Page 1 of 4 1234 LastLast
Results 1 to 10 of 33

Thread: infected with adware again and possible trojan?

  1. #1
    Senior Member
    Join Date
    Apr 2006
    Posts
    153

    Default infected with adware again and possible trojan?

    I'm not sure whether a previous infection is still present or this is something new. Been getting adnxs pop-ups again, ran AdwCleaner and it found stuff to cleaned it(saved the log). Ran Malwarebytes (which it says trial version is over) and it found nothing. Thought we were good to go and again pop-ups. First it was a window that said Microsoft security alert that we were infected with a trojan and an 866 number to call. Did a control/alt/delete to get out of it and didn't click on anything. Then later started getting adnxs pop-ups and now pubmatic.com pop-ups. Those seemed to pop up when we went to print out an e-mail coupon from a restaurant. Anyway I think I need help with cleaning things.

    Here's the FRST log:

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
    Ran by waldo (administrator) on WALDO-PC on 23-10-2014 07:31:17
    Running from C:\Users\waldo\Desktop
    Loaded Profile: waldo (Available profiles: waldo)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 10
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
    (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
    (Acer Incorporated) C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe
    () C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
    (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    (IOI) C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe
    (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
    (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
    (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    (Microsoft Corporation) C:\Windows\splwow64.exe
    (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1258574343\ee\aolsoftware.exe
    (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1258574343\ee\aolupdates.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
    HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2780776 2011-07-19] (CANON INC.)
    HKLM\...\Run: [ISW] => C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
    HKLM-x32\...\Run: [Gateway Photo Frame] => C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe [124416 2009-07-20] (IOI)
    HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73984 2013-01-02] (Check Point Software Technologies LTD)
    HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [98304 2009-11-16] (Apple Computer, Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-1904644152-4117284365-1940985227-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_152_ActiveX.exe [854192 2014-09-20] (Adobe Systems Incorporated)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x5906207176DECF01
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
    SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
    BHO: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
    BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
    BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: ZoneAlarm Security Engine Registrar -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
    Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
    DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
    DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

    FireFox:
    ========
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
    FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @nosltd.com/getPlus+(R),version=1.6.2.100 -> C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
    FF Plugin-x32: @nosltd.com/getPlus+(R),version=1.6.2.97 -> C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
    FF Plugin-x32: @nosltd.com/getPlus+(R),version=1.6.2.99 -> C:\Program Files (x86)\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    Chrome:
    =======

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2011-09-06] ()
    R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
    R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
    R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
    S3 nosGetPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll [52288 2011-03-01] (NOS Microsystems Ltd.)
    R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
    R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2448032 2013-01-02] (Check Point Software Technologies LTD)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
    R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
    R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [34808 2014-10-02] ()
    R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-10-23 07:31 - 2014-10-23 07:31 - 00011269 _____ () C:\Users\waldo\Desktop\FRST.txt
    2014-10-23 07:30 - 2014-10-23 07:31 - 00000000 ____D () C:\FRST
    2014-10-23 07:28 - 2014-10-23 07:28 - 05185536 _____ (AVAST Software) C:\Users\waldo\Desktop\aswMBR.exe
    2014-10-23 07:27 - 2014-10-23 07:27 - 02112000 _____ (Farbar) C:\Users\waldo\Desktop\FRST64.exe
    2014-10-22 11:40 - 2014-10-22 11:40 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
    2014-10-22 10:47 - 2014-10-22 10:47 - 00007343 _____ () C:\Users\waldo\Desktop\AdwCleaner[S0].txt
    2014-10-21 17:07 - 2014-10-21 17:07 - 00054156 ____H () C:\Windows\QTFont.qfn
    2014-10-21 15:02 - 2014-10-22 10:45 - 00000000 ____D () C:\AdwCleaner
    2014-10-21 15:02 - 2014-10-21 15:02 - 01962496 _____ () C:\Users\waldo\Desktop\adwcleaner_4.001.exe
    2014-10-21 11:13 - 2014-06-18 18:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
    2014-10-21 11:13 - 2014-06-18 18:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
    2014-10-21 11:13 - 2014-06-18 18:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
    2014-10-21 11:13 - 2014-06-18 18:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
    2014-10-21 11:13 - 2014-06-18 18:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
    2014-10-21 11:13 - 2014-06-18 18:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
    2014-10-21 11:00 - 2014-09-28 20:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-10-21 11:00 - 2014-09-17 22:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2014-10-21 11:00 - 2014-09-17 21:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2014-10-21 11:00 - 2014-09-04 22:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2014-10-21 11:00 - 2014-09-04 21:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2014-10-21 11:00 - 2014-09-04 01:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
    2014-10-21 11:00 - 2014-09-04 01:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
    2014-10-21 11:00 - 2014-08-28 22:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
    2014-10-21 11:00 - 2014-07-16 22:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2014-10-21 11:00 - 2014-07-16 22:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
    2014-10-21 11:00 - 2014-07-16 22:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
    2014-10-21 11:00 - 2014-07-16 22:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
    2014-10-21 11:00 - 2014-07-16 22:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2014-10-21 11:00 - 2014-07-16 22:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2014-10-21 11:00 - 2014-07-16 21:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
    2014-10-21 11:00 - 2014-07-16 21:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2014-10-21 11:00 - 2014-07-16 21:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2014-10-21 11:00 - 2014-07-16 21:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
    2014-10-21 11:00 - 2014-07-16 21:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
    2014-10-21 10:59 - 2014-09-12 21:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
    2014-10-21 10:59 - 2014-09-12 21:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
    2014-10-21 10:46 - 2014-09-20 01:18 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-10-21 10:46 - 2014-09-20 01:17 - 02236928 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-10-21 10:46 - 2014-09-20 01:17 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 19280896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-10-21 10:46 - 2014-09-20 01:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-10-21 10:46 - 2014-09-20 01:15 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-10-21 10:46 - 2014-09-20 01:15 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-10-21 10:46 - 2014-09-20 01:15 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 13757952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-10-21 10:46 - 2014-09-19 23:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-10-21 10:46 - 2014-09-19 23:56 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-10-21 10:46 - 2014-09-19 23:56 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-10-21 10:46 - 2014-09-19 23:56 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-10-21 10:46 - 2014-09-19 23:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-10-21 10:46 - 2014-09-19 23:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-10-21 10:46 - 2014-09-19 22:43 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2014-10-21 10:46 - 2014-09-19 22:35 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2014-10-18 10:49 - 2014-10-22 13:40 - 00000818 _____ () C:\Windows\setupact.log
    2014-10-03 05:19 - 2014-09-24 22:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2014-10-03 05:19 - 2014-09-24 21:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2014-10-03 04:48 - 2014-10-03 04:50 - 00002218 _____ () C:\DelFix.txt
    2014-10-02 15:41 - 2014-10-02 15:14 - 00000035 _____ () C:\Windows\system32\Drivers\etc\hosts.20141002-144109.backup
    2014-10-02 12:45 - 2014-10-02 12:45 - 00034808 _____ () C:\Windows\system32\Drivers\TrueSight.sys
    2014-10-02 12:45 - 2014-10-02 12:45 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-09-29 17:05 - 2014-10-03 04:48 - 00000000 ____D () C:\Windows\ERUNT
    2014-09-29 16:08 - 2014-09-29 16:08 - 736419181 _____ () C:\Windows\MEMORY.DMP
    2014-09-29 16:08 - 2014-09-29 16:08 - 00277808 _____ () C:\Windows\Minidump\092914-24788-01.dmp
    2014-09-29 16:08 - 2014-09-29 16:08 - 00000000 ____D () C:\Windows\Minidump
    2014-09-24 16:28 - 2012-07-25 23:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
    2014-09-24 16:28 - 2012-07-25 23:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
    2014-09-24 16:28 - 2012-07-25 23:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
    2014-09-24 16:28 - 2012-07-25 23:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
    2014-09-24 16:28 - 2012-07-25 23:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
    2014-09-24 16:28 - 2012-07-25 22:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
    2014-09-24 16:28 - 2012-07-25 22:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
    2014-09-24 16:28 - 2012-06-02 10:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
    2014-09-24 16:26 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
    2014-09-24 16:26 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
    2014-09-24 16:26 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
    2014-09-24 16:26 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
    2014-09-24 16:26 - 2014-07-08 22:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
    2014-09-24 16:26 - 2014-07-08 21:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
    2014-09-24 16:26 - 2014-07-08 21:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
    2014-09-24 16:26 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
    2014-09-24 16:26 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
    2014-09-24 16:26 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
    2014-09-24 16:26 - 2014-07-08 18:38 - 00419992 _____ () C:\Windows\system32\locale.nls
    2014-09-24 16:26 - 2014-07-08 18:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
    2014-09-24 16:26 - 2014-06-26 22:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
    2014-09-24 16:26 - 2014-06-26 21:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
    2014-09-24 16:26 - 2014-06-23 23:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
    2014-09-24 16:26 - 2014-06-23 22:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
    2014-09-24 16:25 - 2014-09-09 18:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2014-09-24 16:25 - 2014-09-09 17:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2014-09-24 16:25 - 2014-08-01 07:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
    2014-09-24 16:25 - 2014-08-01 07:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
    2014-09-24 16:25 - 2014-06-24 22:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2014-09-24 16:25 - 2014-06-24 21:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2014-09-24 16:25 - 2014-05-30 04:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2014-09-24 16:25 - 2014-05-30 04:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2014-09-24 16:25 - 2014-05-30 04:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2014-09-24 16:25 - 2014-05-30 04:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2014-09-24 16:25 - 2014-05-30 03:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2014-09-24 16:25 - 2014-05-30 03:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2014-09-24 16:25 - 2014-05-30 03:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2014-09-24 16:25 - 2014-05-30 03:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-10-23 06:51 - 2012-10-15 08:06 - 00000000 ____D () C:\PDL
    2014-10-23 06:47 - 2009-09-24 04:02 - 01692164 _____ () C:\Windows\WindowsUpdate.log
    2014-10-23 06:35 - 2010-02-02 08:42 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-10-22 14:41 - 2010-02-02 08:42 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-10-22 11:27 - 2009-07-14 00:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-10-22 11:27 - 2009-07-14 00:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-10-22 11:24 - 2009-07-14 01:13 - 00785484 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-10-22 11:20 - 2009-08-27 16:54 - 05628638 _____ () C:\Windows\PFRO.log
    2014-10-22 11:20 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-10-22 10:46 - 2010-10-18 14:29 - 00000000 ____D () C:\Users\waldo\AppData\Roaming\CheckPoint
    2014-10-21 11:04 - 2009-07-14 00:45 - 00420968 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-10-20 14:28 - 2012-11-06 16:20 - 00000000 ____D () C:\ProgramData\CanonIJPLM
    2014-10-03 05:21 - 2011-01-26 10:10 - 00777722 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
    2014-10-02 15:41 - 2009-07-13 22:34 - 00449923 ____R () C:\Windows\system32\Drivers\etc\hosts.20141018-030303.backup
    2014-09-24 17:26 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
    2014-09-24 16:35 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
    2014-09-24 16:35 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism
    2014-09-23 12:07 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\Help
    2014-09-23 11:52 - 2013-11-25 20:56 - 00000000 ____D () C:\Users\waldo\AppData\Roaming\Malwarebytes
    2014-09-23 11:52 - 2013-11-25 20:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2014-09-23 06:21 - 2009-07-13 22:34 - 00449915 ____R () C:\Windows\system32\Drivers\etc\hosts.20140924-145140.backup

    Some content of TEMP:
    ====================
    C:\Users\waldo\AppData\Local\Temp\Quarantine.exe
    C:\Users\waldo\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-10-16 01:56

    ==================== End Of Log ============================

    Addition log:

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014
    Ran by waldo at 2014-10-23 07:31:56
    Running from C:\Users\waldo\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
    AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    FW: ZoneAlarm Free Firewall Firewall (Enabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
    Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{1CAFFEC6-23B4-484B-B17B-3200BE5C5636}) (Version: 99.9 - Eyeo GmbH)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
    Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
    Adobe Download Manager (HKLM-x32\...\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}) (Version: 1.6.2.100 - NOS Microsystems Ltd.)
    Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.05) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.05 - Adobe Systems Incorporated)
    Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
    AnswerWorks 5.0 English Runtime (HKLM-x32\...\{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}) (Version: 5.0.7 - Vantage Software Technologies)
    AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version: - AOL Inc.)
    Backup Manager Advance (x32 Version: 2.0.2.19 - NewTech Infosystems) Hidden
    BitZipper 2010 (HKLM-x32\...\BitZipper_is1) (Version: - Bitberry Software)
    Build-a-lot (HKLM-x32\...\Build-a-lot) (Version: 1.1.0.0 - MumboJumbo)
    Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
    Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version: - )
    Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
    Canon MP Navigator EX 5.1 (HKLM-x32\...\MP Navigator EX 5.1) (Version: - )
    Canon MP780 (HKLM\...\{AA18EE51-24A5-4748-A5E2-4B035C9A4AB2}) (Version: - )
    Canon MX890 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX890_series) (Version: - )
    Canon MX890 series On-screen Manual (HKLM-x32\...\Canon MX890 series On-screen Manual) (Version: - )
    Canon MX890 series User Registration (HKLM-x32\...\Canon MX890 series User Registration) (Version: - )
    Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
    Canon ScanGear Starter (HKLM-x32\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )
    Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
    Canon Speed Dial Utility (HKLM-x32\...\Speed Dial Utility) (Version: - )
    Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) Hidden
    eBay Worldwide (HKLM-x32\...\{AAF89271-2594-468D-B578-96B2E30C41C4}) (Version: 2.1.0703 - OEM)
    EPSON NX110 Series Printer Uninstall (HKLM\...\EPSON NX110 Series) (Version: - SEIKO EPSON Corporation)
    Gateway Games (HKLM-x32\...\WildTangent gateway Master Uninstall) (Version: 1.0.0.71 - WildTangent)
    Gateway InfoCentre (HKLM-x32\...\Gateway InfoCentre) (Version: 3.02.3000 - Gateway Incorporated)
    Gateway MyBackup (HKLM-x32\...\InstallShield_{30075A70-B5D2-440B-AFA3-FB2021740121}) (Version: 2.0.2.19 - NewTech Infosystems)
    Gateway Photo Frame 4.2.3.10 (HKLM-x32\...\Gateway Photo Frame) (Version: 4.2.3.10 - I/O Interconnect)
    Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3002 - Acer Incorporated)
    Gateway Registration (HKLM-x32\...\Gateway Registration) (Version: 1.02.3004 - Gateway Incorporated)
    Gateway ScreenSaver (HKLM-x32\...\Gateway Screensaver) (Version: 1.1.0812 - Gateway Incorporated)
    Gateway Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3014 - Gateway Incorporated)
    Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
    Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3001 - Gateway Incorporated)
    ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
    iSEEK AnswerWorks English Runtime (HKLM-x32\...\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: 010.000.0101 - Vantage Linguistics)
    Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.670 - Oracle)
    Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
    Jewel Quest 2 (remove only) (HKLM-x32\...\Jewel Quest 2) (Version: - )
    Jewel Quest Solitaire II (remove only) (HKLM-x32\...\Jewel Quest Solitaire II) (Version: - )
    Junk Mail filter update (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
    Learn2 Player (Uninstall Only) (HKLM-x32\...\StreetPlugin) (Version: - )
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60831.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Web Publishing Wizard 1.52 (HKLM-x32\...\WebPost) (Version: - )
    Microsoft Works (HKLM-x32\...\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
    MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Nero 9 Essentials (HKLM-x32\...\{40a87585-3dea-47d0-8aac-c7c19689b431}) (Version: - Nero AG)
    Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
    Nero DiscSpeed (x32 Version: 5.4.7.201 - Nero AG) Hidden
    Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
    Nero DriveSpeed (x32 Version: 4.4.7.201 - Nero AG) Hidden
    Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
    Nero Express Help (x32 Version: 9.4.9.100 - Nero AG) Hidden
    Nero InfoTool (x32 Version: 6.4.7.201 - Nero AG) Hidden
    Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
    Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden
    Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
    Nero StartSmart (x32 Version: 9.4.11.209 - Nero AG) Hidden
    Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden
    Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
    NeroExpress (x32 Version: 9.4.10.505 - Nero AG) Hidden
    neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
    NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.7 - )
    PrintMaster 12 (HKLM-x32\...\{2A304FDE-F4E3-446D-AA0D-31425C897B71}) (Version: - Broderbund LLC)
    Quicken 2010 (HKLM-x32\...\{CCF6F57B-F6B4-4508-BF45-63AAC9DE416A}) (Version: 19.1.2.22 - Intuit)
    Quicken 2013 (HKLM-x32\...\{034DD4BB-F0D6-4ECF-B064-8E39E3EF7076}) (Version: 22.1.12.7 - Intuit)
    QuickTime (HKLM-x32\...\QuickTime) (Version: - )
    RealPlayer Basic (HKLM-x32\...\RealPlayer 6.0) (Version: - )
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
    Shockwave (HKLM-x32\...\Shockwave) (Version: - )
    Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
    Uninstall AOL Emergency Connect Utility 1.0 (HKLM-x32\...\AOL Emergency Connect Utility 1.0) (Version: - )
    VC 9.0 Runtime (x32 Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
    Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)
    Welcome Center (HKLM-x32\...\Gateway Welcome Center) (Version: 1.00.3005 - Gateway Incorporated)
    Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
    Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8064.0206 - Microsoft Corporation)
    Windows Live Essentials (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
    Windows Live Mail (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
    Windows Live Messenger (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
    Windows Live Photo Gallery (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
    Windows Live Sign-in Assistant (HKLM-x32\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
    Windows Live Sync (HKLM-x32\...\{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}) (Version: 14.0.8064.206 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
    Windows Live Writer (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
    ZoneAlarm Firewall (x32 Version: 11.0.000.038 - Check Point Software Technologies Ltd.) Hidden
    ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 11.0.000.038 - Check Point)
    ZoneAlarm Security (x32 Version: 11.0.000.038 - Check Point Software Technologies Ltd.) Hidden

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


    ==================== Restore Points =========================

    03-10-2014 08:50:33 End of disinfection
    03-10-2014 09:19:03 Windows Update
    06-10-2014 23:06:19 Windows Update
    10-10-2014 23:45:43 Windows Update
    14-10-2014 00:55:36 Windows Update
    17-10-2014 03:27:38 Windows Update
    20-10-2014 07:11:00 Windows Update
    21-10-2014 14:46:27 Windows Update
    21-10-2014 15:00:59 Windows Update
    21-10-2014 15:13:31 Windows Update
    22-10-2014 15:40:14 Installed Adblock Plus for IE (32-bit and 64-bit)

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2014-10-18 04:03 - 00449987 ____R C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 www.007guard.com
    127.0.0.1 007guard.com
    127.0.0.1 008i.com
    127.0.0.1 www.008k.com
    127.0.0.1 008k.com
    127.0.0.1 www.00hq.com
    127.0.0.1 00hq.com
    127.0.0.1 010402.com
    127.0.0.1 www.032439.com
    127.0.0.1 032439.com
    127.0.0.1 www.0scan.com
    127.0.0.1 0scan.com
    127.0.0.1 1000gratisproben.com
    127.0.0.1 www.1000gratisproben.com
    127.0.0.1 1001namen.com
    127.0.0.1 www.1001namen.com
    127.0.0.1 100888290cs.com
    127.0.0.1 www.100888290cs.com
    127.0.0.1 www.100sexlinks.com
    127.0.0.1 100sexlinks.com
    127.0.0.1 10sek.com
    127.0.0.1 www.10sek.com
    127.0.0.1 www.1-2005-search.com
    127.0.0.1 1-2005-search.com
    127.0.0.1 123fporn.info
    127.0.0.1 www.123fporn.info
    127.0.0.1 123haustiereundmehr.com
    127.0.0.1 www.123haustiereundmehr.com
    127.0.0.1 123moviedownload.com

    There are 1000 more lines.


    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {65D02046-1AC2-4483-99FC-E0FA89388465} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-02] (Google Inc.)
    Task: {9C938A31-6FFB-4747-B9C4-73EEE4631BB1} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
    Task: {BB682B4D-77DF-409C-AB56-075556AFE626} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-02] (Google Inc.)
    Task: {C013CC8A-2836-4417-AFBC-B07172C45338} - System32\Tasks\{BA00E350-E2EA-4669-B799-9BE8AB4A281A} => C:\Program Files (x86)\PowerPointViewer.exe [2009-11-27] (Microsoft Corporation)
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2012-11-06 16:37 - 2011-09-06 07:32 - 00140456 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
    2009-02-02 20:33 - 2009-02-02 20:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll
    2008-09-28 20:55 - 2008-09-28 20:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\ACE.dll
    2009-06-12 19:37 - 2009-06-12 19:37 - 00032768 _____ () C:\Program Files (x86)\Gateway Photo Frame\IOIUSBLib.dll
    2009-06-12 19:37 - 2009-06-12 19:37 - 00025088 _____ () C:\Program Files (x86)\Gateway Photo Frame\IOIHIDLib.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\Windows\system32\Drivers\fieropav.sys:changelist

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mCpFgXKL => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"

    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)

    MSCONFIG\Services: EPSON_EB_RPCV4_01 => 2
    MSCONFIG\Services: EPSON_PM_RPCV4_01 => 2
    MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk => C:\Windows\pss\Event Reminder.lnk.CommonStartup
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    MSCONFIG\startupreg: AOL Fast Start => "C:\Program Files (x86)\AOL 9.5\AOL.EXE" -b
    MSCONFIG\startupreg: BackupManagerTray => "C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k
    MSCONFIG\startupreg: EEventManager => C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
    MSCONFIG\startupreg: EPSON NX110 Series => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFBA.EXE /FU "C:\Windows\TEMP\E_SE634.tmp" /EF "HKCU"
    MSCONFIG\startupreg: HostManager => C:\Program Files (x86)\Common Files\AOL\1258574343\ee\AOLSoftware.exe
    MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
    MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
    MSCONFIG\startupreg: RealTray => C:\Program Files (x86)\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    MSCONFIG\startupreg: WRSVC => "C:\Program Files\Webroot\WRSA.exe" -ul

    ========================= Accounts: ==========================

    Administrator (S-1-5-21-1904644152-4117284365-1940985227-500 - Administrator - Disabled)
    Guest (S-1-5-21-1904644152-4117284365-1940985227-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1904644152-4117284365-1940985227-1002 - Limited - Enabled)
    waldo (S-1-5-21-1904644152-4117284365-1940985227-1000 - Administrator - Enabled) => C:\Users\waldo

    ==================== Faulty Device Manager Devices =============

    Name: Microsoft PS/2 Mouse
    Description: Microsoft PS/2 Mouse
    Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: i8042prt
    Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
    Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
    Devices stay in this state if they have been prepared for removal.
    After you remove the device, this error disappears.Remove the device, and this error should be resolved.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/23/2014 00:09:07 AM) (Source: SideBySide) (EventID: 63) (User: )
    Description: Activation context generation failed for "assemblyIdentity1".Error in manifest or policy file "assemblyIdentity2" on line assemblyIdentity3.
    The value "*" of attribute "language" in element "assemblyIdentity" is invalid.

    Error: (10/23/2014 00:08:24 AM) (Source: SideBySide) (EventID: 63) (User: )
    Description: Activation context generation failed for "assemblyIdentity1".Error in manifest or policy file "assemblyIdentity2" on line assemblyIdentity3.
    The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
    Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
    Please use sxstrace.exe for detailed diagnosis.


    System errors:
    =============
    Error: (10/22/2014 11:30:05 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Updater Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 11:29:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 10:57:20 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Updater Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 10:57:06 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 10:47:58 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Updater Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 10:47:45 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 05:51:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Updater Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/22/2014 05:51:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/21/2014 11:07:01 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Updater Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (10/21/2014 11:06:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).


    Microsoft Office Sessions:
    =========================
    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe

    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe

    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe

    Error: (10/23/2014 00:09:11 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe

    Error: (10/23/2014 00:09:07 AM) (Source: SideBySide) (EventID: 63) (User: )
    Description: assemblyIdentitylanguage*c:\program files (x86)\spybot - search & destroy\DelZip179.dllc:\program files (x86)\spybot - search & destroy\DelZip179.dll8

    Error: (10/23/2014 00:08:24 AM) (Source: SideBySide) (EventID: 63) (User: )
    Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe

    Error: (10/22/2014 01:07:27 AM) (Source: SideBySide) (EventID: 33) (User: )
    Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe


    CodeIntegrity Errors:
    ===================================
    Date: 2014-10-23 07:22:41.895
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 06:51:24.373
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 06:36:22.833
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 06:26:45.021
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 06:14:26.351
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 05:33:31.506
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 01:52:10.228
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 01:40:30.680
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-23 01:22:22.751
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-10-22 20:57:56.592
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Pentium(R) Dual-Core CPU E5300 @ 2.60GHz
    Percentage of memory in use: 26%
    Total physical RAM: 6109.14 MB
    Available physical RAM: 4496.71 MB
    Total Pagefile: 12216.46 MB
    Available Pagefile: 10388.19 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.81 MB

    ==================== Drives ================================

    Drive c: (Gateway) (Fixed) (Total:916.41 GB) (Free:859.53 GB) NTFS
    Drive j: () (Fixed) (Total:111.76 GB) (Free:106.68 GB) FAT32
    Drive k: (FreeAgent Drive) (Fixed) (Total:1863.01 GB) (Free:1727.19 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 2928213B)
    Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
    Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=916.4 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 9F763A2B)
    Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 8 (Size: 114.5 GB) (Disk ID: 807C73BF)
    Partition 1: (Not Active) - (Size=111.8 GB) - (Type=0C)

    ==================== End Of Log ============================

    AswMBR log:

    aswMBR version 1.0.1.2041 Copyright(c) 2014 AVAST Software
    Run date: 2014-10-23 07:33:52
    -----------------------------
    07:33:52.940 OS Version: Windows x64 6.1.7601 Service Pack 1
    07:33:52.940 Number of processors: 2 586 0x170A
    07:33:52.941 ComputerName: WALDO-PC UserName: waldo
    07:33:54.579 Initialize success
    07:33:54.600 VM: initialized successfully
    07:33:54.660 VM: Intel CPU supported
    07:33:58.392 VM: supported disk I/O iaStor.sys
    07:36:11.025 AVAST engine defs: 14102300
    07:36:56.058 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    07:36:56.063 Disk 0 Vendor: WDC_WD10 01.0 Size: 953869MB BusType: 8
    07:36:56.241 VM: Disk 0 MBR read successfully
    07:36:56.247 Disk 0 MBR scan
    07:36:56.311 Disk 0 Windows 7 default MBR code
    07:36:56.314 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 15360 MB offset 2048
    07:36:56.339 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 31459328
    07:36:56.344 Disk 0 Boot: NTFS code=1
    07:36:56.368 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 938407 MB offset 31664128
    07:36:56.418 Disk 0 scanning C:\Windows\system32\drivers
    07:37:20.867 Service scanning
    07:37:48.369 Modules scanning
    07:37:48.388 Disk 0 trace - called modules:
    07:37:48.398
    07:37:49.982 AVAST engine scan C:\Windows
    07:37:53.219 AVAST engine scan C:\Windows\system32
    07:43:04.016 AVAST engine scan C:\Windows\system32\drivers
    07:43:34.269 AVAST engine scan C:\Users\waldo
    07:45:12.540 AVAST engine scan C:\ProgramData
    07:51:06.028 Scan finished successfully
    07:52:17.560 Disk 0 MBR has been saved successfully to "C:\Users\waldo\Desktop\MBR.dat"
    07:52:17.608 The log file has been saved successfully to "C:\Users\waldo\Desktop\aswMBR.txt"


    By the way this all started right after I did Windows updates. Don't know if that's coincidence or not. Thanks for any help you can give me.

  2. #2
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default



    For starters you have an infected hosts file


    Open notepad (Start --> All Programs --> Accessories --> Notepad).
    Please copy the entire contents of the code box below.
    (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
    Save it to the same directory as FRST or FRST64 as fixlist.txt. (it has to be right next to FRST or FRST64) either in a directory you saved FRST or FRST64 or on your desktop if thats where you saved it.
    You can use your mouse to drag Fixlist right next to FRST or FRST64, either above or below it but not on top of it.

    Code:
    Start
    CloseProcesses:
    2014-10-02 15:41 - 2014-10-02 15:14 - 00000035 _____ () C:\Windows\system32\Drivers\etc\hosts.20141002-144109.backup
    2014-10-02 15:41 - 2009-07-13 22:34 - 00449923 ____R () C:\Windows\system32\Drivers\etc\hosts.20141018-030303.backup
    2014-09-23 06:21 - 2009-07-13 22:34 - 00449915 ____R () C:\Windows\system32\Drivers\etc\hosts.20140924-145140.backup
    CMD: ipconfig /flushdns
    Hosts:
    EmptyTemp:
    End
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Then open FRST or FRST64 and click on fix
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.




    =======================================================




    Download Malwarebytes' Anti-Malware to your desktop.

    • Windows XP : Double click on the icon to run it.
    • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"





    • On the Dashboard click on Update Now
    • Go to the Setting Tab
    • Under Setting go to Detection and Protection
    • Under PUP and PUM make sure both are set to show Threat Detections as Malware
    • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
    • Then on the Dashboard click on Scan
    • Make sure to select THREAT SCAN
    • Then click on Scan
    • When the scan is finished and the log pops up...select Copy to Clipboard
    • Please paste the log back into this thread for review
    • Exit Malwarebytes
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  3. #3
    Senior Member
    Join Date
    Apr 2006
    Posts
    153

    Default

    Logs to follow. Downloaded Malwarebytes but it says trial period has expired, license no longer valid. Let it update and ran scan anyway. (could not changed advanced settings, all grayed out).

    Fixlog:

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-10-2014
    Ran by waldo at 2014-10-23 22:33:04 Run:1
    Running from C:\Users\waldo\Desktop
    Loaded Profile: waldo (Available profiles: waldo)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    Start
    CloseProcesses:
    2014-10-02 15:41 - 2014-10-02 15:14 - 00000035 _____ () C:\Windows\system32\Drivers\etc\hosts.20141002-144109.backup
    2014-10-02 15:41 - 2009-07-13 22:34 - 00449923 ____R () C:\Windows\system32\Drivers\etc\hosts.20141018-030303.backup
    2014-09-23 06:21 - 2009-07-13 22:34 - 00449915 ____R () C:\Windows\system32\Drivers\etc\hosts.20140924-145140.backup
    CMD: ipconfig /flushdns
    Hosts:

    *****************

    Processes closed successfully.
    C:\Windows\system32\Drivers\etc\hosts.20141002-144109.backup => Moved successfully.
    C:\Windows\system32\Drivers\etc\hosts.20141018-030303.backup => Moved successfully.
    C:\Windows\system32\Drivers\etc\hosts.20140924-145140.backup => Moved successfully.

    ========= ipconfig /flushdns =========


    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    ========= End of CMD: =========

    C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
    Hosts was reset successfully.


    The system needed a reboot.

    ==== End of Fixlog ====


    MBAM Log:

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 10/23/2014
    Scan Time: 10:44:56 PM
    Logfile: Mbamlog.txt
    Administrator: Yes

    Version: 2.00.3.1025
    Malware Database: v2014.10.24.01
    Rootkit Database: v2014.10.22.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: waldo

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 330696
    Time Elapsed: 9 min, 6 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Enabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)

  4. #4
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Things any better ?



    You need to enable windows to show all files and folders, instructions Here

    Go to VirusTotal and submit this file for analysis, just use the browse feature and then Scan It, if it says this file has been checked before, have them recheck it. When the scan is done just copy and paste the link back to this forum for me to see.

    C:\Windows\system32\Drivers\fieropav.sys <-- This file

    If the site is busy you can try this one
    http://virusscan.jotti.org/en
    Last edited by ken545; 2014-10-24 at 13:53.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  5. #5
    Senior Member
    Join Date
    Apr 2006
    Posts
    153

    Default

    Not sure if things are better, no pop ups at the moment but they come and go. We can go along without a pop up for hours and then we get them again so at this point it's really hard to tell. I will scan that file in a bit but I have a question. That host file that we removed. There's a bunch more just like it in the drivers folder. Could they also be a problem? I also have the same type files on my laptop. Various dates. Just curious. Will get back to you with the info on the file scan soon. Thanks much for your help.

  6. #6
    Senior Member
    Join Date
    Apr 2006
    Posts
    153

    Default

    <<C:\Windows\system32\Drivers\fieropav.sys>>


    Ok I see this when I look in the C drive but when I try to find it with Virus Scan it does NOT show. Looked at properties for this and it says Boot Time Removal Tool. Microsoft Malware Protection and it was created on 10/16/2012. Not sure if that helps or not. And not sure what generated that file. Any ideas? Thanks for all the help. This can be so confusing.

  7. #7
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Your hosts file resides in the etc folder
    C:\Windows\system32\Drivers\etc

    In etc you may have
    Hosts
    ImHosts.sam
    Networks
    Protocol
    Service

    These are all normal and nothing to worry about

    Lets see how that file comes back and we can run a few other programs to make sure no more malware is aboard
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  8. #8
    Senior Member
    Join Date
    Apr 2006
    Posts
    153

    Default

    Quote Originally Posted by ken545 View Post
    Your hosts file resides in the etc folder
    C:\Windows\system32\Drivers\etc

    In etc you may have
    Hosts
    ImHosts.sam
    Networks
    Protocol
    Service

    These are all normal and nothing to worry about

    Lets see how that file comes back and we can run a few other programs to make sure no more malware is aboard
    I see those. What I'm asking about is ones that have the word backup in them. Like this one: hosts.20091119-151955.backup There's a whole bunch of them in there and they all end in .backup Are these normal or are they also infected? Will await your reply

  9. #9
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Only 3 showed up on your FRST log because of the dates

    Go ahead and delete any that look like this
    C:\Windows\system32\Drivers\etc\hosts.20141002-144109.backup



    Please download TDSSKiller.zip
    • Extract it to your desktop
    • Double click TDSSKiller.exe
    • when the window opens, click on Change Parameters
    • under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
    • click OK
    • Press Start Scan
      • As we are only looking for a log of what is on the machine right now > choose to skip whatever is found
      • Then click Continue > Reboot now
    • Copy and paste the log in your next reply
      • A copy of the log will be saved automatically to the root of the drive (typically C:\)
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  10. #10
    Senior Member
    Join Date
    Apr 2006
    Posts
    153

    Default

    Quote Originally Posted by ken545 View Post
    Only 3 showed up on your FRST log because of the dates

    Go ahead and delete any that look like this
    C:\Windows\system32\Drivers\etc\hosts.20141002-144109.backup
    Ok, deleted all 45 of those. I also have those same type of files on my laptop, should I just go ahead and remove those as well or should I go through a check for the laptop as well. Both computers are on the same network. I'm wondering if maybe we keep infecting each other?????? We don't share files but we do share e-mails.


    Here's the log you requested:

    09:50:20.0932 0x1060 TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
    09:50:27.0801 0x1060 ============================================================
    09:50:27.0801 0x1060 Current date / time: 2014/10/24 09:50:27.0801
    09:50:27.0801 0x1060 SystemInfo:
    09:50:27.0801 0x1060
    09:50:27.0801 0x1060 OS Version: 6.1.7601 ServicePack: 1.0
    09:50:27.0801 0x1060 Product type: Workstation
    09:50:27.0802 0x1060 ComputerName: WALDO-PC
    09:50:27.0802 0x1060 UserName: waldo
    09:50:27.0802 0x1060 Windows directory: C:\Windows
    09:50:27.0802 0x1060 System windows directory: C:\Windows
    09:50:27.0802 0x1060 Running under WOW64
    09:50:27.0802 0x1060 Processor architecture: Intel x64
    09:50:27.0802 0x1060 Number of processors: 2
    09:50:27.0802 0x1060 Page size: 0x1000
    09:50:27.0802 0x1060 Boot type: Normal boot
    09:50:27.0802 0x1060 ============================================================
    09:50:28.0001 0x1060 KLMD registered as C:\Windows\system32\drivers\93898908.sys
    09:50:28.0522 0x1060 System UUID: {A8056B36-0DF8-BF23-14EF-7CA6258DA5ED}
    09:50:29.0485 0x1060 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
    09:50:30.0150 0x1060 Drive \Device\Harddisk1\DR1 - Size: 0x1D1C1116000 ( 1863.02 Gb ), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
    09:50:30.0271 0x1060 Drive \Device\Harddisk8\DR8 - Size: 0x1C9FE00000 ( 114.50 Gb ), SectorSize: 0x200, Cylinders: 0x3A62, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
    09:50:30.0273 0x1060 ============================================================
    09:50:30.0273 0x1060 \Device\Harddisk0\DR0:
    09:50:30.0273 0x1060 MBR partitions:
    09:50:30.0273 0x1060 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1E00800, BlocksNum 0x32000
    09:50:30.0273 0x1060 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E32800, BlocksNum 0x728D3800
    09:50:30.0273 0x1060 \Device\Harddisk1\DR1:
    09:50:30.0273 0x1060 MBR partitions:
    09:50:30.0273 0x1060 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE8E07482
    09:50:30.0273 0x1060 \Device\Harddisk8\DR8:
    09:50:30.0274 0x1060 MBR partitions:
    09:50:30.0274 0x1060 \Device\Harddisk8\DR8\Partition1: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0xDF93782
    09:50:30.0274 0x1060 ============================================================
    09:50:30.0275 0x1060 C: <-> \Device\Harddisk0\DR0\Partition2
    09:50:30.0275 0x1060 J: <-> \Device\Harddisk8\DR8\Partition1
    09:50:30.0302 0x1060 K: <-> \Device\Harddisk1\DR1\Partition1
    09:50:30.0302 0x1060 ============================================================
    09:50:30.0302 0x1060 Initialize success
    09:50:30.0302 0x1060 ============================================================
    09:51:04.0376 0x1340 ============================================================
    09:51:04.0376 0x1340 Scan started
    09:51:04.0376 0x1340 Mode: Manual; TDLFS;
    09:51:04.0376 0x1340 ============================================================
    09:51:04.0376 0x1340 KSN ping started
    09:51:07.0250 0x1340 KSN ping finished: true
    09:51:07.0938 0x1340 ================ Scan system memory ========================
    09:51:07.0938 0x1340 System memory - ok
    09:51:07.0939 0x1340 ================ Scan services =============================
    09:51:08.0129 0x1340 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
    09:51:08.0139 0x1340 1394ohci - ok
    09:51:08.0169 0x1340 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
    09:51:08.0177 0x1340 ACPI - ok
    09:51:08.0205 0x1340 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
    09:51:08.0206 0x1340 AcpiPmi - ok
    09:51:08.0343 0x1340 [ ADDA5E1951B90D3D23C56D3CF0622ADC, E85E7BFD29F00ED34BF5BE8BD4DA93CBB14278E16809BB55406875F0DA88551E ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    09:51:08.0347 0x1340 AdobeARMservice - ok
    09:51:08.0400 0x1340 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
    09:51:08.0417 0x1340 adp94xx - ok
    09:51:08.0431 0x1340 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
    09:51:08.0439 0x1340 adpahci - ok
    09:51:08.0461 0x1340 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
    09:51:08.0466 0x1340 adpu320 - ok
    09:51:08.0487 0x1340 [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
    09:51:08.0489 0x1340 AeLookupSvc - ok
    09:51:08.0533 0x1340 [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
    09:51:08.0544 0x1340 AFD - ok
    09:51:08.0557 0x1340 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
    09:51:08.0559 0x1340 agp440 - ok
    09:51:08.0581 0x1340 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
    09:51:08.0584 0x1340 ALG - ok
    09:51:08.0611 0x1340 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
    09:51:08.0612 0x1340 aliide - ok
    09:51:08.0617 0x1340 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
    09:51:08.0619 0x1340 amdide - ok
    09:51:08.0638 0x1340 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
    09:51:08.0640 0x1340 AmdK8 - ok
    09:51:08.0659 0x1340 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
    09:51:08.0661 0x1340 AmdPPM - ok
    09:51:08.0692 0x1340 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
    09:51:08.0695 0x1340 amdsata - ok
    09:51:08.0705 0x1340 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
    09:51:08.0710 0x1340 amdsbs - ok
    09:51:08.0727 0x1340 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
    09:51:08.0729 0x1340 amdxata - ok
    09:51:08.0780 0x1340 [ 85180CF88C5EBAD73B452A43A004CA51, 24D25495DC21293FC1F37EE7E7C2A4725E66D3D25BE05D7EDF4BB4F444C65526 ] AOL ACS C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
    09:51:08.0783 0x1340 AOL ACS - ok
    09:51:08.0813 0x1340 [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID C:\Windows\system32\drivers\appid.sys
    09:51:08.0816 0x1340 AppID - ok
    09:51:08.0837 0x1340 [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc C:\Windows\System32\appidsvc.dll
    09:51:08.0840 0x1340 AppIDSvc - ok
    09:51:08.0874 0x1340 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
    09:51:08.0878 0x1340 Appinfo - ok
    09:51:08.0914 0x1340 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\DRIVERS\arc.sys
    09:51:08.0918 0x1340 arc - ok
    09:51:08.0927 0x1340 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
    09:51:08.0931 0x1340 arcsas - ok
    09:51:09.0031 0x1340 [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    09:51:09.0034 0x1340 aspnet_state - ok
    09:51:09.0057 0x1340 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
    09:51:09.0059 0x1340 AsyncMac - ok
    09:51:09.0095 0x1340 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
    09:51:09.0097 0x1340 atapi - ok
    09:51:09.0157 0x1340 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
    09:51:09.0173 0x1340 AudioEndpointBuilder - ok
    09:51:09.0201 0x1340 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv C:\Windows\System32\Audiosrv.dll
    09:51:09.0213 0x1340 AudioSrv - ok
    09:51:09.0257 0x1340 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
    09:51:09.0260 0x1340 AxInstSV - ok
    09:51:09.0291 0x1340 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
    09:51:09.0301 0x1340 b06bdrv - ok
    09:51:09.0357 0x1340 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
    09:51:09.0368 0x1340 b57nd60a - ok
    09:51:09.0408 0x1340 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
    09:51:09.0411 0x1340 BDESVC - ok
    09:51:09.0434 0x1340 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
    09:51:09.0434 0x1340 Beep - ok
    09:51:09.0516 0x1340 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
    09:51:09.0532 0x1340 BFE - ok
    09:51:09.0591 0x1340 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
    09:51:09.0607 0x1340 BITS - ok
    09:51:09.0634 0x1340 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
    09:51:09.0636 0x1340 blbdrive - ok
    09:51:09.0666 0x1340 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
    09:51:09.0669 0x1340 bowser - ok
    09:51:09.0687 0x1340 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
    09:51:09.0688 0x1340 BrFiltLo - ok
    09:51:09.0695 0x1340 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
    09:51:09.0696 0x1340 BrFiltUp - ok
    09:51:09.0731 0x1340 [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
    09:51:09.0734 0x1340 BridgeMP - ok
    09:51:09.0763 0x1340 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
    09:51:09.0766 0x1340 Browser - ok
    09:51:09.0783 0x1340 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
    09:51:09.0790 0x1340 Brserid - ok
    09:51:09.0817 0x1340 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
    09:51:09.0819 0x1340 BrSerWdm - ok
    09:51:09.0837 0x1340 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
    09:51:09.0838 0x1340 BrUsbMdm - ok
    09:51:09.0850 0x1340 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
    09:51:09.0852 0x1340 BrUsbSer - ok
    09:51:09.0862 0x1340 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
    09:51:09.0864 0x1340 BTHMODEM - ok
    09:51:09.0893 0x1340 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
    09:51:09.0896 0x1340 bthserv - ok
    09:51:09.0916 0x1340 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
    09:51:09.0918 0x1340 cdfs - ok
    09:51:09.0950 0x1340 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\drivers\cdrom.sys
    09:51:09.0954 0x1340 cdrom - ok
    09:51:09.0984 0x1340 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
    09:51:09.0987 0x1340 CertPropSvc - ok
    09:51:09.0999 0x1340 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
    09:51:10.0000 0x1340 circlass - ok
    09:51:10.0026 0x1340 [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
    09:51:10.0034 0x1340 CLFS - ok
    09:51:10.0077 0x1340 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    09:51:10.0080 0x1340 clr_optimization_v2.0.50727_32 - ok
    09:51:10.0137 0x1340 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    09:51:10.0141 0x1340 clr_optimization_v2.0.50727_64 - ok
    09:51:10.0238 0x1340 [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    09:51:10.0243 0x1340 clr_optimization_v4.0.30319_32 - ok
    09:51:10.0260 0x1340 [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    09:51:10.0262 0x1340 clr_optimization_v4.0.30319_64 - ok
    09:51:10.0283 0x1340 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
    09:51:10.0284 0x1340 CmBatt - ok
    09:51:10.0310 0x1340 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
    09:51:10.0312 0x1340 cmdide - ok
    09:51:10.0347 0x1340 [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG C:\Windows\system32\Drivers\cng.sys
    09:51:10.0357 0x1340 CNG - ok
    09:51:10.0378 0x1340 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
    09:51:10.0379 0x1340 Compbatt - ok
    09:51:10.0415 0x1340 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
    09:51:10.0417 0x1340 CompositeBus - ok
    09:51:10.0421 0x1340 COMSysApp - ok
    09:51:10.0442 0x1340 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
    09:51:10.0443 0x1340 crcdisk - ok
    09:51:10.0479 0x1340 [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc C:\Windows\system32\cryptsvc.dll
    09:51:10.0484 0x1340 CryptSvc - ok
    09:51:10.0523 0x1340 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
    09:51:10.0534 0x1340 DcomLaunch - ok
    09:51:10.0568 0x1340 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
    09:51:10.0575 0x1340 defragsvc - ok
    09:51:10.0607 0x1340 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
    09:51:10.0610 0x1340 DfsC - ok
    09:51:10.0658 0x1340 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
    09:51:10.0665 0x1340 Dhcp - ok
    09:51:10.0676 0x1340 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
    09:51:10.0677 0x1340 discache - ok
    09:51:10.0707 0x1340 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\DRIVERS\disk.sys
    09:51:10.0709 0x1340 Disk - ok
    09:51:10.0751 0x1340 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
    09:51:10.0757 0x1340 Dnscache - ok
    09:51:10.0802 0x1340 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
    09:51:10.0814 0x1340 dot3svc - ok
    09:51:10.0839 0x1340 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
    09:51:10.0843 0x1340 DPS - ok
    09:51:10.0894 0x1340 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
    09:51:10.0895 0x1340 drmkaud - ok
    09:51:10.0947 0x1340 [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
    09:51:10.0995 0x1340 DXGKrnl - ok
    09:51:11.0037 0x1340 [ 761B9EDD97A021AA1922501B7A056635, 5F2BD5B086B3E0E3B11237152E0F3CE6D1CC0F927EC72808D59C4CCC9187A6D0 ] e1yexpress C:\Windows\system32\DRIVERS\e1y62x64.sys
    09:51:11.0045 0x1340 e1yexpress - ok
    09:51:11.0078 0x1340 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
    09:51:11.0081 0x1340 EapHost - ok
    09:51:11.0213 0x1340 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
    09:51:11.0332 0x1340 ebdrv - ok
    09:51:11.0365 0x1340 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS C:\Windows\System32\lsass.exe
    09:51:11.0367 0x1340 EFS - ok
    09:51:11.0457 0x1340 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
    09:51:11.0498 0x1340 ehRecvr - ok
    09:51:11.0544 0x1340 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
    09:51:11.0549 0x1340 ehSched - ok
    09:51:11.0589 0x1340 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
    09:51:11.0606 0x1340 elxstor - ok
    09:51:11.0687 0x1340 [ B5581646636759D0DAFA8B008881C079, 0CADE029ABDCDE3A89C0786F1698C93D9A7CC981EFB3761CF243E19E178FF611 ] EPSON_EB_RPCV4_01 C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
    09:51:11.0783 0x1340 EPSON_EB_RPCV4_01 - ok
    09:51:11.0800 0x1340 [ 1E345F2A2D95DA3190596E691CDE9342, 9D1D48F3B749ADA598D155E11E63CD52A4EEABF9BE92A1D997D25D07CF350084 ] EPSON_PM_RPCV4_01 C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
    09:51:11.0877 0x1340 EPSON_PM_RPCV4_01 - ok
    09:51:11.0906 0x1340 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
    09:51:11.0907 0x1340 ErrDev - ok
    09:51:11.0950 0x1340 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
    09:51:11.0958 0x1340 EventSystem - ok
    09:51:11.0979 0x1340 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
    09:51:11.0982 0x1340 exfat - ok
    09:51:12.0002 0x1340 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
    09:51:12.0006 0x1340 fastfat - ok
    09:51:12.0066 0x1340 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
    09:51:12.0082 0x1340 Fax - ok
    09:51:12.0121 0x1340 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\DRIVERS\fdc.sys
    09:51:12.0122 0x1340 fdc - ok
    09:51:12.0134 0x1340 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
    09:51:12.0135 0x1340 fdPHost - ok
    09:51:12.0148 0x1340 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
    09:51:12.0150 0x1340 FDResPub - ok
    09:51:12.0166 0x1340 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
    09:51:12.0168 0x1340 FileInfo - ok
    09:51:12.0184 0x1340 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
    09:51:12.0185 0x1340 Filetrace - ok
    09:51:12.0205 0x1340 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
    09:51:12.0206 0x1340 flpydisk - ok
    09:51:12.0240 0x1340 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
    09:51:12.0247 0x1340 FltMgr - ok
    09:51:12.0312 0x1340 [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
    09:51:12.0382 0x1340 FontCache - ok
    09:51:12.0430 0x1340 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    09:51:12.0432 0x1340 FontCache3.0.0.0 - ok
    09:51:12.0445 0x1340 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
    09:51:12.0447 0x1340 FsDepends - ok
    09:51:12.0469 0x1340 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
    09:51:12.0470 0x1340 Fs_Rec - ok
    09:51:12.0516 0x1340 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
    09:51:12.0521 0x1340 fvevol - ok
    09:51:12.0539 0x1340 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
    09:51:12.0541 0x1340 gagp30kx - ok
    09:51:12.0619 0x1340 [ C44D560E441F091EA3B72F778EC60DE2, 1F90BA0E98C436B98BF6B0BC93146B52C081DF374424E2DCA270316D508A59B2 ] GameConsoleService C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe
    09:51:12.0630 0x1340 GameConsoleService - ok
    09:51:12.0698 0x1340 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
    09:51:12.0735 0x1340 gpsvc - ok
    09:51:12.0804 0x1340 [ 816FD5A6F3C2F3D600900096632FC60E, D92401C4B56663F8A12B6390562608A125713408B00266C53844129679E48E9C ] Greg_Service C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe
    09:51:12.0824 0x1340 Greg_Service - ok
    09:51:12.0921 0x1340 [ 8F0DE4FEF8201E306F9938B0905AC96A, CA7153FE0C037D79FBF7CE0E090D741FB52BCCBBBD4CA505EF4849A0C4199F72 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    09:51:12.0927 0x1340 gupdate - ok
    09:51:12.0944 0x1340 [ 8F0DE4FEF8201E306F9938B0905AC96A, CA7153FE0C037D79FBF7CE0E090D741FB52BCCBBBD4CA505EF4849A0C4199F72 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    09:51:12.0947 0x1340 gupdatem - ok
    09:51:12.0957 0x1340 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
    09:51:12.0958 0x1340 hcw85cir - ok
    09:51:12.0987 0x1340 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
    09:51:12.0995 0x1340 HdAudAddService - ok
    09:51:13.0021 0x1340 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
    09:51:13.0024 0x1340 HDAudBus - ok
    09:51:13.0036 0x1340 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
    09:51:13.0037 0x1340 HidBatt - ok
    09:51:13.0051 0x1340 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
    09:51:13.0054 0x1340 HidBth - ok
    09:51:13.0083 0x1340 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
    09:51:13.0085 0x1340 HidIr - ok
    09:51:13.0105 0x1340 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\System32\hidserv.dll
    09:51:13.0107 0x1340 hidserv - ok
    09:51:13.0157 0x1340 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
    09:51:13.0158 0x1340 HidUsb - ok
    09:51:13.0194 0x1340 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
    09:51:13.0197 0x1340 hkmsvc - ok
    09:51:13.0230 0x1340 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
    09:51:13.0237 0x1340 HomeGroupListener - ok
    09:51:13.0272 0x1340 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
    09:51:13.0281 0x1340 HomeGroupProvider - ok
    09:51:13.0315 0x1340 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
    09:51:13.0319 0x1340 HpSAMD - ok
    09:51:13.0390 0x1340 [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
    09:51:13.0430 0x1340 HTTP - ok
    09:51:13.0498 0x1340 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
    09:51:13.0499 0x1340 hwpolicy - ok
    09:51:13.0556 0x1340 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
    09:51:13.0561 0x1340 i8042prt - ok
    09:51:13.0588 0x1340 [ 1D004CB1DA6323B1F55CAEF7F94B61D9, 8FFFB429BA46938724BBB87AB9B3EC77EA17C4B893BABDBDD38309F02963D405 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
    09:51:13.0596 0x1340 iaStor - ok
    09:51:13.0643 0x1340 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
    09:51:13.0661 0x1340 iaStorV - ok
    09:51:13.0707 0x1340 [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
    09:51:13.0734 0x1340 idsvc - ok
    09:51:14.0077 0x1340 [ 677AA5991026A65ADA128C4B59CF2BAD, 013F9D7362960EEE1DB70EE8B90A896EACA0B752924717FD019A6DD3BFF50C00 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
    09:51:14.0388 0x1340 igfx - ok
    09:51:14.0429 0x1340 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
    09:51:14.0431 0x1340 iirsp - ok
    09:51:14.0515 0x1340 [ 54E0F4CCD6CE99A807459AF928DD64AC, 65EBD9757B811E8F1060F23C4936DBED5FBBEDA290CC4CD7F7781CC3D189BE8B ] IJPLMSVC C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
    09:51:14.0520 0x1340 IJPLMSVC - ok
    09:51:14.0574 0x1340 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
    09:51:14.0603 0x1340 IKEEXT - ok
    09:51:14.0707 0x1340 [ BC64B75E8E0A0B8982AB773483164E72, BF7CB0DEAAF78E20EA56B50FC177E99538FC4F29DA018D98E4286D122789435D ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
    09:51:14.0760 0x1340 IntcAzAudAddService - ok
    09:51:14.0799 0x1340 [ D485D3BD3E2179AA86853A182F70699F, 6398534A471ACC77FE058C28A8DBEABDD0166CC3D9AEC8D45CCB68F978F7303C ] IntcHdmiAddService C:\Windows\system32\drivers\IntcHdmi.sys
    09:51:14.0803 0x1340 IntcHdmiAddService - ok
    09:51:14.0839 0x1340 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
    09:51:14.0841 0x1340 intelide - ok
    09:51:14.0869 0x1340 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
    09:51:14.0872 0x1340 intelppm - ok
    09:51:14.0888 0x1340 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
    09:51:14.0894 0x1340 IPBusEnum - ok
    09:51:14.0918 0x1340 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
    09:51:14.0921 0x1340 IpFilterDriver - ok
    09:51:14.0964 0x1340 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
    09:51:14.0978 0x1340 iphlpsvc - ok
    09:51:15.0012 0x1340 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
    09:51:15.0016 0x1340 IPMIDRV - ok
    09:51:15.0041 0x1340 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
    09:51:15.0046 0x1340 IPNAT - ok
    09:51:15.0059 0x1340 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
    09:51:15.0061 0x1340 IRENUM - ok
    09:51:15.0081 0x1340 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
    09:51:15.0082 0x1340 isapnp - ok
    09:51:15.0124 0x1340 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
    09:51:15.0131 0x1340 iScsiPrt - ok
    09:51:15.0228 0x1340 [ BE72D2B3A99615F84E270C80F0A18448, D038E433ED9F1A183E87853114EEF43DD8690C43D47CFD9BA802B915D0DE75F5 ] ISWKL C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
    09:51:15.0231 0x1340 ISWKL - ok
    09:51:15.0296 0x1340 [ D9A4C1353CC653F8E2FE4D2C6A490E96, C77D09DF7F877EF14A67352255FAC7423ED970C8C66C2029FBA2C7D789A8FBE1 ] IswSvc C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    09:51:15.0339 0x1340 IswSvc - ok
    09:51:15.0355 0x1340 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
    09:51:15.0357 0x1340 kbdclass - ok
    09:51:15.0385 0x1340 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
    09:51:15.0386 0x1340 kbdhid - ok
    09:51:15.0398 0x1340 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso C:\Windows\system32\lsass.exe
    09:51:15.0400 0x1340 KeyIso - ok
    09:51:15.0429 0x1340 [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
    09:51:15.0432 0x1340 KSecDD - ok
    09:51:15.0448 0x1340 [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
    09:51:15.0452 0x1340 KSecPkg - ok
    09:51:15.0460 0x1340 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
    09:51:15.0462 0x1340 ksthunk - ok
    09:51:15.0506 0x1340 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
    09:51:15.0523 0x1340 KtmRm - ok
    09:51:15.0572 0x1340 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\System32\srvsvc.dll
    09:51:15.0578 0x1340 LanmanServer - ok
    09:51:15.0600 0x1340 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
    09:51:15.0604 0x1340 LanmanWorkstation - ok
    09:51:15.0634 0x1340 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
    09:51:15.0636 0x1340 lltdio - ok
    09:51:15.0669 0x1340 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
    09:51:15.0677 0x1340 lltdsvc - ok
    09:51:15.0712 0x1340 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
    09:51:15.0714 0x1340 lmhosts - ok
    09:51:15.0740 0x1340 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
    09:51:15.0743 0x1340 LSI_FC - ok
    09:51:15.0757 0x1340 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
    09:51:15.0760 0x1340 LSI_SAS - ok
    09:51:15.0779 0x1340 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
    09:51:15.0781 0x1340 LSI_SAS2 - ok
    09:51:15.0796 0x1340 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
    09:51:15.0799 0x1340 LSI_SCSI - ok
    09:51:15.0821 0x1340 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
    09:51:15.0824 0x1340 luafv - ok
    09:51:15.0854 0x1340 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
    09:51:15.0858 0x1340 Mcx2Svc - ok
    09:51:15.0873 0x1340 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
    09:51:15.0875 0x1340 megasas - ok
    09:51:15.0896 0x1340 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
    09:51:15.0902 0x1340 MegaSR - ok
    09:51:15.0922 0x1340 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
    09:51:15.0924 0x1340 MMCSS - ok
    09:51:15.0939 0x1340 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
    09:51:15.0941 0x1340 Modem - ok
    09:51:15.0959 0x1340 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
    09:51:15.0961 0x1340 monitor - ok
    09:51:15.0995 0x1340 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
    09:51:15.0997 0x1340 mouclass - ok
    09:51:16.0015 0x1340 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
    09:51:16.0017 0x1340 mouhid - ok
    09:51:16.0048 0x1340 [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
    09:51:16.0051 0x1340 mountmgr - ok
    09:51:16.0114 0x1340 [ 6439D1E559D08BD8A1465A8943357053, 0E300508C22D12FBA3BE566B722F574CBE1B4A1A305356B92B8EA8B86267071B ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
    09:51:16.0125 0x1340 MpFilter - ok
    09:51:16.0144 0x1340 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
    09:51:16.0149 0x1340 mpio - ok
    09:51:16.0176 0x1340 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
    09:51:16.0179 0x1340 mpsdrv - ok
    09:51:16.0230 0x1340 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
    09:51:16.0257 0x1340 MpsSvc - ok
    09:51:16.0289 0x1340 [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
    09:51:16.0293 0x1340 MRxDAV - ok
    09:51:16.0328 0x1340 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
    09:51:16.0332 0x1340 mrxsmb - ok
    09:51:16.0355 0x1340 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
    09:51:16.0362 0x1340 mrxsmb10 - ok
    09:51:16.0379 0x1340 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
    09:51:16.0382 0x1340 mrxsmb20 - ok
    09:51:16.0410 0x1340 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
    09:51:16.0412 0x1340 msahci - ok
    09:51:16.0440 0x1340 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
    09:51:16.0444 0x1340 msdsm - ok
    09:51:16.0471 0x1340 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
    09:51:16.0476 0x1340 MSDTC - ok
    09:51:16.0508 0x1340 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
    09:51:16.0509 0x1340 Msfs - ok
    09:51:16.0522 0x1340 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
    09:51:16.0523 0x1340 mshidkmdf - ok
    09:51:16.0531 0x1340 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
    09:51:16.0532 0x1340 msisadrv - ok
    09:51:16.0576 0x1340 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
    09:51:16.0581 0x1340 MSiSCSI - ok
    09:51:16.0585 0x1340 msiserver - ok
    09:51:16.0611 0x1340 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
    09:51:16.0612 0x1340 MSKSSRV - ok
    09:51:16.0720 0x1340 [ F0D5494D8B177C37E16966262F5D0F68, DD63427DFFD9DD2BEC8336F6AD1BEFE347012331631DC5FEC65E83B1EACDBC67 ] MsMpSvc C:\Program Files\Microsoft Security Client\MsMpEng.exe
    09:51:16.0722 0x1340 MsMpSvc - ok
    09:51:16.0737 0x1340 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
    09:51:16.0739 0x1340 MSPCLOCK - ok
    09:51:16.0753 0x1340 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
    09:51:16.0754 0x1340 MSPQM - ok
    09:51:16.0788 0x1340 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
    09:51:16.0796 0x1340 MsRPC - ok
    09:51:16.0805 0x1340 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
    09:51:16.0807 0x1340 mssmbios - ok
    09:51:16.0822 0x1340 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
    09:51:16.0823 0x1340 MSTEE - ok
    09:51:16.0833 0x1340 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
    09:51:16.0835 0x1340 MTConfig - ok
    09:51:16.0852 0x1340 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
    09:51:16.0854 0x1340 Mup - ok
    09:51:16.0892 0x1340 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
    09:51:16.0902 0x1340 napagent - ok
    09:51:16.0924 0x1340 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
    09:51:16.0932 0x1340 NativeWifiP - ok
    09:51:16.0995 0x1340 [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
    09:51:17.0023 0x1340 NDIS - ok
    09:51:17.0042 0x1340 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
    09:51:17.0044 0x1340 NdisCap - ok
    09:51:17.0064 0x1340 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
    09:51:17.0065 0x1340 NdisTapi - ok
    09:51:17.0105 0x1340 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
    09:51:17.0107 0x1340 Ndisuio - ok
    09:51:17.0142 0x1340 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
    09:51:17.0147 0x1340 NdisWan - ok
    09:51:17.0175 0x1340 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
    09:51:17.0176 0x1340 NDProxy - ok
    09:51:17.0266 0x1340 [ B90E093E7A7250906F1054418B5339C0, F9A0BAC5B4B29F14B5CACA1047F8928A495EFD56E485492BF71C856B296476D6 ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
    09:51:17.0325 0x1340 Nero BackItUp Scheduler 4.0 - ok
    09:51:17.0347 0x1340 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
    09:51:17.0349 0x1340 NetBIOS - ok
    09:51:17.0388 0x1340 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
    09:51:17.0400 0x1340 NetBT - ok
    09:51:17.0410 0x1340 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon C:\Windows\system32\lsass.exe
    09:51:17.0413 0x1340 Netlogon - ok
    09:51:17.0450 0x1340 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
    09:51:17.0459 0x1340 Netman - ok
    09:51:17.0495 0x1340 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    09:51:17.0499 0x1340 NetMsmqActivator - ok
    09:51:17.0530 0x1340 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    09:51:17.0533 0x1340 NetPipeActivator - ok
    09:51:17.0565 0x1340 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
    09:51:17.0574 0x1340 netprofm - ok
    09:51:17.0582 0x1340 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    09:51:17.0585 0x1340 NetTcpActivator - ok
    09:51:17.0592 0x1340 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    09:51:17.0595 0x1340 NetTcpPortSharing - ok
    09:51:17.0612 0x1340 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
    09:51:17.0614 0x1340 nfrd960 - ok
    09:51:17.0665 0x1340 [ F9EEFFC65C68A45001D1349E652B8B6F, E5F223129416083A12A85D48C65B2C8D1BF1124110399938E144308C89F9241D ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
    09:51:17.0670 0x1340 NisDrv - ok
    09:51:17.0720 0x1340 [ 9690F420A99364C1E5C439914B0DE25C, 6C6E0B27C4255001FE5F1EAD911DE1A8BF922C405B0C8031A6BD253CEB1D02A6 ] NisSrv C:\Program Files\Microsoft Security Client\NisSrv.exe
    09:51:17.0734 0x1340 NisSrv - ok
    09:51:17.0773 0x1340 [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc C:\Windows\System32\nlasvc.dll
    09:51:17.0779 0x1340 NlaSvc - ok
    09:51:17.0825 0x1340 [ 0E58F99692802C501454EAC3D2AC3394, 73EBA4A9DFE710E9695350F11C1A72045983DD5AD073136147D1CBC663B80530 ] nosGetPlusHelper C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll
    09:51:17.0827 0x1340 nosGetPlusHelper - ok
    09:51:17.0841 0x1340 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
    09:51:17.0843 0x1340 Npfs - ok
    09:51:17.0885 0x1340 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
    09:51:17.0887 0x1340 nsi - ok
    09:51:17.0898 0x1340 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
    09:51:17.0900 0x1340 nsiproxy - ok
    09:51:17.0993 0x1340 [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
    09:51:18.0023 0x1340 Ntfs - ok
    09:51:18.0095 0x1340 [ BD691091AC7D9713D8F0B07C6B099E6C, 4A69ED227CCBBCB76F78078CEE42506A875759FFB519CB9C40173EF8ACD6D6D2 ] NTI IScheduleSvc C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe
    09:51:18.0098 0x1340 NTI IScheduleSvc - ok
    09:51:18.0111 0x1340 [ 64DDD0DEE976302F4BD93E5EFCC2F013, 19F54B4549999EF96FAE1B2B97973F281304843ADE0CF5823574453AB41E3E9C ] NTIDrvr C:\Windows\system32\drivers\NTIDrvr.sys
    09:51:18.0113 0x1340 NTIDrvr - ok
    09:51:18.0123 0x1340 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
    09:51:18.0124 0x1340 Null - ok
    09:51:18.0141 0x1340 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
    09:51:18.0145 0x1340 nvraid - ok
    09:51:18.0174 0x1340 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
    09:51:18.0178 0x1340 nvstor - ok
    09:51:18.0212 0x1340 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
    09:51:18.0215 0x1340 nv_agp - ok
    09:51:18.0235 0x1340 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
    09:51:18.0237 0x1340 ohci1394 - ok
    09:51:18.0258 0x1340 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
    09:51:18.0265 0x1340 p2pimsvc - ok
    09:51:18.0294 0x1340 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
    09:51:18.0302 0x1340 p2psvc - ok
    09:51:18.0315 0x1340 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
    09:51:18.0318 0x1340 Parport - ok
    09:51:18.0348 0x1340 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
    09:51:18.0351 0x1340 partmgr - ok
    09:51:18.0373 0x1340 [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc C:\Windows\System32\pcasvc.dll
    09:51:18.0377 0x1340 PcaSvc - ok
    09:51:18.0390 0x1340 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
    09:51:18.0394 0x1340 pci - ok
    09:51:18.0410 0x1340 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
    09:51:18.0411 0x1340 pciide - ok
    09:51:18.0435 0x1340 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
    09:51:18.0440 0x1340 pcmcia - ok
    09:51:18.0458 0x1340 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
    09:51:18.0460 0x1340 pcw - ok
    09:51:18.0490 0x1340 [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
    09:51:18.0504 0x1340 PEAUTH - ok
    09:51:18.0587 0x1340 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
    09:51:18.0590 0x1340 PerfHost - ok
    09:51:18.0681 0x1340 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
    09:51:18.0746 0x1340 pla - ok
    09:51:18.0788 0x1340 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
    09:51:18.0798 0x1340 PlugPlay - ok
    09:51:18.0813 0x1340 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
    09:51:18.0816 0x1340 PNRPAutoReg - ok
    09:51:18.0836 0x1340 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
    09:51:18.0844 0x1340 PNRPsvc - ok
    09:51:18.0869 0x1340 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
    09:51:18.0879 0x1340 PolicyAgent - ok
    09:51:18.0909 0x1340 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
    09:51:18.0914 0x1340 Power - ok
    09:51:18.0947 0x1340 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
    09:51:18.0950 0x1340 PptpMiniport - ok
    09:51:18.0995 0x1340 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\DRIVERS\processr.sys
    09:51:18.0997 0x1340 Processor - ok
    09:51:19.0053 0x1340 [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc C:\Windows\system32\profsvc.dll
    09:51:19.0064 0x1340 ProfSvc - ok
    09:51:19.0077 0x1340 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
    09:51:19.0079 0x1340 ProtectedStorage - ok
    09:51:19.0111 0x1340 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
    09:51:19.0114 0x1340 Psched - ok
    09:51:19.0194 0x1340 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
    09:51:19.0256 0x1340 ql2300 - ok
    09:51:19.0275 0x1340 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
    09:51:19.0279 0x1340 ql40xx - ok
    09:51:19.0311 0x1340 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
    09:51:19.0319 0x1340 QWAVE - ok
    09:51:19.0333 0x1340 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
    09:51:19.0335 0x1340 QWAVEdrv - ok
    09:51:19.0352 0x1340 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
    09:51:19.0354 0x1340 RasAcd - ok
    09:51:19.0385 0x1340 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
    09:51:19.0387 0x1340 RasAgileVpn - ok
    09:51:19.0407 0x1340 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
    09:51:19.0411 0x1340 RasAuto - ok
    09:51:19.0441 0x1340 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
    09:51:19.0445 0x1340 Rasl2tp - ok
    09:51:19.0486 0x1340 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
    09:51:19.0503 0x1340 RasMan - ok
    09:51:19.0519 0x1340 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
    09:51:19.0522 0x1340 RasPppoe - ok
    09:51:19.0535 0x1340 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
    09:51:19.0538 0x1340 RasSstp - ok
    09:51:19.0574 0x1340 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
    09:51:19.0581 0x1340 rdbss - ok
    09:51:19.0594 0x1340 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
    09:51:19.0595 0x1340 rdpbus - ok
    09:51:19.0614 0x1340 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
    09:51:19.0615 0x1340 RDPCDD - ok
    09:51:19.0640 0x1340 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
    09:51:19.0641 0x1340 RDPENCDD - ok
    09:51:19.0660 0x1340 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
    09:51:19.0662 0x1340 RDPREFMP - ok
    09:51:19.0740 0x1340 [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
    09:51:19.0742 0x1340 RdpVideoMiniport - ok
    09:51:19.0778 0x1340 [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
    09:51:19.0786 0x1340 RDPWD - ok
    09:51:19.0823 0x1340 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
    09:51:19.0833 0x1340 rdyboost - ok
    09:51:19.0855 0x1340 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
    09:51:19.0858 0x1340 RemoteAccess - ok
    09:51:19.0891 0x1340 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
    09:51:19.0896 0x1340 RemoteRegistry - ok
    09:51:19.0912 0x1340 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
    09:51:19.0915 0x1340 RpcEptMapper - ok
    09:51:19.0958 0x1340 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
    09:51:19.0960 0x1340 RpcLocator - ok
    09:51:19.0990 0x1340 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
    09:51:20.0000 0x1340 RpcSs - ok
    09:51:20.0013 0x1340 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
    09:51:20.0016 0x1340 rspndr - ok
    09:51:20.0032 0x1340 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs C:\Windows\system32\lsass.exe
    09:51:20.0034 0x1340 SamSs - ok
    09:51:20.0056 0x1340 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
    09:51:20.0059 0x1340 sbp2port - ok
    09:51:20.0152 0x1340 [ 794D4B48DFB6E999537C7C3947863463, 93DA8AA20D6B02A3360E7F56150F126E75266E9372E6409D42B89DA588EF49C3 ] SBSDWSCService C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    09:51:20.0198 0x1340 SBSDWSCService - ok
    09:51:20.0222 0x1340 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
    09:51:20.0228 0x1340 SCardSvr - ok
    09:51:20.0252 0x1340 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
    09:51:20.0254 0x1340 scfilter - ok
    09:51:20.0328 0x1340 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
    09:51:20.0371 0x1340 Schedule - ok
    09:51:20.0406 0x1340 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
    09:51:20.0408 0x1340 SCPolicySvc - ok
    09:51:20.0447 0x1340 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
    09:51:20.0453 0x1340 SDRSVC - ok
    09:51:20.0470 0x1340 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
    09:51:20.0471 0x1340 secdrv - ok
    09:51:20.0502 0x1340 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
    09:51:20.0505 0x1340 seclogon - ok
    09:51:20.0520 0x1340 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\system32\sens.dll
    09:51:20.0526 0x1340 SENS - ok
    09:51:20.0541 0x1340 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
    09:51:20.0543 0x1340 SensrSvc - ok
    09:51:20.0561 0x1340 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
    09:51:20.0563 0x1340 Serenum - ok
    09:51:20.0591 0x1340 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
    09:51:20.0594 0x1340 Serial - ok
    09:51:20.0611 0x1340 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
    09:51:20.0613 0x1340 sermouse - ok
    09:51:20.0649 0x1340 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
    09:51:20.0653 0x1340 SessionEnv - ok
    09:51:20.0677 0x1340 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
    09:51:20.0679 0x1340 sffdisk - ok
    09:51:20.0687 0x1340 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
    09:51:20.0689 0x1340 sffp_mmc - ok
    09:51:20.0703 0x1340 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
    09:51:20.0704 0x1340 sffp_sd - ok
    09:51:20.0720 0x1340 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
    09:51:20.0722 0x1340 sfloppy - ok
    09:51:20.0759 0x1340 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
    09:51:20.0768 0x1340 SharedAccess - ok
    09:51:20.0813 0x1340 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
    09:51:20.0829 0x1340 ShellHWDetection - ok
    09:51:20.0849 0x1340 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
    09:51:20.0851 0x1340 SiSRaid2 - ok
    09:51:20.0861 0x1340 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
    09:51:20.0864 0x1340 SiSRaid4 - ok
    09:51:20.0891 0x1340 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
    09:51:20.0894 0x1340 Smb - ok
    09:51:20.0928 0x1340 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
    09:51:20.0931 0x1340 SNMPTRAP - ok
    09:51:20.0937 0x1340 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
    09:51:20.0938 0x1340 spldr - ok
    09:51:20.0978 0x1340 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
    09:51:20.0990 0x1340 Spooler - ok
    09:51:21.0136 0x1340 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
    09:51:21.0317 0x1340 sppsvc - ok
    09:51:21.0338 0x1340 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
    09:51:21.0341 0x1340 sppuinotify - ok
    09:51:21.0390 0x1340 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
    09:51:21.0406 0x1340 srv - ok
    09:51:21.0426 0x1340 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
    09:51:21.0441 0x1340 srv2 - ok
    09:51:21.0481 0x1340 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
    09:51:21.0485 0x1340 srvnet - ok
    09:51:21.0506 0x1340 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
    09:51:21.0511 0x1340 SSDPSRV - ok
    09:51:21.0524 0x1340 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
    09:51:21.0528 0x1340 SstpSvc - ok
    09:51:21.0542 0x1340 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
    09:51:21.0543 0x1340 stexstor - ok
    09:51:21.0581 0x1340 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
    09:51:21.0596 0x1340 stisvc - ok
    09:51:21.0646 0x1340 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
    09:51:21.0648 0x1340 swenum - ok
    09:51:21.0683 0x1340 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
    09:51:21.0703 0x1340 swprv - ok
    09:51:21.0773 0x1340 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
    09:51:21.0836 0x1340 SysMain - ok
    09:51:21.0861 0x1340 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
    09:51:21.0864 0x1340 TabletInputService - ok
    09:51:21.0890 0x1340 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
    09:51:21.0899 0x1340 TapiSrv - ok
    09:51:21.0916 0x1340 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
    09:51:21.0920 0x1340 TBS - ok
    09:51:22.0022 0x1340 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
    09:51:22.0110 0x1340 Tcpip - ok
    09:51:22.0163 0x1340 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
    09:51:22.0196 0x1340 TCPIP6 - ok
    09:51:22.0227 0x1340 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
    09:51:22.0229 0x1340 tcpipreg - ok
    09:51:22.0257 0x1340 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
    09:51:22.0258 0x1340 TDPIPE - ok
    09:51:22.0279 0x1340 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
    09:51:22.0281 0x1340 TDTCP - ok
    09:51:22.0315 0x1340 [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
    09:51:22.0318 0x1340 tdx - ok
    09:51:22.0346 0x1340 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
    09:51:22.0348 0x1340 TermDD - ok
    09:51:22.0388 0x1340 [ 4FC4C50985E5B840F4D72E57286887B8, 0BCBB4A938803AE3A3532B6D8FFC85594AA9AEF5D8F9792684841BEA8780AE9E ] TermService C:\Windows\System32\termsrv.dll
    09:51:22.0402 0x1340 TermService - ok
    09:51:22.0419 0x1340 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
    09:51:22.0422 0x1340 Themes - ok
    09:51:22.0455 0x1340 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
    09:51:22.0458 0x1340 THREADORDER - ok
    09:51:22.0477 0x1340 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
    09:51:22.0481 0x1340 TrkWks - ok
    09:51:22.0539 0x1340 [ A1965DFC0CD91E7CFC42925F8F597274, 7478D7DACD94F0C3D4F0CDAC9CD71CB03CB45C503DE6B1207A51F989844CB1F3 ] TrueSight C:\Windows\System32\drivers\TrueSight.sys
    09:51:22.0575 0x1340 TrueSight - ok
    09:51:22.0638 0x1340 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
    09:51:22.0646 0x1340 TrustedInstaller - ok
    09:51:22.0669 0x1340 [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
    09:51:22.0671 0x1340 tssecsrv - ok
    09:51:22.0716 0x1340 [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
    09:51:22.0718 0x1340 TsUsbFlt - ok
    09:51:22.0759 0x1340 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
    09:51:22.0765 0x1340 tunnel - ok
    09:51:22.0794 0x1340 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
    09:51:22.0797 0x1340 uagp35 - ok
    09:51:22.0839 0x1340 [ 2E22C1FD397A5A9FFEF55E9D1FC96C00, 4646712B3F3AF6188DBCE1A95D92261E8B15E9583FE5DD538EC884F48B51759D ] UBHelper C:\Windows\system32\drivers\UBHelper.sys
    09:51:22.0840 0x1340 UBHelper - ok
    09:51:22.0878 0x1340 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
    09:51:22.0888 0x1340 udfs - ok
    09:51:22.0916 0x1340 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
    09:51:22.0919 0x1340 UI0Detect - ok
    09:51:22.0938 0x1340 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
    09:51:22.0940 0x1340 uliagpkx - ok
    09:51:22.0969 0x1340 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\drivers\umbus.sys
    09:51:22.0971 0x1340 umbus - ok
    09:51:22.0983 0x1340 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
    09:51:22.0985 0x1340 UmPass - ok
    09:51:23.0039 0x1340 [ 70DDE3A86DBEB1D6C3C30AD687B1877A, 2DAE797240DB8F521F1C9D1171524790052E186B060D58A1B102FBFFC80CE48E ] Updater Service C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe
    09:51:23.0049 0x1340 Updater Service - ok
    09:51:23.0073 0x1340 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
    09:51:23.0081 0x1340 upnphost - ok
    09:51:23.0108 0x1340 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
    09:51:23.0111 0x1340 usbccgp - ok
    09:51:23.0137 0x1340 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
    09:51:23.0140 0x1340 usbcir - ok
    09:51:23.0152 0x1340 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
    09:51:23.0154 0x1340 usbehci - ok
    09:51:23.0180 0x1340 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
    09:51:23.0188 0x1340 usbhub - ok
    09:51:23.0208 0x1340 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
    09:51:23.0210 0x1340 usbohci - ok
    09:51:23.0229 0x1340 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
    09:51:23.0230 0x1340 usbprint - ok
    09:51:23.0255 0x1340 [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
    09:51:23.0257 0x1340 usbscan - ok
    09:51:23.0278 0x1340 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\drivers\USBSTOR.SYS
    09:51:23.0281 0x1340 USBSTOR - ok
    09:51:23.0291 0x1340 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
    09:51:23.0293 0x1340 usbuhci - ok
    09:51:23.0307 0x1340 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
    09:51:23.0310 0x1340 UxSms - ok
    09:51:23.0321 0x1340 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc C:\Windows\system32\lsass.exe
    09:51:23.0322 0x1340 VaultSvc - ok
    09:51:23.0337 0x1340 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
    09:51:23.0339 0x1340 vdrvroot - ok
    09:51:23.0372 0x1340 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
    09:51:23.0385 0x1340 vds - ok
    09:51:23.0416 0x1340 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
    09:51:23.0418 0x1340 vga - ok
    09:51:23.0434 0x1340 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
    09:51:23.0443 0x1340 VgaSave - ok
    09:51:23.0494 0x1340 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
    09:51:23.0499 0x1340 vhdmp - ok
    09:51:23.0531 0x1340 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
    09:51:23.0532 0x1340 viaide - ok
    09:51:23.0553 0x1340 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
    09:51:23.0557 0x1340 volmgr - ok
    09:51:23.0604 0x1340 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
    09:51:23.0619 0x1340 volmgrx - ok
    09:51:23.0678 0x1340 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
    09:51:23.0684 0x1340 volsnap - ok
    09:51:23.0739 0x1340 [ 1065A957523ED51AAFFF737CC63010A6, E4BE00FA82C3CF1E019B0A119CC809FE968AF528DD0E3052ACD211A0FE777D8B ] Vsdatant C:\Windows\system32\DRIVERS\vsdatant.sys
    09:51:23.0748 0x1340 Vsdatant - ok
    09:51:23.0774 0x1340 vsmon - ok
    09:51:23.0800 0x1340 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
    09:51:23.0804 0x1340 vsmraid - ok
    09:51:23.0868 0x1340 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
    09:51:23.0936 0x1340 VSS - ok
    09:51:23.0958 0x1340 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
    09:51:23.0959 0x1340 vwifibus - ok
    09:51:24.0012 0x1340 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
    09:51:24.0022 0x1340 W32Time - ok
    09:51:24.0039 0x1340 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
    09:51:24.0040 0x1340 WacomPen - ok
    09:51:24.0069 0x1340 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
    09:51:24.0071 0x1340 WANARP - ok
    09:51:24.0084 0x1340 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
    09:51:24.0086 0x1340 Wanarpv6 - ok
    09:51:24.0103 0x1340 [ ECEB715BECE47E101DDEC06B11126066, 6BD577D6EABD48B1BA31955DB3DEEE68528EA54375CA64D233B723D161B45CBA ] wanatw C:\Windows\system32\DRIVERS\wanatw64.sys
    09:51:24.0105 0x1340 wanatw - ok
    09:51:24.0174 0x1340 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
    09:51:24.0265 0x1340 WatAdminSvc - ok
    09:51:24.0351 0x1340 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
    09:51:24.0440 0x1340 wbengine - ok
    09:51:24.0466 0x1340 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
    09:51:24.0472 0x1340 WbioSrvc - ok
    09:51:24.0502 0x1340 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
    09:51:24.0512 0x1340 wcncsvc - ok
    09:51:24.0526 0x1340 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
    09:51:24.0529 0x1340 WcsPlugInService - ok
    09:51:24.0545 0x1340 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\DRIVERS\wd.sys
    09:51:24.0546 0x1340 Wd - ok
    09:51:24.0592 0x1340 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
    09:51:24.0610 0x1340 Wdf01000 - ok
    09:51:24.0640 0x1340 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
    09:51:24.0644 0x1340 WdiServiceHost - ok
    09:51:24.0650 0x1340 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
    09:51:24.0653 0x1340 WdiSystemHost - ok
    09:51:24.0688 0x1340 [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
    09:51:24.0696 0x1340 WebClient - ok
    09:51:24.0716 0x1340 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
    09:51:24.0723 0x1340 Wecsvc - ok
    09:51:24.0734 0x1340 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
    09:51:24.0738 0x1340 wercplsupport - ok
    09:51:24.0760 0x1340 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
    09:51:24.0764 0x1340 WerSvc - ok
    09:51:24.0785 0x1340 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
    09:51:24.0786 0x1340 WfpLwf - ok
    09:51:24.0791 0x1340 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
    09:51:24.0793 0x1340 WIMMount - ok
    09:51:24.0821 0x1340 WinDefend - ok
    09:51:24.0829 0x1340 WinHttpAutoProxySvc - ok
    09:51:24.0894 0x1340 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
    09:51:24.0906 0x1340 Winmgmt - ok
    09:51:24.0998 0x1340 [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM C:\Windows\system32\WsmSvc.dll
    09:51:25.0089 0x1340 WinRM - ok
    09:51:25.0146 0x1340 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
    09:51:25.0175 0x1340 Wlansvc - ok
    09:51:25.0207 0x1340 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
    09:51:25.0208 0x1340 WmiAcpi - ok
    09:51:25.0236 0x1340 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
    09:51:25.0241 0x1340 wmiApSrv - ok
    09:51:25.0251 0x1340 WMPNetworkSvc - ok
    09:51:25.0264 0x1340 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
    09:51:25.0267 0x1340 WPCSvc - ok
    09:51:25.0316 0x1340 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
    09:51:25.0325 0x1340 WPDBusEnum - ok
    09:51:25.0355 0x1340 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
    09:51:25.0357 0x1340 ws2ifsl - ok
    09:51:25.0373 0x1340 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\system32\wscsvc.dll
    09:51:25.0378 0x1340 wscsvc - ok
    09:51:25.0383 0x1340 WSearch - ok
    09:51:25.0512 0x1340 [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv C:\Windows\system32\wuaueng.dll
    09:51:25.0629 0x1340 wuauserv - ok
    09:51:25.0664 0x1340 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
    09:51:25.0667 0x1340 WudfPf - ok
    09:51:25.0690 0x1340 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
    09:51:25.0695 0x1340 WUDFRd - ok
    09:51:25.0721 0x1340 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
    09:51:25.0725 0x1340 wudfsvc - ok
    09:51:25.0759 0x1340 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
    09:51:25.0766 0x1340 WwanSvc - ok
    09:51:25.0772 0x1340 ================ Scan global ===============================
    09:51:25.0803 0x1340 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
    09:51:25.0843 0x1340 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
    09:51:25.0856 0x1340 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
    09:51:25.0886 0x1340 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
    09:51:25.0928 0x1340 [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
    09:51:25.0941 0x1340 [ Global ] - ok
    09:51:25.0941 0x1340 ================ Scan MBR ==================================
    09:51:25.0950 0x1340 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
    09:51:26.0197 0x1340 \Device\Harddisk0\DR0 - ok
    09:51:26.0203 0x1340 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR1
    09:51:26.0321 0x1340 \Device\Harddisk1\DR1 - ok
    09:51:26.0327 0x1340 [ 3EB5EE06639A3E1AC43B244D1FFFCAF7 ] \Device\Harddisk8\DR8
    09:51:26.0468 0x1340 \Device\Harddisk8\DR8 - ok
    09:51:26.0469 0x1340 ================ Scan VBR ==================================
    09:51:26.0477 0x1340 [ CE72EC9AEE5497C42F64C6472AC6F3DC ] \Device\Harddisk0\DR0\Partition1
    09:51:26.0503 0x1340 \Device\Harddisk0\DR0\Partition1 - ok
    09:51:26.0508 0x1340 [ 1C1C0F551D0A9DAA727EEF0BB999D1DC ] \Device\Harddisk0\DR0\Partition2
    09:51:26.0534 0x1340 \Device\Harddisk0\DR0\Partition2 - ok
    09:51:26.0539 0x1340 [ 1D872005C803E9B4CB0910FA6B25F0A9 ] \Device\Harddisk1\DR1\Partition1
    09:51:26.0601 0x1340 \Device\Harddisk1\DR1\Partition1 - ok
    09:51:26.0607 0x1340 [ 4176398345FA41A7DD0313BBE5B3FE99 ] \Device\Harddisk8\DR8\Partition1
    09:51:26.0609 0x1340 \Device\Harddisk8\DR8\Partition1 - ok
    09:51:26.0610 0x1340 ================ Scan generic autorun ======================
    09:51:26.0884 0x1340 [ 02C60C606B17D7797377F1AC837EA070, AE1E7BF36E51B655A7516D7CCC79BB53BDE6CA15BF5AF37DB65AE242835E1FC2 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    09:51:27.0146 0x1340 RtHDVCpl - ok
    09:51:27.0195 0x1340 [ 0BBFE08ECCE8A209D07C3B68D63FC293, 0374316F3586D191437F5A54F9A322B3F68002652920477DBCFD48EF049E6F21 ] C:\Windows\system32\igfxtray.exe
    09:51:27.0200 0x1340 IgfxTray - ok
    09:51:27.0217 0x1340 [ 2F16207A65B62001FC73E6798D0B8F2A, 44B3B7E0ED654480EE6CB238976FCDC745BE3EFD7CDC71B262146A4CE63731CD ] C:\Windows\system32\hkcmd.exe
    09:51:27.0226 0x1340 HotKeysCmds - ok
    09:51:27.0245 0x1340 [ B69A01794D44C769C2575AE75E2EB31F, CE19EEA3F738A5F2A2C43EB6699AACB21D798B9649D744FB983868FB3E58E7C1 ] C:\Windows\system32\igfxpers.exe
    09:51:27.0255 0x1340 Persistence - ok
    09:51:27.0384 0x1340 [ 912993864DE980DE79E2317B109298AE, CD01E488E6331D0F00092A6F5B4B62F3404C9C5F0736887849AD215730C072D2 ] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
    09:51:27.0497 0x1340 CanonMyPrinter - ok
    09:51:27.0604 0x1340 [ 8B912FCACEA924635ED81520E7EA7C7A, CB4B72B30FC4A005B0208B2742917D7B01199EE422615C664FEAEED1BD705F6D ] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    09:51:27.0633 0x1340 ISW - ok
    09:51:27.0741 0x1340 [ A6AAD37CDCAE75CB62D039E3A4D8F5E3, 4FF763B0D129175BA1B1E794BA313E6C63F7A89D377C786BF5E730AF2A1D95D1 ] C:\Program Files\Microsoft Security Client\msseces.exe
    09:51:27.0804 0x1340 MSC - ok
    09:51:27.0840 0x1340 [ 22107F2015729D8A8943BBE13B091BD0, 0443E8814C3E5E38DBA7922D61C5AD8F91709F9B98B8062EE3B7F5811F82A495 ] C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe
    09:51:27.0842 0x1340 Gateway Photo Frame - ok
    09:51:27.0882 0x1340 [ 01848B246695D84FD5592C40136A0014, AEA8EF78D18575C7043C1DF41B4C5529BFDAA77427D9B63BFA99A0D4579403B9 ] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
    09:51:27.0884 0x1340 ZoneAlarm - ok
    09:51:27.0990 0x1340 [ 7B59D1D1F458B322A722E95554BB591E, F184E22D37E013580AB7FD07172C1F662275D39E036CE22DFA62B2A43823E719 ] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
    09:51:28.0016 0x1340 CanonSolutionMenuEx - ok
    09:51:28.0044 0x1340 [ C341CCFBE98BC7DF6E0B856BB9FC265A, 7EA0A5407591EC8D97A9658DBEB7CB57550E143C526C3502E73F12FEF46F778C ] C:\Program Files (x86)\QuickTime\qttask.exe
    09:51:28.0046 0x1340 QuickTime Task - ok
    09:51:28.0121 0x1340 [ 308F2EE28005510DE616409148CF077B, A2126CB185B0053086BDD6F0A16A503F6CA629AC677E4B7AE6D43C770061D087 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    09:51:28.0130 0x1340 SunJavaUpdateSched - ok
    09:51:28.0132 0x1340 Waiting for KSN requests completion. In queue: 323
    09:51:29.0133 0x1340 Waiting for KSN requests completion. In queue: 16
    09:51:30.0133 0x1340 Waiting for KSN requests completion. In queue: 16
    09:51:31.0153 0x1340 AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.6.305.0 ), 0x61000 ( enabled : updated )
    09:51:31.0174 0x1340 FW detected via SS2: ZoneAlarm Free Firewall Firewall, C:\Program Files (x86)\CheckPoint\ZoneAlarm\\MultiFix.exe ( 11.0.0.38 ), 0x41010 ( enabled )
    09:51:46.0575 0x1340 ============================================================
    09:51:46.0575 0x1340 Scan finished
    09:51:46.0575 0x1340 ============================================================
    09:51:46.0588 0x0eb4 Detected object count: 0
    09:51:46.0588 0x0eb4 Actual detected object count: 0
    09:53:07.0479 0x0c30 Deinitialize success

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •