I am being redirected to various search engines and other sites. New tabs that I don't open are coming up with adult content ads.
I hope I followed directions correctly. Here are the logs:
Malwarebytes Anti-Malware (Trial) 1.60.0.1800
www.malwarebytes.org
Database version: v2012.01.18.05
Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
roy :: ROY-PC [administrator]
Protection: Enabled
1/19/2012 4:30:02 PM
mbam-log-2012-01-19 (16-30-02).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 182291
Time elapsed: 6 minute(s), 25 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-01-19 16:53:58
Windows 6.0.6000 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.BBCO
Running: tp2bwdld.exe; Driver: C:\Users\roy\AppData\Local\Temp\uwrdrpow.sys
---- System - GMER 1.0.15 ----
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x9011C7A2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \Driver\tdx \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.17037
Run by roy at 16:59:28 on 2012-01-19
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3063.1750 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\WDC.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Novatel Wireless\Novacore\Server\NvtlSrvr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = hxxp://www.startsearcher.com
mDefault_Page_URL = hxxp://www.lenovo.com
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = about:blank
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers client\YontooIEClient.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: {9565115D-C7D6-46D3-BD63-B67B481A4368} - No File
TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
uRun: [ISUSPM] c:\programdata\flexnet\connect\11\ISUSPM.exe -scheduler
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [S60 PC Suite Tray] "c:\program files\samsung\samsung pc studio 7\PCSuite.exe" -onlytray
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto
mRun: [iolo AntiVirus] "c:\program files\iolo\antivirus\ioloAV.exe" rstrq
mRun: [ALUAlert] "c:\program files\symantec\liveupdate\ALuNotify.exe" "/LOWDISKSPACE C"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [Samsung.PCSync] "c:\program files\samsung\samsung pc studio 7\PcSync2.exe" /NoDialog
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{315E2755-3200-4715-A27E-D1AB1AC03E85} : DhcpNameServer = 192.168.1.1
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\roy\appdata\roaming\mozilla\firefox\profiles\af2lcday.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm094YYUS&ptb=Pe4FgVVONq7myPeXBIL.Ug&ind=2010110617&ptnrS=GRxdm094YYUS&si=3050&n=77cfda99&psa=&st=kwd&searchfor=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\nuance\pdf reader\bin\nppdf.dll
FF - plugin: c:\program files\nuance\pdf reader\bin\nppdf.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 152ec563-7c7c-4f0b-8a4a-3a98638f84ac
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,BestVideoDownloader,
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-1-16 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-1-16 314456]
R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2011-1-22 20392]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-1-16 20568]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-1-16 55128]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2008-3-26 11776]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2007-7-22 180736]
R3 CapFilt;CapFilt;c:\windows\system32\drivers\CapFilt.sys [2008-3-26 18048]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-1-17 20464]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-5-13 121064]
S3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-8-3 38448]
.
=============== File Associations ===============
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.
=============== Created Last 30 ================
.
2012-01-17 06:43:53 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-17 06:43:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-17 05:41:35 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-01-17 05:41:35 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-01-17 05:40:33 41184 ----a-w- c:\windows\avastSS.scr
2012-01-17 05:39:56 -------- d-----w- c:\programdata\AVAST Software
2012-01-17 05:39:56 -------- d-----w- c:\program files\AVAST Software
2012-01-11 21:31:08 -------- d-----w- c:\program files\Yontoo Layers Client
2012-01-11 21:30:49 814040 ----a-w- c:\program files\mozilla firefox\sqlite3.dll
2012-01-10 04:06:05 -------- d-----w- c:\users\roy\appdata\roaming\Malwarebytes
2012-01-10 04:05:52 -------- d-----w- c:\programdata\Malwarebytes
2012-01-10 02:54:27 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-01-10 02:54:27 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-01-06 06:51:37 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{a42c0687-5ad2-4aa9-b56f-44a1c1096b05}\mpengine.dll
2011-12-30 21:01:09 677136 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
2011-12-29 02:32:08 -------- d-----w- c:\windows\system32\(null)
2011-12-29 02:31:50 -------- d-----w- c:\program files\common files\Lenovo
2011-12-29 02:30:56 21376 ----a-w- c:\windows\system32\drivers\psadd.sys
2011-12-29 02:12:52 -------- d-----w- c:\programdata\PCDr
2011-12-29 01:58:42 -------- d-----w- c:\program files\Broadcom
2011-12-29 01:57:38 -------- d-----w- C:\Drivers
2011-12-29 01:44:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-11-15 18:29:56 222080 ------w- c:\windows\system32\MpSigStub.exe
.
============= FINISH: 17:02:04.96 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 3/26/2008 12:34:40 PM
System Uptime: 1/19/2012 7:04:46 AM (10 hours ago)
.
Motherboard: LENOVO | | SPEEDY
Processor: Intel(R) Pentium(R) Dual CPU T2370 @ 1.73GHz | Socket 478 | 800/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 29 GiB total, 0.561 GiB free.
D: is FIXED (NTFS) - 103 GiB total, 102.081 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 8.1.0
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATK Hotkey
avast! Free Antivirus
Bonjour
Broadband2Go
Broadcom Gigabit Integrated Controller
Cognitive Tutor
EasyCapture
EnergyCut
Google Chrome
Google Earth
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
InstallVC90Support
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Lenovo Easy Camera
lenovo scrnsave
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Malwarebytes Anti-Malware version 1.60.0.1800
mCore
mDriver
mHelp
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
mMHouse
Mozilla Firefox 9.0.1 (x86 en-US)
mPfMgr
MSVC80_x86
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Music Manager
Nuance PDF Reader
OGA Notifier 2.0.0048.0
Power2Go 5.0
QuickTime
Realtek High Definition Audio Driver
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Shuttle Center II
SymNet
Synaptics Pointing Device Driver
System Shield
System Update
TurboTax Audit Support Center 3.0
UltraISO Premium V9.33
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596686) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB2583910)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VeriFace
Windows Live Toolbar
WinFlash
Yontoo Layers Runtime 1.10.01
.
==== Event Viewer Messages From Past Week ========
.
1/19/2012 5:02:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the nsi service.
1/19/2012 5:00:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the fdPHost service.
1/19/2012 5:00:04 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EventSystem service.
1/18/2012 9:33:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinHttpAutoProxySvc service.
1/18/2012 9:33:34 PM, Error: Service Control Manager [7000] - The WinHTTP Web Proxy Auto-Discovery Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/18/2012 9:04:09 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the netprofm service.
1/18/2012 9:03:46 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.12 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/18/2012 9:03:39 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanWorkstation service.
1/18/2012 9:01:25 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the W32Time service.
1/18/2012 9:00:55 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the FDResPub service.
1/18/2012 8:40:22 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.5 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/18/2012 12:43:21 AM, Error: EventLog [6008] - The previous system shutdown at 12:27:19 AM on 1/18/2012 was unexpected.
1/17/2012 9:03:38 PM, Error: EventLog [6008] - The previous system shutdown at 9:02:01 PM on 1/17/2012 was unexpected.
1/17/2012 8:59:20 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.15 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/17/2012 6:47:32 PM, Error: EventLog [6008] - The previous system shutdown at 6:45:23 PM on 1/17/2012 was unexpected.
1/17/2012 6:20:29 PM, Error: EventLog [6008] - The previous system shutdown at 6:19:09 PM on 1/17/2012 was unexpected.
1/17/2012 4:25:56 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.6 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/17/2012 3:05:27 AM, Error: volsnap [35] - The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.
1/16/2012 9:58:07 PM, Error: Service Control Manager [7003] - The SBSD Security Center Service service depends the following service: wscsvc. This service might not be installed.
1/16/2012 9:56:49 PM, Error: EventLog [6008] - The previous system shutdown at 9:55:04 PM on 1/16/2012 was unexpected.
1/16/2012 8:58:55 PM, Error: EventLog [6008] - The previous system shutdown at 11:39:55 PM on 1/14/2012 was unexpected.
1/14/2012 4:18:07 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.11 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/14/2012 12:22:27 AM, Error: EventLog [6008] - The previous system shutdown at 7:30:26 PM on 1/13/2012 was unexpected.
1/14/2012 10:22:46 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.4 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/14/2012 10:21:23 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/13/2012 6:21:16 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.14 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/13/2012 4:39:13 PM, Error: EventLog [6008] - The previous system shutdown at 4:37:35 PM on 1/13/2012 was unexpected.
1/13/2012 4:15:40 PM, Error: EventLog [6008] - The previous system shutdown at 4:09:16 PM on 1/13/2012 was unexpected.
1/13/2012 3:14:24 PM, Error: EventLog [6008] - The previous system shutdown at 3:12:28 PM on 1/13/2012 was unexpected.
1/12/2012 7:44:32 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
1/12/2012 7:40:23 PM, Error: EventLog [6008] - The previous system shutdown at 7:38:52 PM on 1/12/2012 was unexpected.
1/12/2012 7:33:59 PM, Error: EventLog [6008] - The previous system shutdown at 5:42:39 PM on 1/12/2012 was unexpected.
1/12/2012 4:27:44 PM, Error: EventLog [6008] - The previous system shutdown at 4:24:26 PM on 1/12/2012 was unexpected.
1/12/2012 3:00:54 PM, Error: Service Control Manager [7034] - The SQL Server VSS Writer service terminated unexpectedly. It has done this 1 time(s).
1/12/2012 3:00:54 PM, Error: Service Control Manager [7022] - The SQL Server VSS Writer service hung on starting.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7003] - The iolo System Service service depends the following service: vseamps. This service might not be installed.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
1/12/2012 2:59:33 PM, Error: Print [19] - The print spooler failed to share printer HP psc 2400 Series with shared resource name HP psc 2400 Series. Error 1753. The printer cannot be used by others on the network.
1/12/2012 2:58:30 PM, Error: EventLog [6008] - The previous system shutdown at 2:55:47 PM on 1/12/2012 was unexpected.
1/12/2012 2:06:52 PM, Error: EventLog [6008] - The previous system shutdown at 2:05:13 PM on 1/12/2012 was unexpected.
1/12/2012 11:50:30 PM, Error: EventLog [6008] - The previous system shutdown at 11:47:46 PM on 1/12/2012 was unexpected.
1/12/2012 11:18:52 PM, Error: EventLog [6008] - The previous system shutdown at 11:11:42 PM on 1/12/2012 was unexpected.
1/12/2012 10:21:47 PM, Error: EventLog [6008] - The previous system shutdown at 10:16:48 PM on 1/12/2012 was unexpected.
1/12/2012 1:52:01 PM, Error: Microsoft-Windows-WMPNSS-Service [14325] - Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80070424'. In Windows Media Player, turn off media sharing, and then turn it back on.
1/12/2012 1:50:54 PM, Error: Print [19] - The print spooler failed to share printer HP psc 2400 Series with shared resource name HP psc 2400 Series. Error 2114. The printer cannot be used by others on the network.
1/12/2012 1:50:27 PM, Error: EventLog [6008] - The previous system shutdown at 7:22:09 PM on 1/11/2012 was unexpected.
.
==== End Of File ===========================
I hope I followed directions correctly. Here are the logs:
Malwarebytes Anti-Malware (Trial) 1.60.0.1800
www.malwarebytes.org
Database version: v2012.01.18.05
Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
roy :: ROY-PC [administrator]
Protection: Enabled
1/19/2012 4:30:02 PM
mbam-log-2012-01-19 (16-30-02).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 182291
Time elapsed: 6 minute(s), 25 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-01-19 16:53:58
Windows 6.0.6000 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.BBCO
Running: tp2bwdld.exe; Driver: C:\Users\roy\AppData\Local\Temp\uwrdrpow.sys
---- System - GMER 1.0.15 ----
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x9011C7A2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \Driver\tdx \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.17037
Run by roy at 16:59:28 on 2012-01-19
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.3063.1750 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\WDC.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLCapSvc.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Novatel Wireless\Novacore\Server\NvtlSrvr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Lenovo\ShuttleCenter\Kernel\TV\CLSched.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = hxxp://www.startsearcher.com
mDefault_Page_URL = hxxp://www.lenovo.com
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = about:blank
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers client\YontooIEClient.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: {9565115D-C7D6-46D3-BD63-B67B481A4368} - No File
TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
uRun: [ISUSPM] c:\programdata\flexnet\connect\11\ISUSPM.exe -scheduler
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [S60 PC Suite Tray] "c:\program files\samsung\samsung pc studio 7\PCSuite.exe" -onlytray
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto
mRun: [iolo AntiVirus] "c:\program files\iolo\antivirus\ioloAV.exe" rstrq
mRun: [ALUAlert] "c:\program files\symantec\liveupdate\ALuNotify.exe" "/LOWDISKSPACE C"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [Samsung.PCSync] "c:\program files\samsung\samsung pc studio 7\PcSync2.exe" /NoDialog
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{315E2755-3200-4715-A27E-D1AB1AC03E85} : DhcpNameServer = 192.168.1.1
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\roy\appdata\roaming\mozilla\firefox\profiles\af2lcday.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm094YYUS&ptb=Pe4FgVVONq7myPeXBIL.Ug&ind=2010110617&ptnrS=GRxdm094YYUS&si=3050&n=77cfda99&psa=&st=kwd&searchfor=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\nuance\pdf reader\bin\nppdf.dll
FF - plugin: c:\program files\nuance\pdf reader\bin\nppdf.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 152ec563-7c7c-4f0b-8a4a-3a98638f84ac
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,BestVideoDownloader,
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-1-16 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-1-16 314456]
R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2011-1-22 20392]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-1-16 20568]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-1-16 55128]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2008-3-26 11776]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2007-7-22 180736]
R3 CapFilt;CapFilt;c:\windows\system32\drivers\CapFilt.sys [2008-3-26 18048]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-1-17 20464]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-5-13 121064]
S3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-8-3 38448]
.
=============== File Associations ===============
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.
=============== Created Last 30 ================
.
2012-01-17 06:43:53 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-17 06:43:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-17 05:41:35 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-01-17 05:41:35 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-01-17 05:40:33 41184 ----a-w- c:\windows\avastSS.scr
2012-01-17 05:39:56 -------- d-----w- c:\programdata\AVAST Software
2012-01-17 05:39:56 -------- d-----w- c:\program files\AVAST Software
2012-01-11 21:31:08 -------- d-----w- c:\program files\Yontoo Layers Client
2012-01-11 21:30:49 814040 ----a-w- c:\program files\mozilla firefox\sqlite3.dll
2012-01-10 04:06:05 -------- d-----w- c:\users\roy\appdata\roaming\Malwarebytes
2012-01-10 04:05:52 -------- d-----w- c:\programdata\Malwarebytes
2012-01-10 02:54:27 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-01-10 02:54:27 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-01-06 06:51:37 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{a42c0687-5ad2-4aa9-b56f-44a1c1096b05}\mpengine.dll
2011-12-30 21:01:09 677136 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
2011-12-29 02:32:08 -------- d-----w- c:\windows\system32\(null)
2011-12-29 02:31:50 -------- d-----w- c:\program files\common files\Lenovo
2011-12-29 02:30:56 21376 ----a-w- c:\windows\system32\drivers\psadd.sys
2011-12-29 02:12:52 -------- d-----w- c:\programdata\PCDr
2011-12-29 01:58:42 -------- d-----w- c:\program files\Broadcom
2011-12-29 01:57:38 -------- d-----w- C:\Drivers
2011-12-29 01:44:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-11-15 18:29:56 222080 ------w- c:\windows\system32\MpSigStub.exe
.
============= FINISH: 17:02:04.96 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 3/26/2008 12:34:40 PM
System Uptime: 1/19/2012 7:04:46 AM (10 hours ago)
.
Motherboard: LENOVO | | SPEEDY
Processor: Intel(R) Pentium(R) Dual CPU T2370 @ 1.73GHz | Socket 478 | 800/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 29 GiB total, 0.561 GiB free.
D: is FIXED (NTFS) - 103 GiB total, 102.081 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 8.1.0
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATK Hotkey
avast! Free Antivirus
Bonjour
Broadband2Go
Broadcom Gigabit Integrated Controller
Cognitive Tutor
EasyCapture
EnergyCut
Google Chrome
Google Earth
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
InstallVC90Support
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Lenovo Easy Camera
lenovo scrnsave
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Malwarebytes Anti-Malware version 1.60.0.1800
mCore
mDriver
mHelp
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
mMHouse
Mozilla Firefox 9.0.1 (x86 en-US)
mPfMgr
MSVC80_x86
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Music Manager
Nuance PDF Reader
OGA Notifier 2.0.0048.0
Power2Go 5.0
QuickTime
Realtek High Definition Audio Driver
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Shuttle Center II
SymNet
Synaptics Pointing Device Driver
System Shield
System Update
TurboTax Audit Support Center 3.0
UltraISO Premium V9.33
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596686) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB2583910)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VeriFace
Windows Live Toolbar
WinFlash
Yontoo Layers Runtime 1.10.01
.
==== Event Viewer Messages From Past Week ========
.
1/19/2012 5:02:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the nsi service.
1/19/2012 5:00:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the fdPHost service.
1/19/2012 5:00:04 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EventSystem service.
1/18/2012 9:33:34 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinHttpAutoProxySvc service.
1/18/2012 9:33:34 PM, Error: Service Control Manager [7000] - The WinHTTP Web Proxy Auto-Discovery Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/18/2012 9:04:09 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the netprofm service.
1/18/2012 9:03:46 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.12 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/18/2012 9:03:39 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanWorkstation service.
1/18/2012 9:01:25 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the W32Time service.
1/18/2012 9:00:55 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the FDResPub service.
1/18/2012 8:40:22 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.5 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/18/2012 12:43:21 AM, Error: EventLog [6008] - The previous system shutdown at 12:27:19 AM on 1/18/2012 was unexpected.
1/17/2012 9:03:38 PM, Error: EventLog [6008] - The previous system shutdown at 9:02:01 PM on 1/17/2012 was unexpected.
1/17/2012 8:59:20 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.15 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/17/2012 6:47:32 PM, Error: EventLog [6008] - The previous system shutdown at 6:45:23 PM on 1/17/2012 was unexpected.
1/17/2012 6:20:29 PM, Error: EventLog [6008] - The previous system shutdown at 6:19:09 PM on 1/17/2012 was unexpected.
1/17/2012 4:25:56 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.6 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/17/2012 3:05:27 AM, Error: volsnap [35] - The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.
1/16/2012 9:58:07 PM, Error: Service Control Manager [7003] - The SBSD Security Center Service service depends the following service: wscsvc. This service might not be installed.
1/16/2012 9:56:49 PM, Error: EventLog [6008] - The previous system shutdown at 9:55:04 PM on 1/16/2012 was unexpected.
1/16/2012 8:58:55 PM, Error: EventLog [6008] - The previous system shutdown at 11:39:55 PM on 1/14/2012 was unexpected.
1/14/2012 4:18:07 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.11 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/14/2012 12:22:27 AM, Error: EventLog [6008] - The previous system shutdown at 7:30:26 PM on 1/13/2012 was unexpected.
1/14/2012 10:22:46 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.4 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/14/2012 10:21:23 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/13/2012 6:21:16 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.14 for the Network Card with network address 001CBFBB964B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
1/13/2012 4:39:13 PM, Error: EventLog [6008] - The previous system shutdown at 4:37:35 PM on 1/13/2012 was unexpected.
1/13/2012 4:15:40 PM, Error: EventLog [6008] - The previous system shutdown at 4:09:16 PM on 1/13/2012 was unexpected.
1/13/2012 3:14:24 PM, Error: EventLog [6008] - The previous system shutdown at 3:12:28 PM on 1/13/2012 was unexpected.
1/12/2012 7:44:32 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
1/12/2012 7:40:23 PM, Error: EventLog [6008] - The previous system shutdown at 7:38:52 PM on 1/12/2012 was unexpected.
1/12/2012 7:33:59 PM, Error: EventLog [6008] - The previous system shutdown at 5:42:39 PM on 1/12/2012 was unexpected.
1/12/2012 4:27:44 PM, Error: EventLog [6008] - The previous system shutdown at 4:24:26 PM on 1/12/2012 was unexpected.
1/12/2012 3:00:54 PM, Error: Service Control Manager [7034] - The SQL Server VSS Writer service terminated unexpectedly. It has done this 1 time(s).
1/12/2012 3:00:54 PM, Error: Service Control Manager [7022] - The SQL Server VSS Writer service hung on starting.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7003] - The iolo System Service service depends the following service: vseamps. This service might not be installed.
1/12/2012 2:59:48 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
1/12/2012 2:59:33 PM, Error: Print [19] - The print spooler failed to share printer HP psc 2400 Series with shared resource name HP psc 2400 Series. Error 1753. The printer cannot be used by others on the network.
1/12/2012 2:58:30 PM, Error: EventLog [6008] - The previous system shutdown at 2:55:47 PM on 1/12/2012 was unexpected.
1/12/2012 2:06:52 PM, Error: EventLog [6008] - The previous system shutdown at 2:05:13 PM on 1/12/2012 was unexpected.
1/12/2012 11:50:30 PM, Error: EventLog [6008] - The previous system shutdown at 11:47:46 PM on 1/12/2012 was unexpected.
1/12/2012 11:18:52 PM, Error: EventLog [6008] - The previous system shutdown at 11:11:42 PM on 1/12/2012 was unexpected.
1/12/2012 10:21:47 PM, Error: EventLog [6008] - The previous system shutdown at 10:16:48 PM on 1/12/2012 was unexpected.
1/12/2012 1:52:01 PM, Error: Microsoft-Windows-WMPNSS-Service [14325] - Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80070424'. In Windows Media Player, turn off media sharing, and then turn it back on.
1/12/2012 1:50:54 PM, Error: Print [19] - The print spooler failed to share printer HP psc 2400 Series with shared resource name HP psc 2400 Series. Error 2114. The printer cannot be used by others on the network.
1/12/2012 1:50:27 PM, Error: EventLog [6008] - The previous system shutdown at 7:22:09 PM on 1/11/2012 was unexpected.
.
==== End Of File ===========================