also @ TechSpot: Android 4.0: Tracking Ice Cream Sandwich's Availability on Smartphones

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Solved] SVCHOST.exe trojan causes physical memory dump and then wants to reinstall OS

Discussion in 'Virus and Malware Removal' started by ajross, Dec 18, 2011.

Page 1 of 3

  1. ajross Newcomer, in training

    Hello all,

    So, I've run into a bit of a brick wall.
    Several days ago, I was multitasking a few programs and deleting files and whatnot, having a good time. I was prompted with what I thought was just another "Java update" I needed to give permission to run. Normally I just click cancel, but I decided to just update and it would leave me alone. At the last second, I realized it wasn't java. Almost right after I clicked okay, my computer shut off, and then went to a BSOD, and turned back on. It was so slow that my internet window wasn't following my mouse when I'd drag it across the screen.
    Now, I did a full scan with malware-bytes, found the virus (svchost.exe), and deleted it and then rebooted... It seemed to do the trick. Until the next morning when I tried to play my new game: Skyrim. It lagged like you'd not believe. I ran the scan again in safe mode, this time finding svchost.exe as well as 10 other viruses with the same name. Again, like last time, deleted them and then rebooted. It was running like a charm. Tonight, when I turned it on after moving it back from my girlfriend's house, it went to a BSOD stating it was running a physical memory dump. After this completed, it now wants to reinstall the OS!?

    Does this mean that the computer I'm using is now going to lose all of its data and be overcome by the virus after OS reinstall? I looked all over the net with no help whatsoever.

    I have a Dell Windows 7, 64-bit desktop. I've not had any issues with this computer previously, and this is the first time I've dealt with an issue this big. I'm freaking out.

    I'd like to know specifically if I can save my data, if I'm going to need to reinstall the OS completely, and whether or not this is an issue that will need to be fixed physically. (Such as the hardware inside the system.)
    Thanks in advance,
    -Aaron
    ajross, Dec 18, 2011
    #1

  2. Broni Malware Annihilator

    Welcome aboard [IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =============================================================

    Let's see, if we can look at your computer booting from an external source.

    Please download OTLPE (filesize 120,9 MB)

    • When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
    • Reboot your system using the boot CD you just created.
      • Note : If you do not know how to set your computer to boot from CD follow the steps HERE
    • Your system should now display a REATOGO-X-PE desktop.
    • Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
    • Double-click on the OTLPE icon.
    • When asked Do you wish to load the remote registry, select Yes
    • When asked Do you wish to load remote user profile(s) for scanning, select Yes
    • Ensure the box Automatically Load All Remaining Users" is checked and press OK
    • OTL should now start.
    • Press Run Scan to start the scan.
    • When finished, the file will be saved in drive C:\OTL.txt
    • Copy this file to your USB drive if you do not have internet connection on this system
    • Please post the contents of the OTL.txt file in your reply.
    Broni, Dec 18, 2011
    #2

  3. ajross Newcomer, in training

    Okay, thank you. I'm downloading the file as we speak; I'll have the information from the text file as some point this evening.

    I've messed with it a bit since the incident and I can use the computer now; but only in Safe Mode. Booting normally results a BSOD and restart.

    A.
    ajross, Dec 19, 2011
    #3

  4. Broni Malware Annihilator

    If you can boot to safe mode....

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.
    Complete as many steps as you can.
    Broni, Dec 19, 2011
    #4

  5. ajross Newcomer, in training

    Alright, so I've managed to get the disk in and working properly, but it failed to run the scan you said to use in your first set of instructions.

    However, I have used, and am currently using malwarebytes to find viruses.
    Everytime I scan, I come up with the same, stinking one; svchost.exe.

    I was trying to make a backup, but it was apparently copied over to the hard drive... Now what? Please tell me how I can rid of this stupid thing; I'm going to format anyhow, I just need a backup that is virus free!

    I'll try running some of the other scans, though. What do you want me to run scans on? The hard drive I'm using as a back up, or the main drive C, or both?
    ajross, Dec 19, 2011
    #5

  6. Broni Malware Annihilator

    Follow my previous reply.
    Broni, Dec 19, 2011
    #6

  7. ajross Newcomer, in training

    Malwarebytes log:

    Malwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org

    Database version: 8382

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 8.0.7601.17514

    12/19/2011 10:36:55 PM
    mbam-log-2011-12-19 (22-36-55).txt

    Scan type: Quick scan
    Objects scanned: 184249
    Time elapsed: 3 minute(s), 53 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    ajross, Dec 19, 2011
    #7

  8. ajross Newcomer, in training

    Gmer log:

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2011-12-19 22:31:41
    Windows 6.1.7601 Service Pack 1
    Running: gmer.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKCU\Software\Microsoft\Windows Live\Companion\ajross@hotmail.com@0e29dbe20f07eec3cc21ac9400c93b57\r\n 0x7E 0xB1 0xE4 0x17 ...

    ---- EOF - GMER 1.0.15 ----
    ajross, Dec 19, 2011
    #8

  9. ajross Newcomer, in training

    DDS log:

    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 8.0.7601.17514
    Run by Aaron Ross at 22:41:20 on 2011-12-19
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.9892 [GMT -5:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Windows\system32\atieclxx.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe
    C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
    C:\Windows\system32\mfevtps.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe -k HPService
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    C:\Windows\PLF1330.exe
    C:\Windows\vspc1330.exe
    C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
    C:\Program Files (x86)\Steam\steam.exe
    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files\mcafee.com\agent\mcagent.exe
    C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
    C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    -netsvcs
    -netsvcs
    -netsvcs
    -netsvcs
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
    c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.facebook.com/
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111112061611.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5825.1100\swg.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
    uRun: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
    uRun: [Google Update] "C:\Users\Aaron Ross\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10x_ActiveX.exe -update activex
    mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
    mRun: [UpdReg] C:\Windows\UpdReg.EXE
    mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun: [<NO NAME>]
    mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
    mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
    mRun: [CarboniteSetupLite] "C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
    mRun: [MaxMenuMgr] "C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
    mRun: [SPC1330] C:\Windows\vspc1330.exe
    mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
    mRunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
    mRunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
    StartupFolder: C:\Users\AARONR~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\YAHOO!~1.LNK - C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
    DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
    DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/mjss/MJSS.cab109791.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    TCP: DhcpNameServer = 71.252.0.12 71.242.0.12 192.168.1.1
    TCP: Interfaces\{EF2A45E9-F44F-4C78-9508-7EAA07F87FC7} : DhcpNameServer = 71.252.0.12 71.242.0.12 192.168.1.1
    TCP: Interfaces\{EF2A45E9-F44F-4C78-9508-7EAA07F87FC7}\C696E6B6379737F5355435F53313935313 : DhcpNameServer = 71.252.0.12 71.242.0.12
    Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\msc\McSnIePl.dll
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    BHO-X64: 0x1 - No File
    BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO-X64: HP Print Enhancer - No File
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO-X64: McAfee Phishing Filter - No File
    BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111112061611.dll
    BHO-X64: scriptproxy - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5825.1100\swg.dll
    BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO-X64: URLRedirectionBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    BHO-X64: HP Smart BHO Class - No File
    TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
    mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun-x64: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
    mRun-x64: [UpdReg] C:\Windows\UpdReg.EXE
    mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun-x64: [(Default)]
    mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
    mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
    mRun-x64: [CarboniteSetupLite] "C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
    mRun-x64: [MaxMenuMgr] "C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
    mRun-x64: [SPC1330] C:\Windows\vspc1330.exe
    mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
    mRunOnce-x64: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
    mRunOnce-x64: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
    R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
    R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
    R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 FreeAgentGoNext Service;Seagate Service;C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe [2009-12-18 189736]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-2-19 13336]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-3-2 366152]
    R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
    R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
    R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
    R2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2011-2-19 199272]
    R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2011-2-19 208536]
    R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
    R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-2-19 689472]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
    R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
    R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
    R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
    R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
    R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
    R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2010-7-30 25072]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-9-4 219632]
    S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-2-19 220528]
    S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
    S3 phaudlwr;Philips Audio Filter;C:\Windows\system32\DRIVERS\phaudlwr.sys --> C:\Windows\system32\DRIVERS\phaudlwr.sys [?]
    S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-9-4 1116656]
    S3 SPC1330;USB2.0 PC Camera (SPC1330);C:\Windows\system32\DRIVERS\spc1330.sys --> C:\Windows\system32\DRIVERS\spc1330.sys [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2011-12-19 23:49:39 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{716BF4DD-C949-4A8D-A472-185F948C0F0D}
    2011-12-19 23:49:16 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{2A4497C1-E830-474E-91C7-63BC1EDA3C69}
    2011-12-18 14:37:24 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{57E9318E-3240-4435-896A-84EB8D9E2F87}
    2011-12-18 04:36:41 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{7319A5BD-0833-4EB3-A4D2-60A37CCB8543}
    2011-12-18 04:36:16 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{A74FAF9D-1FB8-4D41-9CD9-B310ABA32212}
    2011-12-17 03:23:47 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{26E89422-35B7-44AF-9D7B-1782B5A8C27B}
    2011-12-17 03:23:33 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{87B7F786-2C84-4637-B46E-321CEF18EBE1}
    2011-12-16 13:28:42 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
    2011-12-16 13:07:59 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2011-12-16 13:07:59 2048 ----a-w- C:\Windows\System32\tzres.dll
    2011-12-16 13:07:40 3145216 ----a-w- C:\Windows\System32\win32k.sys
    2011-12-16 13:07:36 723456 ----a-w- C:\Windows\System32\EncDec.dll
    2011-12-16 13:07:36 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
    2011-12-16 13:07:28 43520 ----a-w- C:\Windows\System32\csrsrv.dll
    2011-12-16 12:45:29 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{DF8755D9-9D41-4251-B9AC-770926ED97FA}
    2011-12-16 12:44:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{204E13CB-DF52-48AE-94D9-013EED14B739}
    2011-12-16 12:41:41 20480 ------w- C:\Windows\svchost.exe
    2011-12-16 05:06:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{815D3EFC-6261-4723-A7C6-9270CCF86DE5}
    2011-12-16 05:06:34 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{37BB5F2F-309E-44BE-9B58-CBF6FD5C8EF4}
    2011-12-15 00:08:05 -------- d-----w- C:\Program Files (x86)\EASEUS
    2011-12-14 23:32:44 -------- d-----w- C:\Program Files (x86)\Passware
    2011-12-13 22:51:39 -------- d-----w- C:\Log
    2011-12-13 22:51:25 -------- d-----w- C:\Program Files (x86)\Stellar Phoenix Windows Data Recovery
    2011-12-13 05:01:03 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{E978D518-E25F-43DD-BE18-5A5519A4EF7F}
    2011-12-13 05:00:52 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{5E747CED-EA27-4C72-A863-E9190BB9D4F9}
    2011-12-12 17:00:37 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{C7A26270-F531-49E8-8441-2A8FFBABB6AA}
    2011-12-12 17:00:26 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{7A3B1A57-AF42-4478-B062-380F0C3C529A}
    2011-12-12 01:51:56 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{02439AB9-D373-45BD-B539-1A1887FD6F30}
    2011-12-12 01:51:45 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{E636ECFF-EBA8-49E8-A362-F08ED59BE4B4}
    2011-12-10 17:34:15 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{A15EB08F-EC5C-4DDA-8FC5-1DC01B72B47A}
    2011-12-10 17:33:58 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{5387E63A-CCA7-4E17-A068-EBBDF398BB11}
    2011-12-09 14:55:25 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\WB Games
    2011-12-09 14:47:02 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{83249385-F1CB-47B9-9444-EFEDF6AA10D5}
    2011-12-09 14:46:51 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{477F4219-42C2-45CC-8A78-D9F1956C0086}
    2011-12-09 10:51:33 -------- d-----w- C:\Program Files (x86)\The Lord of the Rings - War in the North
    2011-12-09 01:01:34 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{5F6ED367-36F5-49FE-8D30-EEF3C39B97E5}
    2011-12-09 01:01:23 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{4077CA25-ED6A-4520-8910-55B47D346B60}
    2011-12-08 13:01:10 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{DB982D8E-0852-4371-AFCC-9700374EA63E}
    2011-12-08 13:00:59 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{1E8A1BDD-2142-45CE-BCD9-D73582AC042E}
    2011-12-08 01:00:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{FF32EC4C-B788-4E3B-8F15-271DB37258C8}
    2011-12-08 01:00:33 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{79922A80-B92C-4204-8516-B4E42B77AA21}
    2011-12-06 05:01:39 -------- d-----w- C:\Program Files (x86)\Yontoo
    2011-12-06 05:01:35 -------- d-----w- C:\ProgramData\Tarma Installer
    2011-12-06 00:36:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\dxhr
    2011-12-06 00:35:19 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\28050
    2011-12-05 21:26:33 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{C1ED5646-6DA3-4BE3-B380-64BF975DC12D}
    2011-12-05 21:26:17 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{749F9282-9B51-42D6-9F81-126E0257A78A}
    2011-12-05 04:13:11 -------- d-----w- C:\Program Files (x86)\LIMBO
    2011-12-04 23:15:57 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{9FD68727-0EB3-47F4-931D-3CB96D9B846D}
    2011-12-04 23:15:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{4F592D35-CD1D-4261-B851-E043E6319764}
    2011-12-03 15:53:47 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{45BCA740-CEA1-441D-9D20-E22FCFA8ED3F}
    2011-12-03 15:53:36 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{25D14A3D-CEDB-4E58-AE10-59B9101ECF31}
    2011-12-02 13:56:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{C6DC4EC3-1EA3-41B2-BE6F-D8FE3B6A244E}
    2011-12-02 13:56:44 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{CF4FFCF2-1A2C-4D06-AE19-E6F4F47F7E7E}
    2011-12-02 01:56:31 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{AD1ADC70-9835-4819-BCD7-17A1E466C2EF}
    2011-12-02 01:56:19 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{268FA93E-8478-4C4F-8952-B33288C650B3}
    2011-11-28 21:54:05 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{456F7FE2-83C0-4C94-B1AE-07E034696E87}
    2011-11-28 21:53:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{ADAF9690-EA8D-4E0C-AE55-C40C08D7D454}
    2011-11-27 18:30:03 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{6B808D02-1C09-4FF7-8EE1-EE40BFF7B9E1}
    2011-11-27 18:29:48 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{F5094410-6D11-456F-8D96-455B48EB3150}
    2011-11-26 06:17:17 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{51731400-B673-4205-A201-ABD3725AAFF9}
    2011-11-26 06:17:06 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{2ADE73D4-A286-4CC2-88D5-4E2EA5C85BDB}
    2011-11-25 18:16:38 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{63724F07-BAE1-43D9-AC3B-E3C5BE4639AC}
    2011-11-25 18:16:27 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{9966867C-9AB2-455B-B4B3-A0AD5A24D0FF}
    2011-11-24 22:11:13 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{BB38253F-0566-47D3-A371-5FC922012F06}
    2011-11-24 22:11:02 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{F770DF39-1769-4892-97FC-455F080BAC49}
    2011-11-22 01:50:48 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{6505ABCD-18BE-47D5-84F8-D1EF6B566C99}
    2011-11-22 01:50:37 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{7A80D333-BB40-41B8-9A49-359EB391E04B}
    2011-11-21 13:50:25 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{76DAB8FA-D5A0-4D56-83C3-6A5E70AB5D49}
    2011-11-21 13:50:14 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{D385EAD0-EC32-4CD6-8E1B-0EA5491A9C5D}
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2011-11-21 13:29:05 -------- d-----w- C:\Program Files\iPod
    2011-11-21 13:29:04 -------- d-----w- C:\Program Files\iTunes
    2011-11-20 20:28:36 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\Google
    2011-11-20 20:28:23 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\Deployment
    2011-11-20 20:28:23 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\Apps
    2011-11-20 20:21:06 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{6368B6CB-E8D2-46B1-86B4-E6A88721097E}
    2011-11-20 20:20:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{990FEB0F-65E1-4FC8-94B1-3C2E28E7D686}
    .
    ==================== Find3M ====================
    .
    2011-11-05 05:41:43 1188864 ----a-w- C:\Windows\System32\wininet.dll
    2011-11-05 04:35:00 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2011-11-05 03:32:47 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-11-05 02:48:51 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-10-24 19:29:02 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
    2011-10-24 19:29:02 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
    2011-10-18 19:32:28 161168 ----a-w- C:\Windows\System32\mfevtps.exe
    2011-10-15 18:16:16 75808 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys
    2011-10-15 18:16:16 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys
    2011-10-15 18:16:16 647080 ----a-w- C:\Windows\System32\drivers\mfehidk.sys
    2011-10-15 18:16:16 481768 ----a-w- C:\Windows\System32\drivers\mfefirek.sys
    2011-10-15 18:16:16 284648 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys
    2011-10-15 18:16:16 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys
    2011-10-15 18:16:16 160280 ----a-w- C:\Windows\System32\drivers\mfeapfk.sys
    2011-10-15 18:16:16 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
    2011-10-15 18:16:16 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys
    2011-09-29 16:29:28 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2011-09-23 18:58:47 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    .
    ============= FINISH: 22:46:49.78 ===============
    ajross, Dec 19, 2011
    #9

  10. ajross Newcomer, in training

    Attach log:


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 2/23/2011 2:38:18 PM
    System Uptime: 12/19/2011 6:47:20 PM (4 hours ago)
    .
    Motherboard: Dell Inc. | | 05DN3X
    Processor: Intel(R) Core(TM) i7 CPU 960 @ 3.20GHz | CPU 1 | 3201/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 919 GiB total, 593.41 GiB free.
    D: is CDROM ()
    E: is FIXED (NTFS) - 298 GiB total, 213.276 GiB free.
    F: is Removable
    Y: is FIXED (NTFS) - 12 GiB total, 5.522 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
    Description: Photosmart Plus B209a-m
    Device ID: ROOT\MULTIFUNCTION\0000
    Manufacturer: HP
    Name: Photosmart Plus B209a-m
    PNP Device ID: ROOT\MULTIFUNCTION\0000
    Service:
    .
    ==== System Restore Points ===================
    .
    RP150: 12/13/2011 9:18:22 PM - Removed Skype™ 5.3
    RP151: 12/15/2011 9:50:13 AM - Installed Dell Stage
    RP152: 12/16/2011 12:22:39 AM - Installed Java(TM) 6 Update 30
    RP153: 12/16/2011 3:00:15 AM - Windows Update
    RP154: 12/16/2011 7:36:23 AM - Restore Operation
    RP155: 12/16/2011 8:27:15 AM - Windows Update
    RP156: 12/16/2011 9:03:12 PM - Windows Update
    RP157: 12/16/2011 10:54:33 PM - Installed Dell MusicStage
    RP158: 12/16/2011 11:29:09 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.1.2
    Adobe Shockwave Player 11.6
    Age of Empires III
    Apple Application Support
    Apple Software Update
    ArcSoft WebCam Companion 2
    Assassins Creed Brotherhood version 1.0
    ATI Catalyst Control Center
    Audacity 1.2.6
    B209a-m
    BufferChm
    Carbonite Online Backup Setup
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Combat Arms
    Consumer In-Home Service Agreement
    Crysis® 2
    D3DX10
    DAEMON Tools Lite
    Dead Space™ 2
    Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    Dell DataSafe Local Backup
    Dell DataSafe Local Backup - Support Software
    Dell Getting Started Guide
    Dell MusicStage
    Dell PhotoStage
    Dell Stage
    Dell VideoStage
    Destinations
    Deus Ex: Human Revolution
    DeviceDiscovery
    DirectX 9 Runtime
    Doom 3
    EasyBits GO
    eBay
    Excel Key 8.1 Demo
    Fallout 3
    FINAL FANTASY XIV
    Gates of Andaron 3.4.1
    Google Chrome
    Google Updater
    GoToAssist 8.0.0.514
    GPBaseService2
    Guild Wars
    HP Update
    HPPhotoGadget
    hpPrintProjects
    HPProductAssistant
    HPSSupply
    hpWLPGInstaller
    Intel(R) Control Center
    Intel(R) Rapid Storage Technology
    Internet Explorer
    J2SE Runtime Environment 5.0 Update 2
    Java Auto Updater
    Java(TM) 6 Update 26
    Junk Mail filter update
    Korean Fonts Support For Adobe Reader 9
    Magicka
    Malwarebytes' Anti-Malware version 1.51.2.1300
    MapleStory
    MarketResearch
    McAfee SecurityCenter
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 1.1
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Games for Windows Marketplace
    Microsoft Office 2010 Service Pack 1 (SP1)
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Home and Student 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Single Image 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Nexon Game Manager
    Oblivion
    Pando Media Booster
    Philips Intelligent Agent
    Philips SPC1330NC Webcam
    PhotoShowExpress
    PS_AIO_06_B209a-m_SW_Min
    QuickTime
    Realtek High Definition Audio Driver
    Remotebook SideShow Gadget
    Roxio Activation Module
    Roxio BackOnTrack
    Roxio Burn
    Roxio Creator Starter
    Roxio Express Labeler 3
    Scan
    Seagate Manager Installer
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft Office 2010 (KB2553091)
    Security Update for Microsoft Office 2010 (KB2553096)
    Security Update for Microsoft Office 2010 (KB2553353) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
    Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
    Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
    Skins
    Skype™ 5.3
    SmartWebPrinting
    SolutionCenter
    Sonic CinePlayer Decoder Pack
    Status
    Steam
    swMSM
    The Elder Scrolls V: Skyrim
    The Lord of the Rings Online™ v03.02.05.8032
    THX TruStudio PC
    Toolbox
    TrayApp
    TrustedID
    uCeritify M77-605 - MCAS: Using Microsoft Office Access 2007
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2494150)
    Update for Microsoft Office 2010 (KB2553065)
    Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553455) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2566458)
    Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition
    Update for Microsoft Outlook Social Connector (KB2583935)
    WebReg
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows SideShow Managed Runtime 1.0
    Yahoo! Detect
    Yahoo! Install Manager
    Yahoo! Toolbar
    Yahoo! Widgets
    YouTube Downloader 2.7.4
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12/19/2011 7:54:53 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    12/19/2011 6:49:24 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    12/18/2011 9:41:11 AM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    12/18/2011 9:39:39 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    12/18/2011 9:39:11 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6
    12/18/2011 9:38:59 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff800034fbab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121811-20248-01.
    12/18/2011 9:36:05 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0x000000000001053a, 0xfffff8800e29aa68, 0xfffff8800e29a2c0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121811-21200-01.
    12/16/2011 9:28:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
    12/16/2011 9:28:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    12/16/2011 9:25:20 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    12/16/2011 9:18:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    12/16/2011 9:18:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    12/16/2011 9:17:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    12/16/2011 9:17:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    12/16/2011 9:17:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/16/2011 9:17:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    12/16/2011 9:11:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache mfehidk mfenlfk NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Personal Firewall Service service depends on the Windows Firewall service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Anti-Spam Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    12/16/2011 8:02:56 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
    12/16/2011 8:02:56 AM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/16/2011 7:45:43 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
    12/16/2011 7:42:54 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..
    12/16/2011 7:26:09 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800037d3a9a, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121611-18002-01.
    12/16/2011 7:24:21 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Peer Networking Identity Manager service to connect.
    12/16/2011 7:24:21 AM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Networking Identity Manager service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    12/16/2011 7:24:21 AM, Error: Service Control Manager [7001] - The Peer Name Resolution Protocol service depends on the Peer Networking Identity Manager service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    12/16/2011 7:24:21 AM, Error: Service Control Manager [7000] - The Peer Networking Identity Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/16/2011 12:06:53 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
    12/16/2011 12:04:47 AM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
    12/16/2011 10:21:27 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Cumulative Security Update for Internet Explorer 8 for Windows 7 for x64-based Systems (KB2618444).
    12/16/2011 10:05:23 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    12/15/2011 5:17:00 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user AaronRoss-PC\Aaron Ross SID (S-1-5-21-1291757901-1728682472-3769939207-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    12/15/2011 5:17:00 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user AaronRoss-PC\Aaron Ross SID (S-1-5-21-1291757901-1728682472-3769939207-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    .
    ==== End Of File ===========================
    ajross, Dec 19, 2011
    #10

  11. Broni Malware Annihilator

    I can see you ran everything in normal mode.
    Good news :)
    What are the current issues?

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan:
    [IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    =============================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    Broni, Dec 19, 2011
    #11

  12. ajross Newcomer, in training

    I've run across a major disappointment..
    I was fine until I tried running ComboFix, but it was giving me errors. So I tried booting in safe mode; however, another issue occurred. It now will not run windows in normal mode, or safe mode. It simply starts up like normal, goes to the Windows home screen right before user log in, and stops mid-loading and goes to "windows repair". It finds several issues, and then tries to fix them. Unfortunately, the issues are not repaired and are failed because of an 0x0 error. After I tried doing this again, it then wanted me to reinstall windows 7 again like before.

    I wanted to make sure that I could still operate the computer, so I tried booting from the boot up disk I made earlier in the forum. (Which by the way wouldn't let me do any scans because it said my thing wasn't windows 2000 or later or something.)
    This bootup disk did work, so I imagine its the trojan that is causing all these errors?
    ajross, Dec 20, 2011
    #12

  13. Broni Malware Annihilator

    While booted from the bootdisk can you operate computer normally.
    Did you run aswMBR before Combofix?
    Broni, Dec 20, 2011
    #13

  14. ajross Newcomer, in training

    As far as I know everything is working normally off of the boot disk.. I can't run the scanner though as stated in the previous reply.

    And I did run the previous program's scan before using combofix.. Thinking back to it, however, I might have hit "fix" before hitting the close button...would that have made a difference in the way my computer has been behaving?
    ajross, Dec 21, 2011
    #14

  15. Broni Malware Annihilator

    Can you run aswMBR?
    Broni, Dec 21, 2011
    #15

  16. ajross Newcomer, in training

    I apologize for not getting to reply to this thread sooner...
    I am using a clean computer and flash drive to download aswMBR to install and scan the infected one running on the boot disk. (It won't allow me to access my internet. I'm using a wireless connection.)

    I am unable to use my Windows OS; I am running into the same problem as before...Looping "Windows fix" with fails and errors each time.

    I'll post a new reply once I try out aswMBR on the infected computer; cross your fingers.
    ajross, Dec 24, 2011
    #16

  17. Broni Malware Annihilator

    No problem :)
    Broni, Dec 24, 2011
    #17

  18. ajross Newcomer, in training

    Alright...
    Here is the log it gave me after I saved it to the desktop:

    aswMBR version 0.9.9.1120 Copyright(c) 2011 AVAST Software
    Run date: 2011-12-24 22:41:27
    -----------------------------
    22:41:27.421 OS Version: Windows 5.1.2600
    22:41:27.421 Number of processors: 1 586 0x1A05
    22:41:27.421 ComputerName: REATOGO UserName: SYSTEM
    22:41:27.781 Initialze error 0
    22:41:32.781 AVAST engine download error: 0
    22:41:42.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    22:41:42.484 Disk 0 Vendor: ST310005 CC46 Size: 953869MB BusType: 3
    22:41:42.531 Disk 0 MBR read successfully
    22:41:42.562 Disk 0 MBR scan
    22:41:42.609 Disk 0 TDL4@MBR code has been found
    22:41:42.656 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
    22:41:42.687 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 12542 MB offset 81920
    22:41:42.734 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 941286 MB offset 25767936
    22:41:42.781 Disk 0 MBR [TDL4] **ROOTKIT**
    22:41:42.828 Disk 0 scanning X:\i386\system32\drivers
    22:41:42.875 Service scanning
    22:41:43.546 Modules scanning
    22:41:46.859 Disk 0 trace - called modules:
    22:41:47.031 ntoskrnl.exe CLASSPNP.SYS disk.sys iastor86.SY_ halaacpi.dll
    22:41:47.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b0da030]
    22:41:47.281 3 CLASSPNP.SYS[f74e805b] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8aa34028]
    22:41:47.406 Scan finished successfully
    22:42:04.328 Disk 0 MBR has been saved successfully to "B:\Documents and Settings\Default User\Desktop\MBR.dat"
    22:42:04.375 The log file has been saved successfully to "B:\Documents and Settings\Default User\Desktop\aswMBR.txt"


    aswMBR version 0.9.9.1120 Copyright(c) 2011 AVAST Software
    Run date: 2011-12-24 22:41:27
    -----------------------------
    22:41:27.421 OS Version: Windows 5.1.2600
    22:41:27.421 Number of processors: 1 586 0x1A05
    22:41:27.421 ComputerName: REATOGO UserName: SYSTEM
    22:41:27.781 Initialze error 0
    22:41:32.781 AVAST engine download error: 0
    22:41:42.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    22:41:42.484 Disk 0 Vendor: ST310005 CC46 Size: 953869MB BusType: 3
    22:41:42.531 Disk 0 MBR read successfully
    22:41:42.562 Disk 0 MBR scan
    22:41:42.609 Disk 0 TDL4@MBR code has been found
    22:41:42.656 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
    22:41:42.687 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 12542 MB offset 81920
    22:41:42.734 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 941286 MB offset 25767936
    22:41:42.781 Disk 0 MBR [TDL4] **ROOTKIT**
    22:41:42.828 Disk 0 scanning X:\i386\system32\drivers
    22:41:42.875 Service scanning
    22:41:43.546 Modules scanning
    22:41:46.859 Disk 0 trace - called modules:
    22:41:47.031 ntoskrnl.exe CLASSPNP.SYS disk.sys iastor86.SY_ halaacpi.dll
    22:41:47.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b0da030]
    22:41:47.281 3 CLASSPNP.SYS[f74e805b] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8aa34028]
    22:41:47.406 Scan finished successfully
    22:42:04.328 Disk 0 MBR has been saved successfully to "B:\Documents and Settings\Default User\Desktop\MBR.dat"
    22:42:04.375 The log file has been saved successfully to "B:\Documents and Settings\Default User\Desktop\aswMBR.txt"
    22:43:30.890 Disk 0 MBR has been saved successfully to "B:\Documents and Settings\Default User\Desktop\MBR.dat"
    22:43:30.953 The log file has been saved successfully to "B:\Documents and Settings\Default User\Desktop\aswMBR.txt"
    ajross, Dec 24, 2011
    #18

  19. Broni Malware Annihilator

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
    Broni, Dec 24, 2011
    #19

  20. ajross Newcomer, in training

    Alright.

    I've run the program, and it scanned the system. Unfortunately, I again needed to do it from the boot disk. Though it found a rootkit, and successfully "cured" it.
    However, after it finished, it stated a restart was required. When I clicked restart, nothing happend, and I couldn't find a log. Am I just missing it? And whats next?
    ajross, Dec 24, 2011
    #20
Page 1 of 3