Hello I've been having some troubles.
Upon startup I have a Windows security popup that asks me if I wan't to allow hhsetupwow.exe to make changes to my hard drive. I of course say no but I think someone else using my laptop must have selected yes because things changed.
Now upon startup I still have the same popup, but my security center now gives me alerts about this heur trojan and scans reveal the same.
Of course guaranteeing does nothing.
I went to the 7 step page and tried following the instructions ran MBAM and DDS but the GMER mirrors refuse to work.
Oh and before I post the logs, after running the MBAM and removing the 100+ things found and restarting the problem SEEMS to have abated. Wondering if that means I'm safe or not. Also, I have the somewhat worthless CA security center..is there any free antivirus software I can run along with CA? Or is dual operation impossible?
Logs:
MBAM:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6972
Windows 6.1.7600
Internet Explorer 9.0.8112.16421
6/28/2011 9:11:10 PM
mbam-log-2011-06-28 (21-11-10).txt
Scan type: Quick scan
Objects scanned: 179496
Time elapsed: 5 minute(s), 21 second(s)
Memory Processes Infected: 58
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 63
Registry Data Items Infected: 1
Folders Infected: 3
Files Infected: 94
Memory Processes Infected:
c:\Windows\SysWOW64\iccvid32.exe (Trojan.Tracur.SGen) -> 3076 -> Unloaded process successfully.
c:\programdata\icmui32.exe (Trojan.Tracur.SGen) -> 3212 -> Unloaded process successfully.
c:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> 3264 -> Unloaded process successfully.
c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> 5240 -> Unloaded process successfully.
c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> 7828 -> Failed to unload process.
c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> 6684 -> Failed to unload process.
c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> 7472 -> Failed to unload process.
c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> 6760 -> Failed to unload process.
c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> 7480 -> Failed to unload process.
c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> 6780 -> Failed to unload process.
c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> 7488 -> Failed to unload process.
c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> 6924 -> Failed to unload process.
c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> 7496 -> Failed to unload process.
c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> 6936 -> Failed to unload process.
c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> 7504 -> Failed to unload process.
c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> 7008 -> Failed to unload process.
c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> 7580 -> Failed to unload process.
c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> 7060 -> Failed to unload process.
c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> 7684 -> Failed to unload process.
c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> 7068 -> Failed to unload process.
c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> 816 -> Failed to unload process.
c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> 7076 -> Failed to unload process.
c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> 7680 -> Failed to unload process.
c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> 7088 -> Failed to unload process.
c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> 7664 -> Failed to unload process.
c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> 7104 -> Failed to unload process.
c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> 7344 -> Failed to unload process.
c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> 7116 -> Failed to unload process.
c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> 6236 -> Failed to unload process.
c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> 7164 -> Failed to unload process.
c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> 4960 -> Failed to unload process.
c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> 6308 -> Failed to unload process.
c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> 7564 -> Failed to unload process.
c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> 6440 -> Failed to unload process.
c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> 5680 -> Failed to unload process.
c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> 6556 -> Failed to unload process.
c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> 4884 -> Failed to unload process.
c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> 6564 -> Failed to unload process.
c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> 5760 -> Failed to unload process.
c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> 5500 -> Failed to unload process.
c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> 2500 -> Failed to unload process.
c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> 6772 -> Failed to unload process.
c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> 4672 -> Failed to unload process.
c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> 5468 -> Failed to unload process.
c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> 6532 -> Failed to unload process.
c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> 6732 -> Failed to unload process.
c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> 4740 -> Failed to unload process.
c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> 6900 -> Failed to unload process.
c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> 5400 -> Failed to unload process.
c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> 6904 -> Failed to unload process.
c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> 6640 -> Failed to unload process.
c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> 6360 -> Failed to unload process.
c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> 4908 -> Failed to unload process.
c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> 7140 -> Failed to unload process.
c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> 4868 -> Failed to unload process.
c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> 7132 -> Failed to unload process.
c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> 1396 -> Failed to unload process.
c:\Users\James\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.SGen) -> 4392 -> Failed to unload process.
Memory Modules Infected:
c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient32 (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{29E5D1F9-08F3-47DA-83D7-DE2D215821Cf} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3d10warpwow.exe (Trojan.Tracur.S) -> Value: d3d10warpwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mciwavewow.exe (Trojan.Tracur.SGen) -> Value: mciwavewow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mciwavewow.exe (Trojan.Tracur.SGen) -> Value: mciwavewow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dimsjobwow.exe (Trojan.Tracur.SGen) -> Value: dimsjobwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dimsjobwow.exe (Trojan.Tracur.SGen) -> Value: dimsjobwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> Value: nlslexicons0046wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NlsLexicons0046wow.exe (Trojan.Tracur.SGen) -> Value: NlsLexicons0046wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msasn1wow.exe (Trojan.Tracur.SGen) -> Value: msasn1wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msasn1wow.exe (Trojan.Tracur.SGen) -> Value: msasn1wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrscmdwow.exe (Trojan.Tracur.SGen) -> Value: winrscmdwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrscmdwow.exe (Trojan.Tracur.SGen) -> Value: winrscmdwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rastapiwow.exe (Trojan.Tracur.SGen) -> Value: rastapiwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rastapiwow.exe (Trojan.Tracur.SGen) -> Value: rastapiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pstorecwow.exe (Trojan.Tracur.SGen) -> Value: pstorecwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pstorecwow.exe (Trojan.Tracur.SGen) -> Value: pstorecwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msoeacctwow.exe (Trojan.Tracur.SGen) -> Value: msoeacctwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msoeacctwow.exe (Trojan.Tracur.SGen) -> Value: msoeacctwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eappprxywow.exe (Trojan.Tracur.SGen) -> Value: eappprxywow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eappprxywow.exe (Trojan.Tracur.SGen) -> Value: eappprxywow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dskquotawow.exe (Trojan.Tracur.SGen) -> Value: dskquotawow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dskquotawow.exe (Trojan.Tracur.SGen) -> Value: dskquotawow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdroprwow.exe (Trojan.Tracur.SGen) -> Value: kbdroprwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDROPRwow.exe (Trojan.Tracur.SGen) -> Value: KBDROPRwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vbajet32wow.exe (Trojan.Tracur.SGen) -> Value: vbajet32wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vbajet32wow.exe (Trojan.Tracur.SGen) -> Value: vbajet32wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msxml3awow.exe (Trojan.Tracur.SGen) -> Value: msxml3awow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msxml3awow.exe (Trojan.Tracur.SGen) -> Value: msxml3awow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olecli32wow.exe (Trojan.Tracur.SGen) -> Value: olecli32wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olecli32wow.exe (Trojan.Tracur.SGen) -> Value: olecli32wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> Value: photometadatahandlerwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PhotoMetadataHandlerwow.exe (Trojan.Tracur.SGen) -> Value: PhotoMetadataHandlerwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dmrcwow.exe (Trojan.Tracur.SGen) -> Value: dmrcwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dmrcwow.exe (Trojan.Tracur.SGen) -> Value: dmrcwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3drampwow.exe (Trojan.Tracur.SGen) -> Value: d3drampwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3drampwow.exe (Trojan.Tracur.SGen) -> Value: d3drampwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\framedynwow.exe (Trojan.Tracur.SGen) -> Value: framedynwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\framedynwow.exe (Trojan.Tracur.SGen) -> Value: framedynwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfscliwow.exe (Trojan.Tracur.SGen) -> Value: dfscliwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfscliwow.exe (Trojan.Tracur.SGen) -> Value: dfscliwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bootvidwow.exe (Trojan.Tracur.SGen) -> Value: bootvidwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BOOTVIDwow.exe (Trojan.Tracur.SGen) -> Value: BOOTVIDwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scansettingwow.exe (Trojan.Tracur.SGen) -> Value: scansettingwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scansettingwow.exe (Trojan.Tracur.SGen) -> Value: scansettingwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msltus40wow.exe (Trojan.Tracur.SGen) -> Value: msltus40wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msltus40wow.exe (Trojan.Tracur.SGen) -> Value: msltus40wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscapiwow.exe (Trojan.Tracur.SGen) -> Value: wscapiwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscapiwow.exe (Trojan.Tracur.SGen) -> Value: wscapiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdinhinwow.exe (Trojan.Tracur.SGen) -> Value: kbdinhinwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDINHINwow.exe (Trojan.Tracur.SGen) -> Value: KBDINHINwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdlt1wow.exe (Trojan.Tracur.SGen) -> Value: kbdlt1wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDLT1wow.exe (Trojan.Tracur.SGen) -> Value: KBDLT1wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Value: d3dx9_31wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Value: d3dx9_31wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL (Trojan.Tracur.SGen) -> Value: RTHDBPL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhsetupwow.exe (Trojan.Tracur.SGen) -> Value: hhsetupwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deskadpwow.exe (Trojan.TracurW.Gen) -> Value: deskadpwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deskadpwow.exe (Trojan.TracurW.Gen) -> Value: deskadpwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SyncHostpswow.exe (Trojan.TracurW.Gen) -> Value: SyncHostpswow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\synchostpswow.exe (Trojan.TracurW.Gen) -> Value: synchostpswow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weruiwow.exe (Trojan.TracurW.Gen) -> Value: weruiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weruiwow.exe (Trojan.TracurW.Gen) -> Value: weruiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bitsprx4wow.exe (Trojan.TracurW.Gen) -> Value: bitsprx4wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audioengwow.exe (Trojan.TracurW.Gen) -> Value: audioengwow.exe -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur.SGen) -> Bad: (C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll) Good: () -> Quarantined and deleted successfully.
Folders Infected:
c:\programdata\175576591 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\Users\James\AppData\Roaming\SysWin (Trojan.Agent) -> Delete on reboot.
Files Infected:
c:\Windows\SysWOW64\iccvid32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\programdata\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Users\James\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\hhsetupwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\iccvid32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\584C.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\A416.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\deskadpwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\synchostpswow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\weruiwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\bitsprx4wow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\audioengwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i0.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i1.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i10.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i11.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i12.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i13.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i14.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i15.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i2.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i3.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i4.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i5.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i6.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i7.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i8.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i9.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt0.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt0.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt1.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt1.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt10.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt10.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt11.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt11.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt12.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt12.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt13.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt13.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt14.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt14.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt15.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt15.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt2.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt2.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt3.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt3.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt4.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt4.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt5.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt5.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt6.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt6.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt7.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt7.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt8.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt8.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt9.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt9.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
Attach.txt
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 6/11/2011 9:08:20 PM
System Uptime: 6/28/2011 8:33:39 PM (1 hours ago)
.
Motherboard: Dell Inc. | | 0XK6HV
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz | CPU | 2301/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 451 GiB total, 393.932 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: facap, FastAccess Video Capture
Device ID: ROOT\IMAGE\0000
Manufacturer: Sensible Vision
Name: facap, FastAccess Video Capture
PNP Device ID: ROOT\IMAGE\0000
Service: FACAP
.
Class GUID:
Description:
Device ID: ACPI\SMO8800\1
Manufacturer:
Name:
PNP Device ID: ACPI\SMO8800\1
Service:
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: HIPS Core Filter Driver
Device ID: ROOT\LEGACY_KMXFILTER\0000
Manufacturer:
Name: HIPS Core Filter Driver
PNP Device ID: ROOT\LEGACY_KMXFILTER\0000
Service: KmxFilter
.
==== System Restore Points ===================
.
RP50: 6/23/2011 9:47:39 PM - Windows 7 Service Pack 1
RP51: 6/24/2011 9:50:35 AM - Windows Update
RP52: 6/25/2011 10:14:26 AM - Windows Update
RP53: 6/27/2011 10:30:18 AM - Windows Update
RP54: 6/28/2011 7:04:03 PM - Restore Operation
RP55: 6/28/2011 7:14:16 PM - Windows Update
RP56: 6/28/2011 8:18:28 PM - Restore Operation
RP57: 6/28/2011 8:38:56 PM - Windows Update
RP58: 6/28/2011 8:41:03 PM - Windows Update
.
==== Installed Programs ======================
.
.
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.0)
Age of Mythology
Age of Mythology - The Titans Expansion
Apple Application Support
Apple Software Update
Ask Toolbar
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Bing Bar
Bing Bar Platform
CA Backup and Migration
CA Parental Controls
Centra Client
Conduit Engine
CyberLink PowerDVD 9.6
D3DX10
Dell MusicStage
Dell PhotoStage
Dell Stage
Dell VideoStage
DirectXInstallService
DNAMigrator
EasyBits GO
EMC 10 Content
FrostWire 4.21.8
Google Chrome
GoToAssist 8.0.0.514
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
Malwarebytes' Anti-Malware version 1.51.0.1200
Mesh Runtime
Messenger Companion
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft WSE 3.0 Runtime
mIRC
Mozilla Firefox 4.0.1 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML4 Parser
NVIDIA Stereoscopic 3D Driver
QuickTime
Realtek High Definition Audio Driver
Renesas Electronics USB 3.0 Host Controller Driver
Road Runner Toolbar
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio Easy CD and DVD Burning
Roxio Express Labeler 3
Roxio Update Manager
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Skype Toolbars
Skype™ 5.3
Sonic CinePlayer Decoder Pack
StickyNotes
The Sims Medieval
TWC Customer Controls
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR 4.01 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
6/28/2011 9:00:21 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user James-PC\UpdatusUser SID (S-1-5-21-1966946865-1856105359-1223038778-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/28/2011 8:48:26 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user James-PC\James SID (S-1-5-21-1966946865-1856105359-1223038778-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/28/2011 8:40:32 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2552343).
6/28/2011 8:39:57 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2547666).
6/28/2011 8:39:49 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2545698).
6/28/2011 8:35:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: KmxFilter RxFilter
6/28/2011 8:34:58 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the file specified.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache KmxAgent KmxFile KmxFilter NetBIOS NetBT nsiproxy Psched rdbss RxFilter spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 6:42:15 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the path specified.
6/28/2011 6:25:10 PM, Error: Service Control Manager [7034] - The NVIDIA Update Service Daemon service terminated unexpectedly. It has done this 1 time(s).
6/24/2011 9:46:45 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the WinSock Extention Manager service to connect.
6/24/2011 9:46:45 AM, Error: Service Control Manager [7000] - The WinSock Extention Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/24/2011 6:13:23 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the NVIDIA Update Service Daemon service to connect.
6/24/2011 6:13:23 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/23/2011 9:56:33 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/23/2011 9:46:00 PM, Error: Microsoft-Windows-Service Pack Installer [6] - The Service Pack cannot be installed when the computer is running on battery power.
6/23/2011 11:14:23 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63AA156-D534-4BAC-9BF1-55359CF5EC30} and APPID {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} to the user James-PC\UpdatusUser SID (S-1-5-21-1966946865-1856105359-1223038778-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/22/2011 9:06:52 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EvtEng service.
6/22/2011 5:03:02 PM, Error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
6/22/2011 12:16:32 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: RxFilter
6/22/2011 12:15:50 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x000000000000001c, 0x0000000000000002, 0x0000000000000001, 0xfffff8800187931a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062211-20732-01.
6/21/2011 9:06:16 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
6/21/2011 9:06:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
6/21/2011 9:06:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
6/21/2011 9:06:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
6/21/2011 9:06:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
6/21/2011 9:06:07 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/21/2011 9:05:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
6/21/2011 9:05:42 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache KmxAgent KmxCfg KmxFile KmxFilter KmxFw NetBIOS NetBT nsiproxy Psched rdbss RxFilter spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
6/21/2011 8:37:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WinExtManager with arguments "-Service" in order to run the server: {5F36DC27-B076-4D0C-BD8C-7AEE14022193}
6/21/2011 8:37:44 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
6/21/2011 8:36:49 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
6/21/2011 8:36:30 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache KmxAgent KmxCfg KmxFile KmxFilter KmxFw RxFilter spldr Wanarpv6
6/21/2011 2:12:44 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SeaPort service to connect.
6/21/2011 2:12:44 PM, Error: Service Control Manager [7000] - The SeaPort service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
.
==== End Of File ===========================
Upon startup I have a Windows security popup that asks me if I wan't to allow hhsetupwow.exe to make changes to my hard drive. I of course say no but I think someone else using my laptop must have selected yes because things changed.
Now upon startup I still have the same popup, but my security center now gives me alerts about this heur trojan and scans reveal the same.
Of course guaranteeing does nothing.
I went to the 7 step page and tried following the instructions ran MBAM and DDS but the GMER mirrors refuse to work.
Oh and before I post the logs, after running the MBAM and removing the 100+ things found and restarting the problem SEEMS to have abated. Wondering if that means I'm safe or not. Also, I have the somewhat worthless CA security center..is there any free antivirus software I can run along with CA? Or is dual operation impossible?
Logs:
MBAM:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6972
Windows 6.1.7600
Internet Explorer 9.0.8112.16421
6/28/2011 9:11:10 PM
mbam-log-2011-06-28 (21-11-10).txt
Scan type: Quick scan
Objects scanned: 179496
Time elapsed: 5 minute(s), 21 second(s)
Memory Processes Infected: 58
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 63
Registry Data Items Infected: 1
Folders Infected: 3
Files Infected: 94
Memory Processes Infected:
c:\Windows\SysWOW64\iccvid32.exe (Trojan.Tracur.SGen) -> 3076 -> Unloaded process successfully.
c:\programdata\icmui32.exe (Trojan.Tracur.SGen) -> 3212 -> Unloaded process successfully.
c:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> 3264 -> Unloaded process successfully.
c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> 5240 -> Unloaded process successfully.
c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> 7828 -> Failed to unload process.
c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> 6684 -> Failed to unload process.
c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> 7472 -> Failed to unload process.
c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> 6760 -> Failed to unload process.
c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> 7480 -> Failed to unload process.
c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> 6780 -> Failed to unload process.
c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> 7488 -> Failed to unload process.
c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> 6924 -> Failed to unload process.
c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> 7496 -> Failed to unload process.
c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> 6936 -> Failed to unload process.
c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> 7504 -> Failed to unload process.
c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> 7008 -> Failed to unload process.
c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> 7580 -> Failed to unload process.
c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> 7060 -> Failed to unload process.
c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> 7684 -> Failed to unload process.
c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> 7068 -> Failed to unload process.
c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> 816 -> Failed to unload process.
c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> 7076 -> Failed to unload process.
c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> 7680 -> Failed to unload process.
c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> 7088 -> Failed to unload process.
c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> 7664 -> Failed to unload process.
c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> 7104 -> Failed to unload process.
c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> 7344 -> Failed to unload process.
c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> 7116 -> Failed to unload process.
c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> 6236 -> Failed to unload process.
c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> 7164 -> Failed to unload process.
c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> 4960 -> Failed to unload process.
c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> 6308 -> Failed to unload process.
c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> 7564 -> Failed to unload process.
c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> 6440 -> Failed to unload process.
c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> 5680 -> Failed to unload process.
c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> 6556 -> Failed to unload process.
c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> 4884 -> Failed to unload process.
c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> 6564 -> Failed to unload process.
c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> 5760 -> Failed to unload process.
c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> 5500 -> Failed to unload process.
c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> 2500 -> Failed to unload process.
c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> 6772 -> Failed to unload process.
c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> 4672 -> Failed to unload process.
c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> 5468 -> Failed to unload process.
c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> 6532 -> Failed to unload process.
c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> 6732 -> Failed to unload process.
c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> 4740 -> Failed to unload process.
c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> 6900 -> Failed to unload process.
c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> 5400 -> Failed to unload process.
c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> 6904 -> Failed to unload process.
c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> 6640 -> Failed to unload process.
c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> 6360 -> Failed to unload process.
c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> 4908 -> Failed to unload process.
c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> 7140 -> Failed to unload process.
c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> 4868 -> Failed to unload process.
c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> 7132 -> Failed to unload process.
c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> 1396 -> Failed to unload process.
c:\Users\James\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.SGen) -> 4392 -> Failed to unload process.
Memory Modules Infected:
c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient32 (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{29E5D1F9-08F3-47DA-83D7-DE2D215821Cf} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{29E5D1F9-08F3-47DA-83D7-DE2D215821CF} (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3d10warpwow.exe (Trojan.Tracur.S) -> Value: d3d10warpwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mciwavewow.exe (Trojan.Tracur.SGen) -> Value: mciwavewow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mciwavewow.exe (Trojan.Tracur.SGen) -> Value: mciwavewow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dimsjobwow.exe (Trojan.Tracur.SGen) -> Value: dimsjobwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dimsjobwow.exe (Trojan.Tracur.SGen) -> Value: dimsjobwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> Value: nlslexicons0046wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NlsLexicons0046wow.exe (Trojan.Tracur.SGen) -> Value: NlsLexicons0046wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msasn1wow.exe (Trojan.Tracur.SGen) -> Value: msasn1wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msasn1wow.exe (Trojan.Tracur.SGen) -> Value: msasn1wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrscmdwow.exe (Trojan.Tracur.SGen) -> Value: winrscmdwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrscmdwow.exe (Trojan.Tracur.SGen) -> Value: winrscmdwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rastapiwow.exe (Trojan.Tracur.SGen) -> Value: rastapiwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rastapiwow.exe (Trojan.Tracur.SGen) -> Value: rastapiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pstorecwow.exe (Trojan.Tracur.SGen) -> Value: pstorecwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pstorecwow.exe (Trojan.Tracur.SGen) -> Value: pstorecwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msoeacctwow.exe (Trojan.Tracur.SGen) -> Value: msoeacctwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msoeacctwow.exe (Trojan.Tracur.SGen) -> Value: msoeacctwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eappprxywow.exe (Trojan.Tracur.SGen) -> Value: eappprxywow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eappprxywow.exe (Trojan.Tracur.SGen) -> Value: eappprxywow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dskquotawow.exe (Trojan.Tracur.SGen) -> Value: dskquotawow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dskquotawow.exe (Trojan.Tracur.SGen) -> Value: dskquotawow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdroprwow.exe (Trojan.Tracur.SGen) -> Value: kbdroprwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDROPRwow.exe (Trojan.Tracur.SGen) -> Value: KBDROPRwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vbajet32wow.exe (Trojan.Tracur.SGen) -> Value: vbajet32wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vbajet32wow.exe (Trojan.Tracur.SGen) -> Value: vbajet32wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msxml3awow.exe (Trojan.Tracur.SGen) -> Value: msxml3awow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msxml3awow.exe (Trojan.Tracur.SGen) -> Value: msxml3awow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olecli32wow.exe (Trojan.Tracur.SGen) -> Value: olecli32wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olecli32wow.exe (Trojan.Tracur.SGen) -> Value: olecli32wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> Value: photometadatahandlerwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PhotoMetadataHandlerwow.exe (Trojan.Tracur.SGen) -> Value: PhotoMetadataHandlerwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dmrcwow.exe (Trojan.Tracur.SGen) -> Value: dmrcwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dmrcwow.exe (Trojan.Tracur.SGen) -> Value: dmrcwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3drampwow.exe (Trojan.Tracur.SGen) -> Value: d3drampwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3drampwow.exe (Trojan.Tracur.SGen) -> Value: d3drampwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\framedynwow.exe (Trojan.Tracur.SGen) -> Value: framedynwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\framedynwow.exe (Trojan.Tracur.SGen) -> Value: framedynwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfscliwow.exe (Trojan.Tracur.SGen) -> Value: dfscliwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfscliwow.exe (Trojan.Tracur.SGen) -> Value: dfscliwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bootvidwow.exe (Trojan.Tracur.SGen) -> Value: bootvidwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BOOTVIDwow.exe (Trojan.Tracur.SGen) -> Value: BOOTVIDwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scansettingwow.exe (Trojan.Tracur.SGen) -> Value: scansettingwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scansettingwow.exe (Trojan.Tracur.SGen) -> Value: scansettingwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msltus40wow.exe (Trojan.Tracur.SGen) -> Value: msltus40wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msltus40wow.exe (Trojan.Tracur.SGen) -> Value: msltus40wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscapiwow.exe (Trojan.Tracur.SGen) -> Value: wscapiwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscapiwow.exe (Trojan.Tracur.SGen) -> Value: wscapiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdinhinwow.exe (Trojan.Tracur.SGen) -> Value: kbdinhinwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDINHINwow.exe (Trojan.Tracur.SGen) -> Value: KBDINHINwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbdlt1wow.exe (Trojan.Tracur.SGen) -> Value: kbdlt1wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KBDLT1wow.exe (Trojan.Tracur.SGen) -> Value: KBDLT1wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Value: d3dx9_31wow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Value: d3dx9_31wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL (Trojan.Tracur.SGen) -> Value: RTHDBPL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhsetupwow.exe (Trojan.Tracur.SGen) -> Value: hhsetupwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deskadpwow.exe (Trojan.TracurW.Gen) -> Value: deskadpwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deskadpwow.exe (Trojan.TracurW.Gen) -> Value: deskadpwow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SyncHostpswow.exe (Trojan.TracurW.Gen) -> Value: SyncHostpswow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\synchostpswow.exe (Trojan.TracurW.Gen) -> Value: synchostpswow.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weruiwow.exe (Trojan.TracurW.Gen) -> Value: weruiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weruiwow.exe (Trojan.TracurW.Gen) -> Value: weruiwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bitsprx4wow.exe (Trojan.TracurW.Gen) -> Value: bitsprx4wow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audioengwow.exe (Trojan.TracurW.Gen) -> Value: audioengwow.exe -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur.SGen) -> Bad: (C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll) Good: () -> Quarantined and deleted successfully.
Folders Infected:
c:\programdata\175576591 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\Users\James\AppData\Roaming\SysWin (Trojan.Agent) -> Delete on reboot.
Files Infected:
c:\Windows\SysWOW64\iccvid32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\programdata\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\d3d10warpwow.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\mciwavewow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dimsjobwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\nlslexicons0046wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msasn1wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\winrscmdwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\rastapiwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\pstorecwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msoeacctwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\eappprxywow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dskquotawow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\kbdroprwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\vbajet32wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msxml3awow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\olecli32wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\photometadatahandlerwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dmrcwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\d3drampwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\framedynwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\dfscliwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\bootvidwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\scansettingwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\msltus40wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\wscapiwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\kbdinhinwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\kbdlt1wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\d3dx9_31wow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Users\James\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\hhsetupwow.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\iccvid32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\20D8.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\584C.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\A416.tmp (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\System32\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\icmui32.exe (Trojan.Tracur.SGen) -> Quarantined and deleted successfully.
c:\Windows\deskadpwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\synchostpswow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\weruiwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\bitsprx4wow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\Windows\audioengwow.exe (Trojan.TracurW.Gen) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i0.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i1.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i10.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i11.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i12.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i13.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i14.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i15.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i2.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i3.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i4.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i5.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i6.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i7.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i8.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\175576591\new.i9.kwd (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt0.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt0.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt1.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt1.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt10.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt10.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt11.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt11.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt12.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt12.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt13.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt13.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt14.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt14.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt15.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt15.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt2.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt2.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt3.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt3.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt4.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt4.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt5.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt5.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt6.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt6.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt7.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt7.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt8.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt8.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt9.rar (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\669181175\frt9.rar.ver (Rogue.Multiple) -> Quarantined and deleted successfully.
Attach.txt
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 6/11/2011 9:08:20 PM
System Uptime: 6/28/2011 8:33:39 PM (1 hours ago)
.
Motherboard: Dell Inc. | | 0XK6HV
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz | CPU | 2301/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 451 GiB total, 393.932 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: facap, FastAccess Video Capture
Device ID: ROOT\IMAGE\0000
Manufacturer: Sensible Vision
Name: facap, FastAccess Video Capture
PNP Device ID: ROOT\IMAGE\0000
Service: FACAP
.
Class GUID:
Description:
Device ID: ACPI\SMO8800\1
Manufacturer:
Name:
PNP Device ID: ACPI\SMO8800\1
Service:
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: HIPS Core Filter Driver
Device ID: ROOT\LEGACY_KMXFILTER\0000
Manufacturer:
Name: HIPS Core Filter Driver
PNP Device ID: ROOT\LEGACY_KMXFILTER\0000
Service: KmxFilter
.
==== System Restore Points ===================
.
RP50: 6/23/2011 9:47:39 PM - Windows 7 Service Pack 1
RP51: 6/24/2011 9:50:35 AM - Windows Update
RP52: 6/25/2011 10:14:26 AM - Windows Update
RP53: 6/27/2011 10:30:18 AM - Windows Update
RP54: 6/28/2011 7:04:03 PM - Restore Operation
RP55: 6/28/2011 7:14:16 PM - Windows Update
RP56: 6/28/2011 8:18:28 PM - Restore Operation
RP57: 6/28/2011 8:38:56 PM - Windows Update
RP58: 6/28/2011 8:41:03 PM - Windows Update
.
==== Installed Programs ======================
.
.
