Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Windows Recovery  (Read 8428 times)

0 Members and 1 Guest are viewing this topic.

xfozziex

    Topic Starter


    Greenhorn

    • Experience: Beginner
    • OS: Unknown
    Windows Recovery
    « on: May 22, 2011, 01:39:09 PM »
    Okay, so I have windows recovery virus.  I believe I got most of it off my PC, but I am still experiencing problems.  Most notably are these darn background audio ads!  I really need some help with this and I greatly, greatly appreciate any help you guys can give me.  I do have Malwarebytes and the last several scans revealed no infections.  Any ideas?

    Allan

    • Moderator

    • Mastermind
    • Thanked: 1260
    • Experience: Guru
    • OS: Windows 10
    Re: Windows Recovery
    « Reply #1 on: May 22, 2011, 01:46:38 PM »
    Please follow the instructions in the following link and post your logs:
    http://www.computerhope.com/forum/index.php/topic,46313.0.html

    xfozziex

      Topic Starter


      Greenhorn

      • Experience: Beginner
      • OS: Unknown
      Re: Windows Recovery
      « Reply #2 on: May 23, 2011, 06:52:34 PM »
      Okay, I have done everything on the checklist.  There is no detail in the AVAST log.  It just says "No Virus Found."  Below are the SAS log and MBAM log.  Please let me know your thoughts and my next course of action.  Again, I really appreciate your assistance!

      [recovering disk space - old attachment deleted by admin]

      xfozziex

        Topic Starter


        Greenhorn

        • Experience: Beginner
        • OS: Unknown
        Re: Windows Recovery
        « Reply #3 on: May 23, 2011, 07:03:44 PM »
        Sorry, here is the HiJackThis log:

        [recovering disk space - old attachment deleted by admin]

        xfozziex

          Topic Starter


          Greenhorn

          • Experience: Beginner
          • OS: Unknown
          Re: Windows Recovery
          « Reply #4 on: May 23, 2011, 07:24:20 PM »
          Sorry, here is the correct Sniper.exe log.  I missed that the first time!

          [recovering disk space - old attachment deleted by admin]

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 1020
          • Certifications: List
          • Experience: Expert
          • OS: Windows 10
          Re: Windows Recovery
          « Reply #5 on: May 24, 2011, 01:13:25 PM »
          Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

          1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
          2. The fixes are specific to your problem and should only be used for this issue on this machine.
          3. If you don't know or understand something, please don't hesitate to ask.
          4. Please DO NOT run any other tools or scans while I am helping you.
          5. It is important that you reply to this thread. Do not start a new topic.
          6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
          7. Absence of symptoms does not mean that everything is clear.

          If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
          *****************************************************
          Please do not attach the logs unless absolutely. Copy and paste them in your reply(ies)

          Download Security Check by screen317 from one of the following links and save it to your desktop.

          Link 1
          Link 2

          * Unzip SecurityCheck.zip and a folder named Security Check should appear.
          * Open the Security Check folder and double-click Security Check.bat
          * Follow the on-screen instructions inside of the black box.
          * A Notepad document should open automatically called checkup.txt
          * Post the contents of that document in your next reply.

          Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
          *****************************************************
          Download DDS from HERE or HERE and save it to your desktop.

          Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

          * XP users Double click on dds to run it.
          * If your antivirus or firewall try to block DDS then please allow it to run.
          * When finished DDS will open two (2) logs.

          1) DDS.txt
          2) Attach.txt

          * Save both logs to your desktop.
          * Please copy and paste the entire contents of both logs in your next reply.

          Note: DDS will instruct you to post the Attach.txt log as an attachment.
          Please just post it as you would any other log by copying and pasting it into the reply.
          Windows 8 and Windows 10 dual boot with two SSD's

          xfozziex

            Topic Starter


            Greenhorn

            • Experience: Beginner
            • OS: Unknown
            Re: Windows Recovery
            « Reply #6 on: May 24, 2011, 08:27:09 PM »
             Results of screen317's Security Check version 0.99.11 
             Windows Vista Service Pack 2 (UAC is enabled)
             Internet Explorer 8 
            ``````````````````````````````
            Antivirus/Firewall Check:

             Windows Firewall Enabled! 
             avast! Free Antivirus   
             WMI entry may not exist for antivirus; attempting automatic update.
            ```````````````````````````````
            Anti-malware/Other Utilities Check:

             Malwarebytes' Anti-Malware   
             CCleaner     
             Java(TM) 6 Update 25 
             Adobe Flash Player   
            Adobe Reader 8
            Out of date Adobe Reader installed!
            ````````````````````````````````
            Process Check: 
            objlist.exe by Laurent

             AOL 9.0 AvastSvc.exe -?-   
             AVAST Software Avast AvastUI.exe 
            ``````````End of Log````````````


            DDS1:

            .
            DDS (Ver_11-05-19.01) - NTFSx86
            Internet Explorer: 9.0.8112.16421
            Run by Michael at 22:21:30 on 2011-05-24
            Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.2942.1750 [GMT -4:00]
            .
            AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
            SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
            SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
            .
            ============== Running Processes ===============
            .
            C:\Windows\system32\wininit.exe
            C:\Windows\system32\lsm.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            C:\Windows\system32\nvvsvc.exe
            C:\Windows\system32\svchost.exe -k rpcss
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
            C:\Windows\system32\svchost.exe -k netsvcs
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            C:\Windows\system32\SLsvc.exe
            C:\Windows\system32\svchost.exe -k LocalService
            C:\Windows\system32\rundll32.exe
            C:\Windows\system32\svchost.exe -k NetworkService
            C:\Windows\system32\Dwm.exe
            C:\Program Files\AVAST Software\Avast\AvastSvc.exe
            C:\Windows\Explorer.EXE
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Windows\System32\spoolsv.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
            C:\Windows\system32\taskeng.exe
            C:\Windows\system32\taskeng.exe
            C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
            C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            C:\Program Files\Bonjour\mDNSResponder.exe
            C:\Windows\system32\svchost.exe -k hpdevmgmt
            c:\Program Files\Common Files\LightScribe\LSSrvc.exe
            C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
            C:\Windows\System32\svchost.exe -k HPZ12
            C:\Windows\System32\svchost.exe -k HPZ12
            C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
            C:\Windows\system32\svchost.exe -k imgsvc
            C:\Windows\System32\svchost.exe -k WerSvcGroup
            C:\Windows\system32\SearchIndexer.exe
            C:\Windows\system32\DRIVERS\xaudio.exe
            C:\Windows\system32\WUDFHost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
            C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
            C:\Program Files\Common Files\Java\Java Update\jusched.exe
            C:\Program Files\AVAST Software\Avast\AvastUI.exe
            C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
            C:\Program Files\Windows Media Player\wmpnscfg.exe
            C:\Program Files\Windows Media Player\wmpnetwk.exe
            C:\Program Files\Common Files\AOL\1216085481\ee\aolsoftware.exe
            C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Windows\system32\SearchProtocolHost.exe
            C:\Program Files\AOL 9.0\waol.exe
            C:\Program Files\AOL 9.0\shellmon.exe
            C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
            C:\Windows\system32\SearchFilterHost.exe
            C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe
            C:\Users\Michael\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZLVFXVBY\dds[1].scr
            C:\Windows\system32\WSCRIPT.exe
            C:\Windows\system32\wbem\wmiprvse.exe
            .
            ============== Pseudo HJT Report ===============
            .
            uSearch Bar = Preserve
            mStart Page = hxxp://www.yahoo.com
            mDefault_Page_URL = hxxp://www.yahoo.com
            uInternet Settings,ProxyOverride = *.local
            BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
            BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
            BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
            BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
            BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
            BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
            TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
            TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
            TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
            EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
            uRun: [AOL Fast Start] "c:\program files\aol 9.0\AOL.EXE" -b
            uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
            mRun: [<NO NAME>]
            mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
            mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
            mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
            mRunOnce: [PCDrProfiler] c:\program files\pc-doctor 5 for windows\RunProfiler.exe -r
            uPolicies-explorer: HideSCAHealth = 1 (0x1)
            mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
            mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
            IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
            IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
            IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
            DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
            DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
            DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
            DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
            DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
            .
            ============= SERVICES / DRIVERS ===============
            .
            R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-22 441176]
            R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-5-22 307928]
            R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
            R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
            R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-5-22 19544]
            R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-5-22 53592]
            R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-5-22 42184]
            R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-7-21 21504]
            R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2007-4-18 366080]
            S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
            S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
            .
            =============== Created Last 30 ================
            .
            2011-05-23 22:53:36   --------   d-----w-   c:\users\michael\appdata\roaming\SUPERAntiSpyware.com
            2011-05-23 22:53:36   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
            2011-05-23 22:53:26   --------   d-----w-   c:\program files\SUPERAntiSpyware
            2011-05-23 02:34:09   53592   ----a-w-   c:\windows\system32\drivers\aswMonFlt.sys
            2011-05-23 02:34:09   441176   ----a-w-   c:\windows\system32\drivers\aswSnx.sys
            2011-05-23 02:33:54   40112   ----a-w-   c:\windows\avastSS.scr
            2011-05-23 02:33:42   --------   d-----w-   c:\programdata\AVAST Software
            2011-05-23 02:33:42   --------   d-----w-   c:\program files\AVAST Software
            2011-05-23 02:23:49   472808   ----a-w-   c:\windows\system32\deployJava1.dll
            2011-05-23 02:15:05   --------   d-----w-   c:\program files\CCleaner
            2011-05-22 19:26:16   388096   ----a-r-   c:\users\michael\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
            2011-05-22 19:26:14   --------   d-----w-   c:\program files\Trend Micro
            2011-05-19 22:45:29   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
            2011-05-12 07:01:56   --------   d-----w-   C:\819845643c3d71519b92
            2011-05-11 16:41:01   2409784   ----a-w-   c:\program files\windows mail\OESpamFilter.dat
            2011-05-07 00:25:30   --------   d-----w-   c:\windows\pss
            2011-05-06 23:59:48   --------   d-----w-   c:\program files\PC Tools Security
            2011-04-29 00:31:30   --------   d-----w-   c:\users\michael\appdata\roaming\PCTools
            2011-04-28 23:06:22   --------   d-----w-   C:\959994425cbe2e56425d5fea4098
            2011-04-28 22:37:34   4240384   ----a-w-   c:\windows\system32\GameUXLegacyGDFs.dll
            2011-04-28 22:37:34   28672   ----a-w-   c:\windows\system32\Apphlpdm.dll
            2011-04-28 22:37:17   876032   ----a-w-   c:\windows\system32\XpsPrint.dll
            2011-04-28 21:25:32   --------   d-----w-   c:\users\michael\appdata\roaming\Malwarebytes
            2011-04-28 21:25:27   --------   d-----w-   c:\programdata\Malwarebytes
            2011-04-28 21:25:24   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
            2011-04-26 06:30:04   7071056   ----a-w-   c:\programdata\microsoft\windows defender\definition updates\{371dfdad-e053-4606-a123-ee095f418424}\mpengine.dll
            .
            ==================== Find3M  ====================
            .
            2011-03-10 17:03:51   1162240   ----a-w-   c:\windows\system32\mfc42u.dll
            2011-03-10 17:03:51   1136640   ----a-w-   c:\windows\system32\mfc42.dll
            2011-03-03 15:42:03   739328   ----a-w-   c:\windows\system32\inetcomm.dll
            2011-03-03 15:40:07   173056   ----a-w-   c:\windows\apppatch\AcXtrnal.dll
            2011-03-03 15:40:05   542720   ----a-w-   c:\windows\apppatch\AcLayers.dll
            2011-03-03 15:40:05   458752   ----a-w-   c:\windows\apppatch\AcSpecfc.dll
            2011-03-03 15:40:04   2159616   ----a-w-   c:\windows\apppatch\AcGenral.dll
            2011-03-03 13:25:11   2041856   ----a-w-   c:\windows\system32\win32k.sys
            2011-03-02 15:44:27   86528   ----a-w-   c:\windows\system32\dnsrslvr.dll
            .
            ============= FINISH: 22:22:59.96 ===============


            DDS2:

            UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
            IF REQUESTED, ZIP IT UP & ATTACH IT
            .
            DDS (Ver_11-05-19.01)
            .
            Microsoft® Windows Vista™ Home Premium
            Boot Device: \Device\HarddiskVolume1
            Install Date: 7/11/2008 6:51:15 PM
            System Uptime: 5/23/2011 8:38:39 PM (26 hours ago)
            .
            Motherboard: ECS  |  | Nettle2
            Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5600+ | Socket M2  | 2800/201mhz
            .
            ==== Disk Partitions =========================
            .
            C: is FIXED (NTFS) - 457 GiB total, 310.027 GiB free.
            D: is FIXED (NTFS) - 9 GiB total, 1.035 GiB free.
            E: is CDROM ()
            F: is Removable
            G: is Removable
            H: is Removable
            I: is Removable
            J: is Removable
            .
            ==== Disabled Device Manager Items =============
            .
            ==== System Restore Points ===================
            .
            RP1735: 4/27/2011 12:01:57 AM - Scheduled Checkpoint
            RP1736: 4/27/2011 7:48:13 PM - Scheduled Checkpoint
            RP1737: 4/28/2011 7:05:56 PM - Windows Update
            RP1738: 4/29/2011 5:35:26 PM - Windows Update
            RP1739: 5/6/2011 8:37:22 PM - Windows Update
            RP1740: 5/7/2011 3:02:01 PM - Scheduled Checkpoint
            RP1741: 5/8/2011 11:38:45 AM - Scheduled Checkpoint
            RP1742: 5/9/2011 6:48:26 PM - Scheduled Checkpoint
            RP1743: 5/11/2011 12:00:01 AM - Scheduled Checkpoint
            RP1744: 5/11/2011 10:40:32 PM - Scheduled Checkpoint
            RP1745: 5/12/2011 3:00:19 AM - Windows Update
            RP1746: 5/13/2011 12:04:46 AM - Scheduled Checkpoint
            RP1747: 5/14/2011 12:00:02 AM - Scheduled Checkpoint
            RP1748: 5/15/2011 12:00:03 AM - Scheduled Checkpoint
            RP1749: 5/16/2011 12:00:09 AM - Scheduled Checkpoint
            RP1750: 5/17/2011 12:00:04 AM - Scheduled Checkpoint
            RP1751: 5/18/2011 12:00:10 AM - Scheduled Checkpoint
            RP1752: 5/18/2011 2:52:28 PM - Scheduled Checkpoint
            RP1753: 5/19/2011 8:50:12 AM - Scheduled Checkpoint
            RP1754: 5/19/2011 10:18:49 PM - Scheduled Checkpoint
            RP1755: 5/21/2011 12:00:01 AM - Scheduled Checkpoint
            RP1756: 5/22/2011 12:00:01 AM - Scheduled Checkpoint
            RP1757: 5/22/2011 3:25:44 PM - Installed HiJackThis
            RP1758: 5/22/2011 10:23:13 PM - Installed Java(TM) 6 Update 25
            RP1759: 5/22/2011 10:33:32 PM - avast! Free Antivirus Setup
            RP1760: 5/23/2011 9:53:38 PM - Scheduled Checkpoint
            .
            ==== Installed Programs ======================
            .
             Update for Microsoft Office 2007 (KB2508958)
            32 Bit HP CIO Components Installer
            Activation Assistant for the 2007 Microsoft Office suites
            Adobe Flash Player 10 ActiveX
            Adobe Reader 8
            AIO_Scan
            Amazon MP3 Downloader 1.0.10
            AOL Uninstaller (Choose which Products to Remove)
            Apple Application Support
            Apple Mobile Device Support
            Apple Software Update
            avast! Free Antivirus
            Bonjour
            BufferChm
            C4200
            C4200_doccd
            c4200_Help
            CCleaner
            Copy
            Coupon Printer for Windows
            CustomerResearchQFolder
            Destination Component
            DeviceDiscovery
            DeviceManagementQFolder
            DocProc
            DocProcQFolder
            Enhanced Multimedia Keyboard Solution
            eSupportQFolder
            Facebook Plug-In
            Hardware Diagnostic Tools
            HiJackThis
            Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
            Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
            HP Advisor
            HP Customer Experience Enhancements
            HP Customer Feedback
            HP Customer Participation Program 9.0
            HP Easy Setup - Frontend
            HP Imaging Device Functions 9.0
            HP OCR Software 9.0
            HP On-Screen Cap/Num/Scroll Lock Indicator
            HP Photosmart All-In-One Software 9.0
            HP Photosmart Essential 2.01
            HP Photosmart Essential2.01
            HP Picasso Media Center Add-In
            HP Product Assistant
            HP Smart Web Printing 4.60
            HP Solution Center 9.0
            HP Update
            HPDiagnosticAlert
            HPProductAssistant
            HPSSupply
            iTunes
            Java Auto Updater
            Java(TM) 6 Update 25
            LightScribe  1.4.142.1
            LiveUpdate 3.2 (Symantec Corporation)
            LiveUpdate Notice (Symantec Corporation)
            Magic DVD Copier Version 4.9
            Magic DVD Ripper V5.3 build 7
            Malwarebytes' Anti-Malware
            MarketResearch
            MediaFACE II
            Microsoft .NET Framework 3.5 SP1
            Microsoft .NET Framework 4 Client Profile
            Microsoft Office 2007 Service Pack 2 (SP2)
            Microsoft Office Excel MUI (English) 2007
            Microsoft Office Home and Student 2007
            Microsoft Office OneNote MUI (English) 2007
            Microsoft Office PowerPoint MUI (English) 2007
            Microsoft Office Proof (English) 2007
            Microsoft Office Proof (French) 2007
            Microsoft Office Proof (Spanish) 2007
            Microsoft Office Proofing (English) 2007
            Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
            Microsoft Office Shared MUI (English) 2007
            Microsoft Office Shared Setup Metadata MUI (English) 2007
            Microsoft Office Word MUI (English) 2007
            Microsoft Silverlight
            Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
            Microsoft Visual C++ 2005 Redistributable - KB2467175
            Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
            Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
            Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
            Microsoft Works
            MobileMe Control Panel
            MSXML 4.0 SP2 (KB936181)
            MSXML 4.0 SP2 (KB941833)
            MSXML 4.0 SP2 (KB954430)
            MSXML 4.0 SP2 (KB973688)
            muvee autoProducer 6.0
            My HP Games
            Network Stumbler 0.4.0 (remove only)
            NVIDIA Drivers
            PS_AIO_ProductContext
            PS_AIO_Software
            PS_AIO_Software_min
            PSSWCORE
            Python 2.4.3
            QuickTime
            RealPlayer
            Realtek High Definition Audio Driver
            Rhapsody
            Rhapsody MP3 Download Manager
            Rhapsody Player Engine
            Roxio Activation Module
            Roxio Creator Audio
            Roxio Creator Basic v9
            Roxio Creator Copy
            Roxio Creator Data
            Roxio Creator EasyArchive
            Roxio Creator Tools
            Roxio Express Labeler 3
            Roxio MyDVD Basic v9
            RTC Client API v1.2
            Safari
            Scan
            Security Update for 2007 Microsoft Office System (KB2288621)
            Security Update for 2007 Microsoft Office System (KB2288931)
            Security Update for 2007 Microsoft Office System (KB2345043)
            Security Update for 2007 Microsoft Office System (KB2466156)
            Security Update for 2007 Microsoft Office System (KB2509488)
            Security Update for 2007 Microsoft Office System (KB969559)
            Security Update for 2007 Microsoft Office System (KB976321)
            Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
            Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
            Security Update for Microsoft Office Excel 2007 (KB2464583)
            Security Update for Microsoft Office InfoPath 2007 (KB979441)
            Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
            Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
            Security Update for Microsoft Office system 2007 (972581)
            Security Update for Microsoft Office system 2007 (KB974234)
            Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
            Security Update for Microsoft Office Word 2007 (KB2344993)
            SmartWebPrinting
            Snapfish Media Detector
            Soft Data Fax Modem with SmartCP
            SolutionCenter
            Status
            SUPERAntiSpyware
            System Requirements Lab
            Toolbox
            TrayApp
            UnloadSupport
            Update for 2007 Microsoft Office System (KB967642)
            Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
            Update for Microsoft Office 2007 Help for Common Features (KB963673)
            Update for Microsoft Office Excel 2007 Help (KB963678)
            Update for Microsoft Office OneNote 2007 (KB980729)
            Update for Microsoft Office OneNote 2007 Help (KB963670)
            Update for Microsoft Office Powerpoint 2007 Help (KB963669)
            Update for Microsoft Office Script Editor Help (KB963671)
            Update for Microsoft Office Word 2007 Help (KB963665)
            Verizon High Speed Internet
            VideoToolkit01
            Viewpoint Media Player
            WebReg
            Yahoo! Toolbar
            Yahoo! Toolbar for Internet Explorer
            .
            ==== Event Viewer Messages From Past Week ========
            .
            5/23/2011 8:40:47 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  TfFsMon TFSysMon
            5/19/2011 7:28:22 AM, Error: Service Control Manager [7043]  - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
            5/19/2011 7:27:52 AM, Error: Service Control Manager [7043]  - The Windows Update service did not shut down properly after receiving a preshutdown control.
            5/19/2011 7:27:52 AM, Error: Service Control Manager [7011]  - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSearch service.
            5/19/2011 6:50:27 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  PCTSD spldr TfFsMon TFSysMon Wanarpv6
            5/19/2011 5:13:19 PM, Error: EventLog [6008]  - The previous system shutdown at 5:10:28 PM on 5/19/2011 was unexpected.
            5/19/2011 11:01:26 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  spldr TfFsMon TFSysMon Wanarpv6
            5/19/2011 11:01:26 PM, Error: Service Control Manager [7001]  - The Computer Browser service depends on the Server service which failed to start because of the following error:  The dependency service or group failed to start.
            5/19/2011 11:00:34 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
            5/19/2011 11:00:27 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
            5/19/2011 11:00:24 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
            5/19/2011 11:00:21 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
            5/19/2011 11:00:15 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
            5/18/2011 11:10:00 PM, Error: EventLog [6008]  - The previous system shutdown at 11:07:57 PM on 5/18/2011 was unexpected.
            .
            ==== End Of File ===========================

            xfozziex

              Topic Starter


              Greenhorn

              • Experience: Beginner
              • OS: Unknown
              Re: Windows Recovery
              « Reply #7 on: May 24, 2011, 08:29:30 PM »
              P.S.  Dave, nice to meet you and thanks very much for you assistance.  Really appreciate it.

              SuperDave

              • Malware Removal Specialist


              • Genius
              • Thanked: 1020
              • Certifications: List
              • Experience: Expert
              • OS: Windows 10
              Re: Windows Recovery
              « Reply #8 on: May 25, 2011, 05:21:59 PM »
              Please download the newest version of Adobe Acrobat Reader from Adobe.com

              Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
              Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
              Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

              Once old versions are gone, please install the newest version.
              ******************************************************
              You have Viewpoint installed.

              Viewpoint Media Player/Manager/Toolbar is considered as Foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

              More information:

              * ViewMgr.exe - Useless
              * Viewpoint to Plunge Into Adware

              It is suggested to remove the program now. Go to Start > Control Panel > Add/Remove Programs - (Vista & Win7 is Programs and Features) and remove the following programs if present.

              * Viewpoint
              * Viewpoint Manager
              * Viewpoint Media Player
              * Viewpoint Toolbar
              * Viewpoint Experience Technology

              *************************************************
              Download OTL to your desktop.

              * Open OTL
              * Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

              Code: [Select]
              :OTL
              TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
              mRun: [<NO NAME>]

              :COMMANDS
              [resethosts]
              [purity]
              [emptytemp]
              [start explorer]

              * Click Run Fix
              * OTLI2 may ask to reboot the machine. Please do so if asked.
              * Click OK
              * A report will open. Copy and Paste that report in your next reply.
              *****************************************************
              Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

              link # 1
              Link # 2
              If you are using Firefox, make sure that your download settings are as follows:

              * Tools->Options->Main tab
              * Set to "Always ask me where to Save the files".

              Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

              Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

              Right-click combofix.exe and select Run as Administrator and follow the prompts.
              When finished, ComboFix will produce a log for you.
              Post the ComboFix login your next reply.

              NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

              Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.
              Windows 8 and Windows 10 dual boot with two SSD's