Solved Windows - Delayed Write Failed, Critical Error, System Fix
- Thread starter abonit
- Start date
ComboFix 11-12-15.02 - SouthernBell 12/15/2011 12:17:36.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2037.1243 [GMT -6:00]
Running from: c:\users\SouthernBell\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-11-15 to 2011-12-15 )))))))))))))))))))))))))))))))
.
.
2011-12-15 18:28 . 2011-12-15 18:30 -------- d-----w- c:\users\SouthernBell\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\colortyme\AppData\Local\temp
2011-12-15 04:43 . 2011-12-15 04:43 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\MpKsl8438294d.sys
2011-12-15 04:43 . 2011-12-15 04:43 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\offreg.dll
2011-12-15 03:41 . 2011-12-15 03:41 -------- d-----w- c:\users\SouthernBell\AppData\Roaming\Malwarebytes
2011-12-15 03:41 . 2011-12-15 03:41 -------- d-----w- c:\programdata\Malwarebytes
2011-12-15 03:41 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-15 03:41 . 2011-12-15 03:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-15 03:26 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\mpengine.dll
2011-12-15 03:22 . 2011-12-15 04:49 735142 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-12-15 03:14 . 2011-12-15 03:14 -------- d-----w- C:\_OTL
2011-12-14 19:41 . 2011-12-14 19:41 -------- d-----w- c:\users\Guest\AppData\Local\VirtualStore
2011-12-14 04:03 . 2011-12-14 04:32 -------- d-----w- c:\program files\GridinSoft Trojan Killer
2011-12-08 02:36 . 2011-12-08 02:36 -------- d--h--w- c:\users\SouthernBell\AppData\Roaming\Spotify
2011-11-22 20:21 . 2011-11-22 20:21 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 10:47 . 2011-10-22 23:48 6823496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-12 01:58 . 2006-11-02 08:57 66048 ---ha-w- c:\windows\system32\drivers\smb.sys
2011-10-04 22:22 . 2011-10-27 23:18 703824 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A50AFB11-0EE6-48C4-A630-47BCE84B92F5}\gapaengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AudioEndpointBuilder]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Audiosrv]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudAddService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HDAudBus]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MMCSS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96C-E325-11CE-BFC1-08002BE10318}]
@="[6cFgE][S?û?d, ?ìdeô ??d gª?è ¢o?tr?l?è?š !!! !!! !]"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{640167b4-59b0-47a6-b335-a6b3c0695aea}]
@="Portable Media Devices"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BlackBerry Desktop Redirector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BlackBerry Desktop Redirector.lnk
backup=c:\windows\pss\BlackBerry Desktop Redirector.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Desktop Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Manager.lnk
backup=c:\windows\pss\Desktop Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Connections.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Connections.lnk
backup=c:\windows\pss\HP Connections.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VProperty.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VProperty.lnk
backup=c:\windows\pss\VProperty.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^colortyme^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^palmOne Registration.lnk]
path=c:\users\colortyme\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\palmOne Registration.lnk
backup=c:\windows\pss\palmOne Registration.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^colortyme^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TurboApps WinMobile Conduit.lnk]
path=c:\users\colortyme\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurboApps WinMobile Conduit.lnk
backup=c:\windows\pss\TurboApps WinMobile Conduit.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^FrostWire On Startup.lnk]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk
backup=c:\windows\pss\FrostWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^IMVU.lnk]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
backup=c:\windows\pss\IMVU.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK
backup=c:\windows\pss\wkcalrem.LNK.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2008-11-20 16:06 178688 ---ha-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CarboniteSetupLite]
2009-08-04 07:49 318096 ----a-w- c:\program files\Carbonite\CarbonitePreinstaller.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
2007-01-10 05:59 115816 ----a-w- c:\program files\Common Files\Symantec Shared\ccApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2006-11-06 09:05 106496 ---ha-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2006-11-28 23:42 46704 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 21:50 54576 ---ha-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
2006-10-18 17:32 472800 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-11-06 09:02 98304 ---ha-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-17 00:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-17 00:15 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 07:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-02-06 23:51 3885408 ---ha-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
2006-10-27 13:18 22696 ----a-w- c:\program files\Norton Internet Security\osCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2006-11-06 09:02 81920 ---ha-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2006-11-06 18:58 159744 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2006-11-24 23:33 167936 ----a-w- c:\program files\HP\QuickPlay\QPService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 16:17 421888 ---ha-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC610NC_Monitor]
2006-11-03 16:01 319488 ---ha-w- c:\windows\Philips\SPC610NC\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-06 18:06 149280 ---ha-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2007-11-29 01:51 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-11-15 05:02 815104 ---ha-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]
2006-10-18 17:56 317152 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-02 12:33 1004136 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 15:21 648072 ---ha-w- c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
2006-11-02 09:45 215552 ----a-w- c:\windows\WindowsMobile\wmdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2378550397-1645097847-830149378-1001]
"EnableNotificationsRef"=dword:00000001
.
R0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [x]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [x]
R1 MpKsl02141418;MpKsl02141418;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BE1E524A-871F-46F4-9117-2BD53B97740B}\MpKsl02141418.sys [x]
R1 MpKsl17cb6a83;MpKsl17cb6a83;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{591BBD4F-D4F9-4B5A-9C11-958B1387156E}\MpKsl17cb6a83.sys [x]
R1 MpKsl2477acb6;MpKsl2477acb6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6189334F-32F8-4961-9DC8-8F345FCCA8E6}\MpKsl2477acb6.sys [x]
R1 MpKsl376747fd;MpKsl376747fd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{87D9F391-02B1-42B6-81A1-D2415688ADE7}\MpKsl376747fd.sys [x]
R1 MpKsl37ffeb39;MpKsl37ffeb39;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8EBF86C5-89DD-4DBA-A220-962A6427822C}\MpKsl37ffeb39.sys [x]
R1 MpKsl394acba6;MpKsl394acba6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A25BBA2A-76EB-4FD7-8349-761F4297984F}\MpKsl394acba6.sys [x]
R1 MpKsl5e3160c2;MpKsl5e3160c2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3106923C-0AB7-48EA-BF1D-FCB794A2F2F4}\MpKsl5e3160c2.sys [x]
R1 MpKsl83b93cd4;MpKsl83b93cd4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA9FB80B-4FA3-48EB-858C-62F6A84E9574}\MpKsl83b93cd4.sys [x]
R1 MpKsl89d2da97;MpKsl89d2da97;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{78753302-D25B-4779-80A4-DEDC896D7ED2}\MpKsl89d2da97.sys [x]
R1 MpKslbacf7c01;MpKslbacf7c01;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6189334F-32F8-4961-9DC8-8F345FCCA8E6}\MpKslbacf7c01.sys [x]
R1 MpKslc3fea722;MpKslc3fea722;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA9FB80B-4FA3-48EB-858C-62F6A84E9574}\MpKslc3fea722.sys [x]
R1 MpKslc602097f;MpKslc602097f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3106923C-0AB7-48EA-BF1D-FCB794A2F2F4}\MpKslc602097f.sys [x]
R1 SASDIFSV;SASDIFSV;c:\users\SOUTHE~1\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\SOUTHE~1\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 SASENUM;SASENUM;c:\users\SOUTHE~1\AppData\Local\Temp\SAS_SelfExtract\SASENUM.SYS [x]
R3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\DRIVERS\SPC610NC.SYS [2007-01-19 409728]
S1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070308.001\IDSvix86.sys [2007-02-14 212280]
S1 MpKsl8438294d;MpKsl8438294d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\MpKsl8438294d.sys [2011-12-15 29904]
S2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [2011-04-15 6656]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 SYMNDISV;SYMNDISV;c:\windows\System32\Drivers\SYMNDISV.SYS [2006-10-25 37008]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 18930901
*NewlyCreated* - ASWMBR
*NewlyCreated* - COMHOST
*NewlyCreated* - MPKSL8438294D
*Deregistered* - 18930901
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-15 c:\windows\Tasks\User_Feed_Synchronization-{CC6CCA5F-ACEF-4CA9-BE0E-804557105330}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
TCP: DhcpNameServer = 24.116.2.50 24.116.2.34
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-23709095.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-15 12:30
Windows 6.0.6000 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-12-15 12:37:06
ComboFix-quarantined-files.txt 2011-12-15 18:37
ComboFix2.txt 2011-10-22 19:19
.
Pre-Run: 24,901,558,272 bytes free
Post-Run: 27,372,683,264 bytes free
.
- - End Of File - - 8FD08533FD2019E91E4F6D2F051E9BE2
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2037.1243 [GMT -6:00]
Running from: c:\users\SouthernBell\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-11-15 to 2011-12-15 )))))))))))))))))))))))))))))))
.
.
2011-12-15 18:28 . 2011-12-15 18:30 -------- d-----w- c:\users\SouthernBell\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-15 18:28 . 2011-12-15 18:28 -------- d-----w- c:\users\colortyme\AppData\Local\temp
2011-12-15 04:43 . 2011-12-15 04:43 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\MpKsl8438294d.sys
2011-12-15 04:43 . 2011-12-15 04:43 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\offreg.dll
2011-12-15 03:41 . 2011-12-15 03:41 -------- d-----w- c:\users\SouthernBell\AppData\Roaming\Malwarebytes
2011-12-15 03:41 . 2011-12-15 03:41 -------- d-----w- c:\programdata\Malwarebytes
2011-12-15 03:41 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-15 03:41 . 2011-12-15 03:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-15 03:26 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\mpengine.dll
2011-12-15 03:22 . 2011-12-15 04:49 735142 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-12-15 03:14 . 2011-12-15 03:14 -------- d-----w- C:\_OTL
2011-12-14 19:41 . 2011-12-14 19:41 -------- d-----w- c:\users\Guest\AppData\Local\VirtualStore
2011-12-14 04:03 . 2011-12-14 04:32 -------- d-----w- c:\program files\GridinSoft Trojan Killer
2011-12-08 02:36 . 2011-12-08 02:36 -------- d--h--w- c:\users\SouthernBell\AppData\Roaming\Spotify
2011-11-22 20:21 . 2011-11-22 20:21 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 10:47 . 2011-10-22 23:48 6823496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-12 01:58 . 2006-11-02 08:57 66048 ---ha-w- c:\windows\system32\drivers\smb.sys
2011-10-04 22:22 . 2011-10-27 23:18 703824 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A50AFB11-0EE6-48C4-A630-47BCE84B92F5}\gapaengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AudioEndpointBuilder]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Audiosrv]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudAddService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HDAudBus]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MMCSS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96C-E325-11CE-BFC1-08002BE10318}]
@="[6cFgE][S?û?d, ?ìdeô ??d gª?è ¢o?tr?l?è?š !!! !!! !]"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{640167b4-59b0-47a6-b335-a6b3c0695aea}]
@="Portable Media Devices"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BlackBerry Desktop Redirector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BlackBerry Desktop Redirector.lnk
backup=c:\windows\pss\BlackBerry Desktop Redirector.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Desktop Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Manager.lnk
backup=c:\windows\pss\Desktop Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Connections.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Connections.lnk
backup=c:\windows\pss\HP Connections.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VProperty.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VProperty.lnk
backup=c:\windows\pss\VProperty.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^colortyme^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^palmOne Registration.lnk]
path=c:\users\colortyme\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\palmOne Registration.lnk
backup=c:\windows\pss\palmOne Registration.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^colortyme^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TurboApps WinMobile Conduit.lnk]
path=c:\users\colortyme\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurboApps WinMobile Conduit.lnk
backup=c:\windows\pss\TurboApps WinMobile Conduit.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^FrostWire On Startup.lnk]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk
backup=c:\windows\pss\FrostWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^IMVU.lnk]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
backup=c:\windows\pss\IMVU.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^SouthernBell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK]
path=c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK
backup=c:\windows\pss\wkcalrem.LNK.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2008-11-20 16:06 178688 ---ha-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CarboniteSetupLite]
2009-08-04 07:49 318096 ----a-w- c:\program files\Carbonite\CarbonitePreinstaller.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
2007-01-10 05:59 115816 ----a-w- c:\program files\Common Files\Symantec Shared\ccApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2006-11-06 09:05 106496 ---ha-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2006-11-28 23:42 46704 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 21:50 54576 ---ha-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
2006-10-18 17:32 472800 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-11-06 09:02 98304 ---ha-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-17 00:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-02-17 00:15 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 07:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-02-06 23:51 3885408 ---ha-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
2006-10-27 13:18 22696 ----a-w- c:\program files\Norton Internet Security\osCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2006-11-06 09:02 81920 ---ha-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2006-11-06 18:58 159744 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2006-11-24 23:33 167936 ----a-w- c:\program files\HP\QuickPlay\QPService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 16:17 421888 ---ha-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SPC610NC_Monitor]
2006-11-03 16:01 319488 ---ha-w- c:\windows\Philips\SPC610NC\Monitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-06 18:06 149280 ---ha-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2007-11-29 01:51 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-11-15 05:02 815104 ---ha-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WAWifiMessage]
2006-10-18 17:56 317152 ----a-w- c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-02 12:33 1004136 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 15:21 648072 ---ha-w- c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
2006-11-02 09:45 215552 ----a-w- c:\windows\WindowsMobile\wmdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2378550397-1645097847-830149378-1001]
"EnableNotificationsRef"=dword:00000001
.
R0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [x]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [x]
R1 MpKsl02141418;MpKsl02141418;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BE1E524A-871F-46F4-9117-2BD53B97740B}\MpKsl02141418.sys [x]
R1 MpKsl17cb6a83;MpKsl17cb6a83;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{591BBD4F-D4F9-4B5A-9C11-958B1387156E}\MpKsl17cb6a83.sys [x]
R1 MpKsl2477acb6;MpKsl2477acb6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6189334F-32F8-4961-9DC8-8F345FCCA8E6}\MpKsl2477acb6.sys [x]
R1 MpKsl376747fd;MpKsl376747fd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{87D9F391-02B1-42B6-81A1-D2415688ADE7}\MpKsl376747fd.sys [x]
R1 MpKsl37ffeb39;MpKsl37ffeb39;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8EBF86C5-89DD-4DBA-A220-962A6427822C}\MpKsl37ffeb39.sys [x]
R1 MpKsl394acba6;MpKsl394acba6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A25BBA2A-76EB-4FD7-8349-761F4297984F}\MpKsl394acba6.sys [x]
R1 MpKsl5e3160c2;MpKsl5e3160c2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3106923C-0AB7-48EA-BF1D-FCB794A2F2F4}\MpKsl5e3160c2.sys [x]
R1 MpKsl83b93cd4;MpKsl83b93cd4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA9FB80B-4FA3-48EB-858C-62F6A84E9574}\MpKsl83b93cd4.sys [x]
R1 MpKsl89d2da97;MpKsl89d2da97;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{78753302-D25B-4779-80A4-DEDC896D7ED2}\MpKsl89d2da97.sys [x]
R1 MpKslbacf7c01;MpKslbacf7c01;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6189334F-32F8-4961-9DC8-8F345FCCA8E6}\MpKslbacf7c01.sys [x]
R1 MpKslc3fea722;MpKslc3fea722;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA9FB80B-4FA3-48EB-858C-62F6A84E9574}\MpKslc3fea722.sys [x]
R1 MpKslc602097f;MpKslc602097f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3106923C-0AB7-48EA-BF1D-FCB794A2F2F4}\MpKslc602097f.sys [x]
R1 SASDIFSV;SASDIFSV;c:\users\SOUTHE~1\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\SOUTHE~1\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 SASENUM;SASENUM;c:\users\SOUTHE~1\AppData\Local\Temp\SAS_SelfExtract\SASENUM.SYS [x]
R3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\DRIVERS\SPC610NC.SYS [2007-01-19 409728]
S1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070308.001\IDSvix86.sys [2007-02-14 212280]
S1 MpKsl8438294d;MpKsl8438294d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{32ED2984-505E-433E-A39C-A1159DF8A848}\MpKsl8438294d.sys [2011-12-15 29904]
S2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [2011-04-15 6656]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 SYMNDISV;SYMNDISV;c:\windows\System32\Drivers\SYMNDISV.SYS [2006-10-25 37008]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 18930901
*NewlyCreated* - ASWMBR
*NewlyCreated* - COMHOST
*NewlyCreated* - MPKSL8438294D
*Deregistered* - 18930901
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-15 c:\windows\Tasks\User_Feed_Synchronization-{CC6CCA5F-ACEF-4CA9-BE0E-804557105330}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\SouthernBell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
TCP: DhcpNameServer = 24.116.2.50 24.116.2.34
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-23709095.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-15 12:30
Windows 6.0.6000 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-12-15 12:37:06
ComboFix-quarantined-files.txt 2011-12-15 18:37
ComboFix2.txt 2011-10-22 19:19
.
Pre-Run: 24,901,558,272 bytes free
Post-Run: 27,372,683,264 bytes free
.
- - End Of File - - 8FD08533FD2019E91E4F6D2F051E9BE2
Broni
Posts: 56,041 +516
Looks good 
What are the current issues?
See if you can update and MBAM now.
If still a problem with updating...
1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
2. Restart your computer (very important).
3. Download and run this utility.
4. It will ask to restart your computer (please allow it to).
5. After the computer restarts, install the latest version from here.
Tehn....
Please, download DDS from one of the 2 mirrors and save it to your desktop.
Mirror 1
Mirror 2
* Disable any script blocking protection (if present)
* Double click the dds icon to run the tool.
* When done, DDS will open two logs:
1. DDS.txt
2. Attach.txt
* Save both reports to your desktop by clicking File>Save As in each log.
Include the contents of both logs in your new topic. The scan will instruct you to post Attach.txt as an attachment. No need for that though ..... just post it's contents as you would any other log.
What are the current issues?
See if you can update and MBAM now.
If still a problem with updating...
1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
2. Restart your computer (very important).
3. Download and run this utility.
4. It will ask to restart your computer (please allow it to).
5. After the computer restarts, install the latest version from here.
Tehn....
Please, download DDS from one of the 2 mirrors and save it to your desktop.
Mirror 1
Mirror 2
* Disable any script blocking protection (if present)
* Double click the dds icon to run the tool.
* When done, DDS will open two logs:
1. DDS.txt
2. Attach.txt
* Save both reports to your desktop by clicking File>Save As in each log.
Include the contents of both logs in your new topic. The scan will instruct you to post Attach.txt as an attachment. No need for that though ..... just post it's contents as you would any other log.
DDS.txt
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.16890 BrowserJavaVersion: 1.6.0_17
Run by SouthernBell at 13:56:41 on 2011-12-15
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2037.965 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10y_ActiveX.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\southernbell\appdata\roaming\microsoft\windows\start menu\programs\imvu\Run IMVU.lnk
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 24.116.2.50 24.116.2.34
TCP: Interfaces\{17574FBE-F0C6-42E4-AF65-61CDB0C725BF} : DhcpNameServer = 24.116.2.50 24.116.2.34
TCP: Interfaces\{51A1592B-E40D-47C6-8E39-A54FEA99398D} : DhcpNameServer = 67.142.160.8 67.142.160.9
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20070308.001\IDSvix86.sys [2007-3-20 212280]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKsl256b19d3;MpKsl256b19d3;c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\MpKsl256b19d3.sys [2011-12-15 29904]
R2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [2011-4-14 6656]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-15 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-15 22216]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2006-10-24 37008]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-5-12 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\drivers\SPC610NC.SYS [2007-1-19 409728]
S4 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-12-17 1252232]
.
=============== Created Last 30 ================
.
2011-12-15 19:55:16 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-12-15 19:55:07 -------- d-----w- c:\users\southernbell\appdata\roaming\Malwarebytes
2011-12-15 19:54:30 -------- d-----w- c:\programdata\Malwarebytes
2011-12-15 19:54:24 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-15 19:54:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-15 19:47:31 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\MpKsl256b19d3.sys
2011-12-15 19:47:27 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\offreg.dll
2011-12-15 18:37:08 -------- d-----w- c:\users\southernbell\appdata\local\temp
2011-12-15 18:15:07 98816 ----a-w- c:\windows\sed.exe
2011-12-15 18:15:07 518144 ----a-w- c:\windows\SWREG.exe
2011-12-15 18:15:07 256000 ----a-w- c:\windows\PEV.exe
2011-12-15 18:15:07 208896 ----a-w- c:\windows\MBR.exe
2011-12-15 03:26:51 6823496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\mpengine.dll
2011-12-15 03:14:34 -------- d-----w- C:\_OTL
2011-12-14 04:03:44 -------- d-----w- c:\program files\GridinSoft Trojan Killer
2011-12-08 02:36:20 -------- d-----w- c:\users\southernbell\appdata\roaming\Spotify
2011-11-22 20:21:13 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-10-12 01:58:00 66048 ----a-w- c:\windows\system32\drivers\smb.sys
.
============= FINISH: 13:58:11.92 ===============
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.16890 BrowserJavaVersion: 1.6.0_17
Run by SouthernBell at 13:56:41 on 2011-12-15
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2037.965 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10y_ActiveX.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\southernbell\appdata\roaming\microsoft\windows\start menu\programs\imvu\Run IMVU.lnk
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 24.116.2.50 24.116.2.34
TCP: Interfaces\{17574FBE-F0C6-42E4-AF65-61CDB0C725BF} : DhcpNameServer = 24.116.2.50 24.116.2.34
TCP: Interfaces\{51A1592B-E40D-47C6-8E39-A54FEA99398D} : DhcpNameServer = 67.142.160.8 67.142.160.9
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20070308.001\IDSvix86.sys [2007-3-20 212280]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKsl256b19d3;MpKsl256b19d3;c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\MpKsl256b19d3.sys [2011-12-15 29904]
R2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [2011-4-14 6656]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-15 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-15 22216]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2006-10-24 37008]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-5-12 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
S3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\drivers\SPC610NC.SYS [2007-1-19 409728]
S4 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-12-17 1252232]
.
=============== Created Last 30 ================
.
2011-12-15 19:55:16 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-12-15 19:55:07 -------- d-----w- c:\users\southernbell\appdata\roaming\Malwarebytes
2011-12-15 19:54:30 -------- d-----w- c:\programdata\Malwarebytes
2011-12-15 19:54:24 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-15 19:54:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-15 19:47:31 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\MpKsl256b19d3.sys
2011-12-15 19:47:27 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\offreg.dll
2011-12-15 18:37:08 -------- d-----w- c:\users\southernbell\appdata\local\temp
2011-12-15 18:15:07 98816 ----a-w- c:\windows\sed.exe
2011-12-15 18:15:07 518144 ----a-w- c:\windows\SWREG.exe
2011-12-15 18:15:07 256000 ----a-w- c:\windows\PEV.exe
2011-12-15 18:15:07 208896 ----a-w- c:\windows\MBR.exe
2011-12-15 03:26:51 6823496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{32ed2984-505e-433e-a39c-a1159df8a848}\mpengine.dll
2011-12-15 03:14:34 -------- d-----w- C:\_OTL
2011-12-14 04:03:44 -------- d-----w- c:\program files\GridinSoft Trojan Killer
2011-12-08 02:36:20 -------- d-----w- c:\users\southernbell\appdata\roaming\Spotify
2011-11-22 20:21:13 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-10-12 01:58:00 66048 ----a-w- c:\windows\system32\drivers\smb.sys
.
============= FINISH: 13:58:11.92 ===============
Attach.txt
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Basic
Boot Device: \Device\HarddiskVolume1
Install Date: 3/10/2007 11:26:05 AM
System Uptime: 12/15/2011 1:47:02 PM (0 hours ago)
.
Motherboard: Quanta | | 30BB
Processor: Genuine Intel(R) CPU T2060 @ 1.60GHz | U2E1 | 1600/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 68 GiB total, 25.578 GiB free.
D: is FIXED (NTFS) - 6 GiB total, 0.765 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft 6to4 Adapter
Device ID: ROOT\*6TO4MP\0003
Manufacturer: Microsoft
Name: 6TO4 Adapter
PNP Device ID: ROOT\*6TO4MP\0003
Service: tunnel
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
Activation Assistant for the 2007 Microsoft Office suites
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.3
AIO_Scan
AppCore
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft MediaImpression
ASL_HS_Installer32
AutoUpdate
BPD_Scan
BPDSoftware
BPDSoftware_Ini
BufferChm
CameraHelperMsi
Carbonite Online Backup Setup
ccCommon
CCleaner
Choice Guard
Click to Call with Skype
Conexant HD Audio
Copy
CustomerResearchQFolder
Deal Info
Destinations
Digital Video
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
DocProc
DocProcQFolder
erLT
eSupportQFolder
F4100
F4100_Help
Facebook Plug-In
Fax
ffdshow [rev 1692] [2007-12-09]
Finding Notes Easy 1.5
Form Fill (Windows Live Toolbar)
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Connections (remove only)
HP Customer Experience Enhancements
HP Customer Participation Program 8.0
HP Deskjet All-In-One Software 8.0
HP Easy Setup - Core
HP Easy Setup - Frontend
HP Help and Support
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Officejet J3600 Series
HP Photosmart Essential
HP Quick Launch Buttons 6.10 B9
HP QuickPlay 3.0
HP Smart Web Printing 4.60
HP Solution Center 8.0
HP Total Care Advisor
HP Update
HP User Guide 0048
HP Wireless Assistant
HPNetworkAssistant
HPProductAssistant
HPSSupply
HTC Touch Pro2 User Manual
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 17
Java(TM) SE Runtime Environment 6
Junk Mail filter update
LightScribe 1.4.124.1
LiveUpdate Notice (Symantec Corporation)
LWS Help_main
LWS Launcher
LWS Motion Detection
LWS Pictures And Video
LWS Video Mask Maker
LWS VideoEffects
LWS Webcam Software
LWS WLM Plugin
LWS YouTube Plugin
Malwarebytes' Anti-Malware version 1.51.2.1300
Map Button (Windows Live Toolbar)
MarketResearch
Memorex exPressit Label Design Studio
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Search Enhancement Pack
Microsoft Security Client
Microsoft Security Essentials
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
MSRedist
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
My HP Games
Norton Confidential Browser Component
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
OGA Notifier 2.0.0048.0
OLYMPUS Master 2
palmOne
PhotoFiltre
PrintMaster 2.0 Platinum
ProductContext
QuickTime
Roxio Express Labeler 3
Safari
Scan
Security Update for CAPICOM (KB931906)
Skype™ 5.5
Smart Menus (Windows Live Toolbar)
SmartWebPrinting
Soft Data Fax Modem with SmartCP
SolutionCenter
Sonic Activation Module
SPC 610NC Laptop Camera
Spybot - Search & Destroy
Status
SymNet
Synaptics Pointing Device Driver
Toolbox
TrayApp
Trojan Killer 2.1
TurboApps WinMobile Conduit
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VC80CRTRedist - 8.0.50727.4053
VideoPad Video Editor
VistaGlazz 1.2
WebReg
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Live Writer
Windows Mobile Device Center
Windows Mobile Device Center Driver Update
WinRAR 4.10 beta 1 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
12/8/2011 9:19:55 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL szkg5 szkgfs
12/8/2011 9:19:55 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
12/8/2011 9:18:55 AM, Error: EventLog [6008] - The previous system shutdown at 9:17:16 AM on 12/8/2011 was unexpected.
12/15/2011 12:59:13 PM, Error: Service Control Manager [7022] - The Internet Connection Sharing (ICS) service hung on starting.
12/15/2011 12:17:07 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/15/2011 12:14:24 PM, Error: Service Control Manager [7034] - The Process Monitor service terminated unexpectedly. It has done this 1 time(s).
12/15/2011 1:42:31 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/15/2011 1:05:02 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver has restarted scanning items and is out of pass through mode.
12/15/2011 1:04:06 PM, Error: Service Control Manager [7022] - The Background Intelligent Transfer Service service hung on starting.
12/15/2011 1:04:04 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/14/2011 9:16:51 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/14/2011 2:06:58 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.982.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
12/14/2011 2:06:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
12/14/2011 12:00:54 AM, Error: EventLog [6008] - The previous system shutdown at 11:59:40 PM on 12/13/2011 was unexpected.
12/14/2011 1:56:38 PM, Error: EventLog [6008] - The previous system shutdown at 1:55:00 PM on 12/14/2011 was unexpected.
12/14/2011 1:42:15 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/13/2011 8:51:35 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl MpFilter SASDIFSV SASKUTIL spldr SYMTDI szkg5 szkgfs Wanarpv6
12/13/2011 8:51:35 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
12/13/2011 8:51:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/13/2011 8:51:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/13/2011 8:51:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/13/2011 8:51:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
12/13/2011 8:51:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/13/2011 8:51:22 PM, Error: LSM [1048] - Terminal Service start failed. The relevant status code was This service cannot be started in Safe Mode .
12/13/2011 8:50:45 PM, Error: EventLog [6008] - The previous system shutdown at 8:48:55 PM on 12/13/2011 was unexpected.
12/13/2011 8:46:43 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
12/13/2011 5:53:26 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/13/2011 10:47:57 PM, Error: Microsoft-Windows-WMPNSS-Service [14346] - A new media server was not initialized because RegisterRunningDevice() encountered error '0x80070005'. Restart your computer, and then restart the WMPNetworkSvc service.
12/12/2011 11:54:43 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/12/2011 11:53:49 AM, Error: EventLog [6008] - The previous system shutdown at 10:49:02 PM on 12/11/2011 was unexpected.
.
==== End Of File ===========================
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Basic
Boot Device: \Device\HarddiskVolume1
Install Date: 3/10/2007 11:26:05 AM
System Uptime: 12/15/2011 1:47:02 PM (0 hours ago)
.
Motherboard: Quanta | | 30BB
Processor: Genuine Intel(R) CPU T2060 @ 1.60GHz | U2E1 | 1600/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 68 GiB total, 25.578 GiB free.
D: is FIXED (NTFS) - 6 GiB total, 0.765 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft 6to4 Adapter
Device ID: ROOT\*6TO4MP\0003
Manufacturer: Microsoft
Name: 6TO4 Adapter
PNP Device ID: ROOT\*6TO4MP\0003
Service: tunnel
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
Activation Assistant for the 2007 Microsoft Office suites
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.3
AIO_Scan
AppCore
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft MediaImpression
ASL_HS_Installer32
AutoUpdate
BPD_Scan
BPDSoftware
BPDSoftware_Ini
BufferChm
CameraHelperMsi
Carbonite Online Backup Setup
ccCommon
CCleaner
Choice Guard
Click to Call with Skype
Conexant HD Audio
Copy
CustomerResearchQFolder
Deal Info
Destinations
Digital Video
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
DocProc
DocProcQFolder
erLT
eSupportQFolder
F4100
F4100_Help
Facebook Plug-In
Fax
ffdshow [rev 1692] [2007-12-09]
Finding Notes Easy 1.5
Form Fill (Windows Live Toolbar)
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Connections (remove only)
HP Customer Experience Enhancements
HP Customer Participation Program 8.0
HP Deskjet All-In-One Software 8.0
HP Easy Setup - Core
HP Easy Setup - Frontend
HP Help and Support
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Officejet J3600 Series
HP Photosmart Essential
HP Quick Launch Buttons 6.10 B9
HP QuickPlay 3.0
HP Smart Web Printing 4.60
HP Solution Center 8.0
HP Total Care Advisor
HP Update
HP User Guide 0048
HP Wireless Assistant
HPNetworkAssistant
HPProductAssistant
HPSSupply
HTC Touch Pro2 User Manual
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 17
Java(TM) SE Runtime Environment 6
Junk Mail filter update
LightScribe 1.4.124.1
LiveUpdate Notice (Symantec Corporation)
LWS Help_main
LWS Launcher
LWS Motion Detection
LWS Pictures And Video
LWS Video Mask Maker
LWS VideoEffects
LWS Webcam Software
LWS WLM Plugin
LWS YouTube Plugin
Malwarebytes' Anti-Malware version 1.51.2.1300
Map Button (Windows Live Toolbar)
MarketResearch
Memorex exPressit Label Design Studio
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Search Enhancement Pack
Microsoft Security Client
Microsoft Security Essentials
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
MSRedist
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
My HP Games
Norton Confidential Browser Component
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
OGA Notifier 2.0.0048.0
OLYMPUS Master 2
palmOne
PhotoFiltre
PrintMaster 2.0 Platinum
ProductContext
QuickTime
Roxio Express Labeler 3
Safari
Scan
Security Update for CAPICOM (KB931906)
Skype™ 5.5
Smart Menus (Windows Live Toolbar)
SmartWebPrinting
Soft Data Fax Modem with SmartCP
SolutionCenter
Sonic Activation Module
SPC 610NC Laptop Camera
Spybot - Search & Destroy
Status
SymNet
Synaptics Pointing Device Driver
Toolbox
TrayApp
Trojan Killer 2.1
TurboApps WinMobile Conduit
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VC80CRTRedist - 8.0.50727.4053
VideoPad Video Editor
VistaGlazz 1.2
WebReg
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Feed Detector (Windows Live Toolbar)
Windows Live Writer
Windows Mobile Device Center
Windows Mobile Device Center Driver Update
WinRAR 4.10 beta 1 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
12/8/2011 9:19:55 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL szkg5 szkgfs
12/8/2011 9:19:55 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
12/8/2011 9:18:55 AM, Error: EventLog [6008] - The previous system shutdown at 9:17:16 AM on 12/8/2011 was unexpected.
12/15/2011 12:59:13 PM, Error: Service Control Manager [7022] - The Internet Connection Sharing (ICS) service hung on starting.
12/15/2011 12:17:07 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/15/2011 12:14:24 PM, Error: Service Control Manager [7034] - The Process Monitor service terminated unexpectedly. It has done this 1 time(s).
12/15/2011 1:42:31 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/15/2011 1:05:02 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver has restarted scanning items and is out of pass through mode.
12/15/2011 1:04:06 PM, Error: Service Control Manager [7022] - The Background Intelligent Transfer Service service hung on starting.
12/15/2011 1:04:04 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/14/2011 9:16:51 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/14/2011 2:06:58 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.982.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
12/14/2011 2:06:58 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
12/14/2011 12:00:54 AM, Error: EventLog [6008] - The previous system shutdown at 11:59:40 PM on 12/13/2011 was unexpected.
12/14/2011 1:56:38 PM, Error: EventLog [6008] - The previous system shutdown at 1:55:00 PM on 12/14/2011 was unexpected.
12/14/2011 1:42:15 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/13/2011 8:51:35 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl MpFilter SASDIFSV SASKUTIL spldr SYMTDI szkg5 szkgfs Wanarpv6
12/13/2011 8:51:35 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
12/13/2011 8:51:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/13/2011 8:51:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/13/2011 8:51:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/13/2011 8:51:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
12/13/2011 8:51:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/13/2011 8:51:22 PM, Error: LSM [1048] - Terminal Service start failed. The relevant status code was This service cannot be started in Safe Mode .
12/13/2011 8:50:45 PM, Error: EventLog [6008] - The previous system shutdown at 8:48:55 PM on 12/13/2011 was unexpected.
12/13/2011 8:46:43 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
12/13/2011 5:53:26 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/13/2011 10:47:57 PM, Error: Microsoft-Windows-WMPNSS-Service [14346] - A new media server was not initialized because RegisterRunningDevice() encountered error '0x80070005'. Restart your computer, and then restart the WMPNetworkSvc service.
12/12/2011 11:54:43 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
12/12/2011 11:53:49 AM, Error: EventLog [6008] - The previous system shutdown at 10:49:02 PM on 12/11/2011 was unexpected.
.
==== End Of File ===========================
Do you want me to do another scan using MBAM? I followed the steps you posted in your previous response, I re-installed it using the link in step 5. When it tried to do the automatic update the same error message came up: An error has occurred. Please report this error code to our support team. PROGRAM_ERROR_UPDATING (2, 0, Connection refused) The system cannot find the file specified.
Broni
Posts: 56,041 +516
Let's leave MBAM alone for now.
Any current issues?
1. Download Security Check from HERE, and save it to your Desktop.
2. Download Temp File Cleaner (TFC)
3. Please run a free online scan with the ESET Online Scanner
Any current issues?
1. Download Security Check from HERE, and save it to your Desktop.
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.
2. Download Temp File Cleaner (TFC)
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
3. Please run a free online scan with the ESET Online Scanner
- Disable your antivirus program
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, click on List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
Results of screen317's Security Check version 0.99.24
Windows Vista x86 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Norton Internet Security (Symantec Corporation)
Norton Internet Security
Microsoft Security Essentials
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 17
Java(TM) SE Runtime Environment 6
Out of date Java installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
``````````End of Log````````````
Windows Vista x86 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Norton Internet Security (Symantec Corporation)
Norton Internet Security
Microsoft Security Essentials
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 17
Java(TM) SE Runtime Environment 6
Out of date Java installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
``````````End of Log````````````
Broni
Posts: 56,041 +516
You didn't say:
You're running two AV programs, Norton and MSE.
One of them has to go.
If Norton use this tool to uninstall it: https://www-secure.symantec.com/nor...&version=1&pvid=f-home&entsrc=redirect_pubweb
===============================================================
1. Update your Java version here: http://www.java.com/en/download/installed.jsp
Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.
2. Now, we need to remove old Java version and its remnants...
Download JavaRa to your desktop and unzip it to its own folder
You're running two AV programs, Norton and MSE.
One of them has to go.
If Norton use this tool to uninstall it: https://www-secure.symantec.com/nor...&version=1&pvid=f-home&entsrc=redirect_pubweb
===============================================================
1. Update your Java version here: http://www.java.com/en/download/installed.jsp
Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.
2. Now, we need to remove old Java version and its remnants...
Download JavaRa to your desktop and unzip it to its own folder
- Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
- Accept any prompts.
There are no current issues that I can see. There's a webcam app missing from my laptop but I'm sure I can reinstall it from the website, so that isn't that big of a deal. Everything else seems to be working correctly. Should I uninstall Norton first, before I complete the last 2 steps of your previous post?
Broni
Posts: 56,041 +516
Go here and download standalone installation file: https://www.techspot.com/downloads/6463-java-se.html
Windows 7, XP Offline
Windows 7, XP Offline
Broni
Posts: 56,041 +516
It's not. It's .exe file.
Here is a direct link: http://javadl.sun.com/webapps/download/AutoDL?BundleId=58124
Here is a direct link: http://javadl.sun.com/webapps/download/AutoDL?BundleId=58124
Latest posts
-
Boston Dynamics unveils impressive all-electric Atlas robot- stewi0001 replied
-
Pioneer's latest Blu-ray drive caters to disc diehards- captaincranky replied
-
Sony's Ghost of Tsushima brings familiar PlayStation features to PC- WhiteLeaff replied
-
PlayStation 5 Pro will be bigger, faster, and better using the same CPU- poshflamingos replied
-
The Best Phones: Top Picks for Every Price Range
- WhiteLeaff replied
