What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] pc freezes, crashes, unresponsive

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
my pc's been acting pretty funky lately and i havent been getting my annual check ups on it…also norton somehow installed itself on my computer and my AVG anti-virus went down for a little bit, which i found very very strange.

so here's my HJT log, thanks in advance for any help :thumbup:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:33 AM, on 12/14/2009
Platform: Unknown Windows (WinNT 6.01.3004)
MSIE: Internet Explorer v8.00 (8.00.7100.0000)
Boot mode: Normal

Running processes:
C:\Users\Yee\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\BumpTop\BumpTop.exe
C:\Sun\SDK\jdk\bin\javaw.exe
C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Users\Yee\AppData\Local\Microsoft\Live Mesh\GacBase\Moe.exe
C:\Program Files (x86)\BumpTop\TexHelper.exe
C:\Program Files (x86)\BumpTop\TexHelper.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
C:\Users\Yee\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Yee\AppData\Local\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:/Users/Yee/Music/Temp/Tunebite/.downloading/profile/rrproxy_ie_4ab16c5b.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MoeMonitor.exe] "C:\Users\Yee\AppData\Local\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Yee\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: SDK Tray Menu.lnk = ?
O4 - Global Startup: BumpTop.lnk = C:\Program Files (x86)\BumpTop\BumpTop.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Zune Wireless Configuration Service (ZuneWlanCfgSvc) - Unknown owner - c:\Windows\system32\ZuneWlanCfgSvc.exe (file missing)

–
End of file - 11112 bytes
Post #2
Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
here are the 2 logs from DDS DDS.txt DDS (Ver_09-12-01.01) - NTFSX64 Run by [removed] at 11:09:17.93 on Mon 12/21/2009 Internet Explorer: 8.0.7100.0 BrowserJavaVersion: 1.6.0_17 Microsoft Windows 7 Ultimate 6.1.7100.0.1252.1.1033.18.4091.2162 [GMT -8:00] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Program Files (x86)\AVG\AVG9\avgchsva.exe C:\Program Files (x86)\AVG\AVG9\avgrsa.exe C:\Windows\system32\lsm.exe C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\SysWOW64\PnkBstrB.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe C:\Windows\SysWOW64\vmnat.exe C:\Program Files\Live Mesh\Remote Desktop\wlcrasvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskhost.exe C:\Windows\SysWOW64\vmnetdhcp.exe C:\Program Files (x86)\AVG\AVG9\avgnsa.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Zune\ZuneLauncher.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Users\Yee\AppData\Local\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe C:\Sun\SDK\jdk\bin\javaw.exe C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files (x86)\PowerISO\PWRISOVM.EXE C:\Program Files (x86)\AVG\AVG9\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Users\Yee\AppData\Local\Microsoft\Live Mesh\GacBase\Moe.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Windows\system32\DllHost.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files (x86)\AIM\aim.exe C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe C:\Users\Yee\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Yee\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\msiexec.exe C:\Program Files (x86)\BumpTop\BumpTop.exe C:\Program Files (x86)\BumpTop\TexHelper.exe C:\Program Files (x86)\BumpTop\TexHelper.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Yee\Desktop\dds.com C:\Windows\system32\conhost.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://my.yahoo.com/ mLocal Page = c:\windows\syswow64\blank.htm mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files (x86)\avg\avg9\avgssie.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files (x86)\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll uRun: [MoeMonitor.exe] "c:\users\yee\appdata\local\microsoft\live mesh\bin\servicing\0.9.4014.7\MoeMonitor.exe" uRun: [AdobeBridge] uRun: [Google Update] "c:\users\yee\appdata\local\google\update\GoogleUpdate.exe" /c uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p mRun: [BlackBerryAutoUpdate] c:\program files (x86)\common files\research in motion\auto update\RIMAutoUpdate.exe /background mRun: [PWRISOVM.EXE] c:\program files (x86)\poweriso\PWRISOVM.EXE mRun: [GrooveMonitor] "c:\program files (x86)\microsoft office\office12\GrooveMonitor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [AVG9_TRAY] c:\progra~2\avg\avg9\avgtray.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [vmware-tray] "c:\program files (x86)\vmware\vmware workstation\vmware-tray.exe" mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe" StartupFolder: c:\users\yee\appdata\roaming\micros~1\windows\startm~1\programs\startup\sdktra~1.lnk - c:\sun\sdk\jdk\bin\javaw.exe StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\bumptop.lnk - c:\program files (x86)\bumptop\BumpTop.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~2\micros~1\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~1\office12\REFIEBAR.DLL LSP: c:\program files (x86)\vmware\vmware workstation\vsocklib.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files (x86)\microsoft office\office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files (x86)\avg\avg9\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files (x86)\microsoft office\office12\GrooveShellExtensions.dll mASetup: {9C450606-ED24-4958-92BA-B8940C99D441} - c:\program files (x86)\pixiepack codec pack\InstallerHelper.exe BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files (x86)\avg\avg9\avgssiea.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll mRun-x64: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe" mRun-x64: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe AppInit_DLLs-X64: avgrssta.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\yee\appdata\roaming\mozilla\firefox\profiles\pdqx4b6k.default\ FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/ FF - prefs.js: network.proxy.type - 2 FF - component: c:\program files (x86)\avg\avg9\firefox\components\avgssff.dll FF - plugin: c:\program files (x86)\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files (x86)\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files (x86)\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files (x86)\microsoft\office live\npOLW.dll FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files (x86)\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\program files\itunes\mozilla plugins\npitunes.dll FF - plugin: c:\users\yee\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\drivers\avgldx64.sys [2009-7-22 422920] R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\drivers\avgmfx64.sys [2009-7-22 34248] R1 AvgTdiA;AVG Free8 Network Redirector x64;c:\windows\system32\drivers\avgtdia.sys [2009-7-22 470024] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-4-21 59904] R2 avg9wd;AVG Free WatchDog;c:\program files (x86)\avg\avg9\avgwdsvc.exe [2009-11-3 285392] R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\common files\vmware\usb\vmware-usbarbitrator.exe [2009-10-22 563760] R2 wlcrasvc;Live Mesh Remote Desktop;c:\program files\live mesh\remote desktop\wlcrasvc.exe [2009-10-14 51024] R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\drivers\NETw5s64.sys [2009-9-15 6952960] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-12-5 84584] R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2mdx64.sys [2008-4-15 62040] R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sdx64.sys [2008-4-8 51928] R3 RDPDISPM;RDPDISPM;c:\windows\system32\drivers\rdpdispm.sys [2009-10-14 10576] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL6.SYS [2009-4-21 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV6.SYS [2009-4-21 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT6.SYS [2009-4-21 740864] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-4-21 17920] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x64.sys [2009-9-28 395264] S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2009-8-13 133104] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\netw5v64.sys [2009-4-8 5434368] S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl64.sys [2009-7-9 48640] =============== Created Last 30 ================ 2009-12-21 00:33:40 149280 —-a-w- c:\windows\syswow64\javaws.exe 2009-12-21 00:33:39 145184 —-a-w- c:\windows\syswow64\javaw.exe 2009-12-21 00:33:39 145184 —-a-w- c:\windows\syswow64\java.exe 2009-12-16 18:51:11 6856 ——w- C:\bootsqm.dat 2009-12-16 18:48:59 0 d-sh–w- C:\found.000 2009-12-14 17:15:07 0 d—–w- c:\programdata\Symantec 2009-12-14 17:15:07 0 d—–w- c:\programdata\Norton 2009-12-14 17:15:05 0 d—–w- c:\programdata\NortonInstaller 2009-12-14 04:19:47 0 d—–w- c:\program files\DivX 2009-12-09 08:46:03 465221683 —-a-w- c:\windows\MEMORY.DMP 2009-12-05 08:26:56 84584 —-a-w- c:\windows\system32\drivers\nvhda64v.sys 2009-12-05 08:26:56 62976 —-a-w- c:\windows\system32\nvapo64v.dll 2009-12-05 08:26:56 22528 —-a-w- c:\windows\system32\nvhdap64.dll 2009-12-05 08:25:33 0 d—–w- c:\program files\NVIDIA Corporation 2009-12-05 08:20:00 0 d—–w- c:\program files (x86)\Trend Micro 2009-12-05 08:07:25 0 d—–w- c:\windows\DD1865F0AD7340FBB23E1822E02396FF.TMP 2009-12-04 06:09:30 0 d—–w- c:\users\yee\appdata\roaming\mIRC 2009-12-04 06:09:29 0 d—–w- c:\program files (x86)\mIRC 2009-12-04 06:08:14 0 d—–w- c:\program files\Ventrilo 2009-12-04 06:08:06 262 —-a-w- c:\windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini ==================== Find3M ==================== 2009-12-21 00:33:24 411368 —-a-w- c:\windows\syswow64\deploytk.dll 2009-12-03 02:38:25 189480 —-a-w- c:\windows\syswow64\PnkBstrB.exe 2009-11-21 05:31:00 90216 —-a-w- c:\windows\system32\nvhotkey.dll 2009-11-21 05:31:00 886376 —-a-w- c:\windows\system32\nvsvc64.dll 2009-11-21 05:31:00 61032 —-a-w- c:\windows\system32\nvshext.dll 2009-11-21 05:31:00 151144 —-a-w- c:\windows\system32\nvvsvc.exe 2009-11-21 05:31:00 13825128 —-a-w- c:\windows\system32\nvcpl.dll 2009-11-21 05:31:00 1323624 —-a-w- c:\windows\system32\nvsvcr.dll 2009-11-21 05:31:00 115816 —-a-w- c:\windows\system32\nvmctray.dll 2009-11-20 05:43:02 645736 —-a-w- c:\windows\system32\NVUNINST.EXE 2009-11-14 00:47:28 856064 —-a-w- c:\windows\syswow64\divx_xx0c.dll 2009-11-14 00:47:28 856064 —-a-w- c:\windows\syswow64\divx_xx07.dll 2009-11-14 00:47:28 847872 —-a-w- c:\windows\syswow64\divx_xx0a.dll 2009-11-14 00:47:28 843776 —-a-w- c:\windows\syswow64\divx_xx16.dll 2009-11-14 00:47:28 839680 —-a-w- c:\windows\syswow64\divx_xx11.dll 2009-11-14 00:47:28 696320 —-a-w- c:\windows\syswow64\DivX.dll 2009-11-10 23:15:10 199272 —-a-w- c:\windows\system32\nvcohda6.dll 2009-11-09 17:55:31 470024 —-a-w- c:\windows\system32\drivers\avgtdia.sys 2009-11-07 22:48:57 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf 2009-11-03 18:44:39 422920 —-a-w- c:\windows\system32\drivers\avgldx64.sys 2009-11-03 18:44:39 34248 —-a-w- c:\windows\system32\drivers\avgmfx64.sys 2009-11-03 18:44:34 12464 —-a-w- c:\windows\system32\avgrssta.dll 2009-11-03 04:42:06 226688 ——w- c:\windows\system32\MpSigStub.exe 2009-10-22 13:01:10 958000 —-a-w- c:\windows\system32\vnetlib64.dll 2009-10-22 13:00:04 395824 —-a-w- c:\windows\syswow64\vmnat.exe 2009-10-22 12:59:48 334384 —-a-w- c:\windows\syswow64\vmnetdhcp.exe 2009-10-22 11:22:38 252464 —-a-w- c:\windows\syswow64\vmnc.dll 2009-10-22 08:13:28 56880 —-a-r- c:\windows\system32\vmnetbridge.dll 2009-10-22 08:13:28 55344 —-a-w- c:\windows\system32\vnetinst.dll 2009-10-14 16:19:35 140096 —-a-w- c:\windows\system32\rdpdispd.dll 2009-09-28 17:22:00 496128 —-a-w- c:\windows\system32\yk62x64.dll 2009-09-24 02:37:17 455680 —-a-w- c:\windows\system32\deploytk.dll 2009-04-22 09:52:01 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2009-04-22 09:52:01 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2009-04-22 09:52:01 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2009-04-22 09:52:01 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2009-04-22 09:08:55 174 –sha-w- c:\program files\desktop.ini 2009-04-22 09:08:55 174 –sha-w- c:\program files (x86)\desktop.ini 2009-04-22 05:05:25 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2009-04-22 05:05:25 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2009-04-22 05:05:24 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2009-04-22 05:05:24 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-03-27 04:24:11 9633792 –sha-r- c:\windows\fonts\StaticCache.dat 2009-08-01 16:02:36 245760 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-07-23 06:12:35 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-07-23 05:50:05 16384 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-07-23 05:50:05 32768 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-07-23 05:50:05 16384 –sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat 2009-04-22 05:38:46 398848 –sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7100.0_none_be69c16d5d28757a\WinMail.exe 2009-04-22 05:19:40 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7100.0_none_624b25e9a4cb0444\WinMail.exe ============= FINISH: 11:10:32.51 =============== Attach.txt UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume2 Install Date: 7/22/2009 9:58:24 PM System Uptime: 12/21/2009 10:47:09 AM (1 hours ago) Motherboard: Gateway | | IMV Processor: Intel® Core™2 Duo CPU P8400 @ 2.26GHz | U2E1 | 1586/266mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 286 GiB total, 105.095 GiB free. D: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== No restore point in system. ==== Installed Programs ====================== µTorrent 2007 Microsoft Office Suite Service Pack 2 (SP2) AAC Decoder Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Media Player Adobe Reader 9.2 AIM 7 America's Army 3 Apple Application Support Apple Software Update AutoUpdate AVG Free 9.0 BlackBerry Desktop Software 5.0.1 BlackBerry Device Software v4.5.0 for the BlackBerry 8820 smartphone BlackBerry® Media Sync BumpTop Camera Assistant Software for Gateway CCleaner Choice Guard Combined Community Codec Pack 2009-09-09 Counter-Strike Counter-Strike: Source CrackMem DivX Codec DivX Converter DivX Player DivX Plus DirectShow Filters DivX Plus Media Foundation Components DivX Plus Web Player DivX Version Checker Download Updater (AOL LLC) Google Chrome Google Update Helper H.264 Decoder HijackThis 2.0.2 Java Platform, Enterprise Edition 5 SDK Java™ 6 Update 17 JCreator LE 4.50 Junk Mail filter update LimeWire PRO 5.3.6 Live Mesh Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Live Add-in 1.4 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook Connector Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft VC9 runtime libraries Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable mIRC MKV Splitter Mojo Mozilla Firefox (3.5.5) MSVCRT NVIDIA PhysX PixiePack Codec Pack PowerISO PunkBuster Services PuTTY version 0.60 QuickTime Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB973704) Security Update for Microsoft Office Excel 2007 (KB973593) Security Update for Microsoft Office Outlook 2007 (KB972363) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office Publisher 2007 (KB969693) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Skype web features Skype™ 4.1 Steam™ tools-freebsd tools-linux tools-netware tools-solaris tools-windows tools-winPre2k Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 (KB974561) Update for Microsoft Office Word 2007 Help (KB963665) Update for Outlook 2007 Junk Email Filter (kb976884) VC80CRTRedist - 8.0.50727.4053 Visual C++ 8.0 Runtime Setup Package (x64) VLC media player 1.0.3 VMware Workstation Warcraft III Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Movie Maker Beta Windows Live Photo Gallery Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Media Player Firefox Plugin Xvid 1.2.2 final uninstall ==== Event Viewer Messages From Past Week ======== 12/21/2009 11:01:31 AM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0. 12/21/2009 10:42:48 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect. 12/21/2009 10:39:59 AM, Error: Microsoft-Windows-Kernel-General [6] - An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '\SystemRoot\System32\Config\SAM'. 12/21/2009 10:38:26 AM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:. 12/18/2009 11:19:27 AM, Error: Microsoft-Windows-Kernel-General [6] - An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): ''. 12/18/2009 1:55:55 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MICHAELCHAN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{527904F3-774F-4AAF-BF84-D6BF83DDC8F5}. The master browser is stopping or an election is being forced. 12/18/2009 1:53:21 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000116 (0xfffffa8008c4e010, 0xfffff8800ffc8230, 0x0000000000000000, 0x0000000000000002). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121809-24772-01. 12/17/2009 4:20:17 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007a (0xfffff6fc400098f8, 0xffffffffc0000185, 0x00000000a6d25860, 0xfffff8800131fad8). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121709-36254-01. 12/17/2009 4:15:58 PM, Error: Microsoft-Windows-Kernel-General [6] - An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '\??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT'. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Audio Endpoint Builder service, but this action failed with the following error: Circular service dependency was specified. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7019] - The Windows Audio Endpoint Builder service depends on a service in a group which starts later. Change the order in the service dependency tree to ensure that all services required to start this service are starting before this service is started. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7017] - Detected circular dependencies demand starting Windows Audio Endpoint Builder. Check the service dependency tree. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7000] - The Remote Desktop Services UserMode Port Redirector service failed to start due to the following error: The system cannot find the path specified. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7000] - The Program Compatibility Assistant Service service failed to start due to the following error: The system cannot find the path specified. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7000] - The Plug and Play service failed to start due to the following error: The system cannot find the path specified. 12/16/2009 8:15:00 PM, Error: Service Control Manager [7000] - The HomeGroup Listener service failed to start due to the following error: The system cannot find the path specified. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7034] - The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s). 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Remote Desktop Services UserMode Port Redirector service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The PnP-X IP Bus Enumerator service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Offline Files service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The HomeGroup Listener service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2009 8:14:00 PM, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2009 6:10:59 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007a (0xfffff6fc40009938, 0xffffffffc0000185, 0x00000000464de860, 0xfffff88001327ad8). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121609-26254-01. 12/16/2009 12:03:38 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007a (0xfffff6fc400072b0, 0xffffffffc0000185, 0x000000006cb79860, 0xfffff88000e56910). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121609-25849-01. 12/15/2009 8:07:33 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Base Filtering Engine service, but this action failed with the following error: An instance of the service is already running. 12/15/2009 8:06:04 PM, Error: Microsoft-Windows-Kernel-General [6] - An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): '\??\C:\Users\Yee\ntuser.dat'. 12/15/2009 8:05:32 PM, Error: Service Control Manager [7031] - The Windows Firewall service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/15/2009 8:05:32 PM, Error: Service Control Manager [7031] - The Diagnostic Policy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/15/2009 8:05:32 PM, Error: Service Control Manager [7031] - The Base Filtering Engine service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/14/2009 8:50:15 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MICHAELCHAN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{53B48029-EC94-44C6-BBE7-ADF4E79637CF}. The master browser is stopping or an election is being forced. 12/14/2009 7:33:11 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service. ==== End Of File =========================== I tried running GMER but when I opened it up it gave me a dialog box with the following message: "C:\Windows\system32\config\system: The system cannot find the file specified." Most of the selections on the right side were grayed out, and I ran it anyways and it just said nothing was found.
Post #4 last edited
Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so.

NEXT


Download OTS to your Desktop
  • Close ALL OTHER PROGRAMS.
  • Double-click on OTS.exe to start the program.
  • Check the box that says Scan All Users
  • Check the box that says 64 bit
  • Under Additional Scans check the following:
    • File - Lop Check
    • File - Purity Scan
    • Evnt - EvtViewer (last 10)
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Please attach the log in your next post.

Please explain more about the Norton installation? Norton is not showin in your add/remove programs list, hiowever it does appear as though there were newly created folders from symantec and norton:

2009-12-14 17:15:07 0 d—–w- c:\programdata\Symantec
2009-12-14 17:15:07 0 d—–w- c:\programdata\Norton
2009-12-14 17:15:05 0 d—–w- c:\programdata\NortonInstaller

Navigate to the Norton and symantec folders and tell me what files they contain.
Post #5
Okay, here's the log from Malwarebytes' Malwarebytes' Anti-Malware 1.42 Database version: 3406 Windows 6.1.7100 Internet Explorer 8.0.7100.0 12/21/2009 5:58:54 PM mbam-log-2009-12-21 (17-58-54).txt Scan type: Quick Scan Objects scanned: 106881 Time elapsed: 4 minute(s), 38 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) and as for the norton problem…a norton installer icon showed up on my desktop randomly and actually started installing without me ever opening the .exe. i stopped it and deleted the icon (nothing was actually installed yet) but when i rebooted my computer, the icon was there again. i deleted it again, and it showed up again, then the next time i deleted it it stayed deleted. i just looked at the folders, and they all contain a file 'symdata' but the folder NortonInstaller has a folder Logs, which contains 3 folders with the dates and times in your post…each of those folders contains a .mft archive and 2 .txt files. when i first bought this laptop, norton was originally installed but i deleted it first thing when i turned on my laptop (i hate norton) and this is the first time it has shown up since i initially deleted it.

Attachments:

Post #6
Hi,

Please do the following:

Start OTS
Copy/Paste the information inside the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.


[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
[Files/Folders - Created Within 30 Days]
NY -> Symantec -> C:\ProgramData\Symantec
NY -> Norton -> C:\ProgramData\Norton
NY -> NortonInstaller -> C:\ProgramData\NortonInstaller
NY -> 2 C:\Windows\*.tmp files -> C:\Windows\*.tmp
[Purity]
[Empty Temp Folders]
[Start Explorer]
[Reboot]


The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.

Also, Please advise how your computer is running now and if there are any outstanding issues.
Post #7
Here's the log All Processes Killed [Registry - Safe List] Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. [Files/Folders - Created Within 30 Days] C:\ProgramData\Symantec folder moved successfully. C:\ProgramData\Norton folder moved successfully. C:\ProgramData\NortonInstaller\Logs\12-14-2009-09h16m15s folder moved successfully. C:\ProgramData\NortonInstaller\Logs\12-14-2009-09h16m07s folder moved successfully. C:\ProgramData\NortonInstaller\Logs\12-14-2009-09h15m05s folder moved successfully. C:\ProgramData\NortonInstaller\Logs folder moved successfully. C:\ProgramData\NortonInstaller folder moved successfully. C:\Windows\9580813D94B14C289426A441E2BB29A5.TMP folder deleted successfully. C:\Windows\DD1865F0AD7340FBB23E1822E02396FF.TMP\WiseCustomCalla.dll deleted successfully. C:\Windows\DD1865F0AD7340FBB23E1822E02396FF.TMP folder deleted successfully. [Purity] Purity scan complete. [Empty Temp Folders] User: Administrator User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Mcx1-YEE-PC ->Temp folder emptied: 504 bytes ->Temporary Internet Files folder emptied: 114676 bytes User: Public User: Yee ->Temp folder emptied: 40775389 bytes ->Temporary Internet Files folder emptied: 35939480 bytes ->Java cache emptied: 44205069 bytes ->FireFox cache emptied: 53005186 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes Windows Temp folder emptied: 525631 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67496 bytes RecycleBin emptied: 59378584 bytes Total Files Cleaned = 223.00 mb < End of fix log > OTS by OldTimer - Version 3.1.12.0 fix logfile created on 12212009_220845 Files\Folders moved on Reboot… C:\Users\Yee\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-2220.log moved successfully. Registry entries deleted on Reboot… and my laptop seems to be running much better now, thanks for all the help :D
Post #8
Hi,

Please do the following:

Please go HERE to run Panda's ActiveScan
  • Once you are on the Panda site click the Scan your PC Now button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
    Post the contents of the ActiveScan report

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI