Computer Hope
Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: Dangit on November 25, 2012, 02:42:59 PM
-
I have no printer icon, no system restore, no add remove programs.. i have ran all the programs i was told to run and got all the logs..do i just copy and paste them here?
-
yes
-
# AdwCleaner v2.009 - Logfile created 11/25/2012 at 15:32:02
# Updated 24/11/2012 by Xplode
# Operating system : Windows Vista (TM) Ultimate (32 bits)
# User : Mike - MIKE-PC
# Boot Mode : Normal
# Running from : C:\Users\Mike\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9C0186F\adwcleaner[1].exe
# Option [Search]
***** [Services] *****
Found : WajamUpdater
***** [Files / Folders] *****
File Found : C:\Program Files\Mozilla FireFox\Components\AskSearch.js
Folder Found : C:\Program Files\Conduit
Folder Found : C:\Program Files\Inbox Toolbar
Folder Found : C:\Program Files\Wajam
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar
Folder Found : C:\ProgramData\Trymedia
Folder Found : C:\Users\Mike\AppData\Local\Conduit
Folder Found : C:\Users\Mike\AppData\Local\Wajam
Folder Found : C:\Users\Mike\AppData\LocalLow\Conduit
Folder Found : C:\Users\Mike\AppData\LocalLow\Inbox Toolbar
Folder Found : C:\Users\Mike\AppData\LocalLow\PriceGong
Folder Found : C:\Users\Mike\AppData\Roaming\DefaultTab
Folder Found : C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
Folder Found : C:\Users\Mike\AppData\Roaming\OpenCandy
Folder Found : C:\Users\Mike\Documents\ShopToWin
***** [Registry] *****
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\AppDataLow\Software\Freecause
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Default Tab
Key Found : HKCU\Software\Inbox Toolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{2E497885-E60B-420A-832D-0148B392E058}_is1
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wajam
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Found : HKCU\Software\Wajam
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}
Key Found : HKLM\SOFTWARE\Classes\FCTB000100565.FCTB000100565Pos
Key Found : HKLM\SOFTWARE\Classes\FCTB000100565.FCTB000100565Pos.1
Key Found : HKLM\SOFTWARE\Classes\FCTB000100565.IEToolbar
Key Found : HKLM\SOFTWARE\Classes\FCTB000100565.IEToolbar.1
Key Found : HKLM\SOFTWARE\Classes\FCTB000100565.JSOptionsImpl
Key Found : HKLM\SOFTWARE\Classes\FCTB000100565.JSOptionsImpl.1
Key Found : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook
Key Found : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1
Key Found : HKLM\SOFTWARE\Classes\Inbox.AppServer
Key Found : HKLM\SOFTWARE\Classes\Inbox.IBX404
Key Found : HKLM\SOFTWARE\Classes\Inbox.JSServer
Key Found : HKLM\SOFTWARE\Classes\Inbox.Toolbar
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3177532
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Default Tab
Key Found : HKLM\Software\Freeze.com
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Found : HKLM\Software\Inbox Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
Key Found : HKLM\Software\Wajam
Key Found : HKU\S-1-5-21-1636364814-333627397-1182125356-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Found : HKU\S-1-5-21-1636364814-333627397-1182125356-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [InboxToolbar]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18904
[HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
[HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
[HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
[HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
-\\ Google Chrome v [Unable to get version]
File : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [6267 octets] - [25/11/2012 15:32:02]
########## EOF - C:\AdwCleaner[R1].txt - [6327 octets] ##########
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Inbox Toolbar\Inbox.exe
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe
C:\Users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.com/
uSearch Bar = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
uSearch Page = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
uSearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
uURLSearchHooks: <No Name>: - LocalServer32 - <no file>
uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - c:\program files\microsoft\bingbar\7.1.391.0\BingExt.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Wajam: {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - c:\program files\wajam\ie\priam_bho.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: Inbox Toolbar: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - c:\program files\inbox toolbar\Inbox.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {EE146ACC-D881-1414-2148-B1D008B47ADB} - <orphaned>
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: &Inbox Toolbar: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - c:\program files\inbox toolbar\Inbox.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: &Inbox Toolbar: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - c:\program files\inbox toolbar\Inbox.dll
TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file>
TB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} -
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [InboxToolbar] "c:\program files\inbox toolbar\Inbox.exe" /STARTUP
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PC MightyMax 2012 Tray Icon] "c:\users\mike\appdata\local\pc mightymax 2012\TrayIcon.exe"
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-System: EnableLUA = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab
DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{DEAC3266-D705-465A-BC0D-84675868BA69} : DHCPNameServer = 192.168.1.254
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - c:\program files\inbox toolbar\Inbox.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2012-11-25 21:33:07 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-11-25 21:23:46 -------- d-----w- c:\program files\CCleaner
2012-11-25 00:52:37 -------- d-----w- c:\program files\Norton PC Checkup 3.0
2012-11-25 00:52:23 -------- d-----w- c:\programdata\Norton
2012-11-25 00:50:12 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2012-11-25 00:50:12 49472 ----a-w- c:\windows\system32\netfxperf.dll
2012-11-25 00:50:12 297808 ----a-w- c:\windows\system32\mscoree.dll
2012-11-25 00:50:12 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2012-11-25 00:50:12 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-11-25 00:48:42 -------- d-----w- c:\users\mike\appdata\roaming\PCCUStubInstaller
2012-11-23 00:11:45 -------- d-----w- c:\users\mike\appdata\roaming\licenses
2012-11-23 00:11:43 -------- d-----w- c:\users\mike\appdata\roaming\PCMM2009
2012-11-23 00:11:39 -------- d-----w- c:\users\mike\appdata\roaming\PCMM2012
2012-11-23 00:11:29 -------- d-----w- c:\users\mike\appdata\local\PC MightyMax 2012
2012-11-23 00:03:22 -------- d-----w- c:\users\mike\appdata\local\ElevatedDiagnostics
2012-11-22 19:34:23 -------- d-----w- c:\programdata\PC Optimizer Pro
2012-11-22 19:25:08 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2012-11-22 19:25:04 -------- d-----w- c:\programdata\W3i
2012-11-22 19:25:04 -------- d-----w- c:\program files\W3i
2012-11-22 19:24:18 -------- d-----w- c:\users\mike\appdata\roaming\DefaultTab
2012-11-18 22:46:03 -------- d-----w- c:\program files\Free Window Registry Repair
2012-11-18 22:45:39 -------- d-----w- c:\users\mike\appdata\local\Wajam
2012-11-18 22:45:35 -------- d-----w- c:\program files\Wajam
2012-11-18 22:43:15 -------- d-----w- c:\program files\Coupon Companion
2012-11-18 20:16:26 -------- d-----w- c:\windows\pss
2012-11-15 01:51:31 -------- d-----w- c:\programdata\HP Photo Creations
2012-11-15 01:51:31 -------- d-----w- c:\program files\HP Photo Creations
2012-11-15 01:51:27 -------- d-----w- c:\program files\Coupons
2012-11-15 01:49:56 -------- d-----w- c:\users\mike\appdata\local\HP
2012-11-04 16:54:11 -------- d-----w- c:\users\mike\appdata\local\Facebook
2012-11-04 16:24:14 -------- d-----w- c:\program files\Yahoo!
2012-11-03 00:56:22 5 ----a-w- c:\windows\system32\lMMLDeleteUserData42107612FX.tmp
.
==================== Find3M ====================
.
2012-11-22 19:19:42 74752 ----a-w- c:\windows\system32\spoolss.dll
2012-11-08 04:52:16 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-08 04:52:15 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-30 01:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-29 17:05:04 100344 ----a-w- c:\windows\HPBroker.dll
.
============= FINISH: 15:37:29.62 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 2/2/2009 1:07:09 AM
System Uptime: 11/25/2012 3:16:13 AM (12 hours ago)
.
Motherboard: Intel Corporation | | D945GCL
Processor: Intel(R) Celeron(R) D CPU 3.33GHz | LGA 775 | 3326/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 112 GiB total, 56.076 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
"Nero SoundTrax Help
Adobe Flash Player 11 ActiveX
Adobe Reader 9.1.3
Adobe Shockwave Player 11.6
Adobe SVG Viewer 3.0
Advertising Center
Bing Bar
Bing Rewards Client Installer
CCleaner
CDBurnerXP
Coupon Printer for Windows
DolbyFiles
ESET Smart Security
Facebook Messenger 2.1.4651.0
Free Window Registry Repair
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Deskjet 1000 J110 series Help
HP Deskjet 1000 J110 series Product Improvement Study
HP Photo Creations
HP Product Detection
HP Update
ImagXpress
Inbox Toolbar
Intel(R) Graphics Media Accelerator Driver
Java(TM) 6 Update 14
Java(TM) 6 Update 5
K-Lite Mega Codec Pack 4.4.5
Malwarebytes Anti-Malware version 1.65.1.1000
Menu Templates - Starter Kit
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Movie Templates - Starter Kit
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB973685)
Nero 7 Demo
Nero 9
Nero BurningROM
Nero BurnRights
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DriveSpeed
Nero Express
Nero InfoTool
Nero Installer
Nero Live
Nero Live Help
Nero PhotoSnap
Nero PhotoSnap Help
Nero Recode
Nero Recode Help
Nero Rescue Agent
Nero RescueAgent Help
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero WaveEditor
Nero WaveEditor Help
NeroBurningROM
NeroExpress
neroxml
Norton PC Checkup
OD5WEB
OGA Notifier 2.0.0048.0
Registry Checkup
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
Soft Data Fax Modem with SmartCP
SoundTrax
SupportSoft Assisted Service
swMSM
Uninstall Helper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760413) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Wajam
WORLDPAC speedDIAL
Yahoo! Messenger
Yahoo! Software Update
.
==== Event Viewer Messages From Past Week ========
.
11/18/2012 5:39:18 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
11/18/2012 5:39:18 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
11/18/2012 4:59:52 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC easdrv epfwtdi NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr Tcpip tdx Wanarpv6
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
11/18/2012 4:59:52 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
11/18/2012 4:59:02 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
11/18/2012 4:58:28 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
11/18/2012 4:58:28 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
11/18/2012 4:58:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/18/2012 4:58:20 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
.
==== End Of File ===========================
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org
Database version: v2012.11.25.06
Windows Vista x86 NTFS
Internet Explorer 8.0.6001.18904
Mike :: MIKE-PC [administrator]
11/25/2012 3:35:43 PM
mbam-log-2012-11-25 (15-35-43).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 189675
Time elapsed: 6 minute(s),
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
-
Why do I feel like I'm not gonna get any help with this lol
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Remove the Adware:
- Please close all open programs and internet browsers.
- Double click on adwcleaner.exe to run the tool.
- Click on Delete.
- Confirm each time with OK
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile in your reply.
- You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.
*********************************************************
Download Combofix from any of the links below, and save it to your DESKTOP.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
To prevent your anti-virus application interfering with ComboFix we need to disable it. See here (http://www.pchelpforum.com/anti-virus/110194-how-disable-your-security-applications-4.html) for a tutorial regarding how to do so if you are unsure.
- Close any open windows and double click ComboFix.exe to run it.
You will see the following image:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_disclaimer_ENG.png)
Click I Agree to start the program.
ComboFix will then extract the necessary files and you will see this:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_extraction.png)
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7
It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
If you did not have it installed, you will see the prompt below. Choose YES.
(http://i424.photobucket.com/albums/pp322/digistar/RcAuto1.gif)
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
(http://i424.photobucket.com/albums/pp322/digistar/whatnext.png)
Click on Yes, to continue scanning for malware.
When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.
Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
-
ComboFix 12-11-25.01 - Mike 11/25/2012 17:12:15.1.1 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1013.410 [GMT -6:00]
Running from: c:\users\Mike\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Mike\AppData\Roaming\DefaultTab\DefaultTab
c:\users\Mike\Documents\ShopToWin
c:\windows\system32\DEBUG.log
.
.
((((((((((((((((((((((((( Files Created from 2012-10-25 to 2012-11-25 )))))))))))))))))))))))))))))))
.
.
2012-11-25 21:57 . 2012-11-25 21:57 -------- d-----w- c:\program files\Trend Micro
2012-11-25 21:23 . 2012-11-25 21:23 -------- d-----w- c:\program files\CCleaner
2012-11-25 00:52 . 2012-11-25 00:53 -------- d-----w- c:\program files\Norton PC Checkup 3.0
2012-11-25 00:52 . 2012-11-25 00:53 -------- d-----w- c:\programdata\Norton
2012-11-25 00:50 . 2009-11-08 16:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2012-11-25 00:50 . 2009-11-08 16:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2012-11-25 00:50 . 2009-11-08 16:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2012-11-25 00:50 . 2009-11-08 16:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2012-11-25 00:50 . 2009-11-08 16:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-11-25 00:48 . 2012-11-25 00:48 -------- d-----w- c:\users\Mike\AppData\Roaming\PCCUStubInstaller
2012-11-23 00:11 . 2012-11-23 00:11 -------- d-----w- c:\users\Mike\AppData\Roaming\licenses
2012-11-23 00:11 . 2012-11-23 00:11 -------- d-----w- c:\users\Mike\AppData\Roaming\PCMM2009
2012-11-23 00:11 . 2012-11-23 00:11 -------- d-----w- c:\users\Mike\AppData\Roaming\PCMM2012
2012-11-23 00:11 . 2012-11-25 21:09 -------- d-----w- c:\users\Mike\AppData\Local\PC MightyMax 2012
2012-11-23 00:03 . 2012-11-23 00:03 -------- d-----w- c:\users\Mike\AppData\Local\ElevatedDiagnostics
2012-11-22 19:34 . 2012-11-22 19:34 -------- d-----w- c:\programdata\PC Optimizer Pro
2012-11-22 19:25 . 2012-11-22 19:25 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2012-11-22 19:25 . 2012-11-22 19:25 -------- d-----w- c:\programdata\W3i
2012-11-22 19:25 . 2012-11-22 19:25 -------- d-----w- c:\program files\W3i
2012-11-22 19:24 . 2012-11-25 23:31 -------- d-----w- c:\users\Mike\AppData\Roaming\DefaultTab
2012-11-20 23:32 . 2012-11-20 23:32 -------- d-----w- c:\windows\Sun
2012-11-20 23:25 . 2012-11-20 23:25 -------- d-----w- c:\program files\Hewlett-Packard
2012-11-18 22:46 . 2012-11-18 22:53 -------- d-----w- c:\program files\Free Window Registry Repair
2012-11-18 22:45 . 2012-11-18 22:45 -------- d-----w- c:\users\Mike\AppData\Local\Wajam
2012-11-18 22:45 . 2012-11-18 22:45 -------- d-----w- c:\program files\Wajam
2012-11-18 22:43 . 2012-11-18 22:43 -------- d-----w- c:\program files\Coupon Companion
2012-11-15 01:51 . 2012-11-18 20:18 -------- d-----w- c:\program files\Microsoft Silverlight
2012-11-15 01:51 . 2012-11-15 01:54 -------- d-----w- c:\programdata\HP Photo Creations
2012-11-15 01:51 . 2012-11-15 01:51 -------- d-----w- c:\program files\HP Photo Creations
2012-11-15 01:51 . 2012-11-15 01:51 -------- d-----w- c:\program files\Coupons
2012-11-15 01:49 . 2012-11-15 01:49 -------- d-----w- c:\users\Mike\AppData\Local\HP
2012-11-04 16:54 . 2012-11-04 16:55 -------- d-----w- c:\users\Mike\AppData\Local\Facebook
2012-11-04 16:26 . 2012-11-22 19:24 -------- d-----w- c:\programdata\Yahoo!
2012-11-04 16:24 . 2012-11-22 19:24 -------- d-----w- c:\program files\Yahoo!
2012-11-03 00:56 . 2012-11-03 00:56 5 ----a-w- c:\windows\system32\lMMLDeleteUserData42107612FX.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-22 19:19 . 2005-02-24 03:40 74752 ----a-w- c:\windows\system32\spoolss.dll
2012-11-08 04:52 . 2012-06-26 15:19 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-08 04:52 . 2012-06-26 15:19 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-30 01:54 . 2012-10-20 19:40 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-29 17:05 . 2012-08-29 17:05 100344 ----a-w- c:\windows\HPBroker.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]
2012-06-11 22:22 1307728 ----a-w- c:\program files\Microsoft\BingBar\7.1.391.0\BingExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-06-11 1447168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-16 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"InboxToolbar"="c:\program files\Inbox Toolbar\Inbox.exe" [2012-08-01 1641176]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-09-30 766536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Mike^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk]
backup=c:\windows\pss\Facebook Messenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-11-04 16:54 138096 ----atw- c:\users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2012-05-25 10:25 6595928 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBCore]
2008-09-24 20:32 1561896 ----a-w- c:\program files\Common Files\Nero\Nero BackItUp 4\NBCore.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-02-10 17:53 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1636364814-333627397-1182125356-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMPROTECTOR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-26 04:52]
.
2012-11-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1636364814-333627397-1182125356-1000Core.job
- c:\users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-04 16:54]
.
2012-11-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1636364814-333627397-1182125356-1000UA.job
- c:\users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-04 16:54]
.
2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 17:53]
.
2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 17:53]
.
2012-11-25 c:\windows\Tasks\User_Feed_Synchronization-{6F72D3F2-644A-494D-8BBD-F38BF346A180}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = https://www.google.com/
uSearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms}
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: mitchell1.com\vintage
Trusted Zone: ondemand5.com\www
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
BHO-{EE146ACC-D881-1414-2148-B1D008B47ADB} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{2D922B81-34C7-4AAB-9C5D-433E79FC9445} - (no file)
HKLM-Run-PC MightyMax 2012 Tray Icon - c:\users\Mike\AppData\Local\PC MightyMax 2012\TrayIcon.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-25 17:32
Windows 6.0.6000 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-11-25 17:34:30
ComboFix-quarantined-files.txt 2012-11-25 23:34
.
Pre-Run: 60,086,198,272 bytes free
Post-Run: 60,058,845,184 bytes free
.
- - End Of File - - 486B347D5F2BB0F336436B8C0F6B41CC
-
I didnt run the adware remover.. will do that as soon as i get home.. sorry for the delay
-
# AdwCleaner v2.010 - Logfile created 11/29/2012 at 20:15:45
# Updated 29/11/2012 by Xplode
# Operating system : Windows Vista (TM) Ultimate (32 bits)
# User : Mike - MIKE-PC
# Boot Mode : Normal
# Running from : C:\Users\Mike\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0LTNRKWQ\adwcleaner[1].exe
# Option [Delete]
***** [Services] *****
Stopped & Deleted : WajamUpdater
***** [Files / Folders] *****
File Deleted : C:\Program Files\Mozilla FireFox\Components\AskSearch.js
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Inbox Toolbar
Folder Deleted : C:\Program Files\Wajam
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\Users\Mike\AppData\Local\Conduit
Folder Deleted : C:\Users\Mike\AppData\Local\Wajam
Folder Deleted : C:\Users\Mike\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Mike\AppData\LocalLow\Inbox Toolbar
Folder Deleted : C:\Users\Mike\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Mike\AppData\Roaming\DefaultTab
Folder Deleted : C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
Folder Deleted : C:\Users\Mike\AppData\Roaming\OpenCandy
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Default Tab
Key Deleted : HKCU\Software\Inbox Toolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{2E497885-E60B-420A-832D-0148B392E058}_is1
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wajam
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041D03E-FD4B-44E0-B742-2D9B88305F98}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKCU\Software\Wajam
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000100565.FCTB000100565Pos
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000100565.FCTB000100565Pos.1
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000100565.IEToolbar
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000100565.IEToolbar.1
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000100565.JSOptionsImpl
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000100565.JSOptionsImpl.1
Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook
Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1
Key Deleted : HKLM\SOFTWARE\Classes\Inbox.AppServer
Key Deleted : HKLM\SOFTWARE\Classes\Inbox.IBX404
Key Deleted : HKLM\SOFTWARE\Classes\Inbox.JSServer
Key Deleted : HKLM\SOFTWARE\Classes\Inbox.Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3177532
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Default Tab
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKLM\Software\Inbox Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
Key Deleted : HKLM\Software\Wajam
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [InboxToolbar]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18904
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=US&userid=29a25b9b-1be4-476c-b731-0087d8b4e7e0&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
-\\ Google Chrome v [Unable to get version]
File : C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [6396 octets] - [25/11/2012 15:32:02]
AdwCleaner[S1].txt - [10090 octets] - [29/11/2012 20:15:45]
########## EOF - C:\AdwCleaner[S1].txt - [10151 octets] ##########
-
ComboFix 12-11-25.01 - Mike 11/29/2012 20:27:07.2.1 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1013.431 [GMT -6:00]
Running from: c:\users\Mike\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
.
.
((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-30 )))))))))))))))))))))))))))))))
.
.
2012-11-30 02:35 . 2012-11-30 02:35 -------- d-----w- c:\users\Mike\AppData\Local\temp
2012-11-30 02:35 . 2012-11-30 02:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-26 01:01 . 2012-11-29 00:58 -------- d-----w- c:\program files\Common Files\Symantec Shared
2012-11-26 00:56 . 2012-11-26 00:56 -------- d-----w- c:\programdata\Symantec
2012-11-25 21:57 . 2012-11-25 21:57 -------- d-----w- c:\program files\Trend Micro
2012-11-25 21:23 . 2012-11-25 21:23 -------- d-----w- c:\program files\CCleaner
2012-11-25 00:52 . 2012-11-29 00:53 -------- d-----w- c:\program files\Norton PC Checkup 3.0
2012-11-25 00:52 . 2012-11-25 00:53 -------- d-----w- c:\programdata\Norton
2012-11-25 00:50 . 2009-11-08 16:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2012-11-25 00:50 . 2009-11-08 16:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2012-11-25 00:50 . 2009-11-08 16:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2012-11-25 00:50 . 2009-11-08 16:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2012-11-25 00:50 . 2009-11-08 16:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-11-25 00:48 . 2012-11-25 00:48 -------- d-----w- c:\users\Mike\AppData\Roaming\PCCUStubInstaller
2012-11-23 00:11 . 2012-11-23 00:11 -------- d-----w- c:\users\Mike\AppData\Roaming\licenses
2012-11-23 00:11 . 2012-11-23 00:11 -------- d-----w- c:\users\Mike\AppData\Roaming\PCMM2009
2012-11-23 00:11 . 2012-11-23 00:11 -------- d-----w- c:\users\Mike\AppData\Roaming\PCMM2012
2012-11-23 00:11 . 2012-11-25 21:09 -------- d-----w- c:\users\Mike\AppData\Local\PC MightyMax 2012
2012-11-23 00:03 . 2012-11-23 00:03 -------- d-----w- c:\users\Mike\AppData\Local\ElevatedDiagnostics
2012-11-22 19:34 . 2012-11-22 19:34 -------- d-----w- c:\programdata\PC Optimizer Pro
2012-11-22 19:25 . 2012-11-22 19:25 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2012-11-22 19:25 . 2012-11-22 19:25 -------- d-----w- c:\programdata\W3i
2012-11-22 19:25 . 2012-11-22 19:25 -------- d-----w- c:\program files\W3i
2012-11-20 23:32 . 2012-11-20 23:32 -------- d-----w- c:\windows\Sun
2012-11-20 23:25 . 2012-11-20 23:25 -------- d-----w- c:\program files\Hewlett-Packard
2012-11-18 22:46 . 2012-11-18 22:53 -------- d-----w- c:\program files\Free Window Registry Repair
2012-11-18 22:43 . 2012-11-18 22:43 -------- d-----w- c:\program files\Coupon Companion
2012-11-15 01:51 . 2012-11-18 20:18 -------- d-----w- c:\program files\Microsoft Silverlight
2012-11-15 01:51 . 2012-11-15 01:54 -------- d-----w- c:\programdata\HP Photo Creations
2012-11-15 01:51 . 2012-11-15 01:51 -------- d-----w- c:\program files\HP Photo Creations
2012-11-15 01:51 . 2012-11-15 01:51 -------- d-----w- c:\program files\Coupons
2012-11-15 01:49 . 2012-11-15 01:49 -------- d-----w- c:\users\Mike\AppData\Local\HP
2012-11-04 16:54 . 2012-11-04 16:55 -------- d-----w- c:\users\Mike\AppData\Local\Facebook
2012-11-04 16:26 . 2012-11-22 19:24 -------- d-----w- c:\programdata\Yahoo!
2012-11-04 16:24 . 2012-11-22 19:24 -------- d-----w- c:\program files\Yahoo!
2012-11-03 00:56 . 2012-11-03 00:56 5 ----a-w- c:\windows\system32\lMMLDeleteUserData42107612FX.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-22 19:19 . 2005-02-24 03:40 74752 ----a-w- c:\windows\system32\spoolss.dll
2012-11-08 04:52 . 2012-06-26 15:19 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-08 04:52 . 2012-06-26 15:19 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-30 01:54 . 2012-10-20 19:40 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]
2012-06-11 22:22 1307728 ----a-w- c:\program files\Microsoft\BingBar\7.1.391.0\BingExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-10 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-06-11 1447168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-16 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Mike^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk]
backup=c:\windows\pss\Facebook Messenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-11-04 16:54 138096 ----atw- c:\users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2012-05-25 10:25 6595928 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBCore]
2008-09-24 20:32 1561896 ----a-w- c:\program files\Common Files\Nero\Nero BackItUp 4\NBCore.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-02-10 17:53 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1636364814-333627397-1182125356-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-26 04:52]
.
2012-11-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1636364814-333627397-1182125356-1000Core.job
- c:\users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-04 16:54]
.
2012-11-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1636364814-333627397-1182125356-1000UA.job
- c:\users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-04 16:54]
.
2012-11-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-10 12:35]
.
2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 17:53]
.
2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-10 17:53]
.
2012-11-29 c:\windows\Tasks\User_Feed_Synchronization-{6F72D3F2-644A-494D-8BBD-F38BF346A180}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = https://www.google.com/
uSearchAssistant = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: mitchell1.com\vintage
Trusted Zone: ondemand5.com\www
TCP: DhcpNameServer = 192.168.1.254
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-29 20:35
Windows 6.0.6000 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-11-29 20:37:42
ComboFix-quarantined-files.txt 2012-11-30 02:37
ComboFix2.txt 2012-11-25 23:34
.
Pre-Run: 58,526,154,752 bytes free
Post-Run: 58,558,447,616 bytes free
.
- - End Of File - - 49C2CFBE2E1034368A38B25BF1DAC1AA
-
Download Security Check by screen317 from one of the following links and save it to your desktop.
Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)
* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.
Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
************************************************
Re-running ComboFix to remove infections:
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Open notepad and copy/paste the text in the quotebox below into it:
KillAll::
Firefox::
Trusted Zone: mitchell1.com\vintage
Trusted Zone: ondemand5.com\www
DDS::
Trusted Zone: mitchell1.com\vintage
Trusted Zone: ondemand5.com\www
- Save this as CFScript.txt, in the same location as ComboFix.exe
(http://i424.photobucket.com/albums/pp322/digistar/cfscriptb4.gif)
- Referring to the picture above, drag CFScript into ComboFix.exe
- When finished, it shall produce a log for you at C:\ComboFix.txt
- I don't need to see the log from this transaction.
******************************************
- Download RogueKiller (http://tigzy.geekstogo.com/Tools/RogueKiller.exe) on the desktop
- Close all the running programs
- Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
- Otherwise just double-click on RogueKiller.exe
- Pre-scan will start. Let it finish.
- Click on SCAN button.
- A report (RKreport.txt) should open. Post its content in your next reply. (RKreport could also be found on your desktop)
- If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
-
Results of screen317's Security Check version 0.99.56
Windows Vista x86 (UAC is disabled!)
Out of date service pack!! (http://support.microsoft.com/kb/935791)[/b]
Internet Explorer 8 Out of date!
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````[/u]
Out of date HijackThis installed!
Malwarebytes Anti-Malware version 1.65.1.1000
HijackThis 2.0.2
CCleaner
Java(TM) 6 Update 14
Java(TM) 6 Update 5
Java version out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Google Chrome 21.0.1180.83
Google Chrome 21.0.1180.89
Google Chrome 22.0.1229.79
Google Chrome 22.0.1229.92
Google Chrome 22.0.1229.94
Google Chrome 23.0.1271.64
Google Chrome 23.0.1271.91
````````Process Check: objlist.exe by Laurent````````[/u]
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: 0 %
````````````````````End of Log``````````````````````[/u]
-
RogueKiller V8.3.1 [Nov 29 2012] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows Vista (6.0.6000 ) 32 bits version
Started in : Normal mode
User : Mike [Admin rights]
Mode : Scan -- Date : 11/29/2012 21:23:38
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 7 ¤¤¤
[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD1200JS-00NCB1 ATA Device +++++
--- User ---
[MBR] 3c35e27abcd71d12c6d249aee28cc65b
[BSP] 193ac0b078a6224bd17145b7a6b9c6a9 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 114463 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_11292012_02d2123.txt >>
RKreport[1]_S_11292012_02d2123.txt
-
1. Download this diagnostics tool MGADiag.ext (http://go.microsoft.com/fwlink/?linkid=52012) and save this to your Desktop.
2. Double-click on MGADiag.exe and click Continue
3. When the program has finished, click on Copy
4. Post the results in your next reply.
***********************************************
Please do this even if you don't have the OS disk.
Do you have your OS CD/DVD?
If so,
1/ Click the Start button.
2/ From the Start Menu, Click All programs followed by Accessories.
3/ In the Accessories menu, Right Click on the Command Prompt option.
4/ From the drop down menu that appears, Click on the Run as administrator option.
5/ If you have the User Account Control (UAC) enabled you will be asked for authorisation prior to the command prompt opening. You may simply need to press the Continue button if you are the administrator or insert the administrator password etc.
6/ In the Command Prompt window, type: sfc /scannow and then press Enter.
7/ A message will appear stating that the system scan will begin.
8/ Be patient because the scan may take some time.
9/ If any files require replacing SFC will replace them. You may be asked to insert your Vista DVD for this process to continue.
10/ If everything is okay you should, after the scan, see the following message Windows resource protection did not find any integrity violations.
11/ After the scan has completed, Close the command prompt window.
-
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Genuine
Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-9364X-37XGX-24W6P
Windows Product Key Hash: aA067NOL80NWIZ94L6hWVdZMoIo=
Windows Product ID: 89580-OEM-7332132-00141
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.0.6000.2.00010100.0.0.001
ID: {70781165-46D6-4D2D-96DD-4BA80A5D51DA}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows Vista (TM) Ultimate
Architecture: 0x00000000
Build lab: 6000.vista_gdr.100218-0019
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: 6.0.6002.16398
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 103 Blocked VLK
Microsoft Office Enterprise 2007 - 103 Blocked VLK
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\printui.dll[Hr = 0x80070002]
File Mismatch: C:\Windows\system32\puiapi.dll[Hr = 0x80070002]
File Mismatch: C:\Windows\system32\inetcomm.dll[Hr = 0x80070002]
File Mismatch: C:\Windows\system32\msoert2.dll[Hr = 0x80070002]
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{70781165-46D6-4D2D-96DD-4BA80A5D51DA}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6000.2.00010100.0.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-24W6P</PKey><PID>89580-OEM-7332132-00141</PID><PIDType>2</PIDType><SID>S-1-5-21-1636364814-333627397-1182125356</SID><SYSTEM><Manufacturer>EMACHINES</Manufacturer><Model>T3604</Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>CF94510J.15A.0028.2006.1213.1629</Version><SMBIOSVersion major="2" minor="4"/><Date>20061213000000.000000+000</Date></BIOS><HWID>42303507018400E6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>M07 </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>ACD7202654E586</Val><Hash>fFic3JgCreGGRxyF8uMWB4R4Jcg=</Hash><Pid>89388-707-1528066-65945</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="103"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="103"/><App Id="1A" Version="12" Result="103"/><App Id="1B" Version="12" Result="103"/><App Id="44" Version="12" Result="103"/><App Id="A1" Version="12" Result="103"/><App Id="BA" Version="12" Result="103"/></Applications></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.0.6000.16509
Name: Windows(TM) Vista, Ultimate edition
Description: Windows Operating System - Vista, OEM_SLP channel
Activation ID: 5e802570-4657-4e84-bfbc-6a0e531b84af
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 89580-00146-321-300141-02-1033-6000.0000-0322009
Installation ID: 018324667683941982250213195900750383569 374900702193552
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57201
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57203
Use License URL: http://go.microsoft.com/fwlink/?LinkId=57205
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57204
Partial Product Key: 24W6P
License Status: Licensed
Windows Activation Technologies-->
N/A
HWID Data-->
HWID Hash Current: NgAAAAIABAABAAEAAQABAAAAAgABAAEAnJ/u8K7o0JYgYeRuSOSqdjRmsmDy9Di40F+sVhpL
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20000
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GATEWA SYSTEM
FACP GATEWA SYSTEM
HPET GATEWA SYSTEM
MCFG GATEWA SYSTEM
WDDT GATEWA SYSTEM
ASF! GATEWA SYSTEM
SLIC DELL M07
-
Were you able to do the SFC thingy?
-
yes... i dont have the cd.. but im looking for the log file now.. one sec
-
2012-11-25 16:17:19, Info CBS Loaded Servicing Stack v6.0.6002.18005 with Core: C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6002.18005_none_0b4ada54c46c45b0\cbscore.dll
2012-11-25 16:17:19, Info CSI 00000001@2012/11/25:22:17:19.325 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x69778a50 @0x6bbf854e @0x6bbd63a1 @0x71213c @0x711ebb @0x711949)
2012-11-25 16:17:19, Info CBS Could not load SrClient DLL from path: SrClient.dll. Continuing without system restore points.
2012-11-25 16:17:19, Info CSI 00000002@2012/11/25:22:17:19.340 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x69778a50 @0x6bc2e7b6 @0x6bc10f93 @0x71213c @0x711ebb @0x711949)
2012-11-25 16:17:19, Info CSI 00000003@2012/11/25:22:17:19.340 WcpInitialize (wcp.dll version 0.0.0.5) called (stack @0x69778a50 @0x73ed1a0d @0x73ed1794 @0x713397 @0x7129f6 @0x711949)
2012-11-25 16:17:19, Info CBS NonStart: Checking to ensure startup processing was not required.
2012-11-25 16:17:19, Info CSI 00000004 IAdvancedInstallerAwareStore_ResolvePen dingTransactions (call 1) (flags = 00000004, progress = NULL, phase = 0, pdwDisposition = @0x65fd88
2012-11-25 16:17:19, Info CBS NonStart: Success, startup processing not required as expected.
2012-11-25 16:17:19, Info CSI 00000005 CSI Store 3362432 (0x00334e80) initialized
2012-11-25 16:17:19, Info CBS Session: 30264154:2723861037 initialized.
2012-11-25 16:17:19, Info CBS Session: 30264154:2723861037 finalized. Reboot required: no
2012-11-25 16:17:19, Info CBS Session: 30264154:2726825037 initialized.
2012-11-25 16:17:19, Info CBS Read out cached package applicability for package: Package_for_KB937287~31bf3856ad364e35~x86~~6.0.1.18000, ApplicableState: 7, CurrentState:8
2012-11-25 16:17:19, Info CBS Session: 30264154:2726825037 finalized. Reboot required: no
2012-11-25 16:17:19, Info CBS Session: 30264154:2727449037 initialized.
2012-11-25 16:17:19, Info CBS Read out cached package applicability for package: Microsoft-Windows-DreamScene-Package.16503-TopLevel~31bf3856ad364e35~x86~~6.0.6000.16504, ApplicableState: 7, CurrentState:0
2012-11-25 16:17:19, Info CBS Session: 30264154:2727449037 finalized. Reboot required: no
2012-11-25 16:17:19, Info CBS Session: 30264154:2728541037 initialized.
2012-11-25 16:17:19, Info CBS Session: 30264154:2728541037 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2730413037 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2730413037 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2730569037 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2730569037 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2730569038 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2730569038 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2730569039 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2730569039 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2734313037 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2734313037 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2734469037 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2734469037 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2734469038 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2734469038 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2734469039 initialized.
2012-11-25 16:17:20, Info CBS Session: 30264154:2734469039 finalized. Reboot required: no
2012-11-25 16:17:20, Info CBS Session: 30264154:2736341037 initialized.
2012-11-25 16:17:20, Info CBS Read out cached package applicability for package: Package_for_KB938371~31bf3856ad364e35~x86~~6.0.2.27, ApplicableState: 7, CurrentState:8
2012-11-25 16:17:20, Info CBS Session: 30264154:2736341037 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744609037 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744609037 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744609038 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744609038 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765037 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765037 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765038 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765038 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765039 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765039 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765040 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765040 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765041 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765041 finalized. Reboot required: no
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765042 initialized.
2012-11-25 16:17:21, Info CBS Session: 30264154:2744765042 finalized. Reboot required: no
2012-11-25 16:17:22, Info CBS Session: 30264154:2750069037 initialized.
2012-11-25 16:17:22, Info CBS Read out cached package applicability for package: Package_for_KB955430~31bf3856ad364e35~x86~~6.0.1.18005, ApplicableState: 7, CurrentState:8
2012-11-25 16:17:22, Info CBS Session: 30264154:2750069037 finalized. Reboot required: no
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437037 initialized.
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437037 finalized. Reboot required: no
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437038 initialized.
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437038 finalized. Reboot required: no
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437039 initialized.
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437039 finalized. Reboot required: no
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437040 initialized.
2012-11-25 16:17:26, Info CBS Session: 30264154:2793437040 finalized. Reboot required: no
2012-11-25 16:18:10, Info CBS Session: 30264154:3235579037 initialized.
2012-11-25 16:18:10, Info CBS Read out cached package applicability for package: Package_for_KB972270~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:10, Info CBS Session: 30264154:3235579037 finalized. Reboot required: no
2012-11-25 16:18:10, Info CBS Session: 30264154:3236047037 initialized.
2012-11-25 16:18:10, Info CBS Read out cached package applicability for package: Package_for_KB978207~31bf3856ad364e35~x86~~8.0.1.1, ApplicableState: 0, CurrentState:7
2012-11-25 16:18:10, Info CBS Session: 30264154:3236047037 finalized. Reboot required: no
2012-11-25 16:18:10, Info CBS Session: 30264154:3236047038 initialized.
2012-11-25 16:18:10, Info CBS Read out cached package applicability for package: Package_for_KB971961~31bf3856ad364e35~x86~~8.0.1.1, ApplicableState: 0, CurrentState:7
2012-11-25 16:18:10, Info CBS Session: 30264154:3236047038 finalized. Reboot required: no
2012-11-25 16:18:10, Info CBS Session: 30264154:3236515037 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB979306~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:11, Info CBS Session: 30264154:3236515037 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3244783037 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB953733~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:11, Info CBS Session: 30264154:3244783037 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3244939037 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB938194~31bf3856ad364e35~x86~~6.0.1.2, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:11, Info CBS Session: 30264154:3244939037 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3244939038 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB971468~31bf3856ad364e35~x86~~6.0.1.2, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:11, Info CBS Session: 30264154:3244939038 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3245407037 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB946253~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:11, Info CBS Session: 30264154:3245407037 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3245407038 initialized.
2012-11-25 16:18:11, Info CBS Session: 30264154:3245407038 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3245563037 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB959108~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:11, Info CBS Session: 30264154:3245563037 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3245563038 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB974306~31bf3856ad364e35~x86~~6.0.1.2, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:11, Info CBS Session: 30264154:3245563038 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3246811037 initialized.
2012-11-25 16:18:11, Info CBS Read out cached package applicability for package: Package_for_KB929123~31bf3856ad364e35~x86~~6.0.1.4, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:11, Info CBS Session: 30264154:3246811037 finalized. Reboot required: no
2012-11-25 16:18:11, Info CBS Session: 30264154:3247123037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB967723~31bf3856ad364e35~x86~~6.0.1.7, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3247123037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3251803037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB941649~31bf3856ad364e35~x86~~6.0.2.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3251803037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3251803038 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB946026~31bf3856ad364e35~x86~~6.0.1.3, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3251803038 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3251959037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB970710~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3251959037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3251959038 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB973687~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3251959038 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3252115037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB969947~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3252115037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3252427037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB972592~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:12, Info CBS Session: 30264154:3252427037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3252583037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB957000~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:12, Info CBS Session: 30264154:3252583037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3252739037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB948609~31bf3856ad364e35~x86~~6.0.6001.3053, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3252739037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3252895037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB958481~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3252895037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3253207037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB948610~31bf3856ad364e35~x86~~6.0.6001.2123, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3253207037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3253363037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB958483~31bf3856ad364e35~x86~~6.0.1.2, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3253363037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3253675037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB975467~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3253675037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3254923037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB937077~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3254923037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3255079037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB942831~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:12, Info CBS Session: 30264154:3255079037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3255079038 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB980232~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3255079038 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3255235037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB930178~31bf3856ad364e35~x86~~6.0.1.7, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3255235037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3255391037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB968816~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3255391037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3255547037 initialized.
2012-11-25 16:18:12, Info CBS Session: 30264154:3255547037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3256015037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB979683~31bf3856ad364e35~x86~~6.0.1.3, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3256015037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3256015038 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB981332~31bf3856ad364e35~x86~~8.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3256015038 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3256171037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB971737~31bf3856ad364e35~x86~~6.0.1.3, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3256171037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3256327037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB938123~31bf3856ad364e35~x86~~6.0.1.5, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3256327037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3256639037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB925028~31bf3856ad364e35~x86~~6.0.0.1, ApplicableState: 0, CurrentState:0
2012-11-25 16:18:12, Info CBS Session: 30264154:3256639037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3256951037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB958623~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3256951037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3257575037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB931099~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:12, Info CBS Session: 30264154:3257575037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3257575038 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB960803~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 4, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3257575038 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3257887037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_1_for_KB946456~31bf3856ad364e35~x86~~6.0.1.4, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3257887037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3258043037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB981349~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:12, Info CBS Session: 30264154:3258043037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3258355037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB973507~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3258355037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3258511037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB936824~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3258511037 finalized. Reboot required: no
2012-11-25 16:18:12, Info CBS Session: 30264154:3258667037 initialized.
2012-11-25 16:18:12, Info CBS Read out cached package applicability for package: Package_for_KB956802~31bf3856ad364e35~x86~~6.0.1.3, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:12, Info CBS Session: 30264154:3258667037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3259447037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB946041~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3259447037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3259759037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB974468~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3259759037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3259915037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB974467~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3259915037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3260071037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB971032~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3260071037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3261163037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_1_for_KB936357~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3261163037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3261163038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB952004~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3261163038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3261475037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB975254~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3261475037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3261631037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB971657~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3261631037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3261943037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB956744~31bf3856ad364e35~x86~~6.0.1.8, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3261943037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3262099037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB972591~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 0, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3262099037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3262099038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB976662~31bf3856ad364e35~x86~~8.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3262099038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3262255037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB950974~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3262255037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3262567037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB954154~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3262567037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3262723037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB955069~31bf3856ad364e35~x86~~6.0.1.2, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3262723037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3262723038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_1_for_KB929399~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3262723038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3263191037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB976470~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3263191037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3263347037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB941651~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3263347037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3263347038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB958644~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3263347038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3266311037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB953631~31bf3856ad364e35~x86~~6.0.1.3, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3266311037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3266311038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB973540~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3266311038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3266623037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB975561~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 0, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3266623037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3266623038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB958869~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3266623038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3266883037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB961501~31bf3856ad364e35~x86~~6.0.1.1, ApplicableState: 4, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3266883037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3267113037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB975560~31bf3856ad364e35~x86~~6.0.1.5, ApplicableState: 7, CurrentState:7
2012-11-25 16:18:13, Info CBS Session: 30264154:3267113037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3267213037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Package_for_KB950124~31bf3856ad364e35~x86~~6.0.1.0, ApplicableState: 0, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3267213037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3267979037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~de-DE~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3267979037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268135037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~zh-CN~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268135037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268135038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~ja-JP~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268135038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268135039 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~ar-SA~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268135039 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268291037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~zh-TW~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268291037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268291038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~cs-CZ~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268291038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268291039 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~el-GR~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268291039 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268447037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~es-ES~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268447037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268447038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~fi-FI~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268447038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268447039 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~fr-FR~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268447039 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268603037 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~he-IL~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268603037 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268603038 initialized.
2012-11-25 16:18:13, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~hu-HU~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:13, Info CBS Session: 30264154:3268603038 finalized. Reboot required: no
2012-11-25 16:18:13, Info CBS Session: 30264154:3268603039 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~it-IT~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3268603039 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269071037 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~ko-KR~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269071037 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269227037 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~nl-NL~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269227037 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269227038 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~nb-NO~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269227038 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269227039 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~pl-PL~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269227039 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269383037 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~pt-BR~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269383037 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269383038 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~pt-PT~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269383038 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269383039 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~ru-RU~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269383039 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269539037 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~sv-SE~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269539037 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269539038 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~tr-TR~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269539038 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269539039 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LanguagePack~31bf3856ad364e35~x86~bg-BG~8.0.6001.18702, ApplicableState: 7, CurrentState:0
2012-11-25 16:18:14, Info CBS Session: 30264154:3269539039 finalized. Reboot required: no
2012-11-25 16:18:14, Info CBS Session: 30264154:3269695037 initialized.
2012-11-25 16:18:14, Info CBS Read out cached package applicability for package: Microsoft-Windows-InternetExplorer-8-LIPPack~31bf3856ad364e35~x86~bs-LATN-BA~8.0.6001.18702, ApplicableState: 7, CurrentState:0
201
-
Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\Users\Mike>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.Windows Resource Protection found corrupt files but w
as unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log
C:\Users\Mike>
-
it says the file is to large to post.. that wasnt the whole log.. dunno what happened...
-
it says the file is to large to post.. that wasnt the whole log.. dunno what happened...
That's ok. I didn't need to see the log.
Run the Vista Recovery Console.
1. Eject and remove any discs or memory cards from your computer.
2. Click the "Start" button on the desktop to open the Start menu, click the small arrow icon to the right of the lock icon and select "Restart".
3. Hold the "F8" key on your computer's keyboard as Windows Vista reboots.
4. Highlight and select "Repair your computer" choose your keyboard type and click "Next".
5. Choose your user name, type your password if prompted and click "OK" to access the System Recovery Options menu.
-
I don't have the option to repair computer...only have the option for safe mode etc...
-
I don't have the option to repair computer...only have the option for safe mode etc...
That's strange. Let's do some more checking.
Download DDS from HERE (http://download.bleepingcomputer.com/sUBs/dds.scr) or HERE (http://www.forospyware.com/sUBs/dds) and save it to your desktop.
Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)
* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs.
* Save both reports to your desktop.
* The instructions here ask you to attach the Attach.txt.
(http://i424.photobucket.com/albums/pp322/digistar/DDS.jpg)
1) DDS.txt
2) Attach.txt
Instead of attaching, please copy/past both logs into your Thread
Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.
•Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run.
After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE (http://www.bleepingcomputer.com/forums/topic114351.html).Then post your DDS logs. (DDS.txt and Attach.txt )
-
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 2/2/2009 1:07:09 AM
System Uptime: 11/30/2012 8:36:36 PM (39 hours ago)
.
Motherboard: Intel Corporation | | D945GCL
Processor: Intel(R) Celeron(R) D CPU 3.33GHz | LGA 775 | 3326/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 112 GiB total, 54.368 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
"Nero SoundTrax Help
Adobe Flash Player 11 ActiveX
Adobe Reader 9.1.3
Adobe Shockwave Player 11.6
Adobe SVG Viewer 3.0
Advertising Center
Bing Bar
Bing Rewards Client Installer
CCleaner
CDBurnerXP
Coupon Printer for Windows
DolbyFiles
ESET Smart Security
Facebook Messenger 2.1.4651.0
Free Window Registry Repair
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Deskjet 1000 J110 series Help
HP Deskjet 1000 J110 series Product Improvement Study
HP Photo Creations
HP Product Detection
HP Update
ImagXpress
Intel(R) Graphics Media Accelerator Driver
Java(TM) 6 Update 14
Java(TM) 6 Update 5
K-Lite Mega Codec Pack 4.4.5
Malwarebytes Anti-Malware version 1.65.1.1000
Menu Templates - Starter Kit
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Movie Templates - Starter Kit
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB973685)
Nero 7 Demo
Nero 9
Nero BurningROM
Nero BurnRights
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DriveSpeed
Nero Express
Nero InfoTool
Nero Installer
Nero Live
Nero Live Help
Nero PhotoSnap
Nero PhotoSnap Help
Nero Recode
Nero Recode Help
Nero Rescue Agent
Nero RescueAgent Help
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero WaveEditor
Nero WaveEditor Help
NeroBurningROM
NeroExpress
neroxml
Norton PC Checkup
OD5WEB
OGA Notifier 2.0.0048.0
Registry Checkup
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
Soft Data Fax Modem with SmartCP
SoundTrax
SupportSoft Assisted Service
swMSM
Uninstall Helper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760413) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
WORLDPAC speedDIAL
Yahoo! Messenger
Yahoo! Software Update
.
==== Event Viewer Messages From Past Week ========
.
11/29/2012 9:31:53 PM, Error: Service Control Manager [7034] - The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:31:53 PM, Error: Service Control Manager [7034] - The Norton PC Checkup Application Launcher service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:31:53 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:31:53 PM, Error: Service Control Manager [7034] - The MBAMScheduler service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:31:53 PM, Error: Service Control Manager [7034] - The BingBar Service service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:31:53 PM, Error: Service Control Manager [7031] - The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
11/29/2012 9:31:53 PM, Error: Service Control Manager [7031] - The Nero BackItUp Scheduler 4.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 500 milliseconds: Restart the service.
11/29/2012 9:31:53 PM, Error: Service Control Manager [7031] - The Eset Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
11/29/2012 9:31:52 PM, Error: Service Control Manager [7034] - The BBUpdate service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:31:32 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
11/29/2012 9:29:29 PM, Error: Service Control Manager [7034] - The XAudioService service terminated unexpectedly. It has done this 1 time(s).
11/29/2012 9:21:53 PM, Error: Service Control Manager [7000] - The spooler service failed to start due to the following error: The system cannot find the file specified.
11/29/2012 9:20:06 PM, Error: EventLog [6008] - The previous system shutdown at 9:18:45 PM on 11/29/2012 was unexpected.
11/29/2012 10:05:12 PM, Error: EventLog [6008] - The previous system shutdown at 10:04:17 PM on 11/29/2012 was unexpected.
11/25/2012 5:36:14 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f020b: SAMSUNG Electronics Co., Ltd. - Other hardware - SAMSUNG Mobile USB Composite Device.
11/25/2012 4:16:18 PM, Error: Microsoft-Windows-WPD-MTPClassDriver [15300] - MTP WPD Driver has failed to start. Error 0x8007001f.
.
==== End Of File ===========================
-
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18904
Run by Mike at 11:58:12 on 2012-12-02
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1013.462 [GMT -6:00]
.
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe
C:\Users\Mike\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.com/
uSearchAssistant = hxxp://www.google.com
uURLSearchHooks: <No Name>: - LocalServer32 - <no file>
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - c:\program files\microsoft\bingbar\7.1.391.0\BingExt.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} -
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: EnableLUA = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab
DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{DEAC3266-D705-465A-BC0D-84675868BA69} : DHCPNameServer = 192.168.1.254
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
============= SERVICES / DRIVERS ===============
.
R2 ekrn;Eset Service;c:\program files\eset\eset smart security\ekrn.exe [2007-12-21 468224]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-20 399432]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-20 676936]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\norton pc checkup 3.0\SymcPCCULaunchSvc.exe [2012-11-24 132056]
R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.391.0\SeaPort.EXE [2012-6-11 240208]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-20 22856]
S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.391.0\BBSvc.EXE [2012-6-11 193616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1c98ba8900a98f0;Google Update Service (gupdate1c98ba8900a98f0);c:\program files\google\update\GoogleUpdate.exe [2009-2-10 133104]
.
=============== Created Last 30 ================
.
2012-11-30 23:30:12 -------- d-----w- C:\MGADiagToolOutput
2012-11-30 04:05:21 -------- d-sh--w- C:\$RECYCLE.BIN
2012-11-30 03:29:33 -------- d-s---w- C:\ComboFix
2012-11-30 03:22:10 14336 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2012-11-30 02:37:44 -------- d-----w- c:\users\mike\appdata\local\temp
2012-11-26 01:01:53 -------- d-----w- c:\program files\common files\Symantec Shared
2012-11-26 00:56:05 -------- d-----w- c:\programdata\Symantec
2012-11-25 23:10:00 208896 ----a-w- c:\windows\MBR.exe
2012-11-25 23:09:57 98816 ----a-w- c:\windows\sed.exe
2012-11-25 23:09:57 256000 ----a-w- c:\windows\PEV.exe
2012-11-25 21:57:49 -------- d-----w- c:\program files\Trend Micro
2012-11-25 21:23:46 -------- d-----w- c:\program files\CCleaner
2012-11-25 00:52:37 -------- d-----w- c:\program files\Norton PC Checkup 3.0
2012-11-25 00:52:23 -------- d-----w- c:\programdata\Norton
2012-11-25 00:50:12 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2012-11-25 00:50:12 49472 ----a-w- c:\windows\system32\netfxperf.dll
2012-11-25 00:50:12 297808 ----a-w- c:\windows\system32\mscoree.dll
2012-11-25 00:50:12 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2012-11-25 00:50:12 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-11-25 00:48:42 -------- d-----w- c:\users\mike\appdata\roaming\PCCUStubInstaller
2012-11-23 00:11:45 -------- d-----w- c:\users\mike\appdata\roaming\licenses
2012-11-23 00:11:43 -------- d-----w- c:\users\mike\appdata\roaming\PCMM2009
2012-11-23 00:11:39 -------- d-----w- c:\users\mike\appdata\roaming\PCMM2012
2012-11-23 00:11:29 -------- d-----w- c:\users\mike\appdata\local\PC MightyMax 2012
2012-11-23 00:03:22 -------- d-----w- c:\users\mike\appdata\local\ElevatedDiagnostics
2012-11-22 19:34:23 -------- d-----w- c:\programdata\PC Optimizer Pro
2012-11-22 19:25:08 -------- d-sh--w- c:\windows\system32\AI_RecycleBin
2012-11-22 19:25:04 -------- d-----w- c:\programdata\W3i
2012-11-22 19:25:04 -------- d-----w- c:\program files\W3i
2012-11-18 22:46:03 -------- d-----w- c:\program files\Free Window Registry Repair
2012-11-18 22:43:15 -------- d-----w- c:\program files\Coupon Companion
2012-11-18 20:16:26 -------- d-----w- c:\windows\pss
2012-11-15 01:51:31 -------- d-----w- c:\programdata\HP Photo Creations
2012-11-15 01:51:31 -------- d-----w- c:\program files\HP Photo Creations
2012-11-15 01:51:27 -------- d-----w- c:\program files\Coupons
2012-11-15 01:49:56 -------- d-----w- c:\users\mike\appdata\local\HP
2012-11-04 16:54:11 -------- d-----w- c:\users\mike\appdata\local\Facebook
2012-11-04 16:24:14 -------- d-----w- c:\program files\Yahoo!
2012-11-03 00:56:22 5 ----a-w- c:\windows\system32\lMMLDeleteUserData42107612FX.tmp
.
==================== Find3M ====================
.
2012-11-22 19:19:42 74752 ----a-w- c:\windows\system32\spoolss.dll
2012-11-08 04:52:16 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-08 04:52:15 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-30 01:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
.
============= FINISH: 11:58:55.31 ===============
-
You don't have the Recovery Console installed on your computer. You will have to borrow a Vista (TM) Ultimate disk from someone and perform the SFC with the disk in the drive. It must be the same type as what you have on your computer now. Did you try System Restore to a date before this trouble started?
-
i cant find system restore anywhere.. so no i havent tried that.
-
Click Start, type System Restore in the search box and click on System Restore when it appears in the list.
-
I tried that ...it's not there.
-
I tried that ...it's not there.
Then you will have to borrow a Vista disk from someone and run the SFC.
-
Microsoft Windows [Version 6.0.6000]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\Users\Mike>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.Windows Resource Protection found corrupt files but w
as unable to fix some of them.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log
C:\Users\Mike>
-
sorry it took so long.. i just got my hands on a vista cd... ok, i ran the sfc again and it still said there are errors that were not repaired as i just posted.. i tried the f8 thing with the cd in...and got to the repair computer.. after that i got a window with these options.. repair start up... scan memory for errors.. etc etc... I dont know what to do next.. is there a manual way to install the files i need? or? ugh..
-
What happens when you click "repair computer"?