Hi everyone, I did the Spyware Asylum guide and managed to get these logs for all three. I think Malwarebytes automatically blocked it from being accessed and I also disabled "Adobe Licensing Console" on MSConfig which I've read that also was possibly behind this. Lastly, I also deleted the .exe file and now it hasn't shown up on my volume mixer nor running processes, but I just wanted to make sure and scan again to see if the logs show anything I don't know I'm not aware of or if I should proceed to remove any more files/folders.
ComboFix Log
Malwarebytes Log
HijackThis Log
ComboFix Log
ComboFix 12-02-24.02 - Nigby 02/24/2012 20:33:49.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8173.6488 [GMT -5:00]
Running from: c:\users\Nigby\Downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\box.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-01-25 to 2012-02-25 )))))))))))))))))))))))))))))))
.
.
2012-02-25 01:37 . 2012-02-25 01:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-24 23:27 . 2012-02-24 23:27 -------- d-----w- c:\programdata\Malwarebytes
2012-02-24 23:27 . 2012-02-24 23:27 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-24 23:27 . 2011-12-10 20:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-24 11:33 . 2012-02-08 07:13 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{44A0A969-B2DB-4F80-823A-943646818C2F}\mpengine.dll
2012-02-21 23:47 . 2012-02-21 23:47 -------- d-----w- c:\users\UpdatusUser
2012-02-21 23:47 . 2012-02-10 03:05 2497985 ----a-w- c:\windows\system32\nvcoproc.bin
2012-02-19 07:07 . 2012-02-19 07:07 -------- d-----w- c:\program files (x86)\VideoLAN
2012-02-19 04:29 . 2012-02-19 04:29 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-02-19 04:29 . 2012-02-19 04:29 -------- d-----w- c:\program files (x86)\Java
2012-02-14 20:12 . 2012-02-14 20:12 -------- d-----w- c:\program files (x86)\Microsoft CAPICOM 2.1.0.2
2012-02-14 20:07 . 2012-02-14 20:07 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2012-02-14 20:01 . 2012-01-04 10:44 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-14 20:01 . 2012-01-04 08:58 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2012-02-14 20:01 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-14 20:01 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-02-14 20:01 . 2011-12-30 06:26 515584 ----a-w- c:\windows\system32\timedate.cpl
2012-02-14 20:01 . 2011-12-30 05:27 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
2012-02-14 20:01 . 2012-01-14 04:06 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-02-14 20:01 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys
2012-02-14 16:45 . 2012-02-14 16:45 -------- d-----w- c:\programdata\FLEXnet
2012-02-14 16:27 . 2012-02-14 16:27 -------- d-----w- c:\program files (x86)\Common Files\Macrovision Shared
2012-02-14 15:49 . 2012-02-14 15:49 384 ----a-w- c:\windows\SysWow64\checkOS.bat
2012-02-14 01:03 . 2012-02-14 01:03 -------- d-----w- c:\program files (x86)\ASIO4ALL v2
2012-02-14 00:58 . 2012-02-14 01:04 -------- d-----w- c:\program files (x86)\VstPlugins
2012-02-14 00:58 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\SysWow64\vorbis.acm
2012-02-14 00:57 . 2012-02-14 00:57 -------- d-----w- c:\program files (x86)\Outsim
2012-02-14 00:56 . 2012-02-14 00:58 -------- d-----w- c:\program files (x86)\Image-Line
2012-02-14 00:56 . 2012-02-14 00:56 690474 ----a-w- c:\windows\SysWow64\adbcnsl.exe
2012-02-12 19:07 . 2012-02-12 19:07 -------- d-----w- c:\programdata\Ableton
2012-02-12 19:03 . 2011-03-29 19:38 368640 ----a-w- c:\windows\SysWow64\ReWire.dll
2012-02-12 19:03 . 2011-03-29 19:38 233472 ----a-w- c:\windows\SysWow64\REX Shared Library.dll
2012-02-12 19:02 . 2012-02-12 19:02 -------- d-----w- c:\program files (x86)\Ableton
2012-02-11 18:59 . 2010-03-04 22:27 411480 ----a-w- c:\windows\SysWow64\tsccvid.dll
2012-02-11 18:59 . 2012-02-11 18:59 -------- d-----w- c:\windows\SysWow64\QuickTime
2012-02-11 18:59 . 2012-02-11 18:59 -------- d-----w- c:\windows\SysWow64\Flash
2012-02-11 18:59 . 2012-02-11 18:59 -------- d-----w- c:\program files (x86)\QuickTime
2012-02-11 18:59 . 2012-02-11 18:59 -------- d-----w- c:\program files (x86)\Common Files\TechSmith Shared
2012-02-11 18:59 . 2012-02-11 18:59 -------- d-----w- c:\programdata\TechSmith
2012-02-11 18:59 . 2012-02-11 18:59 -------- d-----w- c:\program files (x86)\TechSmith
2012-02-10 01:05 . 2012-02-10 01:05 416064 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2012-02-07 18:50 . 2012-02-07 18:55 -------- d-----w- C:\Fraps
2012-02-07 05:33 . 2012-02-07 05:33 -------- d-----w- c:\program files (x86)\VirtualDJ
2012-02-05 20:01 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll
2012-02-05 20:01 . 2011-02-19 12:04 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-02-05 20:01 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll
2012-02-05 20:01 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-02-05 20:01 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2012-01-31 00:33 . 2012-02-09 04:38 -------- d-----w- C:\Shared
2012-01-29 04:00 . 2012-01-29 04:34 -------- d-----w- c:\program files (x86)\zbattle.net
2012-01-28 17:17 . 2012-01-28 17:17 -------- d-----w- c:\program files (x86)\Respondus LockDown Browser
2012-01-28 17:17 . 2006-01-04 17:04 729161 ----a-w- c:\windows\SysWow64\fpimage.dll
2012-01-28 17:17 . 2006-01-04 17:04 1410704 ----a-w- c:\windows\SysWow64\FPSPR70.ocx
2012-01-28 05:41 . 2012-01-28 05:41 -------- d-----w- c:\windows\system32\Macromed
2012-01-28 04:23 . 2008-05-08 00:59 99840 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2012-01-28 03:04 . 2012-01-28 03:04 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-01-28 03:03 . 2012-02-14 16:29 -------- d-----w- c:\program files\Common Files\Adobe
2012-01-28 03:02 . 2012-01-28 03:02 -------- d-----w- c:\program files (x86)\Adobe Media Player
2012-01-28 03:01 . 2012-01-28 03:01 -------- d-----w- c:\windows\SysWow64\Macromed
2012-01-28 02:57 . 2012-01-28 02:57 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2012-01-28 02:56 . 2012-02-14 16:31 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2012-01-27 23:07 . 2012-01-27 23:07 -------- d-----w- c:\programdata\Electronic Arts
2012-01-27 23:00 . 2012-01-27 23:07 -------- d-----w- c:\program files (x86)\Electronic Arts
2012-01-27 22:58 . 2012-01-27 22:58 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-01-27 22:58 . 2012-01-27 22:58 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2012-01-27 22:57 . 2012-01-27 22:57 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-01-27 18:12 . 2011-07-07 23:21 1452648 ----a-w- c:\windows\system32\nvhdagenco6420102.dll
2012-01-27 18:12 . 2012-02-10 04:13 1737536 ----a-w- c:\windows\system32\nvdispco64.dll
2012-01-27 18:12 . 2012-02-10 04:13 1466176 ----a-w- c:\windows\system32\nvgenco64.dll
2012-01-27 18:02 . 2011-12-21 22:35 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2012-01-27 18:02 . 2011-11-24 04:02 648808 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2012-01-27 02:30 . 2012-01-27 02:30 -------- d-----w- c:\windows\SysWow64\Wat
2012-01-27 02:30 . 2012-01-27 02:30 -------- d-----w- c:\windows\system32\Wat
2012-01-27 02:16 . 2012-01-27 02:16 -------- d-----w- c:\program files\ESET
2012-01-27 01:29 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2012-01-27 01:26 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-01-27 01:26 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-01-27 01:26 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-01-27 01:26 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-01-27 01:26 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-01-27 01:16 . 2012-01-27 01:18 -------- d-----w- c:\program files (x86)\Common Files\LogiShrd
2012-01-27 01:16 . 2009-07-20 17:33 190992 ----a-w- c:\windows\system32\BtCoreIf.dll
2012-01-27 01:16 . 2009-07-20 17:35 96272 ----a-w- c:\windows\system32\KemXML.dll
2012-01-27 01:16 . 2009-07-20 17:34 159248 ----a-w- c:\windows\system32\KemWnd.dll
2012-01-27 01:16 . 2009-07-20 17:34 235536 ----a-w- c:\windows\system32\kemutb.dll
2012-01-27 01:16 . 2009-07-20 17:34 235536 ----a-w- c:\windows\system32\KemUtil.dll
2012-01-27 01:16 . 2012-01-27 01:16 -------- d-----w- c:\programdata\Logitech
2012-01-27 01:16 . 2012-01-27 01:18 -------- d-----w- c:\program files\Common Files\Logishrd
2012-01-27 01:16 . 2012-01-27 01:16 -------- d-----w- c:\program files\Logitech
2012-01-27 01:15 . 2012-01-27 01:18 -------- d-----w- c:\programdata\LogiShrd
2012-01-27 00:57 . 2012-01-27 00:57 -------- d--h--w- c:\windows\msdownld.tmp
2012-01-26 23:45 . 2012-01-26 20:54 -------- d-----w- c:\windows\Panther
2012-01-26 23:39 . 2012-01-26 23:39 -------- d-----w- C:\Windows.old
2012-01-26 22:51 . 2012-01-26 22:51 -------- d-----w- c:\program files\CCleaner
2012-01-26 22:51 . 2012-01-26 22:51 -------- d-----w- c:\program files\Defraggler
2012-01-26 22:50 . 2012-01-26 22:50 -------- d-----w- c:\program files (x86)\Winamp Detect
2012-01-26 22:50 . 2012-01-26 22:50 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
2012-01-26 22:50 . 2012-01-26 22:51 -------- d-----w- c:\program files (x86)\Winamp
2012-01-26 22:23 . 2012-02-14 20:10 -------- d-----w- c:\program files (x86)\Microsoft Works
2012-01-26 22:23 . 2012-01-27 11:33 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-01-26 22:23 . 2012-01-26 22:23 -------- d-----w- c:\windows\PCHEALTH
2012-01-26 22:22 . 2012-01-26 22:22 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2012-01-26 22:21 . 2012-02-15 21:23 -------- d-----w- c:\programdata\Microsoft Help
2012-01-26 22:21 . 2012-01-26 22:21 -------- d-----r- C:\MSOCache
2012-01-26 22:19 . 2012-01-27 01:12 -------- d-----w- c:\program files (x86)\PowerISO
2012-01-26 22:19 . 2011-06-15 08:30 93240 ----a-w- c:\windows\system32\drivers\scdemu.sys
2012-01-26 22:00 . 2012-01-26 22:00 -------- d-----w- c:\program files (x86)\Conduit
2012-01-26 22:00 . 2012-01-26 22:00 -------- d-----w- c:\program files (x86)\uTorrent
2012-01-26 21:52 . 2012-01-26 21:52 -------- d-----w- c:\program files (x86)\Mumble
2012-01-26 21:22 . 2012-01-26 21:22 -------- d-----w- c:\program files (x86)\EVGA
2012-01-26 21:18 . 2012-01-26 21:18 -------- d-----w- c:\program files (x86)\SystemRequirementsLab
2012-01-26 21:18 . 2012-01-26 21:18 -------- d-----w- c:\windows\Sun
2012-01-26 21:18 . 2012-02-19 04:29 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-01-26 21:17 . 2012-02-23 22:14 -------- d-----w- c:\program files (x86)\Common Files\Steam
2012-01-26 21:17 . 2012-02-24 22:58 -------- d-----w- c:\program files (x86)\Steam
2012-01-26 21:08 . 2012-02-25 01:38 -------- d-----w- c:\programdata\NVIDIA
2012-01-26 21:08 . 2012-02-21 23:48 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2012-01-26 21:08 . 2012-01-26 21:08 -------- d-----w- c:\programdata\NVIDIA Corporation
2012-01-26 21:07 . 2012-02-10 04:13 9717568 ----a-w- c:\windows\system32\nvwgf2umx.dll
2012-01-26 21:07 . 2012-02-10 04:13 2660160 ----a-w- c:\windows\system32\nvapi64.dll
2012-01-26 21:07 . 2012-02-10 04:13 17642816 ----a-w- c:\windows\system32\nvd3dumx.dll
2012-01-26 21:07 . 2011-01-16 23:53 1614440 ----a-w- c:\windows\system32\nvdispco642090.dll
2012-01-26 21:07 . 2011-01-16 23:53 1359976 ----a-w- c:\windows\system32\nvgenco642040.dll
2012-01-26 21:07 . 2011-01-16 23:53 11240 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2012-01-26 21:07 . 2010-12-02 17:12 1359976 ----a-w- c:\windows\system32\nvgenco64hda.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-10 03:14 . 2011-01-16 22:13 6074176 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-10 03:14 . 2011-01-16 22:13 3089728 ----a-w- c:\windows\system32\nvsvc64.dll
2012-02-10 03:07 . 2011-01-16 22:13 889664 ----a-w- c:\windows\system32\nvvsvc.exe
2012-02-10 03:07 . 2011-01-16 22:13 63296 ----a-w- c:\windows\system32\nvshext.dll
2012-02-10 03:07 . 2011-01-16 22:13 118080 ----a-w- c:\windows\system32\nvmctray.dll
2012-01-29 10:10 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-02-25_01.03.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-25 01:07 . 2012-02-25 01:07 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012022420120225\index.dat
- 2012-02-25 01:03 . 2012-02-25 01:02 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012022420120225\index.dat
+ 2010-11-21 03:09 . 2012-02-25 01:17 31786 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-02-25 01:17 32606 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-01-26 21:00 . 2012-02-25 01:17 10032 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-119780234-2923575077-2364730716-1000_UserData.bin
- 2012-02-25 01:02 . 2012-02-25 01:02 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-25 01:38 . 2012-02-25 01:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-25 01:38 . 2012-02-25 01:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-25 01:02 . 2012-02-25 01:02 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-02-17 11:38 . 2012-02-25 01:06 357009 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\MMFApplications\msdc1.dll
- 2009-07-14 02:36 . 2012-02-24 18:11 623940 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-02-25 01:19 623940 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-02-24 18:11 106316 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-02-25 01:19 106316 c:\windows\system32\perfc009.dat
+ 2009-07-14 05:01 . 2012-02-25 01:38 476452 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-02-25 00:53 476452 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2012-01-27 01:11 . 2012-02-25 00:53 3131652 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-119780234-2923575077-2364730716-1000-8192.dat
+ 2012-01-27 01:11 . 2012-02-25 01:38 3131652 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-119780234-2923575077-2364730716-1000-8192.dat
- 2012-02-14 19:28 . 2012-02-25 00:53 1353808 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
+ 2012-02-14 19:28 . 2012-02-25 01:07 1353808 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-01-24 3478336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-19 284440]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2012-1-26 1207312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 136176]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 Adobe Licensing Console;Adobe Licensing Console;c:\windows\SysWOW64\adbcnsl.exe [2012-02-14 690474]
S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-09-29 735960]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-19 13592]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-10 2348352]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-10 382272]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 21:05]
.
2012-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 21:05]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2716216]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{D8B16EEF-7BFF-4742-87B8-8984F8127074}: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\Nigby\AppData\Roaming\Mozilla\Firefox\Profiles\ms8e0cu7.default\
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:f8,0f,3f,7c,a0,ed,cc,01
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Flash\\FlashUtil9f.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Flash\\FlashUtil9f.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
@SACL=
"AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
"DataDir"="ESET\\ESET NOD32 Antivirus\\"
"EditionName"=" "
"InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
"LanguageId"=dword:00000409
"PackageTag"=dword:6090e758
"ProductBase"=dword:00000000
"ProductCode"="{4183655A-5FC6-4A23-A804-7764145EC57C}"
"ProductName"="ESET NOD32 Antivirus"
"ProductType"="eav"
"ProductVersion"="4.0.468.0"
"UniqueId"="0001BD744F220901"
"ScannerBuild"=dword:00001672
"ScannerVersionId"=dword:00001175
"ScannerVersion"="Locked/open ESET for status."
"FixId"=dword:00000009
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-02-24 20:43:10 - machine was rebooted
ComboFix-quarantined-files.txt 2012-02-25 01:43
.
Pre-Run: 394,309,300,224 bytes free
Post-Run: 394,232,758,272 bytes free
.
- - End Of File - - 16827DE73E235A7832BCE9205D0CF20E
Malwarebytes Log
Malwarebytes Anti-Malware (Trial) 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download
Database version: v2012.02.24.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Nigby :: NIGBY-PC [administrator]
Protection: Enabled
2/24/2012 8:47:14 PM
mbam-log-2012-02-24 (20-47-14).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 424555
Time elapsed: 37 minute(s), 21 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
HijackThis Log
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:25:42 PM, on 2/24/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Nigby\Downloads\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 8545 bytes