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.0)
Age of Mythology
Age of Mythology - The Titans Expansion
Apple Application Support
Apple Software Update
Ask Toolbar
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Bing Bar
Bing Bar Platform
CA Backup and Migration
CA Parental Controls
Centra Client
Conduit Engine
CyberLink PowerDVD 9.6
D3DX10
Dell MusicStage
Dell PhotoStage
Dell Stage
Dell VideoStage
DirectXInstallService
DNAMigrator
EasyBits GO
EMC 10 Content
FrostWire 4.21.8
Google Chrome
GoToAssist 8.0.0.514
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
Malwarebytes' Anti-Malware version 1.51.0.1200
Mesh Runtime
Messenger Companion
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft WSE 3.0 Runtime
mIRC
Mozilla Firefox 4.0.1 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML4 Parser
NVIDIA Stereoscopic 3D Driver
QuickTime
Realtek High Definition Audio Driver
Renesas Electronics USB 3.0 Host Controller Driver
Road Runner Toolbar
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio Easy CD and DVD Burning
Roxio Express Labeler 3
Roxio Update Manager
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Skype Toolbars
Skype™ 5.3
Sonic CinePlayer Decoder Pack
StickyNotes
The Sims Medieval
TWC Customer Controls
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR 4.01 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
6/28/2011 9:00:21 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user James-PC\UpdatusUser SID (S-1-5-21-1966946865-1856105359-1223038778-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/28/2011 8:48:26 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user James-PC\James SID (S-1-5-21-1966946865-1856105359-1223038778-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/28/2011 8:40:32 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2552343).
6/28/2011 8:39:57 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2547666).
6/28/2011 8:39:49 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 for x64-based Systems (KB2545698).
6/28/2011 8:35:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: KmxFilter RxFilter
6/28/2011 8:34:58 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the file specified.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache KmxAgent KmxFile KmxFilter NetBIOS NetBT nsiproxy Psched rdbss RxFilter spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 8:11:39 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/28/2011 6:42:15 PM, Error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the path specified.
6/28/2011 6:25:10 PM, Error: Service Control Manager [7034] - The NVIDIA Update Service Daemon service terminated unexpectedly. It has done this 1 time(s).
6/24/2011 9:46:45 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the WinSock Extention Manager service to connect.
6/24/2011 9:46:45 AM, Error: Service Control Manager [7000] - The WinSock Extention Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/24/2011 6:13:23 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the NVIDIA Update Service Daemon service to connect.
6/24/2011 6:13:23 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/23/2011 9:56:33 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} and APPID {D3D96827-F7A7-4C54-A65F-EDC42D9EBB5E} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/23/2011 9:46:00 PM, Error: Microsoft-Windows-Service Pack Installer [6] - The Service Pack cannot be installed when the computer is running on battery power.
6/23/2011 11:14:23 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {D63AA156-D534-4BAC-9BF1-55359CF5EC30} and APPID {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} to the user James-PC\UpdatusUser SID (S-1-5-21-1966946865-1856105359-1223038778-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/22/2011 9:06:52 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the EvtEng service.
6/22/2011 5:03:02 PM, Error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
6/22/2011 12:16:32 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: RxFilter
6/22/2011 12:15:50 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x000000000000001c, 0x0000000000000002, 0x0000000000000001, 0xfffff8800187931a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062211-20732-01.
6/21/2011 9:06:16 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
6/21/2011 9:06:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
6/21/2011 9:06:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
6/21/2011 9:06:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
6/21/2011 9:06:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
6/21/2011 9:06:07 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/21/2011 9:05:59 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
6/21/2011 9:05:42 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache KmxAgent KmxCfg KmxFile KmxFilter KmxFw NetBIOS NetBT nsiproxy Psched rdbss RxFilter spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
6/21/2011 8:37:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WinExtManager with arguments "-Service" in order to run the server: {5F36DC27-B076-4D0C-BD8C-7AEE14022193}
6/21/2011 8:37:44 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
6/21/2011 8:36:49 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
6/21/2011 8:36:30 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache KmxAgent KmxCfg KmxFile KmxFilter KmxFw RxFilter spldr Wanarpv6
6/21/2011 2:12:44 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SeaPort service to connect.
6/21/2011 2:12:44 PM, Error: Service Control Manager [7000] - The SeaPort service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
.
==== End Of File ===========================