Solved SVCHOST.exe trojan causes physical memory dump and then wants to reinstall OS

[ajross]

Hello all,

So, I've run into a bit of a brick wall.
Several days ago, I was multitasking a few programs and deleting files and whatnot, having a good time. I was prompted with what I thought was just another "Java update" I needed to give permission to run. Normally I just click cancel, but I decided to just update and it would leave me alone. At the last second, I realized it wasn't java. Almost right after I clicked okay, my computer shut off, and then went to a BSOD, and turned back on. It was so slow that my internet window wasn't following my mouse when I'd drag it across the screen.
Now, I did a full scan with malware-bytes, found the virus (svchost.exe), and deleted it and then rebooted... It seemed to do the trick. Until the next morning when I tried to play my new game: Skyrim. It lagged like you'd not believe. I ran the scan again in safe mode, this time finding svchost.exe as well as 10 other viruses with the same name. Again, like last time, deleted them and then rebooted. It was running like a charm. Tonight, when I turned it on after moving it back from my girlfriend's house, it went to a BSOD stating it was running a physical memory dump. After this completed, it now wants to reinstall the OS!?

Does this mean that the computer I'm using is now going to lose all of its data and be overcome by the virus after OS reinstall? I looked all over the net with no help whatsoever.

I have a Dell Windows 7, 64-bit desktop. I've not had any issues with this computer previously, and this is the first time I've dealt with an issue this big. I'm freaking out.

I'd like to know specifically if I can save my data, if I'm going to need to reinstall the OS completely, and whether or not this is an issue that will need to be fixed physically. (Such as the hardware inside the system.)
Thanks in advance,
-Aaron

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================================================

Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

• When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
• Reboot your system using the boot CD you just created.
  • Note : If you do not know how to set your computer to boot from CD follow the steps HERE
• Your system should now display a REATOGO-X-PE desktop.
• Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
• Double-click on the OTLPE icon.
• When asked Do you wish to load the remote registry, select Yes
• When asked Do you wish to load remote user profile(s) for scanning, select Yes
• Ensure the box Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

 

[ajross]

Okay, thank you. I'm downloading the file as we speak; I'll have the information from the text file as some point this evening.

I've messed with it a bit since the incident and I can use the computer now; but only in Safe Mode. Booting normally results a BSOD and restart.

A.

 

[Broni]

If you can boot to safe mode....

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.
Complete as many steps as you can.

 

[ajross]

Alright, so I've managed to get the disk in and working properly, but it failed to run the scan you said to use in your first set of instructions.

However, I have used, and am currently using malwarebytes to find viruses.
Everytime I scan, I come up with the same, stinking one; svchost.exe.

I was trying to make a backup, but it was apparently copied over to the hard drive... Now what? Please tell me how I can rid of this stupid thing; I'm going to format anyhow, I just need a backup that is virus free!

I'll try running some of the other scans, though. What do you want me to run scans on? The hard drive I'm using as a back up, or the main drive C, or both?

 

[Broni]

Follow my previous reply.

Complete as many steps as you can.

 

[ajross]

Malwarebytes log:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8382

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

12/19/2011 10:36:55 PM
mbam-log-2011-12-19 (22-36-55).txt

Scan type: Quick scan
Objects scanned: 184249
Time elapsed: 3 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

 

[ajross]

Gmer log:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-12-19 22:31:41
Windows 6.1.7601 Service Pack 1
Running: gmer.exe


---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows Live\Companion\ajross@hotmail.com@0e29dbe20f07eec3cc21ac9400c93b57\r\n 0x7E 0xB1 0xE4 0x17 ...

---- EOF - GMER 1.0.15 ----

 

[ajross]

DDS log:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514
Run by Aaron Ross at 22:41:20 on 2011-12-19
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12279.9892 [GMT -5:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\atieclxx.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\system32\mfevtps.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
C:\Windows\PLF1330.exe
C:\Windows\vspc1330.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
C:\Program Files (x86)\Steam\steam.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\mcafee.com\agent\mcagent.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\DllHost.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
-netsvcs
-netsvcs
-netsvcs
-netsvcs
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.facebook.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111112061611.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5825.1100\swg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
uRun: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
uRun: [Google Update] "C:\Users\Aaron Ross\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10x_ActiveX.exe -update activex
mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [CarboniteSetupLite] "C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
mRun: [MaxMenuMgr] "C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
mRun: [SPC1330] C:\Windows\vspc1330.exe
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
mRunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
mRunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
StartupFolder: C:\Users\AARONR~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\YAHOO!~1.LNK - C:\Program Files (x86)\Yahoo!\Widgets\YahooWidgets.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/mjss/MJSS.cab109791.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
TCP: DhcpNameServer = 71.252.0.12 71.242.0.12 192.168.1.1
TCP: Interfaces\{EF2A45E9-F44F-4C78-9508-7EAA07F87FC7} : DhcpNameServer = 71.252.0.12 71.242.0.12 192.168.1.1
TCP: Interfaces\{EF2A45E9-F44F-4C78-9508-7EAA07F87FC7}\C696E6B6379737F5355435F53313935313 : DhcpNameServer = 71.252.0.12 71.242.0.12
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\msc\McSnIePl.dll
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111112061611.dll
BHO-X64: scriptproxy - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5825.1100\swg.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" /r
mRun-x64: [UpdReg] C:\Windows\UpdReg.EXE
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun-x64: [(Default)]
mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun-x64: [CarboniteSetupLite] "C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
mRun-x64: [MaxMenuMgr] "C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
mRun-x64: [SPC1330] C:\Windows\vspc1330.exe
mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
mRunOnce-x64: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
mRunOnce-x64: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 FreeAgentGoNext Service;Seagate Service;C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe [2009-12-18 189736]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-2-19 13336]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-3-2 366152]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2011-2-19 199272]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2011-2-19 208536]
R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-2-19 689472]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2010-7-30 25072]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-9-4 219632]
S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-2-19 220528]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 phaudlwr;Philips Audio Filter;C:\Windows\system32\DRIVERS\phaudlwr.sys --> C:\Windows\system32\DRIVERS\phaudlwr.sys [?]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-9-4 1116656]
S3 SPC1330;USB2.0 PC Camera (SPC1330);C:\Windows\system32\DRIVERS\spc1330.sys --> C:\Windows\system32\DRIVERS\spc1330.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2011-10-24 249936]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-12-19 23:49:39 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{716BF4DD-C949-4A8D-A472-185F948C0F0D}
2011-12-19 23:49:16 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{2A4497C1-E830-474E-91C7-63BC1EDA3C69}
2011-12-18 14:37:24 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{57E9318E-3240-4435-896A-84EB8D9E2F87}
2011-12-18 04:36:41 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{7319A5BD-0833-4EB3-A4D2-60A37CCB8543}
2011-12-18 04:36:16 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{A74FAF9D-1FB8-4D41-9CD9-B310ABA32212}
2011-12-17 03:23:47 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{26E89422-35B7-44AF-9D7B-1782B5A8C27B}
2011-12-17 03:23:33 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{87B7F786-2C84-4637-B46E-321CEF18EBE1}
2011-12-16 13:28:42 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
2011-12-16 13:07:59 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2011-12-16 13:07:59 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-12-16 13:07:40 3145216 ----a-w- C:\Windows\System32\win32k.sys
2011-12-16 13:07:36 723456 ----a-w- C:\Windows\System32\EncDec.dll
2011-12-16 13:07:36 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2011-12-16 13:07:28 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2011-12-16 12:45:29 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{DF8755D9-9D41-4251-B9AC-770926ED97FA}
2011-12-16 12:44:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{204E13CB-DF52-48AE-94D9-013EED14B739}
2011-12-16 12:41:41 20480 ------w- C:\Windows\svchost.exe
2011-12-16 05:06:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{815D3EFC-6261-4723-A7C6-9270CCF86DE5}
2011-12-16 05:06:34 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{37BB5F2F-309E-44BE-9B58-CBF6FD5C8EF4}
2011-12-15 00:08:05 -------- d-----w- C:\Program Files (x86)\EASEUS
2011-12-14 23:32:44 -------- d-----w- C:\Program Files (x86)\Passware
2011-12-13 22:51:39 -------- d-----w- C:\Log
2011-12-13 22:51:25 -------- d-----w- C:\Program Files (x86)\Stellar Phoenix Windows Data Recovery
2011-12-13 05:01:03 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{E978D518-E25F-43DD-BE18-5A5519A4EF7F}
2011-12-13 05:00:52 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{5E747CED-EA27-4C72-A863-E9190BB9D4F9}
2011-12-12 17:00:37 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{C7A26270-F531-49E8-8441-2A8FFBABB6AA}
2011-12-12 17:00:26 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{7A3B1A57-AF42-4478-B062-380F0C3C529A}
2011-12-12 01:51:56 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{02439AB9-D373-45BD-B539-1A1887FD6F30}
2011-12-12 01:51:45 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{E636ECFF-EBA8-49E8-A362-F08ED59BE4B4}
2011-12-10 17:34:15 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{A15EB08F-EC5C-4DDA-8FC5-1DC01B72B47A}
2011-12-10 17:33:58 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{5387E63A-CCA7-4E17-A068-EBBDF398BB11}
2011-12-09 14:55:25 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\WB Games
2011-12-09 14:47:02 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{83249385-F1CB-47B9-9444-EFEDF6AA10D5}
2011-12-09 14:46:51 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{477F4219-42C2-45CC-8A78-D9F1956C0086}
2011-12-09 10:51:33 -------- d-----w- C:\Program Files (x86)\The Lord of the Rings - War in the North
2011-12-09 01:01:34 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{5F6ED367-36F5-49FE-8D30-EEF3C39B97E5}
2011-12-09 01:01:23 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{4077CA25-ED6A-4520-8910-55B47D346B60}
2011-12-08 13:01:10 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{DB982D8E-0852-4371-AFCC-9700374EA63E}
2011-12-08 13:00:59 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{1E8A1BDD-2142-45CE-BCD9-D73582AC042E}
2011-12-08 01:00:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{FF32EC4C-B788-4E3B-8F15-271DB37258C8}
2011-12-08 01:00:33 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{79922A80-B92C-4204-8516-B4E42B77AA21}
2011-12-06 05:01:39 -------- d-----w- C:\Program Files (x86)\Yontoo
2011-12-06 05:01:35 -------- d-----w- C:\ProgramData\Tarma Installer
2011-12-06 00:36:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\dxhr
2011-12-06 00:35:19 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\28050
2011-12-05 21:26:33 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{C1ED5646-6DA3-4BE3-B380-64BF975DC12D}
2011-12-05 21:26:17 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{749F9282-9B51-42D6-9F81-126E0257A78A}
2011-12-05 04:13:11 -------- d-----w- C:\Program Files (x86)\LIMBO
2011-12-04 23:15:57 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{9FD68727-0EB3-47F4-931D-3CB96D9B846D}
2011-12-04 23:15:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{4F592D35-CD1D-4261-B851-E043E6319764}
2011-12-03 15:53:47 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{45BCA740-CEA1-441D-9D20-E22FCFA8ED3F}
2011-12-03 15:53:36 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{25D14A3D-CEDB-4E58-AE10-59B9101ECF31}
2011-12-02 13:56:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{C6DC4EC3-1EA3-41B2-BE6F-D8FE3B6A244E}
2011-12-02 13:56:44 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{CF4FFCF2-1A2C-4D06-AE19-E6F4F47F7E7E}
2011-12-02 01:56:31 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{AD1ADC70-9835-4819-BCD7-17A1E466C2EF}
2011-12-02 01:56:19 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{268FA93E-8478-4C4F-8952-B33288C650B3}
2011-11-28 21:54:05 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{456F7FE2-83C0-4C94-B1AE-07E034696E87}
2011-11-28 21:53:46 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{ADAF9690-EA8D-4E0C-AE55-C40C08D7D454}
2011-11-27 18:30:03 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{6B808D02-1C09-4FF7-8EE1-EE40BFF7B9E1}
2011-11-27 18:29:48 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{F5094410-6D11-456F-8D96-455B48EB3150}
2011-11-26 06:17:17 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{51731400-B673-4205-A201-ABD3725AAFF9}
2011-11-26 06:17:06 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{2ADE73D4-A286-4CC2-88D5-4E2EA5C85BDB}
2011-11-25 18:16:38 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{63724F07-BAE1-43D9-AC3B-E3C5BE4639AC}
2011-11-25 18:16:27 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{9966867C-9AB2-455B-B4B3-A0AD5A24D0FF}
2011-11-24 22:11:13 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{BB38253F-0566-47D3-A371-5FC922012F06}
2011-11-24 22:11:02 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{F770DF39-1769-4892-97FC-455F080BAC49}
2011-11-22 01:50:48 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{6505ABCD-18BE-47D5-84F8-D1EF6B566C99}
2011-11-22 01:50:37 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{7A80D333-BB40-41B8-9A49-359EB391E04B}
2011-11-21 13:50:25 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{76DAB8FA-D5A0-4D56-83C3-6A5E70AB5D49}
2011-11-21 13:50:14 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{D385EAD0-EC32-4CD6-8E1B-0EA5491A9C5D}
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2011-11-21 13:34:56 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2011-11-21 13:29:05 -------- d-----w- C:\Program Files\iPod
2011-11-21 13:29:04 -------- d-----w- C:\Program Files\iTunes
2011-11-20 20:28:36 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\Google
2011-11-20 20:28:23 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\Deployment
2011-11-20 20:28:23 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\Apps
2011-11-20 20:21:06 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{6368B6CB-E8D2-46B1-86B4-E6A88721097E}
2011-11-20 20:20:55 -------- d-----w- C:\Users\Aaron Ross\AppData\Local\{990FEB0F-65E1-4FC8-94B1-3C2E28E7D686}
.
==================== Find3M ====================
.
2011-11-05 05:41:43 1188864 ----a-w- C:\Windows\System32\wininet.dll
2011-11-05 04:35:00 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-11-05 03:32:47 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-11-05 02:48:51 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-10-24 19:29:02 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2011-10-24 19:29:02 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
2011-10-18 19:32:28 161168 ----a-w- C:\Windows\System32\mfevtps.exe
2011-10-15 18:16:16 75808 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys
2011-10-15 18:16:16 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys
2011-10-15 18:16:16 647080 ----a-w- C:\Windows\System32\drivers\mfehidk.sys
2011-10-15 18:16:16 481768 ----a-w- C:\Windows\System32\drivers\mfefirek.sys
2011-10-15 18:16:16 284648 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys
2011-10-15 18:16:16 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys
2011-10-15 18:16:16 160280 ----a-w- C:\Windows\System32\drivers\mfeapfk.sys
2011-10-15 18:16:16 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
2011-10-15 18:16:16 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys
2011-09-29 16:29:28 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-09-23 18:58:47 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
.
============= FINISH: 22:46:49.78 ===============

 

[ajross]

Attach log:


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 2/23/2011 2:38:18 PM
System Uptime: 12/19/2011 6:47:20 PM (4 hours ago)
.
Motherboard: Dell Inc. | | 05DN3X
Processor: Intel(R) Core(TM) i7 CPU 960 @ 3.20GHz | CPU 1 | 3201/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 919 GiB total, 593.41 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 298 GiB total, 213.276 GiB free.
F: is Removable
Y: is FIXED (NTFS) - 12 GiB total, 5.522 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart Plus B209a-m
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart Plus B209a-m
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
==== System Restore Points ===================
.
RP150: 12/13/2011 9:18:22 PM - Removed Skype™ 5.3
RP151: 12/15/2011 9:50:13 AM - Installed Dell Stage
RP152: 12/16/2011 12:22:39 AM - Installed Java(TM) 6 Update 30
RP153: 12/16/2011 3:00:15 AM - Windows Update
RP154: 12/16/2011 7:36:23 AM - Restore Operation
RP155: 12/16/2011 8:27:15 AM - Windows Update
RP156: 12/16/2011 9:03:12 PM - Windows Update
RP157: 12/16/2011 10:54:33 PM - Installed Dell MusicStage
RP158: 12/16/2011 11:29:09 PM - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1.2
Adobe Shockwave Player 11.6
Age of Empires III
Apple Application Support
Apple Software Update
ArcSoft WebCam Companion 2
Assassins Creed Brotherhood version 1.0
ATI Catalyst Control Center
Audacity 1.2.6
B209a-m
BufferChm
Carbonite Online Backup Setup
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Combat Arms
Consumer In-Home Service Agreement
Crysis® 2
D3DX10
DAEMON Tools Lite
Dead Space™ 2
Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell Getting Started Guide
Dell MusicStage
Dell PhotoStage
Dell Stage
Dell VideoStage
Destinations
Deus Ex: Human Revolution
DeviceDiscovery
DirectX 9 Runtime
Doom 3
EasyBits GO
eBay
Excel Key 8.1 Demo
Fallout 3
FINAL FANTASY XIV
Gates of Andaron 3.4.1
Google Chrome
Google Updater
GoToAssist 8.0.0.514
GPBaseService2
Guild Wars
HP Update
HPPhotoGadget
hpPrintProjects
HPProductAssistant
HPSSupply
hpWLPGInstaller
Intel(R) Control Center
Intel(R) Rapid Storage Technology
Internet Explorer
J2SE Runtime Environment 5.0 Update 2
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
Korean Fonts Support For Adobe Reader 9
Magicka
Malwarebytes' Anti-Malware version 1.51.2.1300
MapleStory
MarketResearch
McAfee SecurityCenter
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 1.1
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nexon Game Manager
Oblivion
Pando Media Booster
Philips Intelligent Agent
Philips SPC1330NC Webcam
PhotoShowExpress
PS_AIO_06_B209a-m_SW_Min
QuickTime
Realtek High Definition Audio Driver
Remotebook SideShow Gadget
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Creator Starter
Roxio Express Labeler 3
Scan
Seagate Manager Installer
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553353) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Skins
Skype™ 5.3
SmartWebPrinting
SolutionCenter
Sonic CinePlayer Decoder Pack
Status
Steam
swMSM
The Elder Scrolls V: Skyrim
The Lord of the Rings Online™ v03.02.05.8032
THX TruStudio PC
Toolbox
TrayApp
TrustedID
uCeritify M77-605 - MCAS: Using Microsoft Office Access 2007
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553455) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition
Update for Microsoft Outlook Social Connector (KB2583935)
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows SideShow Managed Runtime 1.0
Yahoo! Detect
Yahoo! Install Manager
Yahoo! Toolbar
Yahoo! Widgets
YouTube Downloader 2.7.4
.
==== Event Viewer Messages From Past Week ========
.
12/19/2011 7:54:53 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
12/19/2011 6:49:24 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
12/18/2011 9:41:11 AM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
12/18/2011 9:39:39 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
12/18/2011 9:39:11 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6
12/18/2011 9:38:59 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001, 0xfffff800034fbab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121811-20248-01.
12/18/2011 9:36:05 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0x000000000001053a, 0xfffff8800e29aa68, 0xfffff8800e29a2c0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121811-21200-01.
12/16/2011 9:28:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
12/16/2011 9:28:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
12/16/2011 9:25:20 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
12/16/2011 9:18:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/16/2011 9:18:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/16/2011 9:17:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
12/16/2011 9:17:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
12/16/2011 9:17:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/16/2011 9:17:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/16/2011 9:11:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}
12/16/2011 9:07:23 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache mfehidk mfenlfk NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Personal Firewall Service service depends on the Windows Firewall service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The McAfee Anti-Spam Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/16/2011 9:07:23 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/16/2011 8:02:56 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
12/16/2011 8:02:56 AM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/16/2011 7:45:43 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
12/16/2011 7:42:54 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..
12/16/2011 7:26:09 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800037d3a9a, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121611-18002-01.
12/16/2011 7:24:21 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Peer Networking Identity Manager service to connect.
12/16/2011 7:24:21 AM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Networking Identity Manager service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
12/16/2011 7:24:21 AM, Error: Service Control Manager [7001] - The Peer Name Resolution Protocol service depends on the Peer Networking Identity Manager service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
12/16/2011 7:24:21 AM, Error: Service Control Manager [7000] - The Peer Networking Identity Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/16/2011 12:06:53 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
12/16/2011 12:04:47 AM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
12/16/2011 10:21:27 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Cumulative Security Update for Internet Explorer 8 for Windows 7 for x64-based Systems (KB2618444).
12/16/2011 10:05:23 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
12/15/2011 5:17:00 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user AaronRoss-PC\Aaron Ross SID (S-1-5-21-1291757901-1728682472-3769939207-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
12/15/2011 5:17:00 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user AaronRoss-PC\Aaron Ross SID (S-1-5-21-1291757901-1728682472-3769939207-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
.
==== End Of File ===========================

 

[Broni]

I can see you ran everything in normal mode.
Good news
What are the current issues?

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan:


On completion of the scan click "Save log", save it to your desktop and post in your next reply:


NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

=============================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[ajross]

I've run across a major disappointment..
I was fine until I tried running ComboFix, but it was giving me errors. So I tried booting in safe mode; however, another issue occurred. It now will not run windows in normal mode, or safe mode. It simply starts up like normal, goes to the Windows home screen right before user log in, and stops mid-loading and goes to "windows repair". It finds several issues, and then tries to fix them. Unfortunately, the issues are not repaired and are failed because of an 0x0 error. After I tried doing this again, it then wanted me to reinstall windows 7 again like before.

I wanted to make sure that I could still operate the computer, so I tried booting from the boot up disk I made earlier in the forum. (Which by the way wouldn't let me do any scans because it said my thing wasn't windows 2000 or later or something.)
This bootup disk did work, so I imagine its the trojan that is causing all these errors?

 

[Broni]

While booted from the bootdisk can you operate computer normally.
Did you run aswMBR before Combofix?

 

[ajross]

As far as I know everything is working normally off of the boot disk.. I can't run the scanner though as stated in the previous reply.

And I did run the previous program's scan before using combofix.. Thinking back to it, however, I might have hit "fix" before hitting the close button...would that have made a difference in the way my computer has been behaving?

 

[Broni]

Can you run aswMBR?

 

[ajross]

I apologize for not getting to reply to this thread sooner...
I am using a clean computer and flash drive to download aswMBR to install and scan the infected one running on the boot disk. (It won't allow me to access my internet. I'm using a wireless connection.)

I am unable to use my Windows OS; I am running into the same problem as before...Looping "Windows fix" with fails and errors each time.

I'll post a new reply once I try out aswMBR on the infected computer; cross your fingers.

 

[Broni]

No problem

 

[ajross]

Alright...
Here is the log it gave me after I saved it to the desktop:

aswMBR version 0.9.9.1120 Copyright(c) 2011 AVAST Software
Run date: 2011-12-24 22:41:27
-----------------------------
22:41:27.421 OS Version: Windows 5.1.2600
22:41:27.421 Number of processors: 1 586 0x1A05
22:41:27.421 ComputerName: REATOGO UserName: SYSTEM
22:41:27.781 Initialze error 0
22:41:32.781 AVAST engine download error: 0
22:41:42.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:41:42.484 Disk 0 Vendor: ST310005 CC46 Size: 953869MB BusType: 3
22:41:42.531 Disk 0 MBR read successfully
22:41:42.562 Disk 0 MBR scan
22:41:42.609 Disk 0 TDL4@MBR code has been found
22:41:42.656 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
22:41:42.687 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 12542 MB offset 81920
22:41:42.734 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 941286 MB offset 25767936
22:41:42.781 Disk 0 MBR [TDL4] **ROOTKIT**
22:41:42.828 Disk 0 scanning X:\i386\system32\drivers
22:41:42.875 Service scanning
22:41:43.546 Modules scanning
22:41:46.859 Disk 0 trace - called modules:
22:41:47.031 ntoskrnl.exe CLASSPNP.SYS disk.sys iastor86.SY_ halaacpi.dll
22:41:47.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b0da030]
22:41:47.281 3 CLASSPNP.SYS[f74e805b] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8aa34028]
22:41:47.406 Scan finished successfully
22:42:04.328 Disk 0 MBR has been saved successfully to "B:\Documents and Settings\Default User\Desktop\MBR.dat"
22:42:04.375 The log file has been saved successfully to "B:\Documents and Settings\Default User\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1120 Copyright(c) 2011 AVAST Software
Run date: 2011-12-24 22:41:27
-----------------------------
22:41:27.421 OS Version: Windows 5.1.2600
22:41:27.421 Number of processors: 1 586 0x1A05
22:41:27.421 ComputerName: REATOGO UserName: SYSTEM
22:41:27.781 Initialze error 0
22:41:32.781 AVAST engine download error: 0
22:41:42.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:41:42.484 Disk 0 Vendor: ST310005 CC46 Size: 953869MB BusType: 3
22:41:42.531 Disk 0 MBR read successfully
22:41:42.562 Disk 0 MBR scan
22:41:42.609 Disk 0 TDL4@MBR code has been found
22:41:42.656 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
22:41:42.687 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 12542 MB offset 81920
22:41:42.734 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 941286 MB offset 25767936
22:41:42.781 Disk 0 MBR [TDL4] **ROOTKIT**
22:41:42.828 Disk 0 scanning X:\i386\system32\drivers
22:41:42.875 Service scanning
22:41:43.546 Modules scanning
22:41:46.859 Disk 0 trace - called modules:
22:41:47.031 ntoskrnl.exe CLASSPNP.SYS disk.sys iastor86.SY_ halaacpi.dll
22:41:47.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b0da030]
22:41:47.281 3 CLASSPNP.SYS[f74e805b] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8aa34028]
22:41:47.406 Scan finished successfully
22:42:04.328 Disk 0 MBR has been saved successfully to "B:\Documents and Settings\Default User\Desktop\MBR.dat"
22:42:04.375 The log file has been saved successfully to "B:\Documents and Settings\Default User\Desktop\aswMBR.txt"
22:43:30.890 Disk 0 MBR has been saved successfully to "B:\Documents and Settings\Default User\Desktop\MBR.dat"
22:43:30.953 The log file has been saved successfully to "B:\Documents and Settings\Default User\Desktop\aswMBR.txt"

 

[Broni]

Download TDSSKiller and save it to your desktop.

• Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
• If an infected file is detected, the default action will be Cure, click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

 

[ajross]

Alright.

I've run the program, and it scanned the system. Unfortunately, I again needed to do it from the boot disk. Though it found a rootkit, and successfully "cured" it.
However, after it finished, it stated a restart was required. When I clicked restart, nothing happend, and I couldn't find a log. Am I just missing it? And whats next?

 

[Broni]

OK, now we know little bit more about your issue.

Restart computer
When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.
If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.

You should get a black screen with a C:\> prompt. Type with an Enter after each line:

fixmbr

fixboot

exit

Attempt to boot normally.

 

[ajross]

I restarted the computer, however, I didn't get an option for "Recovery Console". On the main "start up" of windows, I could press f2 for setup options, or f12 to select a bootup device. I thought it might be in there, but I didn't see it. I just tried booting up normally, anyhow, and it worked. Should we move on, or should I go back and use command prompt?

 

[Broni]

Good news

Re-run TDSSKiller and post new log.

 

[ajross]

Awesome!
Rerunning TDSSKiller...

 

[Broni]

When done post fresh aswMBR log.