David Templeton
Posts: 35 +0
Hello,
I recently had some trouble with trojan and other viruses that I removed with Avira Free Anti-virus and Malware bytes Anti-Malware. However, I'm still having symptoms that I don't know how to fix and I need to get full functionality back as soon as I can (doesn't everyone
).
The current symptoms I currently see are not being able to access google calendar. I can get to and use gmail fine, but attempts to get to google calendar reports:
"Unable to connect
Firefox can't establish a connection to the server at www.google.com."
Also, I tried running WinSockFix to correct this and it seemed to fix this once, but then the symptoms returned a bit later.
I am unable to logoff successfully. After Vista's windowing system exits, I just get stuck on a blank black screen with the hard drive continuing to work off and on endlessly.
Just before this state, I had removed a few viruses with the aforementioned tools, but afterwards, I noticed something I hadn't encountered before. I kept having one of my instances of svchost.exe grow in memory usage from 300 MB to 1GB (eventually). Then the process would begin to use more and more CPU (up to 35-40 %). I would finally resort to killing that process using Task Manager. After doing this I would notice some oddities in graphics and windowing functionality for a minute or two, then after about 30 minutes to 1 hour, I'd run into the same/similar scenario with the replacement svchost.exe process.
I ran sfx /SCANNOW after running several more scans using the aforementioned tools, sometimes finding something, sometimes not. I had also previously run CCleaner tool (before all this). I no longer have noticed the svchost.exe symptoms since the last day or two (since running your tools GMER, DDS, etc.).
Before all these things, I had installed and been using Mumble (open source voice over IP tool). I still have trouble believing this was the cause of all this, but others that also used Mumble with me have had strange events occur on their machines as well. I eventually uninstalled that software and have just been trying to get my machine back to normal.
Thank you in advance for any and all help as I really need this machine to be back to normal ASAP, but I don't want to reinstall and reconfigure Windows and all applications all over again.
Here are the logs you require to begin (5 steps):
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.24.12
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
OWNER :: GIFTFROMGOD [administrator]
7/25/2012 8:59:55 AM
mbam-log-2012-07-25 (08-59-55).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 188019
Time elapsed: 10 minute(s), 20 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-07-25 15:28:43
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST932032 rev.0001
Running: xy5dleq6.exe; Driver: C:\Users\OWNER\AppData\Local\Temp\pxrcipow.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_33
Run by OWNER at 15:42:49 on 2012-07-25
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.936 [GMT -4:00]
.
AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\rundll32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\TODDSrv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Windows\Explorer.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com
uSearch Bar = Preserve
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No File
TB: {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No File
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Adobe] rundll32.exe "c:\users\owner\appdata\local\apps\adobe\zncvlw.dll",CreateInstance
uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ISW]
mRun: [ZoneAlarm] "c:\program files\checkpoint\zonealarm\zatray.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [Adobe] rundll32.exe "c:\users\owner\appdata\local\apps\adobe\zncvlw.dll",CreateInstance
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 10.0.1.1
TCP: Interfaces\{01832491-381F-49E0-A5A4-988DB319D2EF} : NameServer = 76.5.159.133,63.162.197.99
TCP: Interfaces\{6CD59901-EDA4-4072-A93D-9E5CAA909388} : DhcpNameServer = 10.0.1.1
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
LSA: Notification Packages = scecli psqlpwd
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\gnc54s2q.default-1342793624225\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/outdoors/agriculture/forecast/10-day/24210
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\users\owner\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\users\owner\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-7-19 36000]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-4-4 63928]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-7-19 86224]
R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-7-19 110032]
R2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe [2012-7-19 465360]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-7-19 83392]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-8-9 21504]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-7-9 27056]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-7-9 497320]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2012-1-16 95232]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-5-30 3048136]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2007-5-8 7168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-7 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 257696]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2011-6-2 11336]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 113120]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [2009-8-28 29824]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [2009-8-28 41344]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [2009-8-28 39936]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [2009-8-28 59776]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-07-24 07:27:10 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f07a55a0-0590-4dcf-b873-f2c1540c144f}\offreg.dll
2012-07-24 06:24:26 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f07a55a0-0590-4dcf-b873-f2c1540c144f}\mpengine.dll
2012-07-20 20:50:26 476976 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-07-20 13:01:20 499082 ----a-w- c:\program files\mozilla firefox\uninstall\uninstaller.exe
2012-07-20 12:53:35 -------- d-----w- c:\users\owner\appdata\roaming\CheckPoint
2012-07-20 12:47:07 -------- d-----w- C:\2dda44f8e50167a02f6c581e51e8
2012-07-20 12:45:29 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll
2012-07-20 12:45:24 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-07-20 04:54:52 -------- d-----w- c:\program files\CheckPoint
2012-07-20 04:53:45 -------- d-----w- c:\programdata\CheckPoint
2012-07-19 23:07:09 -------- d-----w- c:\users\owner\appdata\roaming\Avira
2012-07-19 22:56:55 -------- d-----w- c:\program files\Ask.com
2012-07-19 22:56:32 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-19 22:56:32 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-07-19 22:56:30 -------- d-----w- c:\programdata\Avira
2012-07-19 22:56:30 -------- d-----w- c:\program files\Avira
2012-07-17 04:45:19 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-07-16 12:30:45 -------- d-----w- c:\users\owner\appdata\local\{F8223472-D0A5-487D-B3E7-947B7EB53286}
2012-07-16 12:30:41 -------- d-----w- c:\users\owner\appdata\local\{458EFC50-52CB-499A-B5F0-6C4644D127BC}
2012-07-16 12:30:40 -------- d-----w- c:\users\owner\appdata\local\{5FF343BB-041F-457D-9C23-0441700EE7F6}
2012-07-14 15:47:05 -------- d-----w- c:\users\owner\appdata\local\{84D2A485-C8F5-48D7-AA7C-424A3AEE6D05}
2012-07-14 15:46:56 -------- d-----w- c:\users\owner\appdata\local\{327C8E7B-BE2B-4D44-9286-641D999C70A8}
2012-07-13 14:13:27 -------- d-----w- c:\users\owner\appdata\roaming\Mumble
2012-07-13 13:39:31 -------- d-----w- c:\program files\Mumble
2012-07-13 13:14:14 -------- d-----w- c:\users\owner\appdata\local\{C7685BC3-9B44-4480-9FB6-91BC9BB12C58}
2012-07-13 13:14:07 -------- d-----w- c:\users\owner\appdata\local\{F3762B98-99FD-48B7-AE5F-8A85F55EEC93}
2012-07-13 00:13:15 -------- d-----w- c:\users\owner\appdata\local\{89D7CD81-38C6-4298-9250-E1403874A2C2}
2012-07-13 00:13:13 -------- d-----w- c:\users\owner\appdata\local\{AADBD742-3E57-4511-B3E5-7A7D8A3AFBFA}
2012-07-13 00:12:59 -------- d-----w- c:\users\owner\Tracing
2012-07-12 23:41:22 537432 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\DXSETUP.exe
2012-07-12 23:41:21 89944 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\DSETUP.dll
2012-07-12 23:41:21 1801048 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\dsetup32.dll
2012-07-12 23:41:15 94040 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\DSETUP.dll
2012-07-12 23:41:15 525656 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\DXSETUP.exe
2012-07-12 23:41:15 1691480 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\dsetup32.dll
2012-07-12 13:45:19 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 13:39:54 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-07-12 13:39:54 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-07-12 13:39:53 708608 ----a-w- c:\program files\common files\system\ado\msado15.dll
2012-07-12 13:39:42 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-12 13:39:42 278528 ----a-w- c:\windows\system32\schannel.dll
2012-07-12 13:39:42 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-07-04 19:06:15 -------- d-----w- c:\users\owner\appdata\roaming\Malwarebytes
2012-07-04 19:05:56 -------- d-----w- c:\programdata\Malwarebytes
2012-07-04 19:05:55 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-04 19:05:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-04 18:51:51 -------- d-----w- c:\program files\CCleaner
2012-06-29 03:19:15 -------- d-----w- c:\program files\StudyPost!
