Can't Start Windows Firewall

Am unable to start Windows Firewall. Have no Security Center dir for Windows Firewall for manual start. Running malwarebytes and superantisypware in the background. Your help is appreciated. Hijack This scan log below:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:59:51 PM, on 1/5/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\users\duke\downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
R3 - URLSearchHook: TranslatorBar 3.2 Toolbar - {c55f5517-246e-4426-b745-ee25b08eb8b4} - C:\Program Files\TranslatorBar_3.2\prxtbTra0.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SpecialSavings - {74F475FA-6C75-43BD-AAB9-ECDA6184F600} - C:\Program Files\SpecialSavings\SpecialSavingsSinged.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: File2LinkIB - {c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b} - C:\Program Files\file2linkib\file2linkibX.dll
O2 - BHO: TranslatorBar 3.2 - {c55f5517-246e-4426-b745-ee25b08eb8b4} - C:\Program Files\TranslatorBar_3.2\prxtbTra0.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: TranslatorBar 3.2 Toolbar - {c55f5517-246e-4426-b745-ee25b08eb8b4} - C:\Program Files\TranslatorBar_3.2\prxtbTra0.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O3 - Toolbar: File2LinkIB - {c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b} - C:\Program Files\file2linkib\file2linkibX.dll
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [15_15141611632489] "C:\Users\Duke\AppData\Local\LogMeIn Rescue Applet\LMIR0004.tmp_r.bat"
O4 - HKUS\S-1-5-18\..\RunOnce: [AutoLaunch] C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [AutoLaunch] C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: SpecialSavings - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - C:\Program Files\SpecialSavings\SpecialSavingsSinged.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: protector.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: bProtector - bProtector - C:\ProgramData\bProtector\bProtect.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallBrain Updater Service (InstallBrainService) - Unknown owner - C:\Program Files\InstallBrainService\InstallBrainService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9618 bytes

CatByte, I hope I got everything you requested. Let me know and thanks. . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30 Run by [removed] at 16:31:37 on 2012-01-08 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.820 [GMT -5:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Program Files\SUPERAntiSpyware\SASCORE.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\ProgramData\bProtector\bProtect.exe C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files\InstallBrainService\InstallBrainService.exe C:\Windows\System32\svchost.exe -k HPZ12 c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\WINDOWS\System32\igfxpers.exe C:\WINDOWS\System32\igfxtray.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\ProgramData\bProtector\bProtect.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k WindowsMobile C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\locator.exe C:\Program Files\Windows Live\Mail\wlmail.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\SearchFilterHost.exe c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8 uWindow Title = Windows Internet Explorer provided by Yahoo! uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8 mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/ uInternet Settings,ProxyOverride = uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll uURLSearchHooks: TranslatorBar 3.2 Toolbar: {c55f5517-246e-4426-b745-ee25b08eb8b4} - c:\program files\translatorbar_3.2\prxtbTra0.dll mURLSearchHooks: TranslatorBar 3.2 Toolbar: {c55f5517-246e-4426-b745-ee25b08eb8b4} - c:\program files\translatorbar_3.2\prxtbTra0.dll BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: SpecialSavings: {74f475fa-6c75-43bd-aab9-ecda6184f600} - c:\program files\specialsavings\SpecialSavingsSinged.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll BHO: File2LinkIB: {c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b} - c:\program files\file2linkib\file2linkibX.dll BHO: TranslatorBar 3.2 Toolbar: {c55f5517-246e-4426-b745-ee25b08eb8b4} - c:\program files\translatorbar_3.2\prxtbTra0.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn4\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: TranslatorBar 3.2 Toolbar: {c55f5517-246e-4426-b745-ee25b08eb8b4} - c:\program files\translatorbar_3.2\prxtbTra0.dll TB: @c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll TB: File2LinkIB: {c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b} - c:\program files\file2linkib\file2linkibX.dll TB: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File {555d4d79-4bd2-4094-a395-cfc534424a05} uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [] mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe dRunOnce: [AutoLaunch] c:\program files\lavasoft\ad-aware\AutoLaunch.exe monthly StartupFolder: c:\users\duke\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - c:\program files\specialsavings\SpecialSavingsSinged.dll DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{5BE5CE5A-12B2-4D83-9BA2-FE8BCC90F0A0} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{612412EC-350C-4C44-816D-8FE576276A98} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{B2C4325B-438E-4222-B5F2-6ABFC94A2E7F} : DhcpNameServer = 192.168.0.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll AppInit_DLLs: protector.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL SecurityProviders: credssp.dll, digeste.dll mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12 . ================= FIREFOX =================== . FF - ProfilePath - c:\users\duke\appdata\roaming\mozilla\firefox\profiles\7t7csr2e.default\ FF - prefs.js: browser.startup.homepage - hxxp://en-us.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-us:official FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 5643 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - plugin: c:\users\duke\appdata\roaming\mozilla\firefox\profiles\7t7csr2e.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: c:\users\duke\appdata\roaming\mozilla\plugins\npatgpc.dll . ============= SERVICES / DRIVERS =============== . R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648] R1 MpKsl794662bc;MpKsl794662bc;c:\programdata\microsoft\microsoft antimalware\definition updates\{e306b2d8-7d14-4fb5-baf0-dc86e091046a}\MpKsl794662bc.sys [2012-1-8 29904] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664] R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608] R2 bProtector;bProtector;c:\programdata\bprotector\bProtect.exe [2012-1-4 803328] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-7-23 21504] R2 InstallBrainService;InstallBrain Updater Service;c:\program files\installbrainservice\InstallBrainService.exe [2012-1-4 273912] R2 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024] S3 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-10-6 136176] S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-7-23 16896] S4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952] S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-10-6 136176] . =============== Created Last 30 ================ . 2012-01-08 20:58:36 29904 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{e306b2d8-7d14-4fb5-baf0-dc86e091046a}\MpKsl794662bc.sys 2012-01-08 20:58:34 56200 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{e306b2d8-7d14-4fb5-baf0-dc86e091046a}\offreg.dll 2012-01-08 14:08:16 ——– d—–w- c:\users\duke\appdata\local\{A1C7B838-0FF6-439E-8238-072ED84E858B} 2012-01-08 14:08:03 ——– d—–w- c:\users\duke\appdata\local\{90453511-4CC2-472D-B92E-B0E2573E3390} 2012-01-08 13:24:19 ——– d—–w- c:\users\duke\appdata\local\{B8A2D05A-6E99-4261-B6BB-DCB803B2F9D5} 2012-01-08 13:24:09 ——– d—–w- c:\users\duke\appdata\local\{E8B55652-B2CC-4D8D-AC8D-2C77AF1DC9A6} 2012-01-08 00:19:22 ——– d—–w- c:\users\duke\appdata\local\Microsoft Corporation 2012-01-08 00:18:07 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor 2012-01-07 21:58:33 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{e306b2d8-7d14-4fb5-baf0-dc86e091046a}\mpengine.dll 2012-01-07 14:10:56 ——– d—–w- c:\users\duke\appdata\local\{C20424F6-7D5C-4489-82D0-21537539AF5E} 2012-01-07 14:10:40 ——– d—–w- c:\users\duke\appdata\local\{109458E8-A03B-4D65-8DB3-26794FA085A3} 2012-01-06 13:22:31 ——– d—–w- c:\users\duke\appdata\local\{D0E36E0F-7908-4E6B-9D13-A02EDCB50BAD} 2012-01-06 13:22:20 ——– d—–w- c:\users\duke\appdata\local\{4F053FCE-A2BC-4318-8986-7A33B2DC9CEC} 2012-01-05 20:39:23 ——– d—–w- c:\users\duke\appdata\local\LogMeIn Rescue Applet 2012-01-05 19:57:47 ——– d—–w- c:\users\duke\appdata\roaming\PCPro 2012-01-05 19:57:47 ——– d—–w- c:\users\duke\appdata\roaming\PC Cleaners 2012-01-05 19:57:41 5276432 —-a-w- c:\windows\uninst.exe 2012-01-05 19:57:39 ——– d—–w- c:\programdata\PC1Data 2012-01-05 13:42:53 ——– d—–w- c:\users\duke\appdata\local\{58210872-3060-42DF-BEB6-E80E996B5CDF} 2012-01-05 13:42:17 ——– d—–w- c:\users\duke\appdata\local\{11EFFBEE-EC5D-41AE-8DEB-9FA3B2AFDC82} 2012-01-04 23:41:07 ——– d—–w- c:\windows\system32\Extensions 2012-01-04 23:41:00 748544 —-a-w- c:\windows\system32\protector.dll.tmp 2012-01-04 23:41:00 748544 —-a-w- c:\windows\system32\protector.dll 2012-01-04 23:41:00 ——– d—–w- c:\programdata\bProtector 2012-01-04 23:40:19 ——– d—–w- c:\program files\file2linkib 2012-01-04 23:40:11 ——– d—–w- c:\program files\SpecialSavings 2012-01-04 23:40:09 ——– d—–w- c:\users\duke\appdata\roaming\PerformerSoft 2012-01-04 23:40:05 17464 —-a-w- c:\windows\system32\roboot.exe 2012-01-04 23:39:48 ——– d—–w- c:\program files\InstallBrainService 2012-01-04 13:17:27 ——– d—–w- c:\users\duke\appdata\local\{3986A595-3458-4FE1-8616-41F13A108828} 2012-01-04 13:17:17 ——– d—–w- c:\users\duke\appdata\local\{77C85B0B-6E62-4072-9164-1ACF5AC30A92} 2012-01-04 01:13:02 ——– d—–w- c:\users\duke\appdata\local\{670DE5B7-2336-4F5E-88BB-DDCDC114E8D9} 2012-01-04 01:12:52 ——– d—–w- c:\users\duke\appdata\local\{8518381C-FA9E-4B14-8290-F84ED985C162} 2012-01-03 13:12:15 ——– d—–w- c:\users\duke\appdata\local\{C5A0338B-C399-4BA5-BA85-E69877344255} 2012-01-03 13:12:03 ——– d—–w- c:\users\duke\appdata\local\{F5493C63-BE0C-4409-8DD4-80D550A2A01A} 2012-01-03 00:39:24 626688 —-a-w- c:\program files\mozilla firefox\msvcr80.dll 2012-01-03 00:39:24 548864 —-a-w- c:\program files\mozilla firefox\msvcp80.dll 2012-01-03 00:39:24 479232 —-a-w- c:\program files\mozilla firefox\msvcm80.dll 2012-01-03 00:39:24 43992 —-a-w- c:\program files\mozilla firefox\mozutils.dll 2012-01-02 13:38:36 ——– d—–w- c:\users\duke\appdata\local\{CA565071-0B8A-4F8A-BDBE-72BB595AC936} 2012-01-02 13:38:25 ——– d—–w- c:\users\duke\appdata\local\{59FECC9E-0BC1-417F-B50C-E56AF89485A4} 2012-01-01 15:04:00 ——– d—–w- c:\users\duke\appdata\local\{84093D6E-696A-42E8-99CB-FBAAFB8F498C} 2012-01-01 15:03:09 ——– d—–w- c:\users\duke\appdata\local\{F943D98D-334E-4237-8449-29B3BE6CE8CE} 2011-12-31 13:47:14 ——– d—–w- c:\users\duke\appdata\roaming\FixCleaner 2011-12-31 13:47:06 ——– d—–w- c:\program files\FixCleaner 2011-12-31 13:29:48 ——– d—–w- c:\users\duke\appdata\local\{A8B628F3-0BDB-47F1-B40A-65A64FE86310} 2011-12-31 13:29:37 ——– d—–w- c:\users\duke\appdata\local\{457645FF-BA76-43BB-BD8E-5E7CA86A8213} 2011-12-31 02:49:51 20464 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-12-31 02:49:50 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-12-31 01:17:46 ——– d—–w- c:\programdata\PC Tools 2011-12-30 13:26:40 ——– d—–w- c:\users\duke\appdata\local\{2A3AD570-60D9-41C7-A7E1-62A2279B5EF9} 2011-12-30 13:26:30 ——– d—–w- c:\users\duke\appdata\local\{5CFE180E-A4A5-4726-852B-672EF43F3ED4} 2011-12-29 13:10:22 ——– d—–w- c:\users\duke\appdata\local\{808A9ED5-BA38-4B69-B409-4298DD832D56} 2011-12-29 13:10:11 ——– d—–w- c:\users\duke\appdata\local\{B23CEEC5-C2B4-4C52-8108-92DF26DB05E5} 2011-12-28 13:11:39 ——– d—–w- c:\users\duke\appdata\local\{60D3EBC5-277F-4989-B1E8-CE9FB6315AFD} 2011-12-28 13:11:29 ——– d—–w- c:\users\duke\appdata\local\{BD03E8A4-501D-4C0E-8408-4029A4398EE5} 2011-12-27 19:36:05 ——– d—–w- c:\users\duke\appdata\local\{52180DC5-0954-4979-B4A4-A844DB95483C} 2011-12-27 19:35:55 ——– d—–w- c:\users\duke\appdata\local\{71B574B5-7E24-4480-AD9C-34A81EA48878} 2011-12-27 13:22:53 ——– d—–w- c:\users\duke\appdata\local\{3A2F5FA6-6ACA-4ACF-ACD1-C354F20BEE77} 2011-12-26 13:56:34 ——– d—–w- c:\users\duke\appdata\local\{08FDD128-C7B2-47F8-B445-C0CB84937FEF} 2011-12-26 13:56:21 ——– d—–w- c:\users\duke\appdata\local\{AF4EB44F-AD57-4D20-A542-2CCF62DE485A} 2011-12-25 15:07:26 ——– d—–w- c:\users\duke\appdata\local\{5824AC9F-E675-43D3-B5A7-5405262A277C} 2011-12-25 15:06:54 ——– d—–w- c:\users\duke\appdata\local\{20FF060C-E248-4CAA-9899-1E5739351BFB} 2011-12-24 13:37:40 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2011-12-24 13:26:22 ——– d—–w- c:\users\duke\appdata\local\{0910EDF4-DEDF-4154-B684-8A890538C537} 2011-12-24 13:26:09 ——– d—–w- c:\users\duke\appdata\local\{B0469578-6726-491B-884A-118853AF58A2} 2011-12-23 13:16:22 ——– d—–w- c:\users\duke\appdata\local\{9BA74404-D9EB-4F47-A7C9-9C738DD33CD0} 2011-12-23 13:16:12 ——– d—–w- c:\users\duke\appdata\local\{32BAD1CE-BAC8-46E8-96A3-A3523069FF53} 2011-12-23 00:32:24 703824 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ffbbe829-2c2f-4510-81c3-261cedd26895}\gapaengine.dll 2011-12-23 00:23:23 ——– d—–w- c:\program files\Microsoft Security Client 2011-12-23 00:22:14 221568 —-a-w- c:\windows\system32\drivers\netio.sys 2011-12-22 23:45:33 ——– d—–w- c:\users\duke\appdata\local\Ilivid Player 2011-12-22 23:43:48 ——– d—–w- c:\users\duke\appdata\local\PackageAware 2011-12-22 16:00:35 ——– d—–w- c:\users\duke\appdata\roaming\SUPERAntiSpyware.com 2011-12-22 15:59:57 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2011-12-22 15:51:38 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-12-22 15:51:38 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-12-22 15:51:17 429056 —-a-w- c:\windows\system32\EncDec.dll 2011-12-22 15:51:05 2043904 —-a-w- c:\windows\system32\win32k.sys 2011-12-22 15:51:04 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat 2011-12-22 15:50:37 49152 —-a-w- c:\windows\system32\csrsrv.dll 2011-12-22 15:50:32 2048 —-a-w- c:\windows\system32\tzres.dll 2011-12-22 15:45:52 ——– d—–w- c:\users\duke\appdata\local\{BF1C2EE1-B9FE-4B0B-A805-FD61B84BA648} 2011-12-22 15:43:03 ——– d—–w- c:\users\duke\appdata\local\{57546B86-32C6-43AE-B355-AED6DE597B0F} 2011-12-22 14:39:06 ——– d—–w- c:\users\duke\appdata\local\{406EB505-3EFC-4F65-BB60-3C342B6F7236} 2011-12-22 14:38:53 ——– d—–w- c:\users\duke\appdata\local\{85E0B5BC-CFF3-405F-AF27-44C5D5107278} 2011-12-22 01:22:19 ——– d—–w- c:\users\duke\appdata\local\{51AA5926-8104-4E0E-95DA-0610B4493A0E} 2011-12-22 01:22:09 ——– d—–w- c:\users\duke\appdata\local\{7CD7C208-9CD6-4BE1-BFE2-4097B1996F7C} 2011-12-21 13:12:19 ——– d—–w- c:\users\duke\appdata\local\{4738D674-CD15-496A-8563-5A0E246B7C9D} 2011-12-21 13:12:09 ——– d—–w- c:\users\duke\appdata\local\{EEE619D4-5B03-4F1E-B0EB-5C9477258074} 2011-12-20 14:03:37 ——– d—–w- c:\users\duke\appdata\local\{AEAE5B80-BBB1-4DEF-B6E3-43D2B707208C} 2011-12-20 14:03:27 ——– d—–w- c:\users\duke\appdata\local\{E38B962D-DF1F-46F9-A051-E57729B5B1B2} 2011-12-20 02:02:54 ——– d—–w- c:\users\duke\appdata\local\{7A58B0A0-7F95-4EB8-AEDE-67271E9C7696} 2011-12-20 02:02:41 ——– d—–w- c:\users\duke\appdata\local\{F721C491-AF97-447C-B76A-518FC8D4F3CA} 2011-12-19 13:31:08 ——– d—–w- c:\users\duke\appdata\local\{A9944E91-E295-4E4C-BC5D-5B12FB432A45} 2011-12-19 13:30:23 ——– d—–w- c:\users\duke\appdata\local\{FA07B5F1-2903-4553-A27A-77CE858B38BD} 2011-12-18 20:23:51 ——– d—–w- c:\users\duke\appdata\local\{DF12699A-0F38-4F15-810C-7BB22AAA56DA} 2011-12-18 20:22:22 ——– d—–w- c:\users\duke\appdata\local\{50929441-60D1-4C70-A976-0AACC899B464} 2011-12-18 13:29:38 ——– d—–w- c:\users\duke\appdata\local\{1C776862-8E70-4CCC-85EF-45DA6638ECC8} 2011-12-17 22:03:09 ——– d—–w- c:\users\duke\appdata\roaming\QuickScan 2011-12-17 13:53:38 ——– d—–w- c:\users\duke\appdata\local\{F6CE78A4-5238-4C45-B77D-7C8A988AFBAC} 2011-12-17 13:52:32 ——– d—–w- c:\users\duke\appdata\local\{F2A441B2-B40F-4E33-ACD3-0F2D59AEC605} 2011-12-16 22:34:14 ——– d—–w- c:\users\duke\appdata\local\{A289AC56-EBA6-464E-92DB-A914A2AAD583} 2011-12-16 22:34:03 ——– d—–w- c:\users\duke\appdata\local\{0CC48696-8F03-48E2-A39B-8E0E17E83FEC} 2011-12-16 14:04:35 ——– d—–w- c:\users\duke\appdata\local\{EE1BE425-30F8-47EB-B1D9-8E5D46C5BEA9} 2011-12-15 13:15:32 ——– d—–w- c:\users\duke\appdata\local\{33309CFB-AE62-431D-8C73-ADB7DBCC37C9} 2011-12-15 13:11:52 ——– d—–w- c:\users\duke\appdata\local\{D1A57274-AD3B-4129-A56E-6F2EAFA93481} 2011-12-14 13:17:51 ——– d—–w- c:\users\duke\appdata\local\{A1AA21D3-C29C-443D-B40F-C3E51902F3F7} 2011-12-14 13:17:38 ——– d—–w- c:\users\duke\appdata\local\{202E7832-B460-405D-B09B-7F0577062A21} 2011-12-13 13:01:27 ——– d—–w- c:\users\duke\appdata\local\{80E0F8F5-267A-436D-8E92-BA4569B56C48} 2011-12-13 13:01:14 ——– d—–w- c:\users\duke\appdata\local\{99BAFCCA-AC69-475D-A416-AEACEB3B0337} 2011-12-13 00:59:43 ——– d—–w- c:\users\duke\appdata\local\{82278A68-B294-4AD2-8BCF-1D2F7D867C81} 2011-12-12 12:38:23 ——– d—–w- c:\users\duke\appdata\local\{1A275339-BA9C-4D1C-BBF3-E2A63266939A} 2011-12-11 13:50:15 ——– d—–w- c:\users\duke\appdata\local\{9B7CD494-EC8E-4DC9-82A2-AC4423ABEA2D} 2011-12-11 13:49:58 ——– d—–w- c:\users\duke\appdata\local\{454FA9C7-F68D-4C01-92BD-FD3926F724F1} 2011-12-10 12:43:46 ——– d—–w- c:\users\duke\appdata\local\{E45EFFE2-50D7-48D1-A758-EE5DD772A499} 2011-12-10 12:42:28 ——– d—–w- c:\users\duke\appdata\local\{E6FD703A-5E90-4374-92E5-087483153AED} . ==================== Find3M ==================== . 2011-12-06 23:23:53 273408 —-a-w- c:\windows\system32\drivers\afd.sