What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Paltalk PC Nortin

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello all I down laoded Paltalk it now has Nortin PC check up when I installed Paltalk it installed PC Nortin Check up I can not uninstall the darn program on safe mode or reg mode could U please help thanks I am on vista as well. my tech guys wont reinstall this
Post #2
Hi Rodney2007,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Let's make sure I understand you issue correctly. You want Norton uninstalled from your system?

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
RP69: 3/11/2011 2:31:39 AM - Windows Update RP70: 3/11/2011 2:33:35 AM - Windows Update RP71: 3/11/2011 11:02:38 AM - Windows Update RP72: 3/11/2011 12:05:56 PM - Windows Update RP73: 3/11/2011 12:27:11 PM - Windows Update RP74: 3/12/2011 10:14:59 AM - Windows Update RP75: 3/13/2011 2:42:22 AM - Windows Update RP76: 3/14/2011 3:16:59 AM - Windows Update RP77: 3/14/2011 10:56:36 PM - Windows Update RP78: 3/15/2011 10:10:22 AM - Windows Update RP79: 3/16/2011 - Scheduled Checkpoint RP80: 3/16/2011 10:13:48 AM - Windows Update RP81: 3/17/2011 1:24:48 AM - Scheduled Checkpoint RP82: 3/17/2011 1:58:57 PM - Windows Update RP83: 3/19/2011 8:17:20 AM - Windows Update RP84: 3/19/2011 5:16:53 PM - Removed Paltalk Toolbar. RP85: 3/20/2011 2:27:36 AM - Windows Update RP86: 3/20/2011 6:18:19 AM - Restore Operation RP87: 3/20/2011 9:37:06 AM - Restore Operation RP88: 3/20/2011 10:12:56 AM - Installed Symantec Technical Support Web Controls RP89: 3/20/2011 11:48:00 PM - Scheduled Checkpoint RP90: 3/21/2011 11:46:03 AM - Windows Update . ==== Installed Programs ======================
Post #4
DS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 22:45:57.00 on Mon 03/21/2011 Internet Explorer: 8.0.6001.19019 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.877 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\System32\igfxpers.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\OEM02Mon.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Windows Mail\WinMail.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10n_ActiveX.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\easyhome\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KF89DLES\dds[1].scr C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.ca/ mWinlogon: Userinit=userinit.exe BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun mRun: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe mRun: [Conime] %windir%\system32\conime.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: {5A353365-052D-43F9-A8E2-5BDE60D23D14} = 204.187.88.10 209.91.128.10 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun-x64: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe mRun-x64: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2010-10-24 188928] R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2010-10-24 40832] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2010-10-24 72064] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616] R3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk60x64.sys [2007-9-17 369152] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 fssfltr;FssFltr;C:\Windows\System32\drivers\fssfltr.sys [2011-3-11 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2011-2-20 89920] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Progra============== File Associations =============== . JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . 2011-03-21 18:43:25 ——– d—–w- C:\Windows\Paltalk Messenger 2011-03-21 15:46:13 7947600 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{7461CEC1-E4E8-487F-8144-4810879C3E23}\mpengine.dll 2011-03-21 00:28:04 ——– d—–w- C:\Windows\pss 2011-03-20 14:13:30 ——– d—–w- C:\Program Files (x86)\Common Files\Symantec Shared 2011-03-20 11:27:34 ——– d—–w- C:\Users\easyhome\AppData\Local\Apps 2011-03-20 11:27:33 ——– d—–w- C:\Users\easyhome\AppData\Local\Deployment 2011-03-20 04:54:39 ——– d—–w- C:\Users\easyhome\AppData\Roaming\Tific 2011-03-20 04:54:39 ——– d—–w- C:\Users\easyhome\AppData\Local\Tific 2011-03-20 04:54:26 ——– d—–w- C:\PROGRA~3\Norton 2011-03-20 04:54:23 ——– d—–w- C:\PROGRA~3\NortonInstaller 2011-03-18 03:58:15 ——– d—–w- C:\Users\easyhome\AppData\Local\Google 2011-03-11 07:46:37 ——– d—–w- C:\Windows\en 2011-03-11 07:41:53 ——– d—–w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2011-03-11 07:39:15 48488 —-a-w- C:\Windows\System32\drivers\fssfltr.sys 2011-03-11 07:38:44 ——– d—–w- C:\Windows\PCHEALTH 2011-03-11 07:37:13 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-03-11 07:36:52 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-03-11 07:36:52 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-03-11 07:36:52 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-03-11 07:36:52 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-03-11 07:36:25 4398360 —-a-w- C:\Windows\System32\d3dx9_32.dll 2011-03-11 07:36:25 3426072 —-a-w- C:\Windows\SysWow64\d3dx9_32.dll 2011-03-11 07:35:59 469256 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\f4785c201cbdfbe05\InstallManager_WLE_WLE.exe 2011-03-11 07:35:36 15712 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e8f483b01cbdfbe04\MeshBetaRemover.exe 2011-03-11 07:35:33 94040 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e5cc68b01cbdfbe03\DSETUP.dll 2011-03-11 07:35:33 525656 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e5cc68b01cbdfbe03\DXSETUP.exe 2011-03-11 07:35:33 1691480 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e5cc68b01cbdfbe03\dsetup32.dll 2011-03-11 07:35:25 94040 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e1e877c01cbdfbe02\DSETUP.dll 2011-03-11 07:35:25 525656 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e1e877c01cbdfbe02\DXSETUP.exe 2011-03-11 07:35:25 1691480 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e1e877c01cbdfbe02\dsetup32.dll 2011-03-11 07:35:16 6260088 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\dbc545301cbdfbe01\Silverlight.4.0.exe 2011-03-11 07:34:44 ——– d—–w- C:\Users\easyhome\AppData\Local\Windows Live 2011-03-11 07:34:40 ——– d—–w- C:\Program Files (x86)\Common Files\Windows Live 2011-03-11 07:33:51 754688 —-a-w- C:\Windows\SysWow64\webservices.dll 2011-03-11 07:33:51 1103872 —-a-w- C:\Windows\System32\webservices.dll 2011-03-09 00:11:47 2425344 —-a-w- C:\Windows\System32\mstscax.dll 2011-03-09 00:11:46 731136 —-a-w- C:\Windows\System32\mstsc.exe 2011-03-09 00:11:46 677888 —-a-w- C:\Windows\SysWow64\mstsc.exe 2011-03-09 00:11:46 2067968 —-a-w- C:\Windows\SysWow64\mstscax.dll 2011-03-09 00:11:44 559616 —-a-w- C:\Windows\System32\EncDec.dll 2011-03-09 00:11:44 416768 —-a-w- C:\Windows\System32\sbe.dll 2011-03-09 00:11:43 429056 —-a-w- C:\Windows\SysWow64\EncDec.dll 2011-03-09 00:11:43 322560 —-a-w- C:\Windows\SysWow64\sbe.dll 2011-03-09 00:11:43 226816 —-a-w- C:\Windows\System32\mpg2splt.ax 2011-03-09 00:11:43 210944 —-a-w- C:\Windows\System32\sbeio.dll 2011-03-09 00:11:43 177664 —-a-w- C:\Windows\SysWow64\mpg2splt.ax 2011-03-09 00:11:43 153088 —-a-w- C:\Windows\SysWow64\sbeio.dll 2011-02-27 04:36:27 ——– d—–w- C:\Users\easyhome\AppData\Local\Adobe 2011-02-23 22:04:16 2048 —-a-w- C:\Windows\SysWow64\winrsmgr.dll 2011-02-23 22:04:16 2048 —-a-w- C:\Windows\System32\winrsmgr.dll 2011-02-23 22:04:12 13312 —-a-w- C:\Windows\System32\wsmplpxy.dll 2011-02-23 22:04:12 13312 —-a-w- C:\Windows\System32\winrssrv.dll 2011-02-23 22:04:07 10240 —-a-w- C:\Windows\SysWow64\wsmplpxy.dll 2011-02-23 22:04:07 10240 —-a-w- C:\Windows\SysWow64\winrssrv.dll 2011-02-23 02:55:33 ——– d—–w- C:\Users\easyhome\AppData\Roaming\OpenOffice.org 2011-02-21 13:51:31 ——– d—–w- C:\Windows\SysWow64\spool 2011-02-21 13:51:30 ——– d—–w- C:\Program Files (x86)\Windows Portable Devices 2011-02-21 13:51:29 ——– d—–w- C:\Program Files\Windows Portable Devices 2011-02-21 12:34:03 369664 —-a-w- C:\Windows\SysWow64\WMPhoto.dll 2011-02-21 12:34:02 449024 —-a-w- C:\Windows\System32\WMPhoto.dll 2011-02-21 12:34:02 3584 —-a-w- C:\Windows\System32\drivers\en-US\dxgkrnl.sys.mui 2011-02-21 12:32:27 736256 —-a-w- C:\Windows\System32\UIAutomationCore.dll 2011-02-21 12:32:27 4096 —-a-w- C:\Windows\SysWow64\oleaccrc.dll 2011-02-21 12:32:27 4096 —-a-w- C:\Windows\System32\oleaccrc.dll 2011-02-21 12:32:27 315904 —-a-w- C:\Windows\System32\oleacc.dll 2011-02-21 12:32:27 234496 —-a-w- C:\Windows\SysWow64\oleacc.dll 2011-02-21 12:32:26 555520 —-a-w- C:\Windows\SysWow64\UIAutomationCore.dll 2011-02-21 12:21:29 92672 —-a-w- C:\Windows\SysWow64\UIAnimation.dll 2011-02-21 12:21:29 103424 —-a-w- C:\Windows\System32\UIAnimation.dll 2011-02-21 12:21:28 3815424 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-02-21 12:21:28 3023360 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-02-21 12:21:28 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-02-21 12:21:28 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-02-20 19:43:28 ——– d—–w- C:\Windows\SysWow64\vi-VN 2011-02-20 19:43:28 ——– d—–w- C:\Windows\SysWow64\eu-ES 2011-02-20 19:43:28 ——– d—–w- C:\Windows\SysWow64\ca-ES 2011-02-20 19:43:27 ——– d—–w- C:\Windows\System32\eu-ES 2011-02-20 19:43:27 ——– d—–w- C:\Windows\System32\ca-ES 2011-02-20 19:43:25 ——– d—–w- C:\Windows\System32\vi-VN 2011-02-20 19:17:38 ——– d—–w- C:\Windows\System32\EventProviders 2011-02-20 19:04:30 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2011-02-20 19:00:39 99176 —-a-w- C:\Windows\SysWow64\PresentationHostProxy.dll 2011-02-20 19:00:38 49472 —-a-w- C:\Windows\SysWow64\netfxperf.dll 2011-02-20 19:00:38 48960 —-a-w- C:\Windows\System32\netfxperf.dll 2011-02-20 19:00:38 444752 —-a-w- C:\Windows\System32\mscoree.dll 2011-02-20 19:00:38 320352 —-a-w- C:\Windows\System32\PresentationHost.exe 2011-02-20 19:00:38 297808 —-a-w- C:\Windows\SysWow64\mscoree.dll 2011-02-20 19:00:38 295264 —-a-w- C:\Windows\SysWow64\PresentationHost.exe 2011-02-20 19:00:38 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2011-02-20 19:00:38 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2011-02-20 19:00:38 109912 —-a-w- C:\Windows\System32\PresentationHostProxy.dll 2011-02-20 18:16:00 12240896 —-a-w- C:\Windows\SysWow64\NlsLexicons0007.dll 2011-02-20 18:16:00 12240896 —-a-w- C:\Windows\System32\NlsLexicons0007.dll 2011-02-20 18:14:59 719872 —-a-w- C:\Windows\System32\rpcss.dll 2011-02-20 18:13:59 722944 —-a-w- C:\Windows\System32\autofmt.exe 2011-02-20 18:12:59 88064 —-a-w- C:\Windows\System32\drivers\smb.sys 2011-02-20 18:11:59 293888 —-a-w- C:\Windows\System32\wdscore.dll 2011-02-20 18:11:59 138752 —-a-w- C:\Windows\System32\PkgMgr.exe 2011-02-20 18:11:56 315904 —-a-w- C:\Windows\System32\drvstore.dll 2011-02-20 16:14:50 18904 —-a-w- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin 2011-02-20 16:14:50 18904 —-a-w- C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2011-02-20 15:24:37 7680 —-a-w- C:\Program Files\Internet Explorer\iecompat.dll 2011-02-20 15:24:37 7680 —-a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll 2011-02-20 15:20:59 76288 —-a-w- C:\Windows\System32\wextract.exe 2011-02-20 07:34:11 32768 —-a-w- C:\Windows\System32\nshhttp.dll 2011-02-20 07:34:11 24064 —-a-w- C:\Windows\SysWow64\nshhttp.dll 2011-02-20 07:34:06 620032 —-a-w- C:\Windows\System32\drivers\http.sys 2011-02-20 07:34:05 33792 —-a-w- C:\Windows\System32\httpapi.dll 2011-02-20 07:34:04 30720 —-a-w- C:\Windows\SysWow64\httpapi.dll 2011-02-20 07:02:33 ——– d—–w- C:\Users\easyhome\AppData\Local\Yahoo 2011-02-20 06:11:04 ——– d—–w- C:\Users\easyhome\AppData\Roaming\Paltalk 2011-02-20 05:51:18 ——– d—–w- C:\Users\easyhome\AppData\Local\Yahoo! 