2012-06-29 01:19:06 -------- d-----w- c:\program files\MiniBible Post!
.
==================== Find3M ====================
.
2012-07-20 20:50:01 472880 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-09 00:24:03 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-09 00:24:03 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-05-01 14:03:49 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
============= FINISH: 15:43:22.04 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 8/9/2009 6:19:53 PM
System Uptime: 7/25/2012 3:01:45 PM (0 hours ago)
.
Motherboard: Intel Corporation | | SANTA ROSA CRB
Processor: Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1667/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 297 GiB total, 199.816 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Activation Assistant for the 2007 Microsoft Office suites
Adobe Acrobat 4.0
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
Adobe Shockwave Player
Ask Toolbar
Audacity 1.3.14 (Unicode)
Avira Free Antivirus
Avira SearchFree Toolbar plus Web Protection Updater
Bluetooth Stack for Windows by Toshiba
Broadcom High Definition Video Decoder 2.6.40.1
Camera Assistant Software for Toshiba
CCleaner
CD/DVD Drive Acoustic Silencer
D3DX10
Desktop Dialer
Diablo II
DVD MovieFactory for TOSHIBA
e-Sword
Google Talk (remove only)
Google Talk Plugin
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel Matrix Storage Manager
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
Java Auto Updater
Java(TM) 6 Update 33
Java(TM) SE Runtime Environment 6
LADSPA_plugins-win-0.4.15
LAME v3.98.2 for Audacity
Malwarebytes Anti-Malware version 1.62.0.1300
Marvell Miniport Driver
McAfee SiteAdvisor
mCore
mHelp
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Microsoft XML Parser
MiniBible Post! 5.1c
mMHouse
Mozilla Firefox 14.0.1 (x86 en-US)
Mozilla Maintenance Service
mPfMgr
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Paltalk Messenger 10.2
Paltalk Messenger Interop
PANTECH PC USB Modem Software
PANTECH UM175 Driver
Protector Suite QL 5.6
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Segoe UI
SimCity 3000
Skype Click to Call
Skype™ 5.10
StudyPost! 3.1c
Synaptics Pointing Device Driver
System Requirements Lab for Intel
Texas Instruments PCIxx21/x515/xx12 drivers.
TIPCI
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Hardware Setup
TOSHIBA Music
Toshiba Registration
TOSHIBA SD Memory Utilities
TOSHIBA Software Modem
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
Unity Web Player
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VLC media player 2.0.1
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Messenger
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Media Encoder 9 Series
Yahoo! Messenger
ZoneAlarm Firewall
ZoneAlarm Free Firewall
ZoneAlarm LTD Toolbar
ZoneAlarm Security
.
==== Event Viewer Messages From Past Week ========
.
7/25/2012 3:29:48 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer AMYTAYMAY3-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5C. The master browser is stopping or an election is being forced.
7/25/2012 3:05:08 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.16 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
7/25/2012 3:04:16 PM, Error: Service Control Manager [7001] - The Windows Media Player Network Sharing Service service depends on the UPnP Device Host service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
7/25/2012 3:03:45 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
7/24/2012 9:17:08 PM, Error: Service Control Manager [7034] - The Remote Access Connection Manager service terminated unexpectedly. It has done this 5 time(s).
7/24/2012 9:17:08 PM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/24/2012 8:16:15 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.16 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
7/24/2012 8:15:45 PM, Error: yukonwlh [101] - Driver has encountered an internal error
7/24/2012 3:03:24 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
7/24/2012 12:35:26 PM, Error: EventLog [6008] - The previous system shutdown at 12:21:06 PM on 7/24/2012 was unexpected.
7/24/2012 1:34:48 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Remote Access Connection Manager service, but this action failed with the following error: An instance of the service is already running.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2012 3:49:52 PM, Error: Microsoft-Windows-ResourcePublication [1002] - Element Provider\Microsoft.Base.Publication/Publication/Computer failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.
7/23/2012 3:49:26 PM, Error: EventLog [6008] - The previous system shutdown at 3:46:19 PM on 7/23/2012 was unexpected.
7/22/2012 5:19:42 PM, Error: EventLog [6008] - The previous system shutdown at 5:16:57 PM on 7/22/2012 was unexpected.
7/21/2012 2:40:44 PM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
7/21/2012 12:05:51 PM, Error: EventLog [6008] - The previous system shutdown at 12:03:50 PM on 7/21/2012 was unexpected.
7/20/2012 9:05:12 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
7/20/2012 9:01:27 PM, Error: Service Control Manager [7022] - The Server service hung on starting.
7/20/2012 9:01:27 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state.
7/20/2012 8:55:02 AM, Error: Service Control Manager [7030] - The TrueVector Internet Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
7/20/2012 8:49:11 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer TRUEWORSHIPPER that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5. The master browser is stopping or an election is being forced.
7/20/2012 11:07:51 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
7/20/2012 11:07:51 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/20/2012 11:07:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
7/20/2012 11:07:18 PM, Error: Microsoft-Windows-PrintSpooler [22] - Failed to upgrade printer settings for printer Send To OneNote 2007,0 driver Send To Microsoft OneNote Driver. Error: 1801. The device settings for the printer are set to those configured by the manufacturer.
7/19/2012 8:51:21 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
7/18/2012 9:25:44 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer ADMINJT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5CAA9. The master browser is stopping or an election is being forced.
.
==== End Of File ===========================
I recently had some trouble with trojan and other viruses that I removed with Avira Free Anti-virus and Malware bytes Anti-Malware. However, I'm still having symptoms that I don't know how to fix and I need to get full functionality back as soon as I can (doesn't everyone
).The current symptoms I currently see are not being able to access google calendar. I can get to and use gmail fine, but attempts to get to google calendar reports:
"Unable to connect
Firefox can't establish a connection to the server at www.google.com."
Also, I tried running WinSockFix to correct this and it seemed to fix this once, but then the symptoms returned a bit later.
I am unable to logoff successfully. After Vista's windowing system exits, I just get stuck on a blank black screen with the hard drive continuing to work off and on endlessly.
Just before this state, I had removed a few viruses with the aforementioned tools, but afterwards, I noticed something I hadn't encountered before. I kept having one of my instances of svchost.exe grow in memory usage from 300 MB to 1GB (eventually). Then the process would begin to use more and more CPU (up to 35-40 %). I would finally resort to killing that process using Task Manager. After doing this I would notice some oddities in graphics and windowing functionality for a minute or two, then after about 30 minutes to 1 hour, I'd run into the same/similar scenario with the replacement svchost.exe process.
I ran sfx /SCANNOW after running several more scans using the aforementioned tools, sometimes finding something, sometimes not. I had also previously run CCleaner tool (before all this). I no longer have noticed the svchost.exe symptoms since the last day or two (since running your tools GMER, DDS, etc.).
Before all these things, I had installed and been using Mumble (open source voice over IP tool). I still have trouble believing this was the cause of all this, but others that also used Mumble with me have had strange events occur on their machines as well. I eventually uninstalled that software and have just been trying to get my machine back to normal.
Thank you in advance for any and all help as I really need this machine to be back to normal ASAP, but I don't want to reinstall and reconfigure Windows and all applications all over again.
Here are the logs you require to begin (5 steps):
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.24.12
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
OWNER :: GIFTFROMGOD [administrator]
7/25/2012 8:59:55 AM
mbam-log-2012-07-25 (08-59-55).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 188019
Time elapsed: 10 minute(s), 20 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-07-25 15:28:43
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST932032 rev.0001
Running: xy5dleq6.exe; Driver: C:\Users\OWNER\AppData\Local\Temp\pxrcipow.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_33
Run by OWNER at 15:42:49 on 2012-07-25
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.936 [GMT -4:00]
.
AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\rundll32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\TODDSrv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Windows\Explorer.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com
uSearch Bar = Preserve
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {DD662A0C-12FE-4B38-BA53-247F7EC82F46} - No File
TB: {7B13EC3E-999A-4B70-B9CB-2617B8323822} - No File
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Adobe] rundll32.exe "c:\users\owner\appdata\local\apps\adobe\zncvlw.dll",CreateInstance
uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
mRun: [<NO NAME>]
mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ISW]
mRun: [ZoneAlarm] "c:\program files\checkpoint\zonealarm\zatray.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [Adobe] rundll32.exe "c:\users\owner\appdata\local\apps\adobe\zncvlw.dll",CreateInstance
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 10.0.1.1
TCP: Interfaces\{01832491-381F-49E0-A5A4-988DB319D2EF} : NameServer = 76.5.159.133,63.162.197.99
TCP: Interfaces\{6CD59901-EDA4-4072-A93D-9E5CAA909388} : DhcpNameServer = 10.0.1.1
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
LSA: Notification Packages = scecli psqlpwd
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\gnc54s2q.default-1342793624225\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/outdoors/agriculture/forecast/10-day/24210
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mcafee\siteadvisor\NPMcFFPlg32.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\users\owner\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\users\owner\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-7-19 36000]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-4-4 63928]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-7-19 86224]
R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-7-19 110032]
R2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe [2012-7-19 465360]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-7-19 83392]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-8-9 21504]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-7-9 27056]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-7-9 497320]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2012-1-16 95232]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-5-30 3048136]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2007-5-8 7168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-7 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 257696]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2011-6-2 11336]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 113120]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [2009-8-28 29824]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [2009-8-28 41344]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [2009-8-28 39936]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [2009-8-28 59776]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-07-24 07:27:10 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f07a55a0-0590-4dcf-b873-f2c1540c144f}\offreg.dll
2012-07-24 06:24:26 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f07a55a0-0590-4dcf-b873-f2c1540c144f}\mpengine.dll
2012-07-20 20:50:26 476976 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-07-20 13:01:20 499082 ----a-w- c:\program files\mozilla firefox\uninstall\uninstaller.exe
2012-07-20 12:53:35 -------- d-----w- c:\users\owner\appdata\roaming\CheckPoint
2012-07-20 12:47:07 -------- d-----w- C:\2dda44f8e50167a02f6c581e51e8
2012-07-20 12:45:29 6891424 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll
2012-07-20 12:45:24 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-07-20 04:54:52 -------- d-----w- c:\program files\CheckPoint
2012-07-20 04:53:45 -------- d-----w- c:\programdata\CheckPoint
2012-07-19 23:07:09 -------- d-----w- c:\users\owner\appdata\roaming\Avira
2012-07-19 22:56:55 -------- d-----w- c:\program files\Ask.com
2012-07-19 22:56:32 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-19 22:56:32 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-07-19 22:56:30 -------- d-----w- c:\programdata\Avira
2012-07-19 22:56:30 -------- d-----w- c:\program files\Avira
2012-07-17 04:45:19 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-07-16 12:30:45 -------- d-----w- c:\users\owner\appdata\local\{F8223472-D0A5-487D-B3E7-947B7EB53286}
2012-07-16 12:30:41 -------- d-----w- c:\users\owner\appdata\local\{458EFC50-52CB-499A-B5F0-6C4644D127BC}
2012-07-16 12:30:40 -------- d-----w- c:\users\owner\appdata\local\{5FF343BB-041F-457D-9C23-0441700EE7F6}
2012-07-14 15:47:05 -------- d-----w- c:\users\owner\appdata\local\{84D2A485-C8F5-48D7-AA7C-424A3AEE6D05}
2012-07-14 15:46:56 -------- d-----w- c:\users\owner\appdata\local\{327C8E7B-BE2B-4D44-9286-641D999C70A8}
2012-07-13 14:13:27 -------- d-----w- c:\users\owner\appdata\roaming\Mumble
2012-07-13 13:39:31 -------- d-----w- c:\program files\Mumble
2012-07-13 13:14:14 -------- d-----w- c:\users\owner\appdata\local\{C7685BC3-9B44-4480-9FB6-91BC9BB12C58}
2012-07-13 13:14:07 -------- d-----w- c:\users\owner\appdata\local\{F3762B98-99FD-48B7-AE5F-8A85F55EEC93}
2012-07-13 00:13:15 -------- d-----w- c:\users\owner\appdata\local\{89D7CD81-38C6-4298-9250-E1403874A2C2}
2012-07-13 00:13:13 -------- d-----w- c:\users\owner\appdata\local\{AADBD742-3E57-4511-B3E5-7A7D8A3AFBFA}
2012-07-13 00:12:59 -------- d-----w- c:\users\owner\Tracing
2012-07-12 23:41:22 537432 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\DXSETUP.exe
2012-07-12 23:41:21 89944 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\DSETUP.dll
2012-07-12 23:41:21 1801048 ----a-w- c:\program files\common files\windows live\.cache\d75497de1cd608728\dsetup32.dll
2012-07-12 23:41:15 94040 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\DSETUP.dll
2012-07-12 23:41:15 525656 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\DXSETUP.exe
2012-07-12 23:41:15 1691480 ----a-w- c:\program files\common files\windows live\.cache\d27be6ae1cd608727\dsetup32.dll
2012-07-12 13:45:19 2047488 ----a-w- c:\windows\system32\win32k.sys
2012-07-12 13:39:54 1401856 ----a-w- c:\windows\system32\msxml6.dll
2012-07-12 13:39:54 1248768 ----a-w- c:\windows\system32\msxml3.dll
2012-07-12 13:39:53 708608 ----a-w- c:\program files\common files\system\ado\msado15.dll
2012-07-12 13:39:42 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-07-12 13:39:42 278528 ----a-w- c:\windows\system32\schannel.dll
2012-07-12 13:39:42 204288 ----a-w- c:\windows\system32\ncrypt.dll
2012-07-04 19:06:15 -------- d-----w- c:\users\owner\appdata\roaming\Malwarebytes
2012-07-04 19:05:56 -------- d-----w- c:\programdata\Malwarebytes
2012-07-04 19:05:55 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-04 19:05:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-04 18:51:51 -------- d-----w- c:\program files\CCleaner
2012-06-29 03:19:15 -------- d-----w- c:\program files\StudyPost!
2012-06-29 01:19:06 -------- d-----w- c:\program files\MiniBible Post!
.
==================== Find3M ====================
.
2012-07-20 20:50:01 472880 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-09 00:24:03 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-09 00:24:03 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-05-01 14:03:49 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
============= FINISH: 15:43:22.04 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 8/9/2009 6:19:53 PM
System Uptime: 7/25/2012 3:01:45 PM (0 hours ago)
.
Motherboard: Intel Corporation | | SANTA ROSA CRB
Processor: Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1667/mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 297 GiB total, 199.816 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Activation Assistant for the 2007 Microsoft Office suites
Adobe Acrobat 4.0
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
Adobe Shockwave Player
Ask Toolbar
Audacity 1.3.14 (Unicode)
Avira Free Antivirus
Avira SearchFree Toolbar plus Web Protection Updater
Bluetooth Stack for Windows by Toshiba
Broadcom High Definition Video Decoder 2.6.40.1
Camera Assistant Software for Toshiba
CCleaner
CD/DVD Drive Acoustic Silencer
D3DX10
Desktop Dialer
Diablo II
DVD MovieFactory for TOSHIBA
e-Sword
Google Talk (remove only)
Google Talk Plugin
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel Matrix Storage Manager
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
Java Auto Updater
Java(TM) 6 Update 33
Java(TM) SE Runtime Environment 6
LADSPA_plugins-win-0.4.15
LAME v3.98.2 for Audacity
Malwarebytes Anti-Malware version 1.62.0.1300
Marvell Miniport Driver
McAfee SiteAdvisor
mCore
mHelp
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Microsoft XML Parser
MiniBible Post! 5.1c
mMHouse
Mozilla Firefox 14.0.1 (x86 en-US)
Mozilla Maintenance Service
mPfMgr
MSVCRT
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Paltalk Messenger 10.2
Paltalk Messenger Interop
PANTECH PC USB Modem Software
PANTECH UM175 Driver
Protector Suite QL 5.6
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Segoe UI
SimCity 3000
Skype Click to Call
Skype™ 5.10
StudyPost! 3.1c
Synaptics Pointing Device Driver
System Requirements Lab for Intel
Texas Instruments PCIxx21/x515/xx12 drivers.
TIPCI
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Hardware Setup
TOSHIBA Music
Toshiba Registration
TOSHIBA SD Memory Utilities
TOSHIBA Software Modem
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
Unity Web Player
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VLC media player 2.0.1
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Messenger
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Media Encoder 9 Series
Yahoo! Messenger
ZoneAlarm Firewall
ZoneAlarm Free Firewall
ZoneAlarm LTD Toolbar
ZoneAlarm Security
.
==== Event Viewer Messages From Past Week ========
.
7/25/2012 3:29:48 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer AMYTAYMAY3-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5C. The master browser is stopping or an election is being forced.
7/25/2012 3:05:08 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.16 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
7/25/2012 3:04:16 PM, Error: Service Control Manager [7001] - The Windows Media Player Network Sharing Service service depends on the UPnP Device Host service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
7/25/2012 3:03:45 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
7/24/2012 9:17:08 PM, Error: Service Control Manager [7034] - The Remote Access Connection Manager service terminated unexpectedly. It has done this 5 time(s).
7/24/2012 9:17:08 PM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/24/2012 8:16:15 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.16 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
7/24/2012 8:15:45 PM, Error: yukonwlh [101] - Driver has encountered an internal error
7/24/2012 3:03:24 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
7/24/2012 12:35:26 PM, Error: EventLog [6008] - The previous system shutdown at 12:21:06 PM on 7/24/2012 was unexpected.
7/24/2012 1:34:48 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Remote Access Connection Manager service, but this action failed with the following error: An instance of the service is already running.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2012 8:52:06 PM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2012 3:49:52 PM, Error: Microsoft-Windows-ResourcePublication [1002] - Element Provider\Microsoft.Base.Publication/Publication/Computer failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.
7/23/2012 3:49:26 PM, Error: EventLog [6008] - The previous system shutdown at 3:46:19 PM on 7/23/2012 was unexpected.
7/22/2012 5:19:42 PM, Error: EventLog [6008] - The previous system shutdown at 5:16:57 PM on 7/22/2012 was unexpected.
7/21/2012 2:40:44 PM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
7/21/2012 12:05:51 PM, Error: EventLog [6008] - The previous system shutdown at 12:03:50 PM on 7/21/2012 was unexpected.
7/20/2012 9:05:12 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
7/20/2012 9:01:27 PM, Error: Service Control Manager [7022] - The Server service hung on starting.
7/20/2012 9:01:27 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state.
7/20/2012 8:55:02 AM, Error: Service Control Manager [7030] - The TrueVector Internet Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
7/20/2012 8:49:11 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer TRUEWORSHIPPER that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5. The master browser is stopping or an election is being forced.
7/20/2012 11:07:51 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
7/20/2012 11:07:51 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/20/2012 11:07:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
7/20/2012 11:07:18 PM, Error: Microsoft-Windows-PrintSpooler [22] - Failed to upgrade printer settings for printer Send To OneNote 2007,0 driver Send To Microsoft OneNote Driver. Error: 1801. The device settings for the printer are set to those configured by the manufacturer.
7/19/2012 8:51:21 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 0013E81B5FB9 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
7/18/2012 9:25:44 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer ADMINJT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6CD59901-EDA4-4072-A93D-9E5CAA9. The master browser is stopping or an election is being forced.
.
==== End Of File ===========================
