I am having issues but....

Question

...nobody wants to help.

I realize that you all are volunteers and I appreciate that you lend us your expertise in the Malware, Spyware and Virus world, but I am curious as to how long I must wait to get this help?

I posted a new topic with a detailed description of what my computer problems are, yet people who posted after me are getting helped while I am still waiting for a response. I have been checking everyday, multiple times per day for a response to my help request, but haven't heard a word.

Please respond to the thread: "Searches Redirect and More". I am waiting anxiously for help.

Thanks for your attention.

kevinf80_1d0ac6 · Answer

Hello hypocrationII and welcome,

I'm kevinf80 and I will be helping with any malware issues you may have with your system.

Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies.
Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.
Either print or Save to Notepad all instructions and please follow them carefully, if there's something you don't understand or that will not work please let me know and we will go through it together.
Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin.
If you have any P2P installed please remove them before we begin. eg uTorrent, BiTorrent, Limewire etc, etc.
If you are found to be using "Cracked" or illegal software your post will be locked and all assistance stopped.
If you do not reply within 72 hours the thread will be closed, if you need more time let me know. Likewise if I do not respond within 48 hours feel free to PM me.

Please proceed as follows :-

Step 1

Download user posted image

TFC to your desktop, from either of the following links
Link 1
Link 2

Save any unsaved work. TFC will close all open application windows.
Double-click TFC.exe to run the program.
If prompted, click "Yes" to reboot.

Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

Step 2

Download user posted image

OTL from any of the following links and save to your Desktop:

Link 1
Link 2
Link 3

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
In the lower right corner, checkmark "LOP Check" and checkmark "Purity Check".
Under the Custom Scan box paste this in from between the dotted lines.
------------------------------------------------------------------------------------------------------------------------------

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

--------------------------------------------------------------------------------------------------------------------------------
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your reply

Copy and paste OTL Txt and ExtrasTxt in your reply, use multiple posts if required.

Kevin

hypocrationII · Answer

Thank you for helping; it's a very good thing you guys do -- helping us with our virus issues! I ran TFC as instructed, however, when prompted to reboot, the computer hung up at 'Logging Off' and after a few hours I manually shut it down. When I turned the computer back on I re-ran TFC and, upon finishing, it rebooted without issue. I was able to run OTL without any trouble, however, I could not post this reply from the infected computer: instead I get 'The Connection Was Reset' messages every time I tried to post. I even tried to submit the reports in 'Safe Mode with Networking' but to no avail. I tried to send the reports to myself to be accessed from another computer, but the email would not send. Instead there was an error. I even tried to save the email as a draft, but got an 'Unexpected HTTP Status Response' error. Ultimately, I had to save the reports onto a flash drive and use a separate computer to post the results (I scanned the jump drive with AVG and MBAM so hopefully I haven't infected my clean system). Below are the reports. OTL.Txt: OTL logfile created on: 10/5/2010 8:34:02 PM - Run 1 OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\jared and megan\Downloads Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 69.52 Gb Total Space | 42.35 Gb Free Space | 60.92% Space Free | Partition Type: NTFS Drive D: | 69.52 Gb Total Space | 69.42 Gb Free Space | 99.85% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: JAREDANDMEGA-PC Current User Name: jared and megan Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010/10/05 20:31:49 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\jared and megan\Downloads\OTL.exe PRC - [2010/10/05 20:29:17 | 000,204,800 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Users\JAREDA~1\AppData\Local\Temp\RtkBtMnt.exe PRC - [2010/09/29 08:35:32 | 002,067,808 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe PRC - [2010/09/26 16:34:35 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe PRC - [2010/09/26 16:34:32 | 002,331,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgfws9.exe PRC - [2010/09/26 16:20:49 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2010/09/26 16:20:48 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe PRC - [2010/09/26 16:19:25 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe PRC - [2010/09/26 16:19:21 | 000,842,592 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgam.exe PRC - [2010/09/26 16:19:18 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe PRC - [2010/09/26 16:18:57 | 000,596,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2010/09/26 16:18:55 | 005,897,808 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2010/06/14 22:59:11 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Users\jared and megan\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe PRC - [2010/03/24 13:58:22 | 000,309,760 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac PRC - [2010/03/18 11:19:26 | 000,207,360 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2009/01/30 22:10:17 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2008/11/28 11:56:06 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe PRC - [2008/10/28 23:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008/07/22 20:05:18 | 000,846,344 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\LManager.exe PRC - [2008/07/02 20:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008/04/25 22:36:20 | 000,045,056 | ---- | M] (NewTech InfoSystems, Inc.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe PRC - [2008/04/25 22:36:20 | 000,028,672 | ---- | M] () -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe PRC - [2008/04/25 22:36:02 | 000,131,072 | ---- | M] () -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe PRC - [2008/03/03 14:11:14 | 000,016,384 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe PRC - [2008/01/20 19:33:24 | 000,117,248 | ---- | M] () -- \?\C:\Windows\System32\wbem\WMIADAP.EXE PRC - [2007/12/06 17:15:28 | 000,110,592 | ---- | M] () -- C:\ACER\Mobility Center\MobilityService.exe PRC - [2007/05/11 15:55:34 | 001,629,184 | ---- | M] (NetZero, Inc.) -- C:\Program Files\NetZero\exec.exe PRC - [2007/03/22 18:04:18 | 000,009,728 | ---- | M] (SDSD) -- C:\Program Files\Kodak\Printer\Center\KodakSvc.exe PRC - [2007/01/04 20:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe PRC - [2005/08/18 04:41:58 | 000,749,568 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Microsoft Works\WksSb.exe ========== Modules (SafeList) ========== MOD - [2010/10/05 20:31:49 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\jared and megan\Downloads\OTL.exe MOD - [2010/09/26 16:22:19 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll MOD - [2008/01/20 19:34:21 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx MOD - [2008/01/20 19:33:14 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Windows\System32\FastUv32.dll -- (FastUserSwitchingCompatibility) SRV - [2010/09/26 16:34:32 | 002,331,544 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgfws9.exe -- (avgfws9) SRV - [2010/09/26 16:19:18 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2010/09/26 16:18:55 | 005,897,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2010/09/02 19:39:53 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-051210-111108) SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2008/11/28 11:56:06 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService) SRV - [2008/04/25 22:36:20 | 000,045,056 | ---- | M] (NewTech InfoSystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe -- (NTIBackupSvc) SRV - [2008/04/25 22:36:02 | 000,131,072 | ---- | M] () [Auto | Running] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe -- (NTISchedulerSvc) SRV - [2008/03/03 14:11:14 | 000,016,384 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe -- (BUNAgentSvc) SRV - [2008/01/20 19:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/12/06 17:15:28 | 000,110,592 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService) SRV - [2007/03/22 18:04:18 | 000,009,728 | ---- | M] (SDSD) [Auto | Running] -- C:\Program Files\Kodak\printer\center\KodakSvc.exe -- (KodakSvc) SRV - [2007/01/04 20:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2010/09/26 16:22:15 | 000,025,168 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\AVGIDSvx.sys -- (AVGIDSErHrvtx) DRV - [2010/09/26 16:22:14 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (AvgTdiX) DRV - [2010/09/26 16:22:14 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\Drivers\avgrkx86.sys -- (AvgRkx86) DRV - [2010/09/26 16:22:01 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (AvgLdx86) DRV - [2010/09/26 16:21:59 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2010/09/26 16:19:01 | 000,122,448 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSDriver.sys -- (AVGIDSDrivervtx) DRV - [2010/09/26 16:19:01 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSFilter.sys -- (AVGIDSFiltervtx) DRV - [2010/09/26 16:19:00 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSShim.sys -- (AVGIDSShimvtx) DRV - [2010/09/26 16:18:43 | 000,024,856 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgfwd6x.sys -- (Avgfwfd) DRV - [2008/10/01 11:04:16 | 000,012,832 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15) DRV - [2008/08/06 19:40:40 | 000,129,552 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\ahcix86s.sys -- (ahcix86s) DRV - [2008/07/03 23:35:40 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2008/07/03 02:03:48 | 002,152,088 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008/06/10 03:54:36 | 000,123,904 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008/04/28 06:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO) DRV - [2008/04/21 10:49:30 | 000,039,680 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GzOCVsp.sys -- (GzOCVsp) DRV - [2008/04/21 10:49:28 | 000,042,496 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GzOCMdm.sys -- (GzOCMdm) DRV - [2008/04/21 10:49:26 | 000,027,136 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\GzOCBus.sys -- (GzOCBus) DRV - [2008/02/21 20:50:48 | 000,198,064 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP) DRV - [2008/01/30 02:52:06 | 000,014,848 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr) DRV - [2008/01/30 02:51:50 | 000,013,824 | ---- | M] (NewTech Infosystems Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\UBHelper.sys -- (UBHelper) DRV - [2008/01/23 04:18:28 | 001,187,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX) DRV - [2008/01/20 19:32:53 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008/01/20 19:32:53 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008/01/20 19:32:52 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008/01/20 19:32:52 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008/01/20 19:32:52 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008/01/20 19:32:52 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008/01/20 19:32:51 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008/01/20 19:32:51 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008/01/20 19:32:50 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008/01/20 19:32:50 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2008/01/20 19:32:50 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008/01/20 19:32:49 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008/01/20 19:32:49 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008/01/20 19:32:49 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008/01/20 19:32:49 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008/01/20 19:32:49 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008/01/20 19:32:48 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008/01/20 19:32:48 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008/01/20 19:32:47 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008/01/20 19:32:47 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008/01/20 19:32:46 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008/01/20 19:32:45 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008/01/20 19:32:21 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008/01/20 19:32:21 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008/01/20 19:32:21 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2007/04/17 21:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi) DRV - [2006/11/02 06:29:38 | 000,021,264 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DKbFltr.sys -- (DKbFltr) DRV - [2006/11/02 06:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO) DRV - [2006/11/02 02:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006/11/02 02:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006/11/02 02:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006/11/02 02:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006/11/02 02:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006/11/02 02:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006/11/02 02:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006/11/02 02:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006/11/02 02:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006/11/02 02:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006/11/02 02:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006/11/02 01:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006/11/02 01:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006/11/02 01:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006/11/02 01:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006/11/02 01:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006/11/02 01:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006/11/02 00:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: 'ProxyEnable' = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.855 FF - HKLM\software\mozilla\Firefox\Extensions\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/09/26 16:35:04 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\Components: C:\Program Files\Mozilla Firefox\components [2010/09/29 10:59:05 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/29 10:59:06 | 000,000,000 | ---D | M] [2010/05/30 02:45:43 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\mozilla\Extensions [2010/05/30 02:45:43 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\mozilla\Firefox\Profiles\vb5jyy90.default\extensions [2010/07/26 21:28:41 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/07/26 21:28:42 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} O1 HOSTS File: ([2010/09/26 23:50:05 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Pop-up Blocker) - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll (NetZero, Inc.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll () O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.) O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll () O3 - HKLM\..\Toolbar: (ZeroBar) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll (NetZero, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll () O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe () O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer\Acer Registration\ACE1.exe (Leader Technologies) O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe () O4 - HKLM..\Run: [eRecoveryService] File not found O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe (Microsoft® Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe (Microsoft® Corporation) O4 - HKCU..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe (NetZero, Inc.) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKLM..\RunOnceEx: [] File not found O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: intuit.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKCU\..Trusted Domains: netzero.com ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: netzero.net ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites) O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab (MSN Photo Upload Tool) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.69.150 68.87.85.102 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Humpback Whale.jpg O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Humpback Whale.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{87b4a14c-d22d-11de-a1fa-001eecdd214c}\Shell - '' = AutoRun O33 - MountPoints2\{87b4a14c-d22d-11de-a1fa-001eecdd214c}\Shell\AutoRun\command - '' = G:\LaunchU3.exe -- File not found O33 - MountPoints2\G\Shell - '' = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - '' = G:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- '%1' %* O35 - HKLM\..exefile [open] -- '%1' %* O37 - HKLM\...com [@ = comfile] -- '%1' %* O37 - HKLM\...exe [@ = exefile] -- '%1' %* NetSvcs: FastUserSwitchingCompatibility - C:\Windows\System32\FastUv32.dll File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Error creating restore point. ========== Files/Folders - Created Within 30 Days ========== [2010/09/29 10:36:12 | 000,000,000 | ---D | C] -- C:\Users\jared and megan\AppData\Roaming\AVG9 [2010/09/26 22:33:05 | 000,000,000 | ---D | C] -- C:\Users\jared and megan\AppData\Roaming\Malwarebytes [2010/09/26 22:32:56 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010/09/26 22:32:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010/09/26 22:32:54 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010/09/26 22:32:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/09/26 22:29:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2 [2010/09/26 22:29:51 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2010/09/26 17:14:19 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010/09/26 17:11:09 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010/09/26 16:29:53 | 000,000,000 | -H-D | C] -- C:\$AVG [2010/09/26 16:22:15 | 000,025,168 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\AVGIDSvx.sys [2010/09/26 16:22:15 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll [2010/09/26 16:22:14 | 000,052,872 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgrkx86.sys [2010/09/26 16:22:09 | 000,243,024 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys [2010/09/26 16:22:00 | 000,216,400 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys [2010/09/26 16:21:57 | 000,029,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys [2010/09/26 16:21:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\Avg [2010/09/26 16:18:43 | 000,024,856 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgfwd6x.sys [2010/09/26 16:16:36 | 000,000,000 | ---D | C] -- C:\Program Files\AVG [2010/09/26 16:15:57 | 000,000,000 | ---D | C] -- C:\ProgramData\avg9 [2010/09/07 21:22:14 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group [2010/09/07 21:21:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2008/12/04 04:08:06 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll ========== Files - Modified Within 30 Days ========== [2010/10/05 20:32:15 | 002,621,440 | -HS- | M] () -- C:\Users\jared and megan\NTUSER.DAT [2010/10/05 20:29:33 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2010/10/05 20:29:26 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010/10/05 20:29:25 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010/10/05 20:28:28 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010/10/05 20:28:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010/10/05 20:28:00 | 2950,676,480 | -HS- | M] () -- C:\hiberfil.sys [2010/10/05 20:26:53 | 000,524,288 | -HS- | M] () -- C:\Users\jared and megan\NTUSER.DAT{973e0dfd-cfd9-11de-a619-001eecdd214c}.TMContainer00000000000000000001.regtrans-ms [2010/10/05 20:26:53 | 000,065,536 | -HS- | M] () -- C:\Users\jared and megan\NTUSER.DAT{973e0dfd-cfd9-11de-a619-001eecdd214c}.TM.blf [2010/10/05 16:33:27 | 065,661,235 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm [2010/10/01 16:33:49 | 000,623,434 | ---- | M] () -- C:\Windows\System32\drivers\Avg\iavifw.avm [2010/09/29 13:33:15 | 000,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010/09/29 13:33:15 | 000,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010/09/29 13:33:15 | 000,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010/09/29 12:04:00 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2996371701-1281719411-3421169892-1000UA.job [2010/09/29 10:22:46 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\EasyShare Registration Task.job [2010/09/29 10:22:10 | 002,969,104 | -H-- | M] () -- C:\Users\jared and megan\AppData\Local\IconCache.db [2010/09/28 23:04:01 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2996371701-1281719411-3421169892-1000Core.job [2010/09/28 22:55:00 | 000,000,376 | ---- | M] () -- C:\Windows\tasks\Kodak AiO Scheduled Maintenance.job [2010/09/26 22:33:00 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/09/26 22:29:53 | 000,001,878 | ---- | M] () -- C:\Users\jared and megan\Desktop\HijackThis.lnk [2010/09/26 17:18:04 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010/09/26 16:29:38 | 000,054,156 | -H-- | M] () -- C:\Windows\QTFont.qfn [2010/09/26 16:22:55 | 000,002,058 | ---- | M] () -- C:\Users\jared and megan\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [2010/09/26 16:22:54 | 000,002,096 | ---- | M] () -- C:\Users\jared and megan\Desktop\Google Chrome.lnk [2010/09/26 16:22:19 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll [2010/09/26 16:22:19 | 000,001,651 | ---- | M] () -- C:\Users\Public\Desktop\AVG 9.0.lnk [2010/09/26 16:22:15 | 000,025,168 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\AVGIDSvx.sys [2010/09/26 16:22:14 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys [2010/09/26 16:22:14 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgrkx86.sys [2010/09/26 16:22:01 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys [2010/09/26 16:21:59 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys [2010/09/26 16:21:56 | 000,113,461 | ---- | M] () -- C:\Windows\System32\drivers\Avg\iavichjw.avm [2010/09/26 16:18:43 | 000,024,856 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgfwd6x.sys [2010/09/07 18:22:05 | 000,088,064 | R--- | M] () -- C:\Users\Public\Documents\ESBK.mb [2010/09/07 18:22:04 | 000,129,024 | R--- | M] () -- C:\Users\Public\Documents\ESBK.mbb ========== Files Created - No Company Name ========== [2010/09/26 22:33:00 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010/09/26 22:29:53 | 000,001,878 | ---- | C] () -- C:\Users\jared and megan\Desktop\HijackThis.lnk [2010/09/26 17:15:10 | 000,001,891 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2010/09/26 16:22:19 | 000,001,651 | ---- | C] () -- C:\Users\Public\Desktop\AVG 9.0.lnk [2010/09/26 16:21:56 | 000,623,434 | ---- | C] () -- C:\Windows\System32\drivers\Avg\iavifw.avm [2010/09/26 16:21:48 | 000,113,461 | ---- | C] () -- C:\Windows\System32\drivers\Avg\iavichjw.avm [2010/09/26 16:21:47 | 065,661,235 | ---- | C] () -- C:\Windows\System32\drivers\Avg\incavi.avm [2010/09/05 15:11:35 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX.INI [2010/09/05 14:56:50 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Dialogs [2010/09/05 14:56:50 | 000,000,268 | RH-- | C] () -- C:\Users\jared and megan\AppData\Roaming\Definition Bundle [2010/09/05 14:56:50 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT [2010/09/05 14:53:44 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Developer Tools [2010/09/05 14:53:44 | 000,000,268 | RH-- | C] () -- C:\Users\jared and megan\AppData\Roaming\Dance Kit [2010/09/05 14:53:44 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT [2010/04/22 17:11:59 | 000,000,004 | ---- | C] () -- C:\Users\jared and megan\AppData\Roaming\2DF2EE [2010/04/22 17:11:58 | 000,870,128 | ---- | C] () -- C:\Users\jared and megan\AppData\Roaming\mcs.rma [2010/04/11 11:11:15 | 000,000,680 | ---- | C] () -- C:\Users\jared and megan\AppData\Local\d3d9caps.dat [2009/07/13 23:10:04 | 000,000,004 | ---- | C] () -- C:\Users\jared and megan\AppData\Roaming\wklnhst.dat [2009/06/30 10:06:12 | 000,000,022 | ---- | C] () -- C:\Windows\exchng.ini [2009/06/30 10:06:08 | 000,000,611 | ---- | C] () -- C:\Windows\ODBC.INI [2009/04/28 22:38:08 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EKDeviceServices.dll [2009/03/15 11:52:39 | 000,007,680 | ---- | C] () -- C:\Users\jared and megan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/02/18 00:08:11 | 000,000,065 | ---- | C] () -- C:\Windows\wininit.ini [2008/12/29 04:38:42 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll [2008/12/04 06:11:27 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll [2008/12/04 06:11:27 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll [2008/12/04 05:31:15 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini [2008/12/04 04:05:20 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008/12/04 04:05:09 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006/11/02 00:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2001/12/26 17:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll [2001/09/04 00:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll [2001/07/30 17:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll [2001/07/23 23:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll [1996/11/21 00:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\ODBCSTF.DLL [1996/11/21 00:00:00 | 000,022,016 | ---- | C] () -- C:\Windows\System32\DOCOBJ.DLL [1996/11/21 00:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL ========== LOP Check ========== [2009/01/31 10:31:06 | 000,000,000 | -HSD | M] -- C:\Users\jared and megan\AppData\Roaming\.# [2009/01/30 22:12:06 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\Acer [2008/12/04 05:57:50 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\Acer GameZone Console [2009/12/20 16:47:02 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\Amazon [2010/09/29 10:36:12 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\AVG9 [2009/11/23 20:40:55 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\InterVideo [2009/01/30 22:11:59 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\Leadertech [2010/09/05 15:04:32 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\Nikon [2009/07/13 23:10:09 | 000,000,000 | ---D | M] -- C:\Users\jared and megan\AppData\Roaming\Template [2010/09/29 10:22:46 | 000,000,420 | ---- | M] () -- C:\Windows\Tasks\EasyShare Registration Task.job [2010/10/05 20:27:00 | 000,032,524 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat [2008/01/20 19:34:29 | 000,333,203 | RHS- | M] () -- C:\bootmgr [2008/12/04 04:08:46 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK [2006/09/18 14:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys [2010/10/05 20:28:00 | 2950,676,480 | -HS- | M] () -- C:\hiberfil.sys [2009/06/30 09:59:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2009/06/30 09:59:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010/10/05 20:27:58 | 3264,483,328 | -HS- | M] () -- C:\pagefile.sys [2008/12/04 05:32:09 | 000,000,426 | ---- | M] () -- C:\RHDSetup.log < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > [2008/01/20 20:31:11 | 015,716,352 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008/01/20 20:31:01 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008/01/20 20:31:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006/11/02 03:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006/11/02 03:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime: 2009-03-23 20:28:05 ========== Alternate Data Streams ========== @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:73933431 @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A42A9F39 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:798A3728 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C99F6ECA @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:F65733F1 < End of report > ****************************************************************************************************** Extras.Txt: OTL Extras logfile created on: 10/5/2010 8:34:02 PM - Run 1 OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\jared and megan\Downloads Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free 6.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 69.52 Gb Total Space | 42.35 Gb Free Space | 60.92% Space Free | Partition Type: NTFS Drive D: | 69.52 Gb Total Space | 69.42 Gb Free Space | 99.85% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: JAREDANDMEGA-PC Current User Name: jared and megan Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ ] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\ ] .html [@ = ChromeHTML] -- C:\Users\jared and megan\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ \shell\[command]\command] batfile [open] -- '%1' %* cmdfile [open] -- '%1' %* comfile [open] -- '%1' %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe '%1',%* (Microsoft Corporation) exefile [open] -- '%1' %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htafile [open] -- '%1' %* htmlfile [edit] -- 'C:\Program Files\Microsoft Office\Office12\msohtmed.exe' %1 (Microsoft Corporation) htmlfile [print] -- 'C:\Program Files\Microsoft Office\Office12\msohtmed.exe' /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe '%1' (Microsoft Corporation) piffile [open] -- '%1' %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- '%1' scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- '%1' /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd '%V' (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE '%L' (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 'cval' = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware] 'DisableMonitoring' = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] 'AntiVirusOverride' = 0 'AntiSpywareOverride' = 0 'FirewallOverride' = 0 'VistaSp1' = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = 0 'DisableNotifications' = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = 0 'DisableNotifications' = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] 'EnableFirewall' = 0 'DisableNotifications' = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] '{21A2C01A-4AD1-4B34-B954-F5CBAA1D67D0}' = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | '{25BED00E-7D56-4BB7-8481-9B32D6B2B8C0}' = lport=137 | protocol=17 | dir=in | app=system | '{28ADEDE1-A4D5-42D8-9B05-BF7C283C4061}' = lport=5524 | protocol=6 | dir=in | name=spport | '{28ADEDE1-A4D5-42D8-9B05-BF7C283C4062}' = lport=5524 | protocol=6 | dir=out | name=spport | '{4BDCD9AF-0313-454A-BA13-ADEA482CECBE}' = lport=138 | protocol=17 | dir=in | app=system | '{4D0F7F0C-053D-4D11-8409-FCD981240CA0}' = rport=138 | protocol=17 | dir=out | app=system | '{5EA25783-D24B-4339-AA12-30E977AF65B2}' = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | '{688813D1-0609-4CE5-8C4B-50AA7C5C5BC6}' = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | '{7025DE0B-8EAB-4A8C-ABD6-6822C04E5F23}' = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | '{81A6480A-E2E5-4359-AB8A-9167BAAF012D}' = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | '{8A0248F6-4D8A-4014-B439-5419664C573C}' = rport=445 | protocol=6 | dir=out | app=system | '{939D9FC1-3E79-461B-989D-69B14EA235C7}' = rport=137 | protocol=17 | dir=out | app=system | '{9A77B129-9B5A-4573-9157-83BB35C015E5}' = rport=139 | protocol=6 | dir=out | app=system | '{A33255A3-8130-49BF-A6E6-43B61CE8C53A}' = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | '{A8D18268-6887-4A97-8C00-2BA08A57BE5F}' = lport=445 | protocol=6 | dir=in | app=system | '{AF98AEAA-A56C-46D6-B45F-697FAE949F52}' = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | '{BC6CB746-7B7E-4942-A2D2-E579D927E8BE}' = lport=139 | protocol=6 | dir=in | app=system | '{C0C14AB7-2D3A-48EB-ADE8-674FB34631F3}' = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | '{D823C9C7-9586-419A-B06D-627313D99283}' = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | '{E1AB2E94-B741-4F07-902E-F65E3B9B82B5}' = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] '{02BBC3FA-D49C-430A-AD55-EFA2DBA3CC42}' = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | '{0DDE240D-FD2A-4050-AB17-AF76C247A3BE}' = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | '{259F1611-C159-42C3-AFAF-5539853B7035}' = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | '{28ADEDE1-A4D5-42D8-9B05-BF7C283C4059}' = protocol=6 | dir=in | app=c:\windows\system32\svchost.exe | '{28ADEDE1-A4D5-42D8-9B05-BF7C283C4060}' = protocol=6 | dir=out | app=c:\windows\system32\svchost.exe | '{4B95DD87-FF9D-4D5A-9CB1-65E8AE224017}' = dir=in | app=c:\program files\avg\avg9\avgnsx.exe | '{5533EFBD-587E-4F6D-8CB1-9F6108E273C2}' = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | '{595EFA90-A3D0-447C-86E6-174452C439FE}' = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | '{5A6A4999-D213-474E-9218-2C40DB4A4009}' = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | '{5A9C13DB-3E04-4470-A6F5-81572F2BF5D4}' = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | '{5F5E6067-EC42-4CF3-8A31-2D153A4B80E5}' = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | '{6CA15935-B9F5-448A-B437-D0E92CBF93F1}' = protocol=17 | dir=in | app=c:\program files\rhapsody\rhapsody.exe | '{8AFECF3E-7F96-419D-8EC1-6A7260951454}' = dir=in | app=c:\program files\skype\phone\skype.exe | '{8CB612AA-705D-498F-A3CE-3884D1D39278}' = protocol=6 | dir=in | app=c:\program files\v cast music with rhapsody\rhapsody.exe | '{9091CF21-68BD-48A2-A3ED-B8FEEFA6CFD5}' = dir=in | app=c:\program files\avg\avg9\avgam.exe | '{93986BAE-5214-46DC-B318-141D2814B512}' = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | '{B817C3D2-2CBD-4B47-9CB4-0B4068A01CA7}' = dir=in | app=c:\program files\avg\avg9\avgdiagex.exe | '{B9DB264B-4A8F-4D98-9FA3-2EBE7396F2A4}' = dir=in | app=c:\program files\avg\avg9\avgupd.exe | '{BF78205E-AA2E-44FB-B6BC-D4DE35137A74}' = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | '{C37333C5-25AE-43CC-A572-EB83E8511DC0}' = protocol=17 | dir=in | app=c:\program files\v cast music with rhapsody\rhapsody.exe | '{CED9AF54-20DF-4727-9010-027E9F0A5CE1}' = protocol=6 | dir=in | app=c:\program files\rhapsody\rhapsody.exe | '{CFE4FE28-3EC5-4FA2-A6E5-C916CD1B584C}' = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | '{D44E5319-251F-4AAF-ACD0-4EE571006213}' = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | '{D64DAAC3-3615-46D7-9676-E10679B9500C}' = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | '{FA05202C-AD4E-445C-BA6B-13CE4343295F}' = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | '{FF16EECF-BEAA-4300-99D7-25850DAE7F2E}' = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] '{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}' = Notifier '{00203668-8170-44A0-BE44-B632FA4D780F}' = Adobe AIR '{03EDED24-8375-407D-A721-4643D9768BE1}' = kgchlwn '{071EA6A1-4189-3D9C-6B3F-0BE15495CE80}' = Catalyst Control Center Core Implementation '{073F22CE-9A5B-4A40-A604-C7270AC6BF34}' = ESSSONIC '{08137BF5-9879-EBDA-6462-79D3C6D113B2}' = Catalyst Control Center Localization Portuguese '{09621381-D4B0-2D6A-AB14-E8CE4CD424D9}' = Catalyst Control Center Graphics Previews Vista '{0996C331-6DCB-4E38-A3EC-0A77ABAE1361}' = Help_CTR '{09D3675D-E1BB-1B3D-3F35-0338F7AAB0FD}' = Catalyst Control Center Localization Czech '{11316260-6666-467B-AC34-183FCB5D4335}' = Acer Mobility Center Plug-In '{11F3F858-4131-4FFA-A560-3FE282933B6E}' = kgchday '{12EFA1A4-AC3B-443C-8143-237EDE760403}' = NTI Backup Now Standard '{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}' = ESSPCD '{1DE63D16-8A5E-74AB-1A5F-6E1834234229}' = CCC Help Chinese Standard '{20471B27-D702-4FE8-8DEC-0702CC8C0A85}' = InterVideo WinDVD 8 '{2318C2B1-4965-11d4-9B18-009027A5CD4F}' = Google Toolbar for Internet Explorer '{237CD223-1B9D-47E8-A76C-E478B83CCEA2}' = File Uploader '{2413930C-8309-47A6-BC61-5EF27A4222BC}' = NTI Media Maker 8 '{254C0471-5FDF-D591-1219-112ABECED882}' = CCC Help German '{285432CE-2033-7317-27FC-DFB027E24F33}' = Catalyst Control Center Localization French '{29E1DB75-A926-D7A5-6773-E24477526D49}' = CCC Help Chinese Traditional '{2A97D5B3-A989-47E1-B207-1CA9E3635655}' = aioprnt '{2B82EEF1-A86E-CE6A-E7E6-ED114131E383}' = Catalyst Control Center Graphics Full New '{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}' = essvatgt '{2F3FC1A5-37B4-7685-7295-37FD1B3FE806}' = CCC Help Danish '{32EBA2B9-23F8-82A8-E229-0F283EE902B0}' = CCC Help Portuguese '{3A2536D9-53FF-CD79-F46C-9E3902D2EEBA}' = CCC Help English '{3A6CE5E6-7416-37A1-1DA2-2BCB0A9CF444}' = Catalyst Control Center Localization Japanese '{3A7D9B34-E8A9-A352-20C1-0607B1D5F8B6}' = Catalyst Control Center Localization Chinese Traditional '{3BED0238-3A25-41AE-BC23-316914B5B048}' = aioocr '{3F9544A3-63B0-E523-D212-5C010368E492}' = Catalyst Control Center Localization Spanish '{41802C9A-1BF6-9A4E-D903-C6587560D758}' = Catalyst Control Center Localization Chinese Standard '{4537EA4B-F603-4181-89FB-2953FC695AB1}' = netbrdg '{58D9BD9C-C96F-F308-5D72-371A9D3CC939}' = CCC Help Dutch '{5B63A470-9334-44D1-AF61-6CE2DB565AE9}' = Orion '{605A4E39-613C-4A12-B56F-DEFBE6757237}' = SHASTA '{6165BE73-8AC5-A2B6-8910-963387FE5B9B}' = Catalyst Control Center Localization Russian '{643EAE81-920C-4931-9F0B-4B343B225CA6}' = ESSBrwr '{676E0B8A-00BE-4554-B7F0-66ED41E5E5F3}' = CHMC G'zOne Boulder USB Driver V1.2.5 '{67A8747E-0517-75EF-244F-9E219C440107}' = ATI Catalyst Install Manager '{693C08A7-9E76-43FF-B11E-9A58175474C4}' = kgckids '{6A25BA91-82D1-0841-FC65-57CE27540922}' = Catalyst Control Center Localization Danish '{6A41CE62-8379-2A4D-E690-AA5D4DA8A279}' = ccc-core-static '{6BB99DE2-D79C-B223-8D4F-E3D80A478D0F}' = CCC Help Polish '{6c651250-2eb2-11d5-8e33-0050dad72ac2}' = NetZero Internet '{6D52C408-B09A-4520-9B18-475B81D393F1}' = Microsoft Works '{6E52D2FB-5FB5-334E-86F9-4316EEDC2926}' = ccc-utility '{71C2828F-2678-4675-BDEC-895424861262}_is1' = C:\Program Files\Acer GameZone\GameConsole '{72BBB36F-D323-0746-4F92-083E4C5EAC52}' = CCC Help Czech '{73F1681F-ADE1-461F-9F18-B7640507D395}' = ksdip '{77DCDCE3-2DED-62F3-8154-05E745472D07}' = Acrobat.com '{791E3D44-33D3-4446-82AD-5CD4B0169083}' = aiofw '{79E41D91-BA1C-44B9-9358-48E598263ECF}' = center '{7DDF474C-2AF9-4A3B-57E0-FBF31ED2C913}' = Catalyst Control Center Localization Polish '{7E992D2F-5D9F-0A2A-302E-E4AC8FB79F47}' = Catalyst Control Center Graphics Full Existing '{7F811A54-5A09-4579-90E1-C93498E230D9}' = Acer eRecovery Management '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110082360}' = Alien Shooter '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}' = Chicken Invaders 2 '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110422467}' = Tiks Texas Hold em '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}' = Cake Mania '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}' = Galapago '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}' = Mystery Solitaire - Secret Island '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111940693}' = Bookworm Adventures '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112028410}' = Putt Mania '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112548397}' = The Rise of Atlantis '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}' = Alice Greenfingers '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}' = Heroes of Hellas '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}' = Dream Day First Home '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113848220}' = Agatha Christie Peril at End House '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113919217}' = Mythic Mahjong '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}' = Go-Go Gourmet '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11408540}' = Magic Match Adventures '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114086870}' = Womens Murder Club '{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114717227}' = Magic Farm '{837b34e3-7c30-493c-8f6a-2b0f04e2912c}' = Microsoft Visual C++ 2005 Redistributable '{843081BD-351F-46FC-8A17-517A0D9117A3}' = helptut '{84DB8DAE-531B-FDA4-E683-8C82F0F81F26}' = Catalyst Control Center Localization Turkish '{865A7423-1322-E68E-4604-BEB0EEBFB624}' = Catalyst Control Center Localization Norwegian '{87441A59-5E64-4096-A170-14EFE67200C3}' = Picture Control Utility '{8833FFB6-5B0C-4764-81AA-06DFEED9A476}' = Realtek 8169 8168 8101E 8102E Ethernet Driver '{8943CE61-53BD-475E-90E1-A580869E98A2}' = staticcr '{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}' = Microsoft Silverlight '{8A502E38-29C9-49FA-BCFA-D727CA062589}' = ESSTOOLS '{8A8664E1-84C8-4936-891C-BC1F07797549}' = kgcvday '{8E92D746-CD9F-4B90-9668-42B74C14F765}' = ESSini '{8F1B6239-FEA0-450A-A950-B05276CE177C}' = Acer Empowering Technology '{90120000-0016-0409-0000-0000000FF1CE}' = Microsoft Office Excel MUI (English) 2007 '{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-0018-0409-0000-0000000FF1CE}' = Microsoft Office PowerPoint MUI (English) 2007 '{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-001B-0409-0000-0000000FF1CE}' = Microsoft Office Word MUI (English) 2007 '{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-001F-0409-0000-0000000FF1CE}' = Microsoft Office Proof (English) 2007 '{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-001F-040C-0000-0000000FF1CE}' = Microsoft Office Proof (French) 2007 '{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-001F-0C0A-0000-0000000FF1CE}' = Microsoft Office Proof (Spanish) 2007 '{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-002C-0409-0000-0000000FF1CE}' = Microsoft Office Proofing (English) 2007 '{90120000-006E-0409-0000-0000000FF1CE}' = Microsoft Office Shared MUI (English) 2007 '{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-00A1-0409-0000-0000000FF1CE}' = Microsoft Office OneNote MUI (English) 2007 '{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{90120000-0115-0409-0000-0000000FF1CE}' = Microsoft Office Shared Setup Metadata MUI (English) 2007 '{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{91120000-002F-0000-0000-0000000FF1CE}' = Microsoft Office Home and Student 2007 '{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}' = 2007 Microsoft Office Suite Service Pack 1 (SP1) '{91517631-A9F3-4B7C-B482-43E0068FD55A}' = ESSgui '{981029E0-7FC9-4CF3-AB39-6F133621921A}' = Skype Toolbars '{999D43F4-9709-4887-9B1A-83EBB15A8370}' = VPRINTOL '{9B35344F-7FA4-B6BA-E64B-930A5BDB9585}' = Catalyst Control Center InstallProxy '{9BD54685-1496-46A5-AB62-357CD140ED8B}' = kgcinvt '{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}' = ESScore '{9FFC6670-6711-387B-3566-7D0DA1808531}' = CCC Help Swedish '{A1588373-1D86-4D44-86C9-78ABD190F9CC}' = kgcmove '{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}' = Microsoft Works 6.0 '{A8176277-4272-EA16-CDAE-1E37C62E14B2}' = CCC Help Italian '{A9E38025-D8D8-FB5E-0DDB-12691243EF1F}' = CCC Help Norwegian '{AC76BA86-7AD7-1033-7B44-A93000000001}' = Adobe Reader 9.3.4 '{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}' = ESSCDBK '{AFE52E73-FADF-7AEC-9F2E-9C490C77AB61}' = Catalyst Control Center Localization German '{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}' = OfotoXMI '{B16469A5-D2FA-A0C8-D371-2F4C8D5707D4}' = CCC Help Finnish '{B463846D-85B8-5B31-59BD-AA68307ECC69}' = CCC Help Spanish '{B483D67F-8223-F1C5-1CBD-59B13676019E}' = CCC Help Greek '{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}' = CCScore '{B7BA5747-159E-B1E7-B73D-E3B7575D783A}' = CCC Help Thai '{BC4FBC02-B2B7-ACCA-C983-FFF31FC3C1C9}' = CCC Help Japanese '{C0251585-1BE8-4278-B3CB-964B6E01C59D}' = aioscnnr '{C08B098D-E9A6-649F-120D-9263C0527C2E}' = Catalyst Control Center Localization Swedish '{C22EDAB3-B9C3-3189-6FE5-8DC4CFADED81}' = CCC Help Hungarian '{C4FA4F86-63E8-9CD5-8CD3-25E4AC0E8861}' = Catalyst Control Center Localization Finnish '{C63225DD-4956-D968-E563-30371AA23FD8}' = Skins '{C7D5F833-4603-B3A3-4DB7-178022D73CC6}' = Catalyst Control Center Localization Dutch '{CC4AD2ED-C8C8-6548-BAB0-59058B3FA658}' = Catalyst Control Center Localization Greek '{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}' = Microsoft .NET Framework 3.5 SP1 '{CE386A4E-D0DA-4208-8235-BCE43275C694}' = LightScribe 1.4.142.1 '{D04DA284-0680-277B-832E-B795D9302F8D}' = CCC Help Turkish '{D103C4BA-F905-437A-8049-DB24763BBE36}' = Skype™ 4.2 '{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}' = Nikon Message Center '{D32470A1-B10C-4059-BA53-CF0486F68EBC}' = KODAK EASYSHARE 5000 Series All-in-One Software '{D5B90069-DC5F-E482-D86A-B0CBBBD0E50E}' = CCC Help Russian '{DB02F716-6275-42E9-B8D2-83BA2BF5100B}' = SFR '{DC19E750-988B-4005-A355-85EF66055EFE}' = Works Suite OS Pack '{DC626A21-EDF1-40C7-8F2F-D2BA7535529F}' = helpug '{DF7A3C71-08FD-9154-BF1C-81BC491F4C2C}' = CCC Help French '{E0D51394-1D45-460A-B62D-383BC4F8B335}' = QuickTime '{E18B549C-5D15-45DA-8D8F-8FD2BD946344}' = kgcbaby '{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}' = Microsoft Office Suite Activation Assistant '{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}' = tooltips '{E9757890-7EC5-46C8-99AB-B00F07B6525C}' = Nikon Transfer '{EA78289C-35D1-10D4-CA0D-7C653B2E212A}' = Catalyst Control Center Localization Hungarian '{EAE06CC6-8838-CA77-347C-BD3E9DEC6C93}' = Catalyst Control Center Localization Italian '{EB18E9CE-A633-1192-BDF6-4EA15DA97785}' = Catalyst Control Center Graphics Light '{ECA47E2A-51B0-2F2F-67D3-A2A0639092B1}' = Catalyst Control Center Localization Korean '{ED5085E1-BA8E-1464-2E3D-400086526EDE}' = Catalyst Control Center Localization Thai '{F007CBCE-D714-4C0B-8CE9-9B0D78116468}' = ViewNX '{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}' = Realtek High Definition Audio Driver '{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}' = ArcSoft Panorama Maker 5 '{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}' = kgcbase '{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}' = SKINXSDK '{F9593CFB-D836-49BC-BFF1-0E669A411D9F}' = WIRELESS '{FDF9943A-3D5C-46B3-9679-586BD237DDEE}' = SKIN0001 '{FFA58E6D-8053-18D7-C9BB-C76312C1E12C}' = CCC Help Korean 'Acer Assist' = Acer Assist 'Acer Registration' = Acer Registration 'Adobe AIR' = Adobe AIR 'Adobe Flash Player ActiveX' = Adobe Flash Player 10 ActiveX 'Adobe Flash Player Plugin' = Adobe Flash Player 10 Plugin 'Amazon MP3 Downloader' = Amazon MP3 Downloader 1.0.9 'AVG9Uninstall' = AVG 9.0 'com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1' = Acrobat.com 'Google Desktop' = Google Desktop 'Google Updater' = Google Updater 'HijackThis' = HijackThis 2.0.2 'HOMESTUDENTR' = Microsoft Office Home and Student 2007 'InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}' = NTI Backup Now 5 'InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}' = InterVideo WinDVD 8 'InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}' = NTI Media Maker 8 'LManager' = Launch Manager 'Malwarebytes' Anti-Malware_is1' = Malwarebytes' Anti-Malware 'Microsoft .NET Framework 3.5 SP1' = Microsoft .NET Framework 3.5 SP1 'Mozilla Firefox (3.6.10)' = Mozilla Firefox (3.6.10) 'Office8.0' = Microsoft Office 97, Standard Edition 'Rhapsody' = Rhapsody 'SynTPDeinstKey' = Synaptics Pointing Device Driver 'V CAST Music with Rhapsody' = V CAST Music with Rhapsody 'Works2002Setup' = Microsoft Works 2002 Setup Launcher ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] 'Google Chrome' = Google Chrome ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 9/8/2010 1:20:55 AM | Computer Name = jaredandmega-PC | Source = WinMgmt | ID = 10 Description = Error - 9/8/2010 2:11:00 AM | Computer Name = jaredandmega-PC | Source = SPP | ID = 16387 Description = Error - 9/8/2010 2:11:00 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8193 Description = Error - 9/8/2010 2:11:00 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8210 Description = Error - 9/8/2010 3:14:09 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8193 Description = Error - 9/8/2010 3:14:09 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8210 Description = Error - 9/9/2010 3:13:58 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8193 Description = Error - 9/9/2010 3:13:58 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8210 Description = Error - 9/10/2010 3:13:49 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8193 Description = Error - 9/10/2010 3:13:49 AM | Computer Name = jaredandmega-PC | Source = System Restore | ID = 8210 Description = [ System Events ] Error - 12/30/2009 5:24:13 AM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 12/30/2009 5:25:07 AM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 12/30/2009 5:25:11 AM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 12/30/2009 9:35:28 AM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 12/31/2009 12:12:53 AM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 12/31/2009 11:59:51 AM | Computer Name = jaredandmega-PC | Source = ACPI | ID = 327693 Description = : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly. Error - 12/31/2009 11:59:56 AM | Computer Name = jaredandmega-PC | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.1.100 for the Network Card with network address 00242B225395 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). Error - 12/31/2009 12:04:09 PM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 1/2/2010 8:02:19 AM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. Error - 1/3/2010 7:23:09 PM | Computer Name = jaredandmega-PC | Source = disk | ID = 262151 Description = The device, \Device\Harddisk0\DR0, has a bad block. < End of report >

kevinf80_1d0ac6 · Answer

Hiya hypocrationII,

We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

Combofix

Don`t forget Combofix must be saved to your desktop. <--Very important

Ensure you have disabled your Firewall and all anti virus and anti malware programs so they do not interfere with the running of ComboFix. <---Very important

Please include the C:\ComboFix.txt in your next reply for further review.

Examples of how to disable realtime protection available at the following link :-

Disable realtime protection

Note: Do not click combofix's window with your mouse while it's running. That action may cause it to stall.

*EXTRA NOTES*

If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

If necessary you can d/l and save Combofixto a memory stick on a clean PC and transfer to the infected system Desktop. It is very important that it is run from the Desktop. If you have difficulty running CF boot the infected PC into Safe mode with networking and run it in that mode.
To do that re-boot, continuously tap the F8 key until you see the Windows Advanced Menu, from the available options choose Safe mode with networking.

I`m also concerned about this " The device, \Device\Harddisk0\DR0, has a bad block." from event viewer, that could indicate potential hard drive failure.

Lets see how CF goes and take it from there...

Post the log in your reply.

Kevin.

hypocrationII · Answer

Well, if you're concerned so am I! Here's the CF report:   ComboFix 10-10-05.04 - jared and megan 10/06/2010   6:34.1.1 - x86Microsoft® Windows Vista™ Home Basic   6.0.6001.1.1252.1.1033.18.2813.1681 [GMT -7:00]Running from: c:\users\jared and megan\Desktop\ComboFix.exeSP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Created a new restore point.(((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))).c:\programdata\Microsoft\Network\Downloader\qmgr0.datc:\programdata\Microsoft\Network\Downloader\qmgr1.datc:\users\jared and megan\AppData\Roaming\.#----- BITS: Possible infected sites -----hxxp://lh3.ggpht.comhxxp://lh4.ggpht.comhxxp://lh6.ggpht.comhxxp://lh5.ggpht.comhxxp://s16.photobucket.comhxxp://i16.photobucket.comInfected copy of c:\windows\system32\drivers\kbdclass.sys was found and disinfected Restored copy from - Kitty had a snack :p .(((((((((((((((((((((((((   Files Created from 2010-09-06 to 2010-10-06  ))))))))))))))))))))))))))))))).2010-10-06 13:40 . 2010-10-06 13:41    --------    d-----w-    c:\users\jared and megan\AppData\Local	emp2010-10-06 13:40 . 2010-10-06 13:40    --------    d-----w-    c:\users\Default\AppData\Local	emp2010-09-29 17:36 . 2010-09-29 17:36    --------    d-----w-    c:\users\jared and megan\AppData\Roaming\AVG92010-09-29 15:35 . 2010-09-29 15:35    4100960    ----a-w-    c:\programdata\avg9\update\backup\avgui.exe2010-09-29 15:35 . 2010-09-29 15:35    2065760    ----a-w-    c:\programdata\avg9\update\backup\avgtray.exe2010-09-29 15:35 . 2010-09-29 15:35    4394336    ----a-w-    c:\programdata\avg9\update\backup\avgcorex.dll2010-09-27 05:33 . 2010-09-27 05:33    --------    d-----w-    c:\users\jared and megan\AppData\Roaming\Malwarebytes2010-09-27 05:32 . 2010-04-29 22:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys2010-09-27 05:32 . 2010-09-27 05:32    --------    d-----w-    c:\programdata\Malwarebytes2010-09-27 05:32 . 2010-09-27 05:33    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware2010-09-27 05:32 . 2010-04-29 22:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys2010-09-27 05:29 . 2010-09-27 05:31    --------    d-----w-    c:\windows\system32\catroot22010-09-27 05:29 . 2010-09-27 05:29    --------    d-----w-    c:\program files\Trend Micro2010-09-26 23:34 . 2010-09-26 23:34    3586912    ----a-w-    c:\programdata\avg9\update\backup\setup.exe2010-09-26 23:34 . 2010-09-26 23:34    620896    ----a-w-    c:\programdata\avg9\update\backup\avgnsx.exe2010-09-26 23:34 . 2010-09-26 23:34    1619296    ----a-w-    c:\programdata\avg9\update\backup\avgssie.dll2010-09-26 23:34 . 2010-09-26 23:34    1377632    ----a-w-    c:\programdata\avg9\update\backup\avgssff.dll2010-09-26 23:34 . 2010-09-26 23:34    942432    ----a-w-    c:\programdata\avg9\update\backup\avgcfgx.dll2010-09-26 23:34 . 2010-09-26 23:34    598368    ----a-w-    c:\programdata\avg9\update\backup\avgsrmx.dll2010-09-26 23:34 . 2010-09-26 23:34    2331032    ----a-w-    c:\programdata\avg9\update\backup\avgfws9.exe2010-09-26 23:34 . 2010-09-26 23:34    5649320    ----a-w-    c:\programdata\avg9\update\backup\winspamcatcher.dll2010-09-26 23:34 . 2010-09-26 23:34    300896    ----a-w-    c:\programdata\avg9\update\backup\avgchclx.dll2010-09-26 23:34 . 2010-09-26 23:34    1690952    ----a-w-    c:\programdata\avg9\update\backup\avgupd.dll2010-09-26 23:29 . 2010-09-26 23:29    --------    d-----w-    C:\$AVG2010-09-26 23:22 . 2010-09-26 23:22    12536    ----a-w-    c:\windows\system32\avgrsstx.dll2010-09-26 23:22 . 2010-09-26 23:22    25168    ----a-w-    c:\windows\system32\drivers\AVGIDSvx.sys2010-09-26 23:22 . 2010-09-26 23:22    52872    ----a-w-    c:\windows\system32\drivers\avgrkx86.sys2010-09-26 23:22 . 2010-09-26 23:22    243024    ----a-w-    c:\windows\system32\drivers\avgtdix.sys2010-09-26 23:22 . 2010-09-26 23:22    216400    ----a-w-    c:\windows\system32\drivers\avgldx86.sys2010-09-26 23:21 . 2010-09-26 23:21    29584    ----a-w-    c:\windows\system32\drivers\avgmfx86.sys2010-09-26 23:21 . 2010-10-06 11:33    --------    d-----w-    c:\windows\system32\drivers\Avg2010-09-26 23:18 . 2010-09-26 23:18    24856    ----a-w-    c:\windows\system32\drivers\avgfwd6x.sys2010-09-26 23:16 . 2010-09-26 23:16    --------    d-----w-    c:\program files\AVG2010-09-26 23:15 . 2010-09-26 23:16    --------    d-----w-    c:\programdata\avg92010-09-08 04:22 . 2010-09-08 04:22    --------    d-----w-    c:\program files\Enigma Software Group2010-09-08 04:21 . 2010-09-08 04:21    --------    d-----w-    c:\program files\Common Files\Wise Installation Wizard.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-10-06 03:26 . 2009-04-19 18:04    --------    d-----w-    c:\programdata\Google Updater2010-09-27 00:17 . 2008-12-04 13:13    --------    d-----w-    c:\program files\Common Files\Adobe2010-09-27 00:16 . 2010-07-27 04:31    --------    d-----w-    c:\users\jared and megan\AppData\Roaming\Skype2010-09-26 23:31 . 2008-12-04 12:57    --------    d-----w-    c:\programdata\Acer GameZone Console2010-09-26 23:18 . 2006-11-02 10:25    86016    ----a-w-    c:\windows\Inf\infstrng.dat2010-09-26 23:18 . 2006-11-02 10:25    51200    ----a-w-    c:\windows\Inf\infpub.dat2010-09-26 23:18 . 2006-11-02 10:25    86016    ----a-w-    c:\windows\Inf\infstor.dat2010-09-05 22:14 . 2010-09-05 21:56    20    ---h--w-    c:\programdata\PKP_DLdw.DAT2010-09-05 22:04 . 2010-09-05 22:01    --------    d-----w-    c:\users\jared and megan\AppData\Roaming\Nikon2010-09-05 22:01 . 2010-09-05 21:55    --------    d-----w-    c:\program files\Common Files\Nikon2010-09-05 22:01 . 2010-09-05 21:53    20    ---h--w-    c:\programdata\PKP_DLdu.DAT2010-09-05 22:00 . 2008-12-04 12:31    --------    d--h--w-    c:\program files\InstallShield Installation Information2010-09-05 22:00 . 2010-09-05 22:00    2485883    ----a-w-    c:\programdata\ArcSoft\Global Deploy\CheckUpdate\ArcConnect.exe2010-09-05 22:00 . 2010-09-05 21:51    --------    d-----w-    c:\programdata\ArcSoft2010-09-05 21:59 . 2010-09-05 21:59    49152    ----a-r-    c:\users\jared and megan\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe2010-09-05 21:59 . 2010-09-05 21:59    335872    ----a-r-    c:\users\jared and megan\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe2010-09-05 21:58 . 2010-09-05 21:58    57344    ----a-r-    c:\users\jared and megan\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe2010-09-05 21:57 . 2010-09-05 21:55    --------    d-----w-    c:\program files\Nikon2010-09-05 21:56 . 2010-09-05 21:56    --------    d-----w-    c:\programdata\AccountTypes2010-09-05 21:56 . 2010-09-05 21:53    --------    d-----w-    c:\programdata\Ultima_T152010-09-05 21:56 . 2010-09-05 21:53    --------    d-----w-    c:\programdata\EnterNHelp2010-09-05 21:55 . 2010-09-05 21:55    --------    d-----w-    c:\program files\Common Files\muvee Technologies2010-09-05 21:55 . 2010-09-05 21:55    --------    d-----w-    c:\programdata\Nikon2010-09-05 21:53 . 2010-09-05 21:53    --------    d-----w-    c:\programdata\designjet2010-09-05 21:53 . 2003-03-19 19:05    106496    ----a-w-    c:\windows\system32\ATL71.DLL2010-09-05 21:53 . 2008-12-04 12:30    --------    d-----w-    c:\program files\Common Files\InstallShield2010-09-05 21:52 . 2010-09-05 21:52    --------    d-----w-    c:\program files\QuickTime2010-09-05 21:52 . 2010-09-05 21:52    --------    d-----w-    c:\programdata\Apple Computer2010-09-05 21:51 . 2010-09-05 21:50    --------    d-----w-    c:\users\jared and megan\AppData\Roaming\ArcSoft2010-09-05 21:50 . 2010-09-05 21:50    --------    d-----w-    c:\program files\Common Files\ArcSoft2010-09-05 21:50 . 2010-09-05 21:50    --------    d-----w-    c:\program files\ArcSoft2010-09-05 17:30 . 2008-12-04 12:53    --------    d-----w-    c:\programdata\McAfee2010-09-03 02:39 . 2010-09-03 02:40    119808    ----a-w-    c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'swg'='c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2009-01-31 68856]'Google Update'='c:\users\jared and megan\AppData\Local\Google\Update\GoogleUpdate.exe' [2010-05-12 136176]'WMPNSCFG'='c:\program files\Windows Media Player\WMPNSCFG.exe' [2008-01-21 202240]'NetZero_uoltray'='c:\program files\NetZero\exec.exe' [2007-05-11 1629184][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'Windows Defender'='c:\program files\Windows Defender\MSASCui.exe' [2008-01-21 1008184]'StartCCC'='c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe' [2008-01-21 61440]'RtHDVCpl'='RtHDVCpl.exe' [2008-07-03 6266880]'SynTPEnh'='c:\program files\Synaptics\SynTP\SynTPEnh.exe' [2008-02-22 1037608]'LManager'='c:\progra~1\LAUNCH~1\LManager.exe' [2008-07-23 846344]'BkupTray'='c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe' [2008-04-26 28672]'Acer Assist Launcher'='c:\program files\Acer\Acer Assist\launcher.exe' [2007-11-19 1261568]'Acer Product Registration'='c:\program files\Acer\Acer Registration\ACE1.exe' [2007-11-26 3387392]'WorksFUD'='c:\program files\Microsoft Works\wkfud.exe' [2001-10-06 24576]'Microsoft Works Portfolio'='c:\program files\Microsoft Works\WksSb.exe' [2005-08-18 749568]'Microsoft Works Update Detection'='c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe' [2001-08-17 28738]'ArcSoft Connection Service'='c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe' [2010-03-18 207360]'QuickTime Task'='c:\program files\QuickTime\QTTask.exe' [2007-12-11 286720]'AVG9_TRAY'='c:\progra~1\AVG\AVG9\avgtray.exe' [2010-09-29 2067808]'Adobe Reader Speed Launcher'='c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe' [2010-06-20 35760]'Adobe ARM'='c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe' [2010-06-09 976832]'Malwarebytes Anti-Malware (reboot)'='c:\program files\Malwarebytes' Anti-Malware\mbam.exe' [2010-04-29 1090952][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]'EnableUIADesktopToggle'= 0 (0x0)[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]'AppInit_DLLs'=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]@='Service'[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnkbackup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartupbackupExtension=.CommonStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EKIJ5000StatusMonitor]2007-04-03 15:54    753664    ----a-w-    c:\windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]2010-09-03 02:39    30192    ----a-w-    c:\program files\Google\Google Desktop Search\GoogleDesktop.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetZero_uoltray]2007-05-11 22:55    1629184    ----a-w-    c:\program files\NetZero\exec.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]2009-09-16 01:47    479232    ----a-w-    c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]2010-05-13 23:12    26192168    ----a-r-    c:\program files\Skype\Phone\Skype.exe[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]'DisableMonitoring'=dword:00000001R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-26 131072]R3 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe AVGIDSAgent R3 AVGIDSDrivervtx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSDriver.sys [2010-09-26 122448] R3 AVGIDSFiltervtx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSFilter.sys [2010-09-26 30288] R3 AVGIDSShimvtx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSShim.sys [2010-09-26 27216] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-09-03 30192] R3 GzOCBus;CHMC GzOne Boulder USB Composite device driver;c:\windows\system32\DRIVERS\GzOCBus.sys [2008-04-21 27136] R3 GzOCMdm;CHMC GzOne Boulder CDMA USB Modem;c:\windows\system32\DRIVERS\GzOCMdm.sys [2008-04-21 42496] R3 GzOCVsp;CHMC GzOne Boulder USB Virtual Serial Port Driver;c:\windows\system32\DRIVERS\GzOCVsp.sys [2008-04-21 39680] S0 AVGIDSErHrvtx;AVG9IDSErHr;c:\windows\System32\Drivers\AVGIDSvx.sys [2010-09-26 25168] S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2010-09-26 52872] S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2010-09-26 24856] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-09-26 216400] S1 AvgTdiX;AVG Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-09-26 243024] S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-09-26 308136] S2 avgfws9;AVG Firewall;c:\program files\AVG\AVG9\avgfws9.exe [2010-09-26 2331544] S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-11-28 24576] S2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\printer\center\KodakSvc.exe [2007-03-23 9728] S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-26 45056] S2 regi;regi;c:\windows\system32\driversegi.sys [2007-04-18 11032] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork    REG_MULTI_SZ       PLA DPS BFE mpssvc . Contents of the 'Scheduled Tasks' folder 2010-10-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2996371701-1281719411-3421169892-1000Core.job - c:\users\jared and megan\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-12 07:54] 2010-10-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2996371701-1281719411-3421169892-1000UA.job - c:\users\jared and megan\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-12 07:54] 2010-10-06 c:\windows\Tasks\Kodak AiO Scheduled Maintenance.job - c:\program files\Kodak\Printer\Center\Kodak.Statistics.exe [2007-03-23 01:04] . . ------- Supplementary Scan ------- . uStart Page = hxxp://yahoo.com/ mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515 Trusted Zone: intuit.com Trusted Zone: netzero.com Trusted Zone: netzero.net Trusted Zone: real.comhap-app-4-0 Trusted Zone: real.comhapreg FF - ProfilePath - c:\users\jared and megan\AppData\Roaming\Mozilla\Firefox\Profiles\vb5jyy90.default\ FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll FF - plugin: c:\users\jared and megan\AppData\Local\Google\Update\1.2.183.29
pGoogleOneClick8.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref('network.IDN.whitelist.xn--mgbaam7a8h', true); c:\program files\Mozilla Firefox\greprefs\all.js - pref('network.IDN.whitelist.xn--mgberp4a5d4ar', true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref('dom.ipc.plugins.enabled', false); . - - - - ORPHANS REMOVED - - - - HKLM-Run-eRecoveryService - (no file) MSConfigStartUp-AVGT - c:\program files\AVGT\antivirusGT.exe . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) 'BlindDial'=dword:00000000 . Completion time: 2010-10-06  06:43:22 ComboFix-quarantined-files.txt  2010-10-06 13:43 Pre-Run: 45,250,691,072 bytes free Post-Run: 45,189,283,840 bytes free - - End Of File - - 6390614B024763BF5F97BC72B08C8B19

kevinf80_1d0ac6 · Answer

Hi hypocrationII,

Good progress made there, proceed as follows please :-

Step 1

user posted image

Please download Malwarebytes Anti-Malware and save it to your desktop.
Alernative D/L mirror
Alternative D/L mirror

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Just update and run as above if already installed.

Step 2

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

Check
Click the button.
Accept any security warnings from your browser.
Check
Push the Start button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the button.
Push

You can refer to this animation by neomage if needed.
Frequently asked questions available Here

Step 3

Download Security Check by screen317 from HERE or HERE.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

What i`d like in your reply :-

Log from Malwarebytes
Log from ESET
Log from Security Checks
System review, improvements? issues?

Kevin

hypocrationII · Answer

I ran the scans that you instructed and things appear to be operating normally. One of the the issues the computer originally had was that Windows would not update. I haven't tried to update it yet because I want you to authorize that first.

I am able to post from the [previously] infected system and google searches are no longer redirecting. I got a blue screen at one point while disabling virus protection/firewall prior to running Combofix, however, I haven't had any issues since.

Question: Should I have enabled virus protection/firewall prior to running SecurityCheck?

Below are the reports:

******************************************

MBAM:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4757

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

10/6/2010 11:57:17 AM
mbam-log-2010-10-06 (11-57-17).txt

Scan type: Quick scan
Objects scanned: 138872
Time elapsed: 6 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

*****************************************************

ESET:

C:\Qoobox\Quarantine\C\Windows\system32\Drivers\kbdclass.sys.vir Win32/Olmarik.ZC trojan cleaned - quarantined

*****************************************************

SecurityCheck:

Results of screen317's Security Check version 0.99.5
Windows Vista Service Pack 1 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
AVG 9.0
ESET Online Scanner v3
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Adobe Flash Player 10.0.45.2
Adobe Reader 9.3.4
Mozilla Firefox (3.6.10) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
ESET ESET Online Scanner OnlineScannerApp.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

kevinf80_1d0ac6 · Answer

Hi hypocration11,Log are good, nothing to worry us there, lets clean up first before we try an update. As follows please.Step 1Remove Combofix now that we're done with it Please press the Windows Key and R on your keyboard. This will bring up the Run... command. Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the 'x' and '/') Please follow the prompts to uninstall Combofix. You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself. The above procedure will delete the following: ComboFix and its associated files and folders. VundoFix backups, if present The C:_OtMoveIt folder, if present Reset the clock settings. Hide file extensions, if required. Hide System/Hidden files, if required. Reset System Restore. Step 2 Download OTC by OldTimer and save it to your desktop. Alternative mirror Double click icon to start the program. If you are using Vista, please right-click and choose run as administrator Then Click the big button. You will get a prompt saying 'Being Cleanup Process'. Please select Yes. Restart your computer when prompted. Any tools left on thedesktop can be deleted.Step 3Download and scan with CCleaner1. Starting with v 1.27.26 (This version no. will differ), CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free or Slim versions instead of the Standard Build.2. Before first use, select Options > Advanced and UNCHECK 'Only delete files in Windows Temp folder older than 24 hours'3. Then select the items you wish to clean up.In the Windows Tab: Clean all entries in the 'Internet Explorer' section except Cookies if you want to keep those. Clean all the entries in the 'Windows Explorer' section. Clean all entries in the 'System' section. Clean all entries in the 'Advanced' section. Clean any others that you choose. In the Applications Tab: Clean all except cookies in the Firefox/Mozilla section if you use it. Clean all in the Opera section if you use it. Clean Sun Java in the Internet Section. Clean any others that you choose. 4. Click the 'Run Cleaner' button.5. A pop up box will appear advising this process will permanently delete files from your system.6. Click 'OK' and it will scan and clean your system.7. Click 'exit' when done. Step 4If the above instructions went ok, especially the Combofix /Uninstall proceed as follows :-Download and install SP2 from Here The instructions are available at the link Download and install IE8 from Here just follow the prompts at the site. Post back with a fresh HJT log and let me know if all is OK or any specific issues.Kevin

hypocrationII · Answer

Glad to read that the last logs I posted are good!

Combofix uninstalled without issue. I ran OTC and CCleaner as instructed. SP2 installed, plus 63 critical Windows updates (including IE8). There doesn't seem to be any issues. What about the bad block comment that you made earlier: you said it could cause hard drive failure -- is that no longer a concern?

One final question: I realize that Combofix is a very powerful tool and untrained users shouldn't run it - I have no intentions of running it on my own. What about the other tools we used? I would like to run some of these scanners/registry repair tools on my own laptop (the one we have been working on is my cousin's) just to ensure that I'm not infected. For example, even after MBAM and AVG cleared this system ESET found another Trojan hiding out. Do you advise against running ESET, OTC and CCleaner on my own?

Finally, here is a fresh HJT log:

***************************************************

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:34:43 PM, on 10/6/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\jared and megan\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\NetZero\exec.exe
C:\Users\jared and megan\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Users\JAREDA~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Pop-up Blocker - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\jared and megan\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O15 - Trusted Zone: *.intuit.com
O15 - Trusted Zone: *.netzero.com
O15 - Trusted Zone: *.netzero.net
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\Windows\System32\avgrsstx.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG Firewall (avgfws9) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgfws9.exe
O23 - Service: AVG9IDSAgent (AVGIDSAgent) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - SDSD - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

--
End of file - 9070 bytes

kevinf80_1d0ac6 · Answer

Hiya Hyprocration11,

Good to hear that everything went well and updates are now working correctly. Regarding the tools you mention, dont use Combofix on your own; it can do major damage to a system if not used correctly. OTC is of no value to you, it is only used to remove tools we have used. ESET is OK for you to use and is readily available, CCleaner is a general purpose cleaning utility and OK for you to use on your own.
I will give you access to plenty of freebies in my closure when we are finished, to include tools you have mentioned and much much more.

Regarding the bad block, yes that still needs to be checked out, we`ll do that now. As follows please:

Select > All programs > Accessories > Right click on Command prompt and select Run as Administrator
At the command prompt type the following chkdsk /r and tap the enter key, note ther is a space between chkdsk and /r
You will get a message that the drive cannot be locked, but that the command can be scheduled to run at the next boot. Say Y and then tap enter again. You will get a message that chkdsk has been scheduled to run on the next boot. Then reboot.
chkdsk will run during the boot, and it will take quite a bit of time, particularly if your boot partition is large. What the /r flag does is force chkdsk to run an expanded version of chkdsk that has 5 tests. The last two will check the drive for file/folder/free space errors and also fix related MFT errors if there are any.
Let me know how this goes, also if it fixes anything.
When chkdsk finishes, type exit, tap enter and re-boot.

Kevin

hypocrationII · Answer

I ran the command as you instructed, but I fell asleep while it ran and awoke to it completed and the system booted. I don't know if it fixed anything. Is there a way to retrieve the history of the scan?

kevinf80_1d0ac6 · Answer

Hi hypocration11,

You can find the log in event viewer :-

Control Panel > classic view > Admin Tools > Event Viewer > (prompt) >
left panel, click the pointer in front of Windows Logs > under the
above, click Application > middle column, scroll to find the list that
says winnit ( depending on how long you did the last chkdsk, it could
take a while to scroll to the list ), left click on winnit > right
panel, under Event winnit (chkdsk), click Event Properties > a new window showing
you the log you want. Just scroll up and down to view.
That's it. Please let me know if you got it.

Maybe an easier way is to re-boot your PC a few times then run the following:

Please download VEW by Vino Rosso from HERE and save it to your Desktop.

Double-click VEW.exe. to start, Vista and Windows 7 users Right Click and select "Run as Administrator"
Under 'Select log to query...check the boxes for both Application and System.
Under 'Select type to list... select both Error and Critical.
Click the radio button for 'Number of events...Type 10 in the 1 to 20 box.
Then click the Run button.
Notepad will open with the output log. It will take a couple of minutes to generate the log, please be patient.

Please post the Output log in your next reply.

Kevin

hypocrationII · Answer

Kevin:

I apologize for taking so long to respond; things got pretty busy for me since my last response. I want to be sure that you know how much I appreciate your help and the long interval between responses is not an indication of ungratefulness. Now that I have stated that, here is the event log:

*******************************************

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 08/10/2010 9:12:06 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 08/10/2010 10:07:13 PM
Type: Error Category: 0
Event: 8194 Source: VSS
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {8e9c62eb-dc3f-4e28-bdb4-579b119a5b81}

Log: 'Application' Date/Time: 07/10/2010 3:50:20 PM
Type: Error Category: 0
Event: 8194 Source: VSS
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {8e9c62eb-dc3f-4e28-bdb4-579b119a5b81}

Log: 'Application' Date/Time: 07/10/2010 10:20:35 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 07/10/2010 5:39:52 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 07/10/2010 3:16:29 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 07/10/2010 3:13:19 AM
Type: Error Category: 16
Event: 4621 Source: Microsoft-Windows-EventSystem
The COM+ Event System could not remove the EventSystem.EventSubscription object {CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 80070005.

Log: 'Application' Date/Time: 07/10/2010 3:04:09 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 07/10/2010 1:27:21 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 07/10/2010 1:15:48 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 07/10/2010 1:14:13 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 07/10/2010 10:20:36 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 07/10/2010 10:20:36 AM
Type: Error Category: 0
Event: 7023 Source: Service Control Manager
The Network Security service terminated with the following error: The specified module could not be found.

Log: 'System' Date/Time: 07/10/2010 10:20:36 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Log: 'System' Date/Time: 07/10/2010 10:02:04 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Log: 'System' Date/Time: 07/10/2010 10:02:04 AM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.

Log: 'System' Date/Time: 07/10/2010 10:02:04 AM
Type: Error Category: 0
Event: 10005 Source: Microsoft-Windows-DistributedCOM
DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Log: 'System' Date/Time: 07/10/2010 5:39:53 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 07/10/2010 5:39:53 AM
Type: Error Category: 0
Event: 7023 Source: Service Control Manager
The Network Security service terminated with the following error: The specified module could not be found.

Log: 'System' Date/Time: 07/10/2010 5:39:53 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Log: 'System' Date/Time: 07/10/2010 3:16:32 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

kevinf80_1d0ac6 · Answer

Hiya hypocration11,

How is your system responding? any issue?

You have several startup entries that are notcrucial or necessary, they will slow your system startup time. Please d/l and run Malwarebytes Startuplite All of the instructions are in the link, you basically install, run and follow the prompts.

Post back and give system update please.

Kevin

hypocrationII · Answer

Kevin, the system is running great. None of the previous symptoms that prompted me to this forum are present and opening programs or navigating the internetz is fast/smooth.

kevinf80_1d0ac6 · Answer

Since this issue appears to be resolved the topic has been closed. Glad we could help.:emotion-21:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

The fixes and advice in this thread are for this System only. Do not apply the instructions from this thread to your own System. Please start a new thread describing your issue and someone will be along to assist you.

Virus & Spyware

I am having issues but....

Was this post helpful?