2011-02-20 05:48:58 ——– d—–w- C:\Program Files (x86)\Yahoo! 2011-02-20 05:43:58 ——– d—–w- C:\Program Files (x86)\OpenOffice.org 3 2011-02-20 05:43:02 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-02-20 05:25:45 ——– d—–w- C:\Users\easyhome\AppData\Roaming\Malwarebytes 2011-02-20 05:25:41 38224 —-a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys 2011-02-20 05:25:40 ——– d—–w- C:\PROGRA~3\Malwarebytes 2011-02-20 05:25:37 24152 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-02-20 05:25:37 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-02-20 04:22:24 372736 —-a-w- C:\Windows\System32\unregmp2.exe 2011-02-20 04:22:24 1486848 —-a-w- C:\Program Files\Windows Media Player\setup_wm.exe 2011-02-20 04:22:24 1418752 —-a-w- C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2011-02-20 04:22:23 310784 —-a-w- C:\Windows\SysWow64\unregmp2.exe 2011-02-20 04:20:56 441856 —-a-w- C:\Windows\System32\WSDApi.dll 2011-02-20 04:19:54 50688 —-a-w- C:\Windows\System32\rtutils.dll 2011-02-20 04:19:54 36864 —-a-w- C:\Windows\SysWow64\rtutils.dll 2011-02-20 04:19:52 317952 —-a-w- C:\Windows\SysWow64\MP4SDECD.DLL 2011-02-20 04:19:52 295424 —-a-w- C:\Windows\System32\MP4SDECD.DLL 2011-02-20 04:19:50 273920 —-a-w- C:\Windows\System32\spoolsv.exe 2011-02-20 04:19:46 81920 —-a-w- C:\Windows\SysWow64\iccvid.dll 2011-02-20 04:19:07 1797120 —-a-w- C:\Windows\System32\msxml6.dll 2011-02-20 04:19:07 1401856 —-a-w- C:\Windows\SysWow64\msxml6.dll 2011-02-20 04:19:01 53248 —-a-w- C:\Windows\SysWow64\tsgqec.dll 2011-02-20 04:19:01 45056 —-a-w- C:\Windows\System32\tsgqec.dll 2011-02-20 04:19:01 151552 —-a-w- C:\Windows\System32\aaclient.dll 2011-02-20 04:19:01 136192 —-a-w- C:\Windows\SysWow64\aaclient.dll 2011-02-20 04:17:56 599552 —-a-w- C:\Windows\System32\RMActivate.exe 2011-02-20 04:16:59 88576 —-a-w- C:\Windows\System32\atl.dll 2011-02-20 04:15:48 1869824 —-a-w- C:\Windows\System32\msxml3.dll 2011-02-20 04:15:47 1248768 —-a-w- C:\Windows\SysWow64\msxml3.dll 2011-02-20 04:15:33 82944 —-a-w- C:\Windows\System32\msasn1.dll 2011-02-20 04:15:33 60928 —-a-w- C:\Windows\SysWow64\msasn1.dll 2011-02-20 04:15:19 1927680 —-a-w- C:\Windows\System32\gameux.dll 2011-02-20 04:15:18 32256 —-a-w- C:\Windows\System32\Apphlpdm.dll 2011-02-20 04:15:18 28672 —-a-w- C:\Windows\SysWow64\Apphlpdm.dll 2011-02-20 04:15:18 1696256 —-a-w- C:\Windows\SysWow64\gameux.dll 2011-02-20 04:15:16 4240384 —-a-w- C:\Windows\SysWow64\GameUXLegacyGDFs.dll 2011-02-20 04:15:16 4240384 —-a-w- C:\Windows\System32\GameUXLegacyGDFs.dll 2011-02-20 04:15:13 203264 —-a-w- C:\Windows\System32\wkssvc.dll 2011-02-20 04:15:09 4699024 —-a-w- C:\Windows\System32\ntoskrnl.exe 2011-02-20 04:14:54 1585168 —-a-w- C:\Windows\System32\ntdll.dll 2011-02-20 04:14:53 1168512 —-a-w- C:\Windows\SysWow64\ntdll.dll 2011-02-20 04:14:49 1251840 —-a-w- C:\Windows\System32\sdclt.exe 2011-02-20 04:14:46 516096 —-a-w- C:\Program Files\Windows Mail\wab.exe 2011-02-20 04:14:46 515584 —-a-w- C:\Program Files (x86)\Windows Mail\wab.exe 2011-02-20 04:14:45 68096 —-a-w- C:\Program Files\Windows Mail\wabmig.exe 2011-02-20 04:14:45 66048 —-a-w- C:\Program Files (x86)\Windows Mail\wabmig.exe 2011-02-20 04:14:45 35328 —-a-w- C:\Program Files\Windows Mail\wabfind.dll 2011-02-20 04:14:45 33280 —-a-w- C:\Program Files (x86)\Windows Mail\wabfind.dll 2011-02-20 04:14:31 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2011-02-20 04:14:30 2048 —-a-w- C:\Windows\System32\tzres.dll 2011-02-20 04:13:08 72192 —-a-w- C:\Windows\System32\l3codeca.acm 2011-02-20 04:13:08 62464 —-a-w- C:\Windows\SysWow64\l3codeca.acm 2011-02-20 04:13:07 220672 —-a-w- C:\Windows\SysWow64\l3codecp.acm 2011-02-20 04:13:07 181760 —-a-w- C:\Windows\System32\l3codecp.acm 2011-02-20 04:13:04 621568 —-a-w- C:\Windows\System32\usp10.dll 2011-02-20 04:13:04 502272 —-a-w- C:\Windows\SysWow64\usp10.dll . ==================== Find3M ==================== . 2011-01-20 16:46:10 900480 —-a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2011-01-20 16:17:15 366592 —-a-w- C:\Windows\System32\winspool.drv 2011-01-20 16:17:03 625152 —-a-w- C:\Windows\System32\dxgi.dll 2011-01-20 16:16:53 287232 —-a-w- C:\Windows\System32\d3d10core.dll 2011-01-20 16:16:52 327680 —-a-w- C:\Windows\System32\d3d10_1core.dll 2011-01-20 16:16:52 196096 —-a-w- C:\Windows\System32\d3d10_1.dll 2011-01-20 16:16:52 1268224 —-a-w- C:\Windows\System32\d3d10.dll 2011-01-20 16:16:47 748544 —-a-w- C:\Windows\System32\stobject.dll 2011-01-20 16:16:40 47104 —-a-w- C:\Windows\System32\cdd.dll 2011-01-20 16:16:10 3548672 —-a-w- C:\Windows\System32\mf.dll 2011-01-20 16:16:08 35840 —-a-w- C:\Windows\System32\printfilterpipelineprxy.dll 2011-01-20 16:14:49 278528 —-a-w- C:\Windows\System32\mfplat.dll 2011-01-20 16:14:49 195072 —-a-w- C:\Windows\System32\mfps.dll 2011-01-20 16:08:16 478720 —-a-w- C:\Windows\SysWow64\dxgi.dll 2011-01-20 16:08:06 219648 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2011-01-20 16:08:06 189952 —-a-w- C:\Windows\SysWow64\d3d10core.dll 2011-01-20 16:08:06 160768 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2011-01-20 16:08:06 1029120 —-a-w- C:\Windows\SysWow64\d3d10.dll 2011-01-20 16:07:42 258048 —-a-w- C:\Windows\SysWow64\winspool.drv 2011-01-20 16:07:16 586240 —-a-w- C:\Windows\SysWow64\stobject.dll 2011-01-20 16:06:38 2873344 —-a-w- C:\Windows\SysWow64\mf.dll 2011-01-20 16:04:54 98816 —-a-w- C:\Windows\SysWow64\mfps.dll 2011-01-20 16:04:54 209920 —-a-w- C:\Windows\SysWow64\mfplat.dll 2011-01-20 15:01:50 3068416 —-a-w- C:\Windows\System32\xpsservices.dll 2011-01-20 15:01:09 1653760 —-a-w- C:\Windows\System32\XpsPrint.dll 2011-01-20 14:59:59 1032192 —-a-w- C:\Windows\System32\printfilterpipelinesvc.exe 2011-01-20 14:58:38 1461760 —-a-w- C:\Windows\System32\OpcServices.dll 2011-01-20 14:57:44 479744 —-a-w- C:\Windows\System32\XpsGdiConverter.dll 2011-01-20 14:57:28 231936 —-a-w- C:\Windows\System32\XpsRasterService.dll 2011-01-20 14:42:00 1257984 —-a-w- C:\Windows\System32\MFH264Dec.dll 2011-01-20 14:41:29 428544 —-a-w- C:\Windows\System32\MFHEAACdec.dll 2011-01-20 14:40:17 345088 —-a-w- C:\Windows\System32\mfreadwrite.dll 2011-01-20 14:40:14 34304 —-a-w- C:\Windows\System32\mfpmp.exe 2011-01-20 14:40:11 377344 —-a-w- C:\Windows\System32\mfmp4src.dll 2011-01-20 14:37:06 2002944 —-a-w- C:\Windows\System32\d3d10warp.dll 2011-01-20 14:35:30 566272 —-a-w- C:\Windows\System32\d3d10level9.dll 2011-01-20 14:28:38 1554432 —-a-w- C:\Windows\SysWow64\xpsservices.dll 2011-01-20 14:27:50 876032 —-a-w- C:\Windows\SysWow64\XpsPrint.dll 2011-01-20 14:25:25 847360 —-a-w- C:\Windows\SysWow64\OpcServices.dll 2011-01-20 14:24:32 288768 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2011-01-20 14:24:26 135680 —-a-w- C:\Windows\SysWow64\XpsRasterService.dll 2011-01-20 14:15:10 979456 —-a-w- C:\Windows\SysWow64\MFH264Dec.dll 2011-01-20 14:14:39 357376 —-a-w- C:\Windows\SysWow64\MFHEAACdec.dll 2011-01-20 14:14:03 302592 —-a-w- C:\Windows\SysWow64\mfmp4src.dll 2011-01-20 14:14:03 261632 —-a-w- C:\Windows\SysWow64\mfreadwrite.dll 2011-01-20 14:12:46 1172480 —-a-w- C:\Windows\SysWow64\d3d10warp.dll 2011-01-20 14:11:34 486400 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2011-01-20 14:06:15 834048 —-a-w- C:\Windows\System32\d2d1.dll 2011-01-20 14:02:46 1555968 —-a-w- C:\Windows\System32\DWrite.dll 2011-01-20 14:02:44 1147904 —-a-w- C:\Windows\System32\FntCache.dll 2011-01-20 13:47:51 683008 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-01-20 13:44:05 1068544 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-01-08 09:03:01 48128 —-a-w- C:\Windows\System32\atmlib.dll 2011-01-08 08:47:50 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2011-01-08 06:45:51 367104 —-a-w- C:\Windows\System32\atmfd.dll 2011-01-08 06:28:49 292352 —-a-w- C:\Windows\SysWow64\atmfd.dll 2010-12-31 14:16:41 2757632 —-a-w- C:\Windows\System32\win32k.sys 2010-12-28 16:08:18 466944 —-a-w- C:\Windows\System32\odbc32.dll 2010-12-28 15:55:03 413696 —-a-w- C:\Windows\SysWow64\odbc32.dll . ============= FINISH: 22:46:47.05 =============== m Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] .
Post #5
==== System Restore Points ===================
.
RP67: 3/10/2011 1:48:10 AM - Scheduled Checkpoint
RP68: 3/10/2011 7:22:07 AM - Windows Update
RP69: 3/11/2011 2:31:39 AM - Windows Update
RP70: 3/11/2011 2:33:35 AM - Windows Update
RP71: 3/11/2011 11:02:38 AM - Windows Update
RP72: 3/11/2011 12:05:56 PM - Windows Update
RP73: 3/11/2011 12:27:11 PM - Windows Update
RP74: 3/12/2011 10:14:59 AM - Windows Update
RP75: 3/13/2011 2:42:22 AM - Windows Update
RP76: 3/14/2011 3:16:59 AM - Windows Update
RP77: 3/14/2011 10:56:36 PM - Windows Update
RP78: 3/15/2011 10:10:22 AM - Windows Update
RP79: 3/16/2011 - Scheduled Checkpoint
RP80: 3/16/2011 10:13:48 AM - Windows Update
RP81: 3/17/2011 1:24:48 AM - Scheduled Checkpoint
RP82: 3/17/2011 1:58:57 PM - Windows Update
RP83: 3/19/2011 8:17:20 AM - Windows Update
RP84: 3/19/2011 5:16:53 PM - Removed Paltalk Toolbar.
RP85: 3/20/2011 2:27:36 AM - Windows Update
RP86: 3/20/2011 6:18:19 AM - Restore Operation
RP87: 3/20/2011 9:37:06 AM - Restore Operation
RP88: 3/20/2011 10:12:56 AM - Installed Symantec Technical Support Web Controls
RP89: 3/20/2011 11:48:00 PM - Scheduled Checkpoint
RP90: 3/21/2011 11:46:03 AM - Windows Update
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader X (10.0.1)
AVerMedia HC82 Express-Card Hybrid Analog
AVerMedia MCE Encoder x64 [removed]
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Compatibility Pack for the 2007 Office system
D3DX10
Dell Resource CD
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java Auto Updater
Java™ 6 Update 24
Junk Mail filter update
Malwarebytes' Anti-Malware
Mesh Runtime
Messenger Companion
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
OpenOffice.org 3.3
PreReq
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Segoe UI
Symantec Technical Support Web Controls
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Yahoo! BrowserPlus 2.9.8
Yahoo! Messenger
Yahoo! Software Update
.
==== Event Viewer Messages From Past Week ========
.
3/21/2011 12:04:59 AM, Error: RasMan [20062] - Internal Error: Disconnect operation on PPPoE2-0 completed with an error. PPPoE2-0
3/21/2011 11:25:57 AM, Error: Service Control Manager [7000] - The BCM42RLY service failed to start due to the following error: The system cannot find the file specified.
3/20/2011 9:41:08 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
3/20/2011 9:29:59 AM, Error: Service Control Manager [7031] - The Common Client Job Manager Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
3/20/2011 9:20:51 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.99.1460.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6603.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
3/20/2011 8:29:21 AM, Error: LsaSrv [6033] - An anonymous session connected from 79.169.250.75 has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller. The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock DWORD value to 1. This message will be logged at most once a day.
3/20/2011 8:11:39 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
3/20/2011 7:16:23 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
3/20/2011 7:06:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
3/20/2011 7:06:52 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
3/20/2011 7:06:50 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter spldr Wanarpv6
3/20/2011 7:06:50 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 7:06:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/20/2011 7:06:42 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
3/20/2011 7:05:24 AM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21
3/20/2011 6:50:17 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC MpFilter NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx Wanarpv6
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/20/2011 6:50:17 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
3/20/2011 6:49:23 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
3/20/2011 6:49:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
3/20/2011 6:49:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
3/20/2011 6:22:11 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
3/20/2011 5:37:35 AM, Error: LsaSrv [6033] - An anonymous session connected from 79.232.48.184 has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller. The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock DWORD value to 1. This message will be logged at most once a day.
3/20/2011 10:13:34 AM, Error: Service Control Manager [7030] - The Symantec RemoteAssist service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
3/19/2011 1:49:57 PM, Error: LsaSrv [6033] - An anonymous session connected from 83.6.254.240 has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller. The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock DWORD value to 1. This message will be logged at most once a day.
3/18/2011 12:01:24 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {4991D34B-80A1-4291-83B6-3328366B9097} to the user easyhome-PC\easyhome SID (S-1-5-21-178916056-3759017967-7272017-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
3/17/2011 9:26:40 PM, Error: Microsoft-Windows-Time-Service [34] - The time service has detected that the system time needs to be changed by -86387 seconds. The time service will not change the system time by more than -54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123) is working properly.
3/17/2011 2:37:21 PM, Error: EventLog [6008] - The previous system shutdown at 2:33:36 PM on 3/17/2011 was unexpected.
3/16/2011 10:17:04 AM, Error: EventLog [6008] - The previous system shutdown at 10:14:12 AM on 3/16/2011 was unexpected.
3/15/2011 2:11:13 PM, Error: LsaSrv [6033] - An anonymous session connected from 205.209.143.30 has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller. The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock DWORD value to 1. This message will be logged at most once a day.
.
==== End Of File ===========================
Post #6
DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 23:02:00.05 on Mon 03/21/2011 Internet Explorer: 8.0.6001.19019 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.840 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\System32\igfxpers.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\OEM02Mon.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Windows Mail\WinMail.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10n_ActiveX.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\easyhome\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W7W3P5SK\dds[1].pif C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.ca/ mWinlogon: Userinit=userinit.exe BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun mRun: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe mRun: [Conime] %windir%\system32\conime.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: {5A353365-052D-43F9-A8E2-5BDE60D23D14} = 204.187.88.10 209.91.128.10 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun-x64: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe mRun-x64: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2010-10-24 188928] R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2010-10-24 40832] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2010-10-24 72064] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616] R3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk60x64.sys [2007-9-17 369152] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 fssfltr;FssFltr;C:\Windows\System32\drivers\fssfltr.sys [2011-3-11 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2011-2-20 89920] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== File Associations =============== . JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . 2011-03-21 18:43:25 ——– d—–w- C:\Windows\Paltalk Messenger 2011-03-21 15:46:13 7947600 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{7461CEC1-E4E8-487F-8144-4810879C3E23}\mpengine.dll 2011-03-21 00:28:04 ——– d—–w- C:\Windows\pss 2011-03-20 14:13:30 ——– d—–w- C:\Program Files (x86)\Common Files\Symantec Shared 2011-03-20 11:27:34 ——– d—–w- C:\Users\easyhome\AppData\Local\Apps 2011-03-20 11:27:33 ——– d—–w- C:\Users\easyhome\AppData\Local\Deployment 2011-03-20 04:54:39 ——– d—–w- C:\Users\easyhome\AppData\Roaming\Tific 2011-03-20 04:54:39 ——– d—–w- C:\Users\easyhome\AppData\Local\Tific 2011-03-20 04:54:26 ——– d—–w- C:\PROGRA~3\Norton 2011-03-20 04:54:23 ——– d—–w- C:\PROGRA~3\NortonInstaller 2011-03-18 03:58:15 ——– d—–w- C:\Users\easyhome\AppData\Local\Google 2011-03-11 07:46:37 ——– d—–w- C:\Windows\en 2011-03-11 07:41:53 ——– d—–w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2011-03-11 07:39:15 48488 —-a-w- C:\Windows\System32\drivers\fssfltr.sys 2011-03-11 07:38:44 ——– d—–w- C:\Windows\PCHEALTH 2011-03-11 07:37:13 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-03-11 07:36:52 69464 —-a-w- C:\Windows\SysWow64\XAPOFX1_3.dll 2011-03-11 07:36:52 523088 —-a-w- C:\Windows\System32\d3dx10_42.dll 2011-03-11 07:36:52 515416 —-a-w- C:\Windows\SysWow64\XAudio2_5.dll 2011-03-11 07:36:52 453456 —-a-w- C:\Windows\SysWow64\d3dx10_42.dll 2011-03-11 07:36:25 4398360 —-a-w- C:\Windows\System32\d3dx9_32.dll 2011-03-11 07:36:25 3426072 —-a-w- C:\Windows\SysWow64\d3dx9_32.dll 2011-03-11 07:35:59 469256 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\f4785c201cbdfbe05\InstallManager_WLE_WLE.exe 2011-03-11 07:35:36 15712 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e8f483b01cbdfbe04\MeshBetaRemover.exe 2011-03-11 07:35:33 94040 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e5cc68b01cbdfbe03\DSETUP.dll 2011-03-11 07:35:33 525656 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e5cc68b01cbdfbe03\DXSETUP.exe 2011-03-11 07:35:33 1691480 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e5cc68b01cbdfbe03\dsetup32.dll 2011-03-11 07:35:25 94040 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e1e877c01cbdfbe02\DSETUP.dll 2011-03-11 07:35:25 525656 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e1e877c01cbdfbe02\DXSETUP.exe 2011-03-11 07:35:25 1691480 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\e1e877c01cbdfbe02\dsetup32.dll 2011-03-11 07:35:16 6260088 —-a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\dbc545301cbdfbe01\Silverlight.4.0.exe 2011-03-11 07:34:44 ——– d—–w- C:\Users\easyhome\AppData\Local\Windows Live 2011-03-11 07:34:40 ——– d—–w- C:\Program Files (x86)\Common Files\Windows Live 2011-03-11 07:33:51 754688 —-a-w- C:\Windows\SysWow64\webservices.dll 2011-03-11 07:33:51 1103872 —-a-w- C:\Windows\System32\webservices.dll 2011-03-09 00:11:47 2425344 —-a-w- C:\Windows\System32\mstscax.dll 2011-03-09 00:11:46 731136 —-a-w- C:\Windows\System32\mstsc.exe 2011-03-09 00:11:46 677888 —-a-w- C:\Windows\SysWow64\mstsc.exe 2011-03-09 00:11:46 2067968 —-a-w- C:\Windows\SysWow64\mstscax.dll 2011-03-09 00:11:44 559616 —-a-w- C:\Windows\System32\EncDec.dll 2011-03-09 00:11:44 416768 —-a-w- C:\Windows\System32\sbe.dll 2011-03-09 00:11:43 429056 —-a-w- C:\Windows\SysWow64\EncDec.dll 2011-03-09 00:11:43 322560 —-a-w- C:\Windows\SysWow64\sbe.dll 2011-03-09 00:11:43 226816 —-a-w- C:\Windows\System32\mpg2splt.ax 2011-03-09 00:11:43 210944 —-a-w- C:\Windows\System32\sbeio.dll 2011-03-09 00:11:43 177664 —-a-w- C:\Windows\SysWow64\mpg2splt.ax 2011-03-09 00:11:43 153088 —-a-w- C:\Windows\SysWow64\sbeio.dll 2011-02-27 04:36:27 ——– d—–w- C:\Users\easyhome\AppData\Local\Adobe 2011-02-23 22:04:16 2048 —-a-w- C:\Windows\SysWow64\winrsmgr.dll 2011-02-23 22:04:16 2048 —-a-w- C:\Windows\System32\winrsmgr.dll 2011-02-23 22:04:12 13312 —-a-w- C:\Windows\System32\wsmplpxy.dll 2011-02-23 22:04:12 13312 —-a-w- C:\Windows\System32\winrssrv.dll 2011-02-23 22:04:07 10240 —-a-w- C:\Windows\SysWow64\wsmplpxy.dll 2011-02-23 22:04:07 10240 —-a-w- C:\Windows\SysWow64\winrssrv.dll 2011-02-23 02:55:33 ——– d—–w- C:\Users\easyhome\AppData\Roaming\OpenOffice.org 2011-02-21 13:51:31 ——– d—–w- C:\Windows\SysWow64\spool 2011-02-21 13:51:30 ——– d—–w- C:\Program Files (x86)\Windows Portable Devices 2011-02-21 13:51:29 ——– d—–w- C:\Program Files\Windows Portable Devices 2011-02-21 12:34:03 369664 —-a-w- C:\Windows\SysWow64\WMPhoto.dll 2011-02-21 12:34:02 449024 —-a-w- C:\Windows\System32\WMPhoto.dll 2011-02-21 12:34:02 3584 —-a-w- C:\Windows\System32\drivers\en-US\dxgkrnl.sys.mui 2011-02-21 12:32:27 736256 —-a-w- C:\Windows\System32\UIAutomationCore.dll 2011-02-21 12:32:27 4096 —-a-w- C:\Windows\SysWow64\oleaccrc.dll 2011-02-21 12:32:27 4096 —-a-w- C:\Windows\System32\oleaccrc.dll 2011-02-21 12:32:27 315904 —-a-w- C:\Windows\System32\oleacc.dll 2011-02-21 12:32:27 234496 —-a-w- C:\Windows\SysWow64\oleacc.dll 2011-02-21 12:32:26 555520 —-a-w- C:\Windows\SysWow64\UIAutomationCore.dll 2011-02-21 12:21:29 92672 —-a-w- C:\Windows\SysWow64\UIAnimation.dll 2011-02-21 12:21:29 103424 —-a-w- C:\Windows\System32\UIAnimation.dll 2011-02-21 12:21:28 3815424 —-a-w- C:\Windows\System32\UIRibbon.dll 2011-02-21 12:21:28 3023360 —-a-w- C:\Windows\SysWow64\UIRibbon.dll 2011-02-21 12:21:28 1164800 —-a-w- C:\Windows\SysWow64\UIRibbonRes.dll 2011-02-21 12:21:28 1164800 —-a-w- C:\Windows\System32\UIRibbonRes.dll 2011-02-20 19:43:28 ——– d—–w- C:\Windows\SysWow64\vi-VN 2011-02-20 19:43:28 ——– d—–w- C:\Windows\SysWow64\eu-ES 2011-02-20 19:43:28 ——– d—–w- C:\Windows\SysWow64\ca-ES 2011-02-20 19:43:27 ——– d—–w- C:\Windows\System32\eu-ES 2011-02-20 19:43:27 ——– d—–w- C:\Windows\System32\ca-ES 2011-02-20 19:43:25 ——– d—–w- C:\Windows\System32\vi-VN 2011-02-20 19:17:38 ——– d—–w- C:\Windows\System32\EventProviders 2011-02-20 19:04:30 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2011-02-20 19:00:39 99176 —-a-w- C:\Windows\SysWow64\PresentationHostProxy.dll 2011-02-20 19:00:38 49472 —-a-w- C:\Windows\SysWow64\netfxperf.dll 2011-02-20 19:00:38 48960 —-a-w- C:\Windows\System32\netfxperf.dll 2011-02-20 19:00:38 444752 —-a-w- C:\Windows\System32\mscoree.dll 2011-02-20 19:00:38 320352 —-a-w- C:\Windows\System32\PresentationHost.exe 2011-02-20 19:00:38 297808 —-a-w- C:\Windows\SysWow64\mscoree.dll 2011-02-20 19:00:38 295264 —-a-w- C:\Windows\SysWow64\PresentationHost.exe 2011-02-20 19:00:38 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2011-02-20 19:00:38 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2011-02-20 19:00:38 109912 —-a-w- C:\Windows\System32\PresentationHostProxy.dll 2011-02-20 18:16:00 12240896 —-a-w- C:\Windows\SysWow64\NlsLexicons0007.dll 2011-02-20 18:16:00 12240896 —-a-w- C:\Windows\System32\NlsLexicons0007.dll 2011-02-20 18:14:59 719872 —-a-w- C:\Windows\System32\rpcss.dll 2011-02-20 18:13:59 722944 —-a-w- C:\Windows\System32\autofmt.exe 2011-02-20 18:12:59 88064 —-a-w- C:\Windows\System32\drivers\smb.sys 2011-02-20 18:11:59 293888 —-a-w- C:\Windows\System32\wdscore.dll 2011-02-20 18:11:59 138752 —-a-w- C:\Windows\System32\PkgMgr.exe 2011-02-20 18:11:56 315904 —-a-w- C:\Windows\System32\drvstore.dll 2011-02-20 16:14:50 18904 —-a-w- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin 2011-02-20 16:14:50 18904 —-a-w- C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2011-02-20 15:24:37 7680 —-a-w- C:\Program Files\Internet Explorer\iecompat.dll 2011-02-20 15:24:37 7680 —-a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll 2011-02-20 15:20:59 76288 —-a-w- C:\Windows\System32\wextract.exe 2011-02-20 07:34:11 32768 —-a-w- C:\Windows\System32\nshhttp.dll 2011-02-20 07:34:11 24064 —-a-w- C:\Windows\SysWow64\nshhttp.dll 2011-02-20 07:34:06 620032 —-a-w- C:\Windows\System32\drivers\http.sys 2011-02-20 07:34:05 33792 —-a-w- C:\Windows\System32\httpapi.dll 2011-02-20 07:34:04 30720 —-a-w- C:\Windows\SysWow64\httpapi.dll 2011-02-20 07:02:33 ——– d—–w- C:\Users\easyhome\AppData\Local\Yahoo 2011-02-20 06:11:04 ——– d—–w- C:\Users\easyhome\AppData\Roaming\Paltalk 2011-02-20 05:51:18 ——– d—–w- C:\Users\easyhome\AppData\Local\Yahoo! 2011-02-20 05:48:58 ——– d—–w- C:\Program Files (x86)\Yahoo! 2011-02-20 05:43:58 ——– d—–w- C:\Program Files (x86)\OpenOffice.org 3 2011-02-20 05:43:02 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-02-20 05:25:45 ——– d—–w- C:\Users\easyhome\AppData\Roaming\Malwarebytes 2011-02-20 05:25:41 38224 —-a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys 2011-02-20 05:25:40 ——– d—–w- C:\PROGRA~3\Malwarebytes 2011-02-20 05:25:37 24152 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-02-20 05:25:37 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-02-20 04:22:24 372736 —-a-w- C:\Windows\System32\unregmp2.exe 2011-02-20 04:22:24 1486848 —-a-w- C:\Program Files\Windows Media Player\setup_wm.exe 2011-02-20 04:22:24 1418752 —-a-w- C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2011-02-20 04:22:23 310784 —-a-w- C:\Windows\SysWow64\unregmp2.exe 2011-02-20 04:20:56 441856 —-a-w- C:\Windows\System32\WSDApi.dll 2011-02-20 04:19:54 50688 —-a-w- C:\Windows\System32\rtutils.dll 2011-02-20 04:19:54 36864 —-a-w- C:\Windows\SysWow64\rtutils.dll 2011-02-20 04:19:52 317952 —-a-w- C:\Windows\SysWow64\MP4SDECD.DLL 2011-02-20 04:19:52 295424 —-a-w- C:\Windows\System32\MP4SDECD.DLL 2011-02-20 04:19:50 273920 —-a-w- C:\Windows\System32\spoolsv.exe 2011-02-20 04:19:46 81920 —-a-w- C:\Windows\SysWow64\iccvid.dll 2011-02-20 04:19:07 1797120 —-a-w- C:\Windows\System32\msxml6.dll 2011-02-20 04:19:07 1401856 —-a-w- C:\Windows\SysWow64\msxml6.dll 2011-02-20 04:19:01 53248 —-a-w- C:\Windows\SysWow64\tsgqec.dll 2011-02-20 04:19:01 45056 —-a-w- C:\Windows\System32\tsgqec.dll 2011-02-20 04:19:01 151552 —-a-w- C:\Windows\System32\aaclient.dll 2011-02-20 04:19:01 136192 —-a-w- C:\Windows\SysWow64\aaclient.dll 2011-02-20 04:17:56 599552 —-a-w- C:\Windows\System32\RMActivate.exe 2011-02-20 04:16:59 88576 —-a-w- C:\Windows\System32\atl.dll 2011-02-20 04:15:48 1869824 —-a-w- C:\Windows\System32\msxml3.dll 2011-02-20 04:15:47 1248768 —-a-w- C:\Windows\SysWow64\msxml3.dll 2011-02-20 04:15:33 82944 —-a-w- C:\Windows\System32\msasn1.dll 2011-02-20 04:15:33 60928 —-a-w- C:\Windows\SysWow64\msasn1.dll 2011-02-20 04:15:19 1927680 —-a-w- C:\Windows\System32\gameux.dll 2011-02-20 04:15:18 32256 —-a-w- C:\Windows\System32\Apphlpdm.dll 2011-02-20 04:15:18 28672 —-a-w- C:\Windows\SysWow64\Apphlpdm.dll 2011-02-20 04:15:18 1696256 —-a-w- C:\Windows\SysWow64\gameux.dll 2011-02-20 04:15:16 4240384 —-a-w- C:\Windows\SysWow64\GameUXLegacyGDFs.dll 2011-02-20 04:15:16 4240384 —-a-w- C:\Windows\System32\GameUXLegacyGDFs.dll 2011-02-20 04:15:13 203264 —-a-w- C:\Windows\System32\wkssvc.dll 2011-02-20 04:15:09 4699024 —-a-w- C:\Windows\System32\ntoskrnl.exe 2011-02-20 04:14:54 1585168 —-a-w- C:\Windows\System32\ntdll.dll 2011-02-20 04:14:53 1168512 —-a-w- C:\Windows\SysWow64\ntdll.dll 2011-02-20 04:14:49 1251840 —-a-w- C:\Windows\System32\sdclt.exe 2011-02-20 04:14:46 516096 —-a-w- C:\Program Files\Windows Mail\wab.exe 2011-02-20 04:14:46 515584 —-a-w- C:\Program Files (x86)\Windows Mail\wab.exe 2011-02-20 04:14:45 68096 —-a-w- C:\Program Files\Windows Mail\wabmig.exe 2011-02-20 04:14:45 66048 —-a-w- C:\Program Files (x86)\Windows Mail\wabmig.exe 2011-02-20 04:14:45 35328 —-a-w- C:\Program Files\Windows Mail\wabfind.dll 2011-02-20 04:14:45 33280 —-a-w- C:\Program Files (x86)\Windows Mail\wabfind.dll 2011-02-20 04:14:31 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2011-02-20 04:14:30 2048 —-a-w- C:\Windows\System32\tzres.dll 2011-02-20 04:13:08 72192 —-a-w- C:\Windows\System32\l3codeca.acm 2011-02-20 04:13:08 62464 —-a-w- C:\Windows\SysWow64\l3codeca.acm 2011-02-20 04:13:07 220672 —-a-w- C:\Windows\SysWow64\l3codecp.acm 2011-02-20 04:13:07 181760 —-a-w- C:\Windows\System32\l3codecp.acm 2011-02-20 04:13:04 621568 —-a-w- C:\Windows\System32\usp10.dll 2011-02-20 04:13:04 502272 —-a-w- C:\Windows\SysWow64\usp10.dll . ==================== Find3M ==================== . 2011-01-20 16:46:10 900480 —-a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2011-01-20 16:17:15 366592 —-a-w- C:\Windows\System32\winspool.drv 2011-01-20 16:17:03 625152 —-a-w- C:\Windows\System32\dxgi.dll 2011-01-20 16:16:53 287232 —-a-w- C:\Windows\System32\d3d10core.dll 2011-01-20 16:16:52 327680 —-a-w- C:\Windows\System32\d3d10_1core.dll 2011-01-20 16:16:52 196096 —-a-w- C:\Windows\System32\d3d10_1.dll 2011-01-20 16:16:52 1268224 —-a-w- C:\Windows\System32\d3d10.dll 2011-01-20 16:16:47 748544 —-a-w- C:\Windows\System32\stobject.dll 2011-01-20 16:16:40 47104 —-a-w- C:\Windows\System32\cdd.dll 2011-01-20 16:16:10 3548672 —-a-w- C:\Windows\System32\mf.dll 2011-01-20 16:16:08 35840 —-a-w- C:\Windows\System32\printfilterpipelineprxy.dll 2011-01-20 16:14:49 278528 —-a-w- C:\Windows\System32\mfplat.dll 2011-01-20 16:14:49 195072 —-a-w- C:\Windows\System32\mfps.dll 2011-01-20 16:08:16 478720 —-a-w- C:\Windows\SysWow64\dxgi.dll 2011-01-20 16:08:06 219648 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2011-01-20 16:08:06 189952 —-a-w- C:\Windows\SysWow64\d3d10core.dll 2011-01-20 16:08:06 160768 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2011-01-20 16:08:06 1029120 —-a-w- C:\Windows\SysWow64\d3d10.dll 2011-01-20 16:07:42 258048 —-a-w- C:\Windows\SysWow64\winspool.drv 2011-01-20 16:07:16 586240 —-a-w- C:\Windows\SysWow64\stobject.dll 2011-01-20 16:06:38 2873344 —-a-w- C:\Windows\SysWow64\mf.dll 2011-01-20 16:04:54 98816 —-a-w- C:\Windows\SysWow64\mfps.dll 2011-01-20 16:04:54 209920 —-a-w- C:\Windows\SysWow64\mfplat.dll 2011-01-20 15:01:50 3068416 —-a-w- C:\Windows\System32\xpsservices.dll 2011-01-20 15:01:09 1653760 —-a-w- C:\Windows\System32\XpsPrint.dll 2011-01-20 14:59:59 1032192 —-a-w- C:\Windows\System32\printfilterpipelinesvc.exe 2011-01-20 14:58:38 1461760 —-a-w- C:\Windows\System32\OpcServices.dll 2011-01-20 14:57:44 479744 —-a-w- C:\Windows\System32\XpsGdiConverter.dll 2011-01-20 14:57:28 231936 —-a-w- C:\Windows\System32\XpsRasterService.dll 2011-01-20 14:42:00 1257984 —-a-w- C:\Windows\System32\MFH264Dec.dll 2011-01-20 14:41:29 428544 —-a-w- C:\Windows\System32\MFHEAACdec.dll 2011-01-20 14:40:17 345088 —-a-w- C:\Windows\System32\mfreadwrite.dll 2011-01-20 14:40:14 34304 —-a-w- C:\Windows\System32\mfpmp.exe 2011-01-20 14:40:11 377344 —-a-w- C:\Windows\System32\mfmp4src.dll 2011-01-20 14:37:06 2002944 —-a-w- C:\Windows\System32\d3d10warp.dll 2011-01-20 14:35:30 566272 —-a-w- C:\Windows\System32\d3d10level9.dll 2011-01-20 14:28:38 1554432 —-a-w- C:\Windows\SysWow64\xpsservices.dll 2011-01-20 14:27:50 876032 —-a-w- C:\Windows\SysWow64\XpsPrint.dll 2011-01-20 14:25:25 847360 —-a-w- C:\Windows\SysWow64\OpcServices.dll 2011-01-20 14:24:32 288768 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2011-01-20 14:24:26 135680 —-a-w- C:\Windows\SysWow64\XpsRasterService.dll 2011-01-20 14:15:10 979456 —-a-w- C:\Windows\SysWow64\MFH264Dec.dll 2011-01-20 14:14:39 357376 —-a-w- C:\Windows\SysWow64\MFHEAACdec.dll 2011-01-20 14:14:03 302592 —-a-w- C:\Windows\SysWow64\mfmp4src.dll 2011-01-20 14:14:03 261632 —-a-w- C:\Windows\SysWow64\mfreadwrite.dll 2011-01-20 14:12:46 1172480 —-a-w- C:\Windows\SysWow64\d3d10warp.dll 2011-01-20 14:11:34 486400 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2011-01-20 14:06:15 834048 —-a-w- C:\Windows\System32\d2d1.dll 2011-01-20 14:02:46 1555968 —-a-w- C:\Windows\System32\DWrite.dll 2011-01-20 14:02:44 1147904 —-a-w- C:\Windows\System32\FntCache.dll 2011-01-20 13:47:51 683008 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-01-20 13:44:05 1068544 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-01-08 09:03:01 48128 —-a-w- C:\Windows\System32\atmlib.dll 2011-01-08 08:47:50 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2011-01-08 06:45:51 367104 —-a-w- C:\Windows\System32\atmfd.dll 2011-01-08 06:28:49 292352 —-a-w- C:\Windows\SysWow64\atmfd.dll 2010-12-31 14:16:41 2757632 —-a-w- C:\Windows\System32\win32k.sys 2010-12-28 16:08:18 466944 —-a-w- C:\Windows\System32\odbc32.dll 2010-12-28 15:55:03 413696 —-a-w- C:\Windows\SysWow64\odbc32.dll . ============= FINISH: 23:02:22.18 =============== This is for DDS as asked to do the rest is the other I think
Post #7
No when I down loaded new virsion it said comes with free Norton PC check up. I tryed to deleat it and would not in safe mode or none safe mode anyhow the works are on bottom for u anyhow called Norton told them what happen they gave me link and did it then did systom restore it came back on now gone for some what good thank god.
Post #8 last edited
I am unclear as to what you are telling me in your last post Are you saying that you have resolved your issue?
Post #11
Yes. I got the logs you posted. I'm not seeing any malware in there. If you've got Norton uninstalled… do you need help with anything besides resetting your restore points?
Post #12
I could use help to schedual my laptop to go on or off I some days leave on over night by accaden and I prob could uninstall windows fire wall and use another program.
Post #13
There is a lot about window I don't know… especially with Vista (which I don't have). I think you will be better served to "tweak" you system in the Windows Forum. The Tech Team should get you fixed right up.

There are some 3rd party firewalls in the links at the end of this post.

So… let's reset your restore points.

Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI