DDS:
DDS (Ver_10-03-17.01) - NTFSX64
The GMER scan keeps freezing partway. I managed to save part of the log:
GMER 1.0.15.15281 - http://www.gmer.net
Thank you in advance for the help!
Kevin
[external image: Posted Image]
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them Stay with this topic until I give you the all clean post.
You might want to print these instructions out.
I suggest you do this:
XP Users
Double-click My Computer.
Click the
Tools menu , and then click
Folder Options .
Click the
View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder,
select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.
Vista Users
To
enable the viewing of
hidden and protected system files in Windows Vista please follow these steps:
Close all programs so that you are at your desktop.
Click on the
Start button. This is the small round button with the Windows flag in the lower left corner.
Click on the
Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:
If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.
If you are in the Control Panel Home view do the following:
Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Please do not delete anything unless instructed to.
We've been seeing some Java infections lately.
Go here and follow the instructions to clear your
Java Cache
Next:
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under
Main choose:
Select All
Click the
Empty Selected button.
If you use Firefox browser Click
Firefox at the top and choose:
Select All
Click the
Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.
If you use Opera browser Click
Opera at the top and choose:
Select All
Click the
Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.
Click
Exit on the Main menu to close the program.
It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.
Next:
Please download
Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish . If an update is found, it will download and install the latest version. Once the program has loaded, select Perform quick scan , then click Scan .[external image: Posted Image] When the scan is complete, click OK , then Show Results to view the results. [external image: Posted Image] Then click Remove Selected . When completed, a log will open in Notepad. Please save it to a convenient location and post the results. Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also please describe how your computer behaves at the moment.
Please don't attach the scans / logs, use
"copy/paste". .
Thanks for helping me LDtate!
Malwarebytes' log:
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org
Database version: 3994
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18904
4/15/2010 10:20:04 PM
mbam-log-2010-04-15 (22-20-04).txt
Scan type: Full scan (C:\|)
Objects scanned: 325484
Time elapsed: 1 hour(s), 53 minute(s), 48 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Download ComboFix from one of these locations:
Link 1 Link 2 If using this link, Right Click and select Save As.
* IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note : If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs Double click on ComboFix.exe & follow the prompts.Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7. Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the
C:\ComboFix.txt using Copy / Paste in your next reply.
Notes:
1.
Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of
ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine.
Give it atleast 20-30 minutes to finish if needed.
Please do not attach the scan results from Combofx. Use copy/paste.
Also please describe how your computer behaves at the moment.
Hi LDtate,[external image: Posted Image]
You may wish to try
StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve performance.
The only thing that showed up were AIM and MSN, but my computer is still running slower than normal.
Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:
C:\Users\Kevin\Desktop\esqi11x9.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If virscan.org is too busy you can try these.
http://virscan.org/
http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html
I can't find the file there
C:\Windows\system32\taskeng.exeC:\Users\Kevin\Desktop\esqi11x9.exe enable the viewing of hidden and protected system files in Windows Vista please follow these steps:Start button. This is the small round button with the Windows flag in the lower left corner.Control Panel menu option.Remove the checkmark from the checkbox labeled Hide extensions for known file types.Remove the checkmark from the checkbox labeled Hide protected operating system files.
DDS (Ver_10-03-17.01) - NTFSX64
Run by [removed] at 18:07:27.99 on Mon 04/19/2010
Internet Explorer: 8.0.6001.18904
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3998.1131 [GMT -7:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_58be29c0\STacSV64.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\agr64svc.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\SMINST\BLService.exe
C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files (x86)\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\conime.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\splwow64.exe
C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe
C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
c:\program files\windows defender\MpCmdRun.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Kevin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Kevin\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\syswow64\blank.htm
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~2\micros~2\office14\GROOVEEX.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files (x86)\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~2\micros~2\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files (x86)\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [LightScribe Control Panel] c:\program files (x86)\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [Aim] "c:\program files (x86)\aim\aim.exe" /d locale=en-US
uRun: [Skype] "c:\program files (x86)\skype\phone\Skype.exe" /nosplash /minimized
uRun: [AdobeBridge]
mRun: [DVDAgent] "c:\program files (x86)\hewlett-packard\media\dvd\DVDAgent.exe"
mRun: [TSMAgent] "c:\program files (x86)\hewlett-packard\touchsmart\media\TSMAgent.exe"
mRun: [CLMLServer for HP TouchSmart] "c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\CLMLSvc.exe"
mRun: [TVAgent] "c:\program files (x86)\hewlett-packard\media\tv\TVAgent.exe"
mRun: [UCam_Menu] "c:\program files (x86)\hewlett-packard\media\webcam\muitransfer\muistartmenu.exe" "c:\program files (x86)\hewlett-packard\media\webcam" update "software\hewlett-packard\media\Webcam"
mRun: [QlbCtrl.exe] "c:\program files (x86)\hewlett-packard\hp quick launch buttons\QlbCtrl.exe" /Start
mRun: [hpWirelessAssistant] c:\program files (x86)\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [googletalk] "c:\program files (x86)\google\google talk\googletalk.exe" /autostart
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - /105
IE: Send image to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files (x86)\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files (x86)\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files (x86)\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~2\micros~2\office14\GROOVEEX.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files (x86)\common files\lightscribe\LSRunOnce.exe"
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg64.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\progra~1\micros~2\office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
mRun-x64: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun-x64: [Persistence] c:\windows\system32\igfxpers.exe
mRun-x64: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun-x64: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
mRun-x64: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun-x64: [SysTrayApp] c:\program files\idt\wdm\sttray64.exe
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
================= FIREFOX ===================
FF - ProfilePath - c:\users\kevin\appdata\roaming\mozilla\firefox\profiles\ouwp8ewn.default\
FF - plugin: c:\progra~2\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~2\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files (x86)\google\google updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: c:\program files (x86)\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files (x86)\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\users\kevin\appdata\local\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\kevin\appdata\roaming\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\kevin\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\kevin\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
—- FIREFOX POLICIES —-
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 134024]
R2 {55662437-DA8C-40c0-AADA-2C816A897A49};{55662437-DA8C-40c0-AADA-2C816A897A49};c:\program files (x86)\hewlett-packard\media\dvd\000.fcl [2008-9-26 27632]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\x86\ekrn.exe [2009-5-14 731840]
R2 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2009-5-14 44944]
R2 hpsrv;HP Service;c:\windows\system32\hpservice.exe [2008-3-18 23040]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files (x86)\sminst\BLService.exe [2008-10-18 365904]
R2 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files (x86)\hewlett-packard\media\tv\kernel\tv\TVCapSvc.exe [2008-9-24 296320]
R2 TVSched;TV Task Scheduler (TVTS);c:\program files (x86)\hewlett-packard\media\tv\kernel\tv\TVSched.exe [2008-9-24 116096]
R3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-18 193840]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [2008-9-4 64000]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-7-15 126464]
R3 NETw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\NETw5v64.sys [2008-11-17 4751360]
R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-26 4924336]
S2 clr_optimization_v4.0.21006_32;Microsoft .NET Framework NGEN v4.0.21006_X86;c:\windows\microsoft.net\framework\v4.0.21006\mscorsvw.exe [2009-10-7 129856]
S2 clr_optimization_v4.0.21006_64;Microsoft .NET Framework NGEN v4.0.21006_X64;c:\windows\microsoft.net\framework64\v4.0.21006\mscorsvw.exe [2009-10-7 138560]
S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2010-1-9 133104]
S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\teamviewer\version5\TeamViewer_Service.exe [2010-1-12 185640]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\common files\macrovision shared\flexnet publisher\FNPLicensingService64.exe [2010-1-9 1038088]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\microsoft office\office14\GROOVE.EXE [2009-10-29 30603640]
S3 NETw3v64;Intel® PRO/Wireless 3945ABG Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\drivers\NETw3v64.sys [2008-1-20 3154432]
S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework64\v4.0.21006\wpf\WPFFontCache_v0400.exe [2009-10-7 1007448]
S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk60x64.sys [2006-11-2 273408]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2010-1-9 93184]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-22 61976]
S4 Norton Internet Security;Norton Internet Security;"c:\program files (x86)\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files (x86)\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 –> c:\program files (x86)\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 311656]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 427880]
============== File Associations ===============
JSEFile=c:\windows\syswow64\WScript.exe "%1" %*
=============== Created Last 30 ================
2010-04-17 21:39:32 846517507 —-a-w- c:\windows\MEMORY.DMP
2010-04-17 03:34:35 0 d—–w- c:\program files (x86)\Groove Games
2010-04-16 02:06:05 0 d—–w- c:\users\kevin\appdata\roaming\Malwarebytes
2010-04-16 02:05:35 0 d—–w- c:\programdata\Malwarebytes
2010-04-16 02:05:34 24664 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-16 02:05:27 0 d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2010-04-15 02:18:35 1420688 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 02:18:33 29696 —-a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-15 02:18:33 224256 —-a-w- c:\windows\system32\iphlpsvc.dll
2010-04-15 02:18:17 135168 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-15 02:18:16 273920 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 02:18:16 105472 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 02:18:08 4690832 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-04-15 02:18:03 612864 —-a-w- c:\windows\system32\vbscript.dll
2010-04-15 02:18:01 420352 —-a-w- c:\windows\syswow64\vbscript.dll
2010-04-15 02:17:43 62464 —-a-w- c:\windows\syswow64\l3codeca.acm
2010-04-15 02:17:40 72192 —-a-w- c:\windows\system32\l3codeca.acm
2010-04-14 14:03:33 104960 —-a-w- c:\windows\system32\cabview.dll
2010-04-14 14:03:31 98304 —-a-w- c:\windows\syswow64\cabview.dll
2010-04-14 14:03:13 218112 —-a-w- c:\windows\system32\wintrust.dll
2010-04-14 14:03:11 171520 —-a-w- c:\windows\syswow64\wintrust.dll
2010-04-11 06:26:54 0 d—–w- c:\users\kevin\appdata\roaming\Cool Record Edit Pro
2010-04-11 06:14:14 0 d—–w- c:\users\kevin\appdata\roaming\Free Sound Recorder
2010-04-11 04:36:22 0 d—–w- c:\program files (x86)\YouTube Downloader
2010-04-09 17:49:10 0 d—–w- c:\programdata\Trymedia
2010-04-07 23:45:00 604672 ——w- c:\windows\system32\stapi64.dll
2010-04-05 05:10:18 0 d—–w- c:\program files\WinRAR
2010-04-05 04:59:55 0 d—–w- c:\program files (x86)\WinAce
2010-04-03 00:13:27 56 —ha-w- c:\windows\syswow64\ezsidmv.dat
2010-04-03 00:12:11 0 d—–r- c:\program files (x86)\Skype
2010-04-03 00:12:06 0 d—–w- c:\programdata\Skype
2010-04-02 00:44:37 0 d—–w- c:\windows\syswow64\Adobe
2010-03-31 03:28:56 1538560 —-a-w- c:\windows\system32\inetcpl.cpl
2010-03-30 03:22:49 0 d—–w- c:\program files (x86)\QS
2010-03-23 04:47:19 0 d—–w- C:\tmpp
2010-03-21 16:09:30 0 d—–w- c:\program files (x86)\common files\Software Update Utility
==================== Find3M ====================
2010-04-07 23:48:29 51200 —-a-w- c:\windows\inf\infpub.dat
2010-04-07 23:48:28 86016 —-a-w- c:\windows\inf\infstor.dat
2010-04-07 23:48:28 143360 —-a-w- c:\windows\inf\infstrng.dat
2010-04-07 23:42:04 30808 —-a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2010-04-07 23:27:53 665600 —-a-w- c:\windows\inf\drvindex.dat
2010-02-24 17:16:06 212864 ——w- c:\windows\system32\MpSigStub.exe
2010-02-23 07:03:02 1147904 —-a-w- c:\windows\system32\wininet.dll
2010-02-23 06:57:40 132096 —-a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:57:39 77312 —-a-w- c:\windows\system32\iesetup.dll
2010-02-23 06:39:13 916480 —-a-w- c:\windows\syswow64\wininet.dll
2010-02-23 06:39:00 1209344 —-a-w- c:\windows\syswow64\urlmon.dll
2010-02-23 06:37:26 206848 —-a-w- c:\windows\syswow64\occache.dll
2010-02-23 06:35:21 611840 —-a-w- c:\windows\syswow64\mstime.dll
2010-02-23 06:34:51 5944832 —-a-w- c:\windows\syswow64\mshtml.dll
2010-02-23 06:34:49 594432 —-a-w- c:\windows\syswow64\msfeeds.dll
2010-02-23 06:34:49 55296 —-a-w- c:\windows\syswow64\msfeedsbs.dll
2010-02-23 06:34:06 25600 —-a-w- c:\windows\syswow64\jsproxy.dll
2010-02-23 06:33:45 71680 —-a-w- c:\windows\syswow64\iesetup.dll
2010-02-23 06:33:45 1985536 —-a-w- c:\windows\syswow64\iertutil.dll
2010-02-23 06:33:45 164352 —-a-w- c:\windows\syswow64\ieui.dll
2010-02-23 06:33:45 109056 —-a-w- c:\windows\syswow64\iesysprep.dll
2010-02-23 06:33:44 55808 —-a-w- c:\windows\syswow64\iernonce.dll
2010-02-23 06:33:44 184320 —-a-w- c:\windows\syswow64\iepeers.dll
2010-02-23 06:33:44 11070976 —-a-w- c:\windows\syswow64\ieframe.dll
2010-02-23 06:33:38 387584 —-a-w- c:\windows\syswow64\iedkcs32.dll
2010-02-23 05:19:22 162816 —-a-w- c:\windows\system32\ieUnatt.exe
2010-02-23 04:55:36 133632 —-a-w- c:\windows\syswow64\ieUnatt.exe
2010-02-23 04:55:24 173056 —-a-w- c:\windows\syswow64\ie4uinit.exe
2010-02-23 04:54:43 13312 —-a-w- c:\windows\syswow64\msfeedssync.exe
2010-02-20 23:44:53 32768 —-a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:42:16 33792 —-a-w- c:\windows\system32\httpapi.dll
2010-02-20 23:39:35 24064 —-a-w- c:\windows\syswow64\nshhttp.dll
2010-02-20 23:37:20 31232 —-a-w- c:\windows\syswow64\httpapi.dll
2010-02-20 21:40:37 610304 —-a-w- c:\windows\system32\drivers\http.sys
2010-01-30 23:57:24 703400 —-a-w- c:\windows\fonts\Capture it.ttf
2010-01-25 13:03:03 534016 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 13:03:03 159232 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 13:03:03 158720 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 13:02:33 535040 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 13:00:33 457216 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 12:48:34 472576 —-a-w- c:\windows\syswow64\secproc_isv.dll
2010-01-25 12:48:34 151040 —-a-w- c:\windows\syswow64\secproc_ssp_isv.dll
2010-01-25 12:48:34 151040 —-a-w- c:\windows\syswow64\secproc_ssp.dll
2010-01-25 12:48:06 472064 —-a-w- c:\windows\syswow64\secproc.dll
2010-01-25 12:45:56 329216 —-a-w- c:\windows\syswow64\msdrm.dll
2010-01-25 08:37:36 413696 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:37:32 594944 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:37:32 409600 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:37:29 594432 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:35:01 346624 —-a-w- c:\windows\syswow64\RMActivate_ssp_isv.exe
2010-01-25 08:35:00 523776 —-a-w- c:\windows\syswow64\RMActivate_isv.exe
2010-01-25 08:34:56 511488 —-a-w- c:\windows\syswow64\RMActivate.exe
2010-01-25 08:34:56 347136 —-a-w- c:\windows\syswow64\RMActivate_ssp.exe
2010-01-23 10:00:20 2048 —-a-w- c:\windows\system32\tzres.dll
2010-01-23 09:44:02 2048 —-a-w- c:\windows\syswow64\tzres.dll
2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini
2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2010-01-14 14:00:03 245760 –sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
2008-10-18 23:04:16 8192 –sha-w- c:\windows\users\default\NTUSER.DAT
============= FINISH: 18:09:27.59 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 4/1/2009 1:08:00 AM
System Uptime: 4/18/2010 5:23:48 PM (25 hours ago)
Motherboard: Quanta | | 3602
Processor: Intel® Core™2 Duo CPU P7350 @ 2.00GHz | CPU | 2000/1066mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 453 GiB total, 331.443 GiB free.
D: is FIXED (NTFS) - 12 GiB total, 1.978 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP112: 4/7/2010 4:04:02 PM - Windows Vista™ Service Pack 2
RP113: 4/8/2010 6:23:53 PM - Windows Update
RP114: 4/10/2010 8:23:26 PM - Installed Vegas Pro 9.0
RP115: 4/10/2010 8:51:55 PM - Removed Vegas Pro 9.0
RP116: 4/11/2010 10:23:30 AM - Scheduled Checkpoint
RP117: 4/12/2010 2:25:22 AM - Scheduled Checkpoint
RP118: 4/12/2010 7:04:16 AM - Windows Update
RP119: 4/15/2010 3:01:23 AM - Windows Update
RP120: 4/15/2010 1:27:55 PM - Windows Update
RP121: 4/16/2010 7:17:17 PM - Scheduled Checkpoint
RP122: 4/17/2010 12:21:43 PM - Windows Update
RP123: 4/18/2010 12:44:29 PM - Scheduled Checkpoint
RP124: 4/19/2010 6:57:45 AM - Windows Update
RP125: 4/19/2010 5:51:04 PM - Windows Update
==== Installed Programs ======================
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Drive CS4
Adobe Dynamiclink Support
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash CS4
Adobe Flash CS4 Extension - Flash Lite STI en
Adobe Flash CS4 Professional
Adobe Flash CS4 STI-en
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS4
Adobe Media Encoder CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 9.3.2
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe Shockwave Player 11.5
Adobe SING CS4
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
AIM 7
Ashampoo Burning Studio 9.20
CCleaner
Compatibility Pack for the 2007 Office system
Connect
Download Updater (AOL LLC)
DVD Architect Pro 5.0
EASEUS Data Recovery Wizard Professional 4.3.6
ESU for Microsoft Vista
Facebook Plug-In
Foxit Reader
Google Apps
Google Chrome
Google Talk (remove only)
Google Talk Plugin
Google Update Helper
Google Updater
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Customer Experience Enhancements
HP Doc Viewer
HP Help and Support
HP MediaSmart DVD
HP MediaSmart Music/Photo/Video
HP MediaSmart TV
HP MediaSmart Webcam
HP MULTIPLE MODEM INSTALLER for VISTA
HP Quick Launch Buttons 6.40 H2
HP Smart Web Printing
HP Total Care Advisor
HP Update
HP User Guides 0128
HP Wireless Assistant
HPTCSSetup
IDT Audio
Java™ 6 Update 17
Java™ 6 Update 7
K-Lite Codec Pack 5.6.1 (Full)
kuler
LightScribe System Software 1.14.17.1
Malwarebytes' Anti-Malware
Microsoft .NET Framework 4 Multi-Targeting Pack
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Help 3.0 Beta 2
Microsoft Office Access MUI (English) 2010 (Beta)
Microsoft Office Access Setup Metadata MUI (English) 2010 (Beta)
Microsoft Office Excel MUI (English) 2010 (Beta)
Microsoft Office Groove MUI (English) 2010 (Beta)
Microsoft Office InfoPath MUI (English) 2010 (Beta)
Microsoft Office OneNote MUI (English) 2010 (Beta)
Microsoft Office Outlook MUI (English) 2010 (Beta)
Microsoft Office PowerPoint MUI (English) 2010 (Beta)
Microsoft Office Professional Plus 2010
Microsoft Office Professional Plus 2010 (Beta)
Microsoft Office Proof (English) 2010 (Beta)
Microsoft Office Proof (French) 2010 (Beta)
Microsoft Office Proof (Spanish) 2010 (Beta)
Microsoft Office Proofing (English) 2010 (Beta)
Microsoft Office Publisher MUI (English) 2010 (Beta)
Microsoft Office Send-a-Smile
Microsoft Office Shared MUI (English) 2010 (Beta)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)
Microsoft Office Word MUI (English) 2010 (Beta)
Microsoft Silverlight
Microsoft SQL Server 2008 Browser
Microsoft SQL Server Compact 3.5 SP2 Beta English
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 Express Beta 2 - ENU
Microsoft Works
Mozilla Firefox (3.6.3)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
PDF Settings CS4
Photoshop Camera Raw
Picasa 3
Pixel Bender Toolkit
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek USB 2.0 Card Reader
Security Update for Microsoft Office 2010 File Validation - Beta (KB976133)
Skype™ 4.2
Spotify
SpywareBlaster 4.2
SQL Server 2008 R2 Management Objects
SQL Server System CLR Types
Suite Shared Configuration CS4
TeamViewer 5
Unlocker 1.8.8
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Vegas Pro 9.0
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
WinPatrol 2009
YouTube Downloader 2.5.4
==== Event Viewer Messages From Past Week ========
4/19/2010 4:24:10 PM, Error: Service Control Manager [7034] - The TeamViewer 5 service terminated unexpectedly. It has done this 1 time(s).
4/19/2010 3:47:48 PM, Error: Service Control Manager [7030] - The TeamViewer 5 service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
4/19/2010 3:33:00 PM, Error: Microsoft-Windows-Dhcp-Client [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00238BEFA320. The following error occurred: The wait operation timed out.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
4/18/2010 12:46:17 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.188 for the Network Card with network address 0022FAF27296 has been denied by the DHCP server 192.168.1.254 (The DHCP Server sent a DHCPNACK message).
4/17/2010 9:14:02 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.67 for the Network Card with network address 0022FAF27296 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
4/17/2010 2:41:40 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SQL Server (SQLEXPRESS) service to connect.
4/17/2010 2:41:40 PM, Error: Service Control Manager [7000] - The SQL Server (SQLEXPRESS) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/17/2010 2:39:35 PM, Error: EventLog [6008] - The previous system shutdown at 2:37:20 PM on 4/17/2010 was unexpected.
4/17/2010 2:27:57 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
4/17/2010 2:27:53 PM, Error: Service Control Manager [7034] - The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 2 time(s).
4/17/2010 2:27:25 PM, Error: Service Control Manager [7034] - The Office Software Protection Platform service terminated unexpectedly. It has done this 1 time(s).
4/17/2010 2:27:23 PM, Error: Service Control Manager [7031] - The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
4/17/2010 2:27:13 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
4/17/2010 2:27:04 PM, Error: Service Control Manager [7034] - The Recovery Service for Windows service terminated unexpectedly. It has done this 1 time(s).
4/15/2010 3:26:47 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SRTSP SRTSPX
4/15/2010 3:25:27 AM, Error: EventLog [6008] - The previous system shutdown at 4:28:52 PM on 4/11/2010 was unexpected.
==== End Of File ===========================
It's gone.
That's all I saw that was suspect.
Ohh. Thanks for the fast replies. What should I do now?
