EBAF62DE43C3807EDF8 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
00:22:35.0885 3488  nvraid - ok
00:22:35.0900 3488  [ 1F43ABFFAC3D6CA356851D517392966E ] nvstor          C:\Windows\system32\drivers\nvstor.sys
00:22:35.0900 3488  nvstor - ok
00:22:35.0916 3488  [ 6934A936A7369DFE37B7DBA93F5E5E49 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
00:22:35.0916 3488  nv_agp - ok
00:22:35.0932 3488  [ 26657F3B4F39A0E64AF859278B599C4E ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
00:22:35.0947 3488  p2pimsvc - ok
00:22:35.0979 3488  [ FD8F61F0D1F64BBB3D835F39A3F979C9 ] p2psvc          C:\Windows\system32\p2psvc.dll
00:22:35.0979 3488  p2psvc - ok
00:22:36.0010 3488  [ 57DCE4FB0467986AE78E1C6FC5240D32 ] Parport         C:\Windows\System32\drivers\parport.sys
00:22:36.0010 3488  Parport - ok
00:22:36.0026 3488  [ BAFF6122CFC9F95CA175AD8C348179A4 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
00:22:36.0026 3488  partmgr - ok
00:22:36.0073 3488  [ C37AFACC6F809061A9CB5A8A863894F2 ] PcaSvc          C:\Windows\System32\pcasvc.dll
00:22:36.0073 3488  PcaSvc - ok
00:22:36.0166 3488  [ 91ED124E261EA8FAA1C0FFDF2A71B0C4 ] pci             C:\Windows\system32\drivers\pci.sys
00:22:36.0182 3488  pci - ok
00:22:36.0182 3488  [ 346E38FCC6859A727DD28AFAD1F0AFF4 ] pciide          C:\Windows\system32\drivers\pciide.sys
00:22:36.0182 3488  pciide - ok
00:22:36.0197 3488  [ 4D3BDCC1C7B40C9D7B6AD990E6DEC397 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
00:22:36.0197 3488  pcmcia - ok
00:22:36.0229 3488  [ BF28771D1436C88BE1D297D3098B0F7D ] pcw             C:\Windows\system32\drivers\pcw.sys
00:22:36.0229 3488  pcw - ok
00:22:36.0244 3488  [ E6B3ACBA06BAF48594557FCCBFA66FD2 ] pdc             C:\Windows\system32\drivers\pdc.sys
00:22:36.0307 3488  pdc - ok
00:22:36.0339 3488  [ 0ECEE590F2E2EF969FB74A6FC583A1E6 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
00:22:36.0339 3488  PEAUTH - ok
00:22:36.0401 3488  [ 8E3C640FFF5A963F570233AE99C0FFF3 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
00:22:36.0401 3488  PerfHost - ok
00:22:36.0588 3488  [ 70B39E7241F750A248798CE82C44596D ] pla             C:\Windows\system32\pla.dll
00:22:36.0619 3488  pla - ok
00:22:36.0666 3488  [ 2C02AFF8383D893F8DBEB07A84F6E77C ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
00:22:36.0666 3488  PlugPlay - ok
00:22:36.0683 3488  [ 4570F8A37D221660F3A09D6F4DD4BA94 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
00:22:36.0683 3488  PNRPAutoReg - ok
00:22:36.0745 3488  [ 26657F3B4F39A0E64AF859278B599C4E ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
00:22:36.0745 3488  PNRPsvc - ok
00:22:36.0808 3488  [ 0FF8507A8B901B904E98EB36B9E347EE ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
00:22:36.0822 3488  PolicyAgent - ok
00:22:36.0838 3488  [ C8DD82C3035E60D671B8CC5DF128D3A9 ] Power           C:\Windows\system32\umpo.dll
00:22:36.0838 3488  Power - ok
00:22:36.0947 3488  [ F6EA63145C20A23732AD2CA1EBA65FA1 ] PrintNotify     C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
00:22:37.0588 3488  PrintNotify - ok
00:22:37.0668 3488  [ ECD373F9571C745894367CC2635EA44F ] Processor       C:\Windows\System32\drivers\processr.sys
00:22:37.0668 3488  Processor - ok
00:22:37.0761 3488  [ 6E409D818C6B342544EAE741B1422B85 ] ProfSvc         C:\Windows\system32\profsvc.dll
00:22:37.0761 3488  ProfSvc - ok
00:22:37.0809 3488  [ FC0141B4A5AD6D637D883C1A89FC45C5 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
00:22:37.0809 3488  Psched - ok
00:22:37.0918 3488  [ DAA9DEE0A5D5F238C4EE54C2C7FB67C5 ] QWAVE           C:\Windows\system32\qwave.dll
00:22:37.0918 3488  QWAVE - ok
00:22:37.0963 3488  [ 83868EB2924E6BC21A54337C65D614D1 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
00:22:37.0963 3488  QWAVEdrv - ok
00:22:37.0979 3488  [ B337B1F1E82A83E20A1743E008E25C0F ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
00:22:37.0979 3488  RasAcd - ok
00:22:38.0041 3488  [ 044638489B4A5FE5334F46C5314A0826 ] RasAuto         C:\Windows\System32\rasauto.dll
00:22:38.0057 3488  RasAuto - ok
00:22:38.0168 3488  [ 0A655DD285E4E1E2975CEAB8FDE75295 ] RasMan          C:\Windows\System32\rasmans.dll
00:22:38.0198 3488  RasMan - ok
00:22:38.0230 3488  [ 5247F308C4103CDC4FE12AE1D235800A ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
00:22:38.0230 3488  RasPppoe - ok
00:22:38.0307 3488  [ D67ED4AB59D1EF66B05AD1A81AC28B26 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
00:22:38.0307 3488  rdbss - ok
00:22:38.0338 3488  [ 6B21EBF892CD8CACB71669B35AB5DE32 ] rdpbus          C:\Windows\System32\drivers\rdpbus.sys
00:22:38.0338 3488  rdpbus - ok
00:22:38.0371 3488  [ 680C1DAE268B6FB67FA21B389A8B79EF ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
00:22:38.0371 3488  RDPDR - ok
00:22:38.0449 3488  [ BC8A79C625568DDB7DCA49D0C2741A64 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
00:22:38.0463 3488  RdpVideoMiniport - ok
00:22:38.0496 3488  [ A26AEC49F318FEE141DDDB2C5F99B3E6 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
00:22:38.0496 3488  rdyboost - ok
00:22:38.0619 3488  [ 2D39BCFA4DD1081B8F282B623456B858 ] ReFS            C:\Windows\system32\drivers\ReFS.sys
00:22:38.0666 3488  ReFS - ok
00:22:38.0713 3488  [ DF78648AC3C8DC9D70E6714AF785382F ] RemoteAccess    C:\Windows\System32\mprdim.dll
00:22:38.0729 3488  RemoteAccess - ok
00:22:38.0776 3488  [ 7594FEFBAD6BA4645CE7AA175C19BAD0 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
00:22:38.0776 3488  RemoteRegistry - ok
00:22:38.0854 3488  [ 65B9FDE300A6DECC03BA44C4616DCAD6 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
00:22:38.0869 3488  RpcEptMapper - ok
00:22:38.0963 3488  [ A737B433ABAF3F2DCB2BD7B4CC582B26 ] RpcLocator      C:\Windows\system32\locator.exe
00:22:38.0963 3488  RpcLocator - ok
00:22:39.0104 3488  [ 20CC6E9FE25ACD34BE4FCDDB7B08364D ] RpcSs           C:\Windows\system32\rpcss.dll
00:22:39.0119 3488  RpcSs - ok
00:22:39.0183 3488  [ 2D05A5508F4685412F2B89E8C2189ABC ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
00:22:39.0183 3488  rspndr - ok
00:22:39.0260 3488  [ 3AB1AA5155684F40E2F5215A258D2471 ] RTL8168         C:\Windows\system32\DRIVERS\Rt630x64.sys
00:22:39.0277 3488  RTL8168 - ok
00:22:39.0369 3488  [ AAC76DA735718DB96E95509BCFCD75CB ] RTLU3E8023-W8-64 C:\Windows\system32\DRIVERS\rtu30x64w8.sys
00:22:39.0385 3488  RTLU3E8023-W8-64 - ok
00:22:39.0465 3488  [ 1A063730F221B2746FF00457AE17E4F0 ] s3cap           C:\Windows\System32\drivers\vms3cap.sys
00:22:39.0479 3488  s3cap - ok
00:22:39.0494 3488  [ 382100E75B6F4668AEAEF228C6CEFFAD ] SamSs           C:\Windows\system32\lsass.exe
00:22:39.0494 3488  SamSs - ok
00:22:39.0541 3488  [ C624A1B32211C3166EDB3F4AB02A30B7 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
00:22:39.0541 3488  sbp2port - ok
00:22:39.0776 3488  [ 74A3B67F03877D06B09B1B40C5ED582E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
00:22:39.0776 3488  SCardSvr - ok
00:22:39.0947 3488  [ 92D2FA1870F4EB4A9BA767DB6E0DEF6F ] ScDeviceEnum    C:\Windows\System32\ScDeviceEnum.dll
00:22:39.0947 3488  ScDeviceEnum - ok
00:22:40.0432 3488  [ FA7ABD857DEB0FE3C94CC39A4C845E66 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
00:22:40.0447 3488  scfilter - ok
00:22:40.0729 3488  [ 3151A020E03DDE31AAC49F35C5EFB4DB ] Schedule        C:\Windows\system32\schedsvc.dll
00:22:40.0729 3488  Schedule - ok
00:22:40.0854 3488  [ ACFDC4EE40EC6E4A0AB91D923B8288C8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
00:22:40.0854 3488  SCPolicySvc - ok
00:22:40.0980 3488  [ C54B6B2170BF628FD42F799A66956D75 ] sdbus           C:\Windows\System32\drivers\sdbus.sys
00:22:40.0980 3488  sdbus - ok
00:22:41.0074 3488  [ 0B1E929D11A8E358106955603FAC65E8 ] sdstor          C:\Windows\System32\drivers\sdstor.sys
00:22:41.0088 3488  sdstor - ok
00:22:41.0182 3488  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
00:22:41.0182 3488  secdrv - ok
00:22:41.0260 3488  [ 6627154693B6C2B8A59727F5B38728E8 ] seclogon        C:\Windows\system32\seclogon.dll
00:22:41.0260 3488  seclogon - ok
00:22:41.0338 3488  [ 81FE9A81EDF8016816C9E91FBFBF7D35 ] SENS            C:\Windows\System32\sens.dll
00:22:41.0338 3488  SENS - ok
00:22:41.0447 3488  [ 6E4012AE67F09F867EF620C8D5524C0B ] SensrSvc        C:\Windows\system32\sensrsvc.dll
00:22:41.0463 3488  SensrSvc - ok
00:22:41.0525 3488  [ DB2FF24CE0BDD15FE75870AFE312BA89 ] SerCx           C:\Windows\system32\drivers\SerCx.sys
00:22:41.0541 3488  SerCx - ok
00:22:41.0588 3488  [ 0044B31F93946D5D41982314381FE431 ] SerCx2          C:\Windows\system32\drivers\SerCx2.sys
00:22:41.0588 3488  SerCx2 - ok
00:22:41.0666 3488  [ 1F0135949A6AD6025F363F80FE268251 ] Serenum         C:\Windows\System32\drivers\serenum.sys
00:22:41.0666 3488  Serenum - ok
00:22:41.0729 3488  [ 81633C87B42B63BA484A6177179AC750 ] Serial          C:\Windows\System32\drivers\serial.sys
00:22:41.0729 3488  Serial - ok
00:22:41.0808 3488  [ 148195AE95D9BC7375A08846439FDAC1 ] sermouse        C:\Windows\System32\drivers\sermouse.sys
00:22:41.0822 3488  sermouse - ok
00:22:41.0949 3488  [ 624BB76941938B9F5776DEA56004D33E ] SessionEnv      C:\Windows\system32\sessenv.dll
00:22:41.0965 3488  SessionEnv - ok
00:22:42.0012 3488  [ 472B7A5AC181C050888DB454663DD764 ] sfloppy         C:\Windows\System32\drivers\sfloppy.sys
00:22:42.0027 3488  sfloppy - ok
00:22:42.0184 3488  [ 8081FF3DAE8159FE8956B09BC29CE983 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
00:22:42.0215 3488  SharedAccess - ok
00:22:42.0387 3488  [ 7FD9A61A3523A61FC135D61D6E160314 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
00:22:42.0387 3488  ShellHWDetection - ok
00:22:42.0480 3488  [ 693C0C1A4F89BED4CEA1FA291638C02B ] silabenm        C:\Windows\system32\DRIVERS\silabenm.sys
00:22:43.0168 3488  silabenm - ok
00:22:43.0200 3488  [ CD54DDA4898439ADB7A2E26EB9133028 ] silabser        C:\Windows\system32\DRIVERS\silabser.sys
00:22:43.0215 3488  silabser - ok
00:22:43.0246 3488  [ 2F518D13DD6F3053837FE606F1A2EA1F ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
00:22:43.0246 3488  SiSRaid2 - ok
00:22:43.0293 3488  [ 1AC9A200A9C49C4508F04AAFFCA34A3F ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
00:22:43.0310 3488  SiSRaid4 - ok
00:22:43.0451 3488  [ 3C84DCCE5B322F745A75CA8BA3A0F6B3 ] smphost         C:\Windows\System32\smphost.dll
00:22:43.0465 3488  smphost - ok
00:22:43.0543 3488  [ 961507DB02D7AC0B7A7828D457143B8E ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
00:22:43.0543 3488  SNMPTRAP - ok
00:22:43.0683 3488  [ F6AF6499C3788105EA7AF1DA27769A77 ] spaceport       C:\Windows\system32\drivers\spaceport.sys
00:22:43.0683 3488  spaceport - ok
00:22:43.0730 3488  [ F337BE11071818FC3F5DC2940B6BDE34 ] SpbCx           C:\Windows\system32\drivers\SpbCx.sys
00:22:43.0730 3488  SpbCx - ok
00:22:43.0918 3488  [ FCB156A6745631A67DEA61827061D483 ] Spooler         C:\Windows\System32\spoolsv.exe
00:22:43.0918 3488  Spooler - ok
00:22:44.0543 3488  [ F264662C057A54AA2DE41B3C7551712F ] sppsvc          C:\Windows\system32\sppsvc.exe
00:22:44.0668 3488  sppsvc - ok
00:22:44.0746 3488  [ 3D0CA97EA01210E0BC032EB6FDCCF03D ] srv             C:\Windows\system32\DRIVERS\srv.sys
00:22:44.0793 3488  srv - ok
00:22:44.0919 3488  [ FD4A645C5BA587257A97D7AC46212F4A ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
00:22:45.0435 3488  srv2 - ok
00:22:46.0027 3488  [ D3EAE998706531157CBEA3F5218435BC ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
00:22:46.0344 3488  srvnet - ok
00:22:46.0387 3488  [ CF6C3037839CF78421A94F9060C2886F ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
00:22:46.0390 3488  SSDPSRV - ok
00:22:46.0406 3488  [ 198A737DBA666F4808D62E9A8277A6B7 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
00:22:46.0406 3488  SstpSvc - ok
00:22:46.0515 3488  [ 857693A4DA826BCD422C48114AA72B10 ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe
00:22:46.0937 3488  STacSV - ok
00:22:46.0952 3488  [ 366DEA74BBA65B362BCCFC6FC2ADFD8B ] stexstor        C:\Windows\system32\drivers\stexstor.sys
00:22:46.0968 3488  stexstor - ok
00:22:46.0984 3488  [ A73F13903345464F04D463B84890A271 ] STHDA           C:\Windows\system32\DRIVERS\stwrt64.sys
00:22:46.0999 3488  STHDA - ok
00:22:47.0016 3488  [ 63E9CE568CF1192771A5F0460DE7D2B9 ] stisvc          C:\Windows\System32\wiaservc.dll
00:22:47.0031 3488  stisvc - ok
00:22:47.0046 3488  [ 0ED2E318ABB68C1A35A8B8038BDB4C90 ] storahci        C:\Windows\system32\drivers\storahci.sys
00:22:47.0046 3488  storahci - ok
00:22:47.0077 3488  [ 8B9486B64E5FC17FB9CC04CA10B77A34 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
00:22:47.0077 3488  storflt - ok
00:22:47.0093 3488  [ 1D5A045F59D216448FCDE3A8D69970E2 ] stornvme        C:\Windows\system32\drivers\stornvme.sys
00:22:47.0093 3488  stornvme - ok
00:22:47.0109 3488  [ A45F5AC9D8069D0EC66E3CA73103073B ] StorSvc         C:\Windows\system32\storsvc.dll
00:22:47.0124 3488  StorSvc - ok
00:22:47.0124 3488  [ 548759755BC73DAD663250239D7E0B9F ] storvsc         C:\Windows\system32\drivers\storvsc.sys
00:22:47.0124 3488  storvsc - ok
00:22:47.0140 3488  [ E395BE02F80A79A6CF973BA38DBB8135 ] svsvc           C:\Windows\system32\svsvc.dll
00:22:47.0265 3488  svsvc - ok
00:22:47.0281 3488  [ 65454187E0F8B6C0DCECB0287D06EC43 ] swenum          C:\Windows\System32\drivers\swenum.sys
00:22:47.0281 3488  swenum - ok
00:22:47.0296 3488  [ 1C71D72D4997A284128FBEE770726330 ] swprv           C:\Windows\System32\swprv.dll
00:22:47.0312 3488  swprv - ok
00:22:47.0343 3488  [ 7E85DB0463AD2403AE84AD162B162279 ] SysMain         C:\Windows\system32\sysmain.dll
00:22:47.0343 3488  SysMain - ok
00:22:47.0421 3488  [ D73DBBB96CEE90C2856164AAD8543425 ] SystemEventsBroker C:\Windows\System32\SystemEventsBrokerServer.dll
00:22:47.0437 3488  SystemEventsBroker - ok
00:22:47.0468 3488  [ 54A1F83B166F1062000A0D816CB3B43A ] TabletInputService C:\Windows\System32\TabSvc.dll
00:22:47.0468 3488  TabletInputService - ok
00:22:47.0515 3488  [ 5A5BAB1CA9621E73E25EE4744B67CDA6 ] TapiSrv         C:\Windows\System32\tapisrv.dll
00:22:47.0531 3488  TapiSrv - ok
00:22:47.0578 3488  [ 4C58B60C1E6A2946D6E3D67A36E5E03E ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
00:22:47.0609 3488  Tcpip - ok
00:22:47.0703 3488  [ 4C58B60C1E6A2946D6E3D67A36E5E03E ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
00:22:47.0703 3488  TCPIP6 - ok
00:22:47.0734 3488  [ 41CF802064F72E55F50CA0A221FD36D4 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
00:22:47.0734 3488  tcpipreg - ok
00:22:47.0765 3488  [ 576FA545FAB846B06E79B324160DE25C ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
00:22:47.0812 3488  tdx - ok
00:22:47.0843 3488  [ 232D185D2337F141311D0CF1983E1431 ] terminpt        C:\Windows\System32\drivers\terminpt.sys
00:22:47.0843 3488  terminpt - ok
00:22:47.0890 3488  [ 76938862B2674EFED79E814CD36E6A08 ] TermService     C:\Windows\System32\termsrv.dll
00:22:47.0906 3488  TermService - ok
00:22:47.0952 3488  [ 2180DBCE75B914E5E5BBFFFAAE97AA21 ] Themes          C:\Windows\system32\themeservice.dll
00:22:47.0952 3488  Themes - ok
00:22:48.0048 3488  [ 4C5179DB61B9E14BEC15CDC4B152B2E9 ] THREADORDER     C:\Windows\system32\mmcss.dll
00:22:48.0048 3488  THREADORDER - ok
00:22:48.0095 3488  [ B5ED9CC61798C7D44BD535D40B89EFB5 ] TimeBroker      C:\Windows\System32\TimeBrokerServer.dll
00:22:48.0095 3488  TimeBroker - ok
00:22:48.0172 3488  [ 80A2FC1A089A71F2DBE5D8394FFB009F ] TPM             C:\Windows\system32\drivers\tpm.sys
00:22:48.0187 3488  TPM - ok
00:22:48.0204 3488  [ 884113C2BB703FE806C8608B75F34831 ] TrkWks          C:\Windows\System32\trkwks.dll
00:22:48.0204 3488  TrkWks - ok
00:22:48.0281 3488  [ 44A94FB4C76528D2382FFE04B05827C3 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
00:22:48.0281 3488  TrustedInstaller - ok
00:22:48.0296 3488  [ BF8F54CA37E9C9D6582C31C5761F8C93 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
00:22:48.0296 3488  TsUsbFlt - ok
00:22:48.0312 3488  [ 20185BEB7512EDE4EFECDFA148AC9F99 ] TsUsbGD         C:\Windows\System32\drivers\TsUsbGD.sys
00:22:48.0328 3488  TsUsbGD - ok
00:22:48.0343 3488  [ E85916632CD3B9E9B546968DB950BF42 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
00:22:48.0343 3488  tunnel - ok
00:22:48.0374 3488  [ F6EEAD052943B5A3104C1405BB856C54 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
00:22:48.0374 3488  uagp35 - ok
00:22:48.0421 3488  [ FE6067B1FD4E63650C667B33D080565B ] UASPStor        C:\Windows\System32\drivers\uaspstor.sys
00:22:48.0421 3488  UASPStor - ok
00:22:48.0437 3488  [ 807F8CF3E973305FC435C61CBBEE2A49 ] UCX01000        C:\Windows\System32\drivers\ucx01000.sys
00:22:48.0437 3488  UCX01000 - ok
00:22:48.0484 3488  [ C61EAF8E1E4B2F62BA4FDF457440B2C6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
00:22:48.0484 3488  udfs - ok
00:22:48.0499 3488  [ 9578691F297E1B1F519970FE6D47CB21 ] UEFI            C:\Windows\System32\drivers\UEFI.sys
00:22:48.0499 3488  UEFI - ok
00:22:48.0531 3488  [ A867F0F978EE64C87FADC3B100869EE4 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
00:22:48.0531 3488  UI0Detect - ok
00:22:48.0578 3488  [ 5EAB5117DDB24FC4D39E6FFFCF1837B9 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
00:22:48.0578 3488  uliagpkx - ok
00:22:48.0594 3488  [ DA34C39A18E60E7C3FA0630566408034 ] umbus           C:\Windows\System32\drivers\umbus.sys
00:22:48.0594 3488  umbus - ok
00:22:48.0609 3488  [ AE8294875E5446E359B1E8035D40C05E ] UmPass          C:\Windows\System32\drivers\umpass.sys
00:22:48.0609 3488  UmPass - ok
00:22:48.0749 3488  [ 87743CF5FF2FB3F2B424F0D8DFF8FD8C ] UmRdpService    C:\Windows\System32\umrdp.dll
00:22:48.0765 3488  UmRdpService - ok
00:22:48.0876 3488  [ C98493DD8E6A50154FAC75C15E1C36BB ] upnphost        C:\Windows\System32\upnphost.dll
00:22:48.0908 3488  upnphost - ok
00:22:48.0939 3488  [ F957092C63CD71D85903CA0D8370F473 ] USBAAPL64       C:\Windows\System32\Drivers\usbaapl64.sys
00:22:48.0939 3488  USBAAPL64 - ok
00:22:49.0001 3488  [ 621317D14B93CBFBD5694767EFB6B40A ] usbccgp         C:\Windows\System32\drivers\usbccgp.sys
00:22:49.0017 3488  usbccgp - ok
00:22:49.0033 3488  [ 0139248F6B95CF0D837B5B46A2722D40 ] usbcir          C:\Windows\System32\drivers\usbcir.sys
00:22:49.0048 3488  usbcir - ok
00:22:49.0065 3488  [ C996CBEF922B5653A01E3F50DDCE2F86 ] usbehci         C:\Windows\System32\drivers\usbehci.sys
00:22:49.0065 3488  usbehci - ok
00:22:49.0079 3488  [ E30B159760053C5A1297D2CD08046CD7 ] usbhub          C:\Windows\System32\drivers\usbhub.sys
00:22:49.0173 3488  usbhub - ok
00:22:49.0329 3488  [ 5C90D5379B53590FBB24BBAD4FA682EE ] USBHUB3         C:\Windows\System32\drivers\UsbHub3.sys
00:22:49.0345 3488  USBHUB3 - ok
00:22:49.0408 3488  [ A0F0484C97D6441ED6A75D7426ECCC9E ] usbohci         C:\Windows\System32\drivers\usbohci.sys
00:22:49.0423 3488  usbohci - ok
00:22:49.0454 3488  [ 4D655E3B684BE9B0F7FFD8A2935C348C ] usbprint        C:\Windows\System32\drivers\usbprint.sys
00:22:49.0454 3488  usbprint - ok
00:22:49.0487 3488  [ 0F030491BA4A27BD46F8B8ACEEE83F1A ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
00:22:49.0501 3488  usbscan - ok
00:22:49.0533 3488  [ 9D168BFA334D47BE404367EB58D4E130 ] USBSTOR         C:\Windows\System32\drivers\USBSTOR.SYS
00:22:49.0548 3488  USBSTOR - ok
00:22:49.0566 3488  [ FC974B03C8B87455F44F734C8F31A3C8 ] usbuhci         C:\Windows\System32\drivers\usbuhci.sys
00:22:49.0742 3488  usbuhci - ok
00:22:49.0853 3488  [ 44603DA5A87FB491EF59C889EBBB4DDB ] USBXHCI         C:\Windows\System32\drivers\USBXHCI.SYS
00:22:49.0853 3488  USBXHCI - ok
00:22:49.0934 3488  [ 382100E75B6F4668AEAEF228C6CEFFAD ] VaultSvc        C:\Windows\system32\lsass.exe
00:22:49.0934 3488  VaultSvc - ok
00:22:49.0986 3488  [ FEB26E3B8345A7E8D62F945C4AE86562 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
00:22:49.0986 3488  vdrvroot - ok
00:22:50.0143 3488  [ 8A4D808D1EC7C1C47B2C8BF488A9A07A ] vds             C:\Windows\System32\vds.exe
00:22:50.0205 3488  vds - ok
00:22:50.0236 3488  [ A026EDEAA5EECAE0B08E2748B616D4BD ] VerifierExt     C:\Windows\system32\drivers\VerifierExt.sys
00:22:50.0236 3488  VerifierExt - ok
00:22:50.0299 3488  [ 8ABB4BABF59F092DF0B43778D8FD1884 ] vhdmp           C:\Windows\System32\drivers\vhdmp.sys
00:22:50.0346 3488  vhdmp - ok
00:22:50.0377 3488  [ 06D38968028E9AB19DE9B618C7B6D199 ] viaide          C:\Windows\system32\drivers\viaide.sys
00:22:50.0392 3488  viaide - ok
00:22:50.0408 3488  [ 511AD3FF957A0127E6BD336FF6F89C38 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
00:22:50.0425 3488  vmbus - ok
00:22:50.0425 3488  [ DA40BEA0A863CE768C940CA9723BF81F ] VMBusHID        C:\Windows\System32\drivers\VMBusHID.sys
00:22:50.0425 3488  VMBusHID - ok
00:22:50.0456 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicguestinterface C:\Windows\System32\ICSvc.dll
00:22:50.0471 3488  vmicguestinterface - ok
00:22:50.0471 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicheartbeat   C:\Windows\System32\ICSvc.dll
00:22:50.0486 3488  vmicheartbeat - ok
00:22:50.0486 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmickvpexchange C:\Windows\System32\ICSvc.dll
00:22:50.0503 3488  vmickvpexchange - ok
00:22:50.0517 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicrdv         C:\Windows\System32\ICSvc.dll
00:22:50.0517 3488  vmicrdv - ok
00:22:50.0565 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicshutdown    C:\Windows\System32\ICSvc.dll
00:22:50.0565 3488  vmicshutdown - ok
00:22:50.0596 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmictimesync    C:\Windows\System32\ICSvc.dll
00:22:50.0596 3488  vmictimesync - ok
00:22:50.0658 3488  [ C42C38E15C0DC39D4B0BDF34F733E468 ] vmicvss         C:\Windows\System32\ICSvc.dll
00:22:50.0658 3488  vmicvss - ok
00:22:50.0830 3488  [ 0E068DF0796A33D2922EC69652A2C043 ] VMUSBArbService C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
00:22:50.0830 3488  VMUSBArbService - ok
00:22:50.0949 3488  [ 6DBA40D936A02CDE219D43FD47C845F8 ] vmware-view-usbd C:\Program Files (x86)\VMware\VMware Horizon View Client\bin\vmware-view-usbd.exe
00:22:50.0958 3488  vmware-view-usbd - ok
00:22:50.0981 3488  [ 771D3F512B2738338E321556D9D4690F ] vmwsprrdpwks    C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe
00:22:50.0982 3488  vmwsprrdpwks - ok
00:22:51.0028 3488  [ 436E1A724E7E683F6B612D3D58F04241 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
00:22:51.0030 3488  volmgr - ok
00:22:51.0062 3488  [ 7DD4EAE2E680948D9AFF3E1B5234C1D3 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
00:22:51.0065 3488  volmgrx - ok
00:22:51.0108 3488  [ 17F7B0F2298D97F4B6C7A69511033D3D ] volsnap         C:\Windows\system32\drivers\volsnap.sys
00:22:51.0112 3488  volsnap - ok
00:22:51.0133 3488  [ DAC438FB5FF85A9E72806E2341D5D732 ] vpci            C:\Windows\System32\drivers\vpci.sys
00:22:51.0139 3488  vpci - ok
00:22:51.0169 3488  [ 4539F45F9F4C9757A86A56C949421E07 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
00:22:51.0175 3488  vsmraid - ok
00:22:51.0203 3488  [ D0CBA7B3531CCF2ADB985856D5F92434 ] VSS             C:\Windows\system32\vssvc.exe
00:22:51.0216 3488  VSS - ok
00:22:51.0235 3488  [ 0849B7260F26FE05EA56DED0672E2F4B ] VSTXRAID        C:\Windows\system32\drivers\vstxraid.sys
00:22:51.0241 3488  VSTXRAID - ok
00:22:51.0266 3488  [ 71066FF95C487327E44C8AF1B72EBE8B ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
00:22:51.0268 3488  vwifibus - ok
00:22:51.0282 3488  [ 29AB43937FFDA0B0FB56984226E698C6 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
00:22:51.0284 3488  vwififlt - ok
00:22:51.0299 3488  [ 8B8624A93E3F88CB923AEB05B6313227 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
00:22:51.0303 3488  vwifimp - ok
00:22:51.0327 3488  [ DC821E811EFBB65CDD77FBB8B6ECA385 ] W32Time         C:\Windows\system32\w32time.dll
00:22:51.0332 3488  W32Time - ok
00:22:51.0349 3488  [ 0910AB9ED404C1434E2D0376C2AD5D8B ] WacomPen        C:\Windows\System32\drivers\wacompen.sys
00:22:51.0353 3488  WacomPen - ok
00:22:51.0383 3488  [ 841345442390953CBC8801B95D3D0540 ] wbengine        C:\Windows\system32\wbengine.exe
00:22:51.0398 3488  wbengine - ok
00:22:51.0419 3488  [ 0F1DFA2FED73FA78B8C3CDE332A870F6 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
00:22:51.0424 3488  WbioSrvc - ok
00:22:51.0433 3488  [ 0EAEC313B24837613621B4A2536ED382 ] Wcmsvc          C:\Windows\System32\wcmsvc.dll
00:22:51.0441 3488  Wcmsvc - ok
00:22:51.0487 3488  [ F6B4C2280FF7C7156AC8A4687B9DA35E ] wcncsvc         C:\Windows\System32\wcncsvc.dll
00:22:51.0502 3488  wcncsvc - ok
00:22:51.0515 3488  [ B7BF1D783F5B2484E8CE1C0C78257F16 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
00:22:51.0528 3488  WcsPlugInService - ok
00:22:51.0556 3488  [ F2E08D1C067FEFC3A42D21FD4810F1D3 ] WdBoot          C:\Windows\system32\drivers\WdBoot.sys
00:22:51.0557 3488  WdBoot - ok
00:22:51.0575 3488  [ CB6C63FF8342B467E2EF76E98D5B934D ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
00:22:51.0582 3488  Wdf01000 - ok
00:22:51.0596 3488  [ E234820E6B84ABA5E84E00227F505AE8 ] WdFilter        C:\Windows\system32\drivers\WdFilter.sys
00:22:51.0599 3488  WdFilter - ok
00:22:51.0611 3488  [ F581F9C9D6953FABFA24E67105F0B614 ] WdiServiceHost  C:\Windows\system32\wdi.dll
00:22:51.0613 3488  WdiServiceHost - ok
00:22:51.0616 3488  [ F581F9C9D6953FABFA24E67105F0B614 ] WdiSystemHost   C:\Windows\system32\wdi.dll
00:22:51.0623 3488  WdiSystemHost - ok
00:22:51.0636 3488  [ A74AD6D80AC26E1B5DD276FC927F2BAC ] WdNisDrv        C:\Windows\system32\Drivers\WdNisDrv.sys
00:22:51.0638 3488  WdNisDrv - ok
00:22:51.0653 3488  WdNisSvc - ok
00:22:51.0696 3488  [ A70CAF5EA36CBA5FCA24244306D4D5C6 ] WebClient       C:\Windows\System32\webclnt.dll
00:22:51.0700 3488  WebClient - ok
00:22:51.0721 3488  [ 384E1D04FE20845B2559D292F17A9FA1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
00:22:51.0725 3488  Wecsvc - ok
00:22:51.0730 3488  [ 455014F4E48B67EBE0F032E2B0E06BF2 ] WEPHOSTSVC      C:\Windows\system32\wephostsvc.dll
00:22:51.0733 3488  WEPHOSTSVC - ok
00:22:51.0753 3488  [ F13DBA57CEA9B7074B95EDCA6AD2635E ] wercplsupport   C:\Windows\System32\wercplsupport.dll
00:22:51.0760 3488  wercplsupport - ok
00:22:51.0765 3488  [ FD7E58B6AA3EABF2D12B9762A20E11E4 ] WerSvc          C:\Windows\System32\WerSvc.dll
00:22:51.0772 3488  WerSvc - ok
00:22:51.0799 3488  [ 715ABA3DD164D06457A2A3C92F6EA9D5 ] WFPLWFS         C:\Windows\system32\DRIVERS\wfplwfs.sys
00:22:51.0802 3488  WFPLWFS - ok
00:22:51.0817 3488  [ 8C840E1FD7584E74BD0CC1EA581EC187 ] WiaRpc          C:\Windows\System32\wiarpc.dll
00:22:51.0824 3488  WiaRpc - ok
00:22:51.0850 3488  [ 5F66B7BB330AA80067FC66149A692620 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
00:22:51.0853 3488  WIMMount - ok
00:22:51.0858 3488  WinDefend - ok
00:22:51.0892 3488  [ 0E70990EC2E5D2331AA5E88DB0CFB826 ] WinHttpAutoProxySvc C:\Windows\system32\winhttp.dll
00:22:51.0898 3488  WinHttpAutoProxySvc - ok
00:22:52.0029 3488  [ FC8BD690321216C32BB58B035B6D5674 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
00:22:52.0033 3488  Winmgmt - ok
00:22:52.0082 3488  [ B56BFFFB740D76E634DB7B4802E36E4E ] WinRM           C:\Windows\system32\WsmSvc.dll
00:22:52.0113 3488  WinRM - ok
00:22:52.0173 3488  [ 3AF1FA17F1C4ACBDB660D8F98B1A9C13 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
00:22:52.0179 3488  WinUsb - ok
00:22:52.0288 3488  [ F6F13FB009D43CE75FDBC35A5A46F9BB ] WlanSvc         C:\Windows\System32\wlansvc.dll
00:22:52.0297 3488  WlanSvc - ok
00:22:52.0488 3488  [ 06BF5897949A8F24893F792E876B71F5 ] wlidsvc         C:\Windows\system32\wlidsvc.dll
00:22:52.0497 3488  wlidsvc - ok
00:22:52.0509 3488  [ 2834D9D3B4F554A39C72F00EA3F0E128 ] WmiAcpi         C:\Windows\System32\drivers\wmiacpi.sys
00:22:52.0510 3488  WmiAcpi - ok
00:22:52.0531 3488  [ B96F7A1236C3F21212DE2C40A3DDB005 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
00:22:52.0534 3488  wmiApSrv - ok
00:22:52.0562 3488  WMPNetworkSvc - ok
00:22:52.0574 3488  [ 7FC5667DF73D4B04AA457CC3A4180E09 ] Wof             C:\Windows\system32\drivers\Wof.sys
00:22:52.0576 3488  Wof - ok
00:22:52.0614 3488  [ EDFA5CEDBE174FAAA4A09A6B297AEA42 ] workfolderssvc  C:\Windows\system32\workfolderssvc.dll
00:22:52.0628 3488  workfolderssvc - ok
00:22:52.0656 3488  [ A2468CC3509394A33C4C32F99563D845 ] wpcfltr         C:\Windows\system32\DRIVERS\wpcfltr.sys
00:22:52.0658 3488  wpcfltr - ok
00:22:52.0683 3488  [ 19F4DF69876DA7E9C4965351560FE6B7 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
00:22:52.0690 3488  WPCSvc - ok
00:22:52.0720 3488  [ 25BE82B325AC22FE563A58A1AC29F4C1 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
00:22:52.0724 3488  WPDBusEnum - ok
00:22:52.0729 3488  [ 9F2904B55F6CECCD1A8D986B5CE2609A ] WpdUpFltr       C:\Windows\system32\drivers\WpdUpFltr.sys
00:22:52.0730 3488  WpdUpFltr - ok
00:22:52.0752 3488  [ AE072B0339D0A18E455DC21666CAD572 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
00:22:52.0755 3488  ws2ifsl - ok
00:22:52.0790 3488  [ 501D5EFAB9711039479AE48401386D2B ] wscsvc          C:\Windows\System32\wscsvc.dll
00:22:52.0793 3488  wscsvc - ok
00:22:52.0797 3488  WSearch - ok
00:22:52.0831 3488  [ 552BD369EF502489AF40899BDBFF35C6 ] wsnm            C:\Program Files (x86)\VMware\VMware Horizon View Client\wsnm\wsnm.exe
00:22:52.0834 3488  wsnm - ok
00:22:53.0027 3488  [ 6B2D71124C1EA86B74412F414C42431D ] WSService       C:\Windows\System32\WSService.dll
00:22:53.0105 3488  WSService - ok
00:22:53.0260 3488  [ F8AAE8C41092D195C470EE7EF2D0BB01 ] wuauserv        C:\Windows\system32\wuaueng.dll
00:22:53.0304 3488  wuauserv - ok
00:22:53.0366 3488  [ 481286719402E4BAEFEA0604AB1B5113 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
00:22:53.0368 3488  WudfPf - ok
00:22:53.0400 3488  [ D7B4859227B02BCC1055B279A63C937F ] WUDFRd          C:\Windows\System32\drivers\WUDFRd.sys
00:22:53.0404 3488  WUDFRd - ok
00:22:53.0413 3488  [ D7B4859227B02BCC1055B279A63C937F ] WUDFSensorLP    C:\Windows\system32\DRIVERS\WUDFRd.sys
00:22:53.0416 3488  WUDFSensorLP - ok
00:22:53.0437 3488  [ 51D28F7F1F888DDCF2C67DCF3B79A5D3 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
00:22:53.0441 3488  wudfsvc - ok
00:22:53.0462 3488  [ D7B4859227B02BCC1055B279A63C937F ] WUDFWpdFs       C:\Windows\system32\DRIVERS\WUDFRd.sys
00:22:53.0463 3488  WUDFWpdFs - ok
00:22:53.0472 3488  [ D7B4859227B02BCC1055B279A63C937F ] WUDFWpdMtp      C:\Windows\system32\DRIVERS\WUDFRd.sys
00:22:53.0473 3488  WUDFWpdMtp - ok
00:22:53.0597 3488  [ A0900F8F628B5AF6841414EB3CF11E50 ] WwanSvc         C:\Windows\System32\wwansvc.dll
00:22:53.0625 3488  WwanSvc - ok
00:22:53.0640 3488  ================ Scan global ===============================
00:22:53.0680 3488  [ 3500AF0BA2EF095BF313EEB75D2366C6 ] C:\Windows\system32\basesrv.dll
00:22:53.0772 3488  [ EAB311B0A7A8EA0346F14F08D4BC8F46 ] C:\Windows\system32\winsrv.dll
00:22:53.0817 3488  [ 3600ED7EA8AED849E20700551C0BD63B ] C:\Windows\system32\sxssrv.dll
00:22:53.0894 3488  [ E0C7813A97CA7947FF5C18A8F3B61A45 ] C:\Windows\system32\services.exe
00:22:53.0898 3488  [Global] - ok
00:22:53.0898 3488  ================ Scan MBR ==================================
00:22:53.0922 3488  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
00:22:53.0945 3488  \Device\Harddisk0\DR0 - ok
00:22:53.0952 3488  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1
00:22:53.0980 3488  \Device\Harddisk1\DR1 - ok
00:22:53.0981 3488  ================ Scan VBR ==================================
00:22:53.0984 3488  [ 7B6E0BBDB7BB60CBDAC4EA9DBBCFB1D1 ] \Device\Harddisk0\DR0\Partition1
00:22:53.0999 3488  \Device\Harddisk0\DR0\Partition1 - ok
00:22:54.0019 3488  [ 725FF3117B2345BE9DDD1B451FCC0501 ] \Device\Harddisk0\DR0\Partition2
00:22:54.0027 3488  \Device\Harddisk0\DR0\Partition2 - ok
00:22:54.0035 3488  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk0\DR0\Partition3
00:22:54.0037 3488  \Device\Harddisk0\DR0\Partition3 - ok
00:22:54.0057 3488  [ 9A46419798180A728FEAE1618C879082 ] \Device\Harddisk0\DR0\Partition4
00:22:54.0076 3488  \Device\Harddisk0\DR0\Partition4 - ok
00:22:54.0080 3488  [ 036BD3EDA2CC2C990B6635202BF19C9B ] \Device\Harddisk1\DR1\Partition1
00:22:54.0081 3488  \Device\Harddisk1\DR1\Partition1 - ok
00:22:54.0081 3488  ============================================================
00:22:54.0081 3488  Scan finished
00:22:54.0081 3488  ============================================================
00:22:54.0093 3472  Detected object count: 1
00:22:54.0093 3472  Actual detected object count: 1
00:30:31.0759 3472  HKLM\SYSTEM\ControlSet001\services\99224798 - will be deleted on reboot
00:30:31.0886 3472  C:\Windows\system32\drivers\48963131.sys - will be deleted on reboot
00:30:31.0886 3472  99224798 ( HiddenService.Multi.Generic ) - User select action: Delete
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2017-12-01 14:44:13
-----------------------------
14:44:13.681    OS Version: Windows x64 6.2.9200
14:44:13.681    Number of processors: 4 586 0x3001
14:44:13.681    ComputerName: HP-DESKTOP  UserName: Owner
14:44:15.087    Initialize success
14:44:15.087    VM: initialized successfully
14:44:15.087    VM: Amd CPU BiosDisabled
14:46:22.359    AVAST engine defs: 17030301
14:49:33.023    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000028
14:49:33.023    Disk 0 Vendor: ST2000DM001-1ER164 HP51 Size: 1907729MB BusType: 11
14:49:33.151    Disk 0 MBR read successfully
14:49:33.163    Disk 0 MBR scan
14:49:33.163    Disk 0 unknown MBR code
14:49:33.163    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
14:49:33.241    Disk 0 scanning C:\Windows\system32\drivers
14:49:50.530    Service scanning
14:50:20.265    Modules scanning
14:50:20.265    Disk 0 trace - called modules:
14:50:20.280    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
14:50:20.280    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000f36b5770]
14:50:20.296    3 CLASSPNP.SYS[fffff801e1a81170] -> nt!IofCallDriver -> \Device\00000028[0xffffe000f34fc060]
14:50:21.939    AVAST engine scan C:\
17:13:22.180    Disk 0 MBR has been saved successfully to "F:\MBR.dat"
17:13:22.259    The log file has been saved successfully to "F:\aswMBR.txt"
18:28:47.000    Disk 0 statistics 19550655/0/0 @ 0.97 MB/s
18:28:47.016    Scan finished successfully
19:15:56.494    Disk 0 MBR has been saved successfully to "F:\MBR.dat"
19:15:56.634    The log file has been saved successfully to "F:\log.txt"

Haven't done the fixlist yet because I mentioned that Teamviewer worked for me despite what you saw. I wonder if the virus allows it to function just not function properly?
 


  • 0

#10
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

Go ahead and run the fixlist,


  • 0

Advertisements


#11
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

New FRST:

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2017
Ran by Owner (01-12-2017 19:42:41)
Running from C:\Users\Owner\Documents\My Documentss
Windows 8.1 (Update) (X64) (2016-08-17 03:13:17)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3592585487-3101742847-3297218791-500 - Administrator - Disabled)
Guest (S-1-5-21-3592585487-3101742847-3297218791-501 - Limited - Disabled)
Owner (S-1-5-21-3592585487-3101742847-3297218791-1001 - Administrator - Enabled) => C:\Users\Owner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{F6FCA281-09CC-4753-990C-937B93A52C94}) (Version: 1.6 - Eyeo GmbH)
Apple Application Support (32-bit) (HKLM-x32\...\{D2FE6376-E549-4F63-A2C5-CA24DA035DE4}) (Version: 5.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Canon MX330 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX330_series) (Version:  - )
DisplayKEY USB Cradle (HKLM\...\{BBA09DF4-4519-4BD0-B203-A58CACB92DFA}) (Version: 2.0.0.329 - Supra)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 62.0.3202.94 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 57.0 (x64 en-US) (HKLM\...\Mozilla Firefox 57.0 (x64 en-US)) (Version: 57.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 57.0.0.6525 - Mozilla)
Pulse Secure Setup Client (HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\Juniper_Setup_Client) (Version: 8.1.6.61491 - Pulse Secure, LLC)
Pulse Secure Setup Client 64-bit Activex Control (HKLM\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Pulse Secure, LLC)
Skype version 8.11 (HKLM-x32\...\Skype_is1) (Version: 8.11 - Skype Technologies S.A.)
TeamViewer 13 (HKLM-x32\...\TeamViewer) (Version: 13.0.5058 - TeamViewer)
VMware Horizon Client (HKLM\...\{C7F8E8FA-0832-427E-B2B1-ABF6F8495C35}) (Version: 3.5.2.30397 - VMware, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {37E3E53A-7645-4BC9-A9E5-6AD32F4E1D7F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {B42061CE-B050-4D93-9898-FDC821CAFA75} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-06-25] (Google Inc.)
Task: {E26968CF-C91C-4ECD-8592-53C9462086F2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-06-25] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2016-09-01 17:12 - 2016-09-01 17:12 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 001353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-06-16 11:10 - 2015-06-16 11:10 - 000226240 _____ () C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
2015-07-31 15:42 - 2015-07-31 15:42 - 006363792 _____ () C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe
2011-11-11 14:27 - 2011-11-11 14:27 - 000073216 _____ () C:\dKEYUSBCradle\stunnel-4.10.exe
2016-08-17 21:28 - 2016-08-17 21:28 - 000183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-06-16 11:04 - 2015-06-16 11:04 - 000239552 _____ () C:\Program Files (x86)\Common Files\VMware\DeviceRedirectionCommon\ftnlapi.dll
2005-03-29 00:58 - 2005-03-29 00:58 - 000847872 _____ () C:\dKEYUSBCradle\libeay32.dll
2010-03-16 09:52 - 2010-03-16 09:52 - 000159744 _____ () C:\dKEYUSBCradle\libssl32.dll
2017-11-13 20:26 - 2017-11-16 16:11 - 001551816 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\ffmpeg.dll
2017-11-13 20:26 - 2017-11-16 16:08 - 000088064 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node
2017-11-13 20:26 - 2017-11-16 16:08 - 002559608 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\libglesv2.dll
2017-11-13 20:26 - 2017-11-16 16:08 - 000031864 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\libegl.dll
2017-11-13 20:26 - 2017-11-16 16:08 - 000400896 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\@paulcbetts\spellchecker\build\Release\spellchecker.node
2017-11-13 20:26 - 2017-11-16 16:08 - 000129536 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node
2017-11-13 20:26 - 2017-11-16 16:08 - 002130944 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\slimcore\bin\skypert.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 07:25 - 2017-12-01 19:31 - 000000035 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Theme2\img10.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B0F18B4F-919F-43AF-A627-9C194E0F3EA7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AA45BFFA-AF50-4204-936E-8298D71F48C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{6F5DD6F7-273C-4120-88F4-21075693C53D}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{653C3824-617F-428D-B923-667101E57C88}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{2F0DA2BF-4BC6-48F6-B1FE-526BEFBE03F2}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{06BE2CF4-D1FA-44D2-8E4A-7180A21CA29B}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{F3CECC4E-413A-4150-913D-3CFB88A0F371}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{8E917DD7-9FA7-48D9-BC8C-DE3C3F9818B5}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-remotemks.exe
FirewallRules: [{72F5AA83-97BB-4815-AA2F-93BDB81022FF}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{AD42FE2C-FA6B-42E3-AC07-AA4D90ED436B}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{7349F58B-B9D1-4E0A-A317-53A03F2FF9AC}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{380A0B4C-5C08-493A-A13E-E90B145DF4C7}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{805B19D2-A89C-4037-BB86-AE3C567E2F5D}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{4B4FA0B1-B9A5-4F67-8736-C9DD5C9F37C1}] => (Allow) C:\Program Files (x86)\VMware\VMware Horizon View Client\vmware-view.exe
FirewallRules: [{7819CFC0-2C8D-4DBF-9C0C-536FE8552347}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{21B12A09-1673-4F5A-8A79-A7F0AFA5487A}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{6876DCAD-50FE-48DF-8E7C-585DB61594AC}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{09E7FC8C-9F5A-41FE-988F-3F6484F09F07}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{EF7D00EF-4397-492D-98BF-800DEC16BB01}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{EF5B2034-9891-437F-83CE-FFF59CF4DBD4}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{E30262F1-8502-4A36-93FE-77034462D423}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{4F4CE04A-BE79-4321-8C9E-017A8A0D488B}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{79D3C402-663D-45A4-A041-A49611746F3F}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D292530A-95EA-4DE5-863D-07E6EAFD20C8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Restore Points =========================

13-07-2017 19:01:45 Windows Update
23-07-2017 00:38:49 Windows Update
09-08-2017 07:06:25 Windows Modules Installer
12-08-2017 15:05:36 Windows Update
15-09-2017 04:39:34 Windows Update
15-10-2017 09:31:32 Windows Update
19-10-2017 04:49:09 Windows Update
17-11-2017 08:53:05 Windows Update
24-11-2017 09:48:48 Windows Update
28-11-2017 13:59:11 Installed Adblock Plus for IE (32-bit and 64-bit)
01-12-2017 17:54:13 Removed Bonjour

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (12/01/2017 07:35:28 PM) (Source: DCOM) (EventID: 10010) (User: HP-DESKTOP)
Description: The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.

Error: (12/01/2017 07:35:28 PM) (Source: DCOM) (EventID: 10010) (User: HP-DESKTOP)
Description: The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.

Error: (12/01/2017 07:35:28 PM) (Source: DCOM) (EventID: 10010) (User: HP-DESKTOP)
Description: The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.


==================== Memory info ===========================

Processor: AMD A8-7600 Radeon R7, 10 Compute Cores 4C+6G
Percentage of memory in use: 26%
Total physical RAM: 7092.85 MB
Available physical RAM: 5237.44 MB
Total Virtual: 14260.85 MB
Available Virtual: 12299.02 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1862.5 GB) (Free:1818.5 GB) NTFS
Drive e: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive f: () (Removable) (Total:3.81 GB) (Free:1.24 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: D9D82C40)

Partition: GPT.

========================================================
Disk: 1 (Size: 3.8 GB) (Disk ID: E44A23EB)
Partition 1: (Not Active) - (Size=3.8 GB) - (Type=0B)

==================== End of Addition.txt ============================

 

Fix Log:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 30-11-2017
Ran by Owner (01-12-2017 19:31:02) Run:1
Running from C:\Users\Owner\Documents\My Documentss
Loaded Profiles: Owner (Available Profiles: Owner)
Boot Mode: Normal
==============================================

fixlist content:
*****************
FF Extension: (Converter) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\@Converter.xpi [2017-11-19]
FF Extension: (Search Encrypt) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\@searchencrypt.xpi [2017-11-17]
FF Extension: (Disable Media WMF NV12 format) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\features\{fdceb2ea-817f-4945-8dff-be20c3e18c8a}\[email protected] [2017-11-22] [Lagacy]
FF SearchPlugin: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\searchplugins\yahoo! powered.xml [2017-11-18]
CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
Task: {E1A5D9C1-B602-4879-92C3-A63534EF021E} - System32\Tasks\{EE0246C1-3455-44FF-8A58-3CAADCD84D78} => C:\Windows\system32\pcalua.exe -a C:\Users\Owner\AppData\Local\{8E00B85C-AAA8-D4E4-C730-F10CE3580D94}\uninst.exe -c -P=/Uninstall /s /noun /DelSelfDir
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\42925105.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\67090335.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\72642326.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\99224798.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\42925105.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\67090335.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\72642326.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\99224798.sys => ""="Driver"
Hosts:
EmptyTemp:
CMD: for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"


*****************

C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\@Converter.xpi => moved successfully
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\@searchencrypt.xpi => moved successfully
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\features\{fdceb2ea-817f-4945-8dff-be20c3e18c8a}\[email protected] => moved successfully
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\searchplugins\yahoo! powered.xml => moved successfully
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSuggestURL => removed successfully
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\SOFTWARE\Google\Chrome\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce => key removed successfully
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\SOFTWARE\Google\Chrome\Extensions\pilplloabdedfmialnfchjomjmpjcoej => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E1A5D9C1-B602-4879-92C3-A63534EF021E} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E1A5D9C1-B602-4879-92C3-A63534EF021E} => key removed successfully
C:\Windows\System32\Tasks\{EE0246C1-3455-44FF-8A58-3CAADCD84D78} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{EE0246C1-3455-44FF-8A58-3CAADCD84D78} => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\42925105.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\67090335.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\72642326.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\99224798.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\42925105.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\67090335.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\72642326.sys => key removed successfully
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\99224798.sys => key removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1" =========


========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 16620499 B
Java, Flash, Steam htmlcache => 506 B
Windows/system/drivers => 22108 B
Edge => 0 B
Chrome => 9311781 B
Firefox => 93322219 B
Opera => 2171674 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
Owner => 452351346 B

RecycleBin => 0 B
EmptyTemp: => 555.2 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 19:31:59 ====

 

Virustotal ratio was 0/56

 

About to start the elevated command prompt


  • 0

#12
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

Sorry for the delay in getting back to you but the Internet went down.  Our cable is acting up.  The Internet is back up but the TV is still down.

 

You posted the Addition.txt twice can you post the FRST log?


  • 0

#13
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Sorry about that. I was in a hurry and thought I copied the right thing. 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-11-2017
Ran by Owner (administrator) on HP-DESKTOP (01-12-2017 19:41:10)
Running from C:\Users\Owner\Documents\My Documentss
Loaded Profiles: Owner (Available Profiles: Owner)
Platform: Windows 8.1 (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Supra) C:\dKEYUSBCradle\SyncService.exe
() C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
() C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Supra) C:\dKEYUSBCradle\ProxyDaemon.exe
() C:\dKEYUSBCradle\stunnel-4.10.exe
(VMware) C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\wsnm\wsnm.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\bin\vmware-view-usbd.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Supra) C:\dKEYUSBCradle\SyncInfoApp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2014-01-05] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-01-05] (Hewlett-Packard )
HKLM\...\Run: [VMware Netlink 3 HV Install Utility] => C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnliu.exe [70080 2015-06-16] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [57446344 2017-11-16] (Skype Technologies S.A.)
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\MountPoints2: E - "E:\LaunchU3.exe" -a
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\...\MountPoints2: {fa696a82-d4c7-11e7-82d0-3010b326e15f} - "E:\LaunchU3.exe" -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DisplayKEY eSYNC Info.lnk [2016-11-16]
ShortcutTarget: DisplayKEY eSYNC Info.lnk -> C:\dKEYUSBCradle\SyncInfoApp.exe (Supra)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{86AD8D79-0E93-4DF3-B074-8F9C824C0DAE}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D65109DD-A864-4F63-834E-35604F19EAF5}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-3592585487-3101742847-3297218791-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2017-01-03] (Eyeo GmbH)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2017-01-03] (Eyeo GmbH)
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} hxxps://juniper.net/dana-cached/sc/JuniperSetupClient64.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} hxxps://home.mynmg.com/dana-cached/sc/JuniperSetupClient.cab

FireFox:
========
FF DefaultProfile: p85zmb8q.default
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default [2017-12-01]
FF Homepage: Mozilla\Firefox\Profiles\p85zmb8q.default -> hxxps://www.msn.com/
hxxps://www.msn.com/
FF NewTab: Mozilla\Firefox\Profiles\p85zmb8q.default -> hxxp://search.searchinfast.com?uid=7f6cf28c-82ce-4522-9e81-0073053f3f3f&uc=20160830&ap=appfocus5&source=googledisplay-bb8&page=newtab&implementation_id=dm_0.2.1
FF NewTabOverride: Mozilla\Firefox\Profiles\p85zmb8q.default -> Disabled: @Converter
FF NewTabOverride: Mozilla\Firefox\Profiles\p85zmb8q.default -> Disabled: @DownloadManager
FF Extension: (Adblock Plus Pop-up Addon) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\[email protected] [2016-08-17] [Lagacy]
FF Extension: (Adguard AdBlocker) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\p85zmb8q.default\Extensions\[email protected] [2017-11-28]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2017-12-01]
CHR Extension: (Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-11-10]
CHR Extension: (Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-11-10]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-25]
CHR Extension: (Adguard AdBlocker) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2017-11-28]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-25]
CHR Extension: (Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-11-10]
CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-25]
CHR Extension: (Search Manager) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahhmpbckpgdidfnmfkfgiflpjijilce [2017-11-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-10-01]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-06-25]
CHR Extension: (Chrome Media Router) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-11-28]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 dKeySync; C:\dKEYUSBCradle\SyncService.exe [42496 2011-11-11] (Supra) [File not signed]
R2 ftnlsv3hv; C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe [226240 2015-06-16] ()
R2 ftscanmgr; C:\Program Files (x86)\VMware\ScannerRedirection\ftscanmgr.exe [6363792 2015-07-31] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [340480 2014-01-05] (IDT, Inc.) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10945264 2017-11-24] (TeamViewer GmbH)
R2 vmware-view-usbd; C:\Program Files (x86)\VMware\VMware Horizon View Client\bin\vmware-view-usbd.exe [1156824 2015-10-13] (VMware, Inc.)
R2 vmwsprrdpwks; C:\Program Files (x86)\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe [261776 2015-05-08] (VMware)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)
R2 wsnm; C:\Program Files (x86)\VMware\VMware Horizon View Client\wsnm\wsnm.exe [533208 2015-10-14] (VMware, Inc.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 RTLU3E8023-W8-64; C:\Windows\system32\DRIVERS\rtu30x64w8.sys [92376 2013-10-11] (Realtek )
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)
S1 MpKslc5795e0e; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A4C5EC7D-7B65-4CAD-9630-D1D3FE65AF28}\MpKslc5795e0e.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-01 19:17 - 2017-12-01 19:17 - 000140782 _____ C:\TDSSKiller.2.8.16.0_01.12.2017_19.17.26_log.txt
2017-12-01 17:58 - 2017-12-01 19:31 - 000000000 ____D C:\Users\Owner\Documents\My Documentss
2017-12-01 17:26 - 2017-12-01 17:26 - 000000000 ____D C:\Users\Owner\AppData\Local\TeamViewer
2017-12-01 14:47 - 2017-12-01 17:28 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-12-01 14:47 - 2017-12-01 14:47 - 000001059 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 13.lnk
2017-12-01 14:47 - 2017-12-01 14:47 - 000001047 _____ C:\Users\Public\Desktop\TeamViewer 13.lnk
2017-12-01 14:47 - 2017-12-01 14:47 - 000000000 ____D C:\Users\Owner\AppData\Roaming\TeamViewer
2017-12-01 14:35 - 2017-12-01 19:41 - 000000000 ____D C:\FRST
2017-11-29 11:26 - 2017-11-29 11:27 - 000005308 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_11.26.51_log.txt
2017-11-29 00:22 - 2017-11-29 00:39 - 000141342 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.22.12_log.txt
2017-11-29 00:18 - 2017-11-29 00:20 - 000141342 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.18.20_log.txt
2017-11-29 00:15 - 2017-11-29 00:15 - 000012450 _____ C:\Users\Owner\Desktop\MBRCheck_11.29.17_00.15.25.txt
2017-11-29 00:11 - 2017-11-29 00:16 - 000141232 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.11.51_log.txt
2017-11-29 00:09 - 2017-11-29 00:30 - 000000000 ____D C:\TDSSKiller_Quarantine
2017-11-29 00:09 - 2017-11-29 00:10 - 000277994 _____ C:\TDSSKiller.2.8.16.0_29.11.2017_00.09.13_log.txt
2017-11-29 00:08 - 2017-12-01 19:39 - 000000000 ____D C:\Program Files\HitmanPro
2017-11-29 00:07 - 2017-11-29 00:15 - 000000000 ____D C:\ProgramData\HitmanPro
2017-11-29 00:06 - 2017-11-29 00:07 - 000011126 _____ C:\Users\Owner\Desktop\MBRCheck_11.29.17_00.06.36.txt
2017-11-28 23:41 - 2017-11-29 00:09 - 000090582 _____ C:\Windows\ntbtlog.txt
2017-11-28 13:59 - 2017-11-28 13:59 - 000000000 ____D C:\Users\Owner\AppData\LocalLow\Adblock Plus for IE
2017-11-28 13:59 - 2017-11-28 13:59 - 000000000 ____D C:\Program Files\Adblock Plus for IE
2017-11-28 13:48 - 2017-11-28 14:13 - 000000000 ____D C:\Users\Owner\Documents\ConnectWiseControl
2017-11-28 12:46 - 2017-11-28 14:13 - 000000000 ____D C:\ProgramData\scre..tion_2c2536e5112611c9_0006.0004_82786dc597925baa
2017-11-28 12:45 - 2017-11-28 12:45 - 000085272 _____ C:\Users\Owner\Downloads\ConnectWiseControl.Client.exe
2017-11-28 12:37 - 2017-11-28 12:37 - 000352151 _____ C:\Users\Owner\Desktop\Computer Bill.pdf
2017-11-28 11:16 - 2017-11-28 12:46 - 000000000 ____D C:\ProgramData\scre..tion_2c2536e5112611c9_0006.0004_93709a72a0cf73c5
2017-11-28 10:43 - 2017-11-28 10:56 - 001204720 _____ (Adobe Systems Incorporated) C:\Users\Owner\Downloads\flashplayer27_ka_install.exe
2017-11-27 02:00 - 2017-11-27 02:00 - 000189114 _____ C:\Users\Owner\Desktop\soft experts.pdf
2017-11-22 11:08 - 2017-11-28 13:52 - 000000000 ____D C:\Windows\Minidump
2017-11-18 10:22 - 2017-11-18 10:22 - 000000000 ____D C:\Users\Owner\AppData\Roaming\Opera Software
2017-11-18 10:22 - 2017-11-18 10:22 - 000000000 ____D C:\Users\Owner\AppData\Local\Opera Software
2017-11-18 10:21 - 2017-11-18 10:21 - 000000065 _____ C:\Users\Owner\Downloads\Word_Setup [1].exe
2017-11-17 10:46 - 2017-11-17 10:47 - 140852175 _____ C:\Users\Owner\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_en-US(1).exe
2017-11-17 10:46 - 2017-11-17 10:46 - 140852175 _____ C:\Users\Owner\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_en-US.exe
2017-11-17 10:44 - 2017-11-17 10:44 - 001668448 _____ ( ) C:\Users\Owner\Downloads\Word_Setup.exe
2017-11-15 09:08 - 2017-10-16 12:38 - 002013016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-11-15 09:08 - 2017-10-14 02:38 - 025731584 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-11-15 09:08 - 2017-10-14 02:23 - 004168704 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-11-15 09:08 - 2017-10-14 02:13 - 002903552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-11-15 09:08 - 2017-10-14 02:09 - 005979648 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-11-15 09:08 - 2017-10-14 01:30 - 015266816 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-11-15 09:08 - 2017-10-14 01:21 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-11-15 09:08 - 2017-10-14 01:14 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-11-15 09:08 - 2017-10-14 01:05 - 015431680 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-11-15 09:08 - 2017-10-14 00:50 - 002293760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-11-15 09:08 - 2017-10-14 00:33 - 004542464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-11-15 09:08 - 2017-10-14 00:28 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-11-15 09:08 - 2017-10-14 00:14 - 013317632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-11-15 09:08 - 2017-10-14 00:10 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-11-15 09:08 - 2017-10-10 09:38 - 003631616 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-11-15 09:08 - 2017-09-08 11:14 - 003084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2017-11-15 09:08 - 2017-09-08 10:50 - 002471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2017-11-15 09:08 - 2017-08-10 19:39 - 002779136 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-11-15 09:08 - 2017-08-10 19:30 - 002464256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-11-15 09:07 - 2017-10-17 13:11 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-11-15 09:07 - 2017-10-14 07:04 - 001548624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-11-15 09:07 - 2017-10-14 02:11 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-11-15 09:07 - 2017-10-14 02:01 - 000816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-11-15 09:07 - 2017-10-14 01:36 - 001033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-11-15 09:07 - 2017-10-14 01:31 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-11-15 09:07 - 2017-10-14 01:30 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-11-15 09:07 - 2017-10-14 01:30 - 000380416 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-11-15 09:07 - 2017-10-14 01:29 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-11-15 09:07 - 2017-10-14 01:27 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-11-15 09:07 - 2017-10-14 01:09 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-11-15 09:07 - 2017-10-14 00:58 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-11-15 09:07 - 2017-10-14 00:53 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-11-15 09:07 - 2017-10-14 00:45 - 000662016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-11-15 09:07 - 2017-10-14 00:28 - 000880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2017-11-15 09:07 - 2017-10-14 00:25 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-11-15 09:07 - 2017-10-14 00:24 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-11-15 09:07 - 2017-10-14 00:24 - 000331776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-11-15 09:07 - 2017-10-14 00:23 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-11-15 09:07 - 2017-10-14 00:07 - 001314304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-11-15 09:07 - 2017-10-14 00:04 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-11-15 09:07 - 2017-10-10 10:36 - 000124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys
2017-11-15 09:07 - 2017-10-10 09:38 - 000425984 _____ (Microsoft Corporation) C:\Windows\system32\PCPTpm12.dll
2017-11-15 09:07 - 2017-10-10 09:11 - 002749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-11-15 09:07 - 2017-10-10 09:08 - 000367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCPTpm12.dll
2017-11-15 09:07 - 2017-10-05 01:17 - 000380248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-11-15 09:07 - 2017-09-14 17:52 - 000986968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-11-15 09:07 - 2017-09-07 21:31 - 000685440 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-11-15 09:07 - 2017-09-07 21:28 - 000507176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-11-15 09:07 - 2017-09-07 15:31 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\mgmtapi.dll
2017-11-15 09:07 - 2017-09-07 13:20 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mgmtapi.dll
2017-11-15 09:07 - 2017-09-07 11:20 - 000513456 _____ C:\Windows\SysWOW64\locale.nls
2017-11-15 09:07 - 2017-09-07 11:20 - 000513456 _____ C:\Windows\system32\locale.nls
2017-11-15 09:07 - 2017-09-07 07:40 - 000995272 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-11-15 09:07 - 2017-09-07 07:40 - 000922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-11-15 09:07 - 2017-09-06 17:07 - 000158552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2017-11-15 09:07 - 2017-09-06 15:17 - 000461144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2017-11-15 09:07 - 2017-09-06 15:17 - 000443224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2017-11-15 09:07 - 2017-09-06 08:14 - 000166400 _____ (Microsoft Corporation) C:\Windows\system32\regsvc.dll
2017-11-15 08:57 - 2017-10-11 01:35 - 000143016 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-11-15 08:57 - 2017-10-10 09:21 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 002023936 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-11-15 08:57 - 2017-10-10 07:18 - 001570304 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000670208 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000605184 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000603648 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000402944 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000370688 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000241664 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-11-15 08:57 - 2017-10-10 07:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-11-14 15:47 - 2017-11-14 15:47 - 000092928 _____ C:\Users\Owner\Downloads\resume 2015 (Kyle McManaman).docx - Microsoft Word Online.htm
2017-11-14 15:47 - 2017-11-14 15:47 - 000000000 ____D C:\Users\Owner\Downloads\resume 2015 (Kyle McManaman).docx - Microsoft Word Online_files
2017-11-14 10:42 - 2017-11-14 10:42 - 053914496 _____ (Skype Technologies S.A. ) C:\Users\Owner\Downloads\Skype-8.10.0.9 (1).exe
2017-11-13 20:30 - 2017-11-13 20:30 - 053914496 _____ (Skype Technologies S.A. ) C:\Users\Owner\Downloads\Skype-8.10.0.9.exe
2017-11-13 20:26 - 2017-11-22 11:26 - 000001326 _____ C:\Users\Public\Desktop\Skype.lnk
2017-11-13 20:26 - 2017-11-22 11:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-11-13 20:26 - 2017-11-13 20:26 - 000000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2017-11-13 13:21 - 2017-11-13 13:21 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2017-11-13 10:15 - 2017-11-13 10:15 - 000123362 _____ C:\Users\Owner\Downloads\GACB_2015.pdf
2017-11-10 08:28 - 2017-11-10 08:28 - 000071441 _____ C:\Users\Owner\Downloads\patient-billing-flow.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-12-01 19:38 - 2016-11-30 00:16 - 000000000 ____D C:\Users\Owner\AppData\LocalLow\Mozilla
2017-12-01 19:38 - 2016-08-29 18:49 - 000000000 ___DO C:\Users\Owner\OneDrive
2017-12-01 19:36 - 2013-08-22 08:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-12-01 19:36 - 2013-08-22 08:44 - 000337840 _____ C:\Windows\system32\FNTCACHE.DAT
2017-12-01 19:35 - 2016-08-16 19:45 - 000065536 _____ C:\Windows\system32\spu_storage.bin
2017-12-01 19:35 - 2013-08-22 07:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2017-12-01 19:31 - 2016-08-18 12:10 - 000000000 ____D C:\Users\Owner\AppData\LocalLow\Temp
2017-12-01 18:45 - 2014-11-21 02:44 - 000865068 _____ C:\Windows\system32\PerfStringBackup.INI
2017-12-01 18:45 - 2013-08-22 07:36 - 000000000 ____D C:\Windows\Inf
2017-12-01 14:46 - 2013-08-22 09:36 - 000000000 ___HD C:\Program Files\WindowsApps
2017-12-01 14:46 - 2013-08-22 09:36 - 000000000 ____D C:\Windows\AppReadiness
2017-12-01 14:45 - 2016-08-17 12:49 - 000003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{06EA9419-B131-4841-A5DD-11FDC460B3F6}
2017-12-01 14:38 - 2016-08-16 19:11 - 000003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3592585487-3101742847-3297218791-1001
2017-11-28 13:52 - 2016-08-16 18:39 - 000000000 ____D C:\Windows\Panther
2017-11-28 13:45 - 2016-08-16 21:13 - 000000000 ____D C:\Users\Owner
2017-11-28 12:46 - 2017-06-25 07:10 - 000000000 ____D C:\Users\Owner\AppData\Local\Deployment
2017-11-28 11:12 - 2017-01-19 19:46 - 000000000 ____D C:\Users\Owner\AppData\Roaming\VMware
2017-11-24 09:52 - 2016-08-16 22:56 - 000000000 ____D C:\Windows\system32\MRT
2017-11-24 09:49 - 2017-10-15 09:32 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2017-11-24 09:49 - 2016-08-16 22:56 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-11-22 11:08 - 2017-03-28 15:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-22 11:08 - 2016-08-17 12:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-21 14:45 - 2013-08-22 09:36 - 000000000 ____D C:\Windows\system32\NDF
2017-11-20 14:32 - 2016-08-21 10:08 - 000545440 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-11-19 10:36 - 2016-08-17 12:50 - 000001175 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-19 10:36 - 2016-08-17 12:50 - 000000000 ____D C:\Users\Owner\AppData\Roaming\Mozilla
2017-11-18 10:32 - 2016-08-16 23:01 - 000000000 ____D C:\Windows\system32\appraiser
2017-11-17 08:56 - 2013-08-22 09:20 - 000000000 ____D C:\Windows\CbsTemp
2017-11-14 13:49 - 2017-06-25 07:11 - 000002215 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-14 13:49 - 2017-06-25 07:11 - 000002203 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-11-13 15:43 - 2017-06-25 07:10 - 000003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-11-13 15:43 - 2017-06-25 07:10 - 000003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-11-03 18:41 - 2016-08-16 23:03 - 000835568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-11-03 18:41 - 2016-08-16 23:03 - 000177648 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Some files in TEMP:
====================
2017-12-01 19:39 - 2017-11-28 13:12 - 011584088 _____ (SurfRight B.V.) C:\Users\Owner\AppData\Local\Temp\HitmanPro.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-27 11:31

==================== End of FRST.txt ============================


  • 0

#14
Himynameiskyle

Himynameiskyle

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts

Is there a difference between Windows Powershell and an elevated command prompt?


  • 0

#15
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,001 posts
  • MVP

They are not the same and don't use the same commands so best to stay with command prompts.  Usually you can search for cmd.exe and then right click on it and run as admin.


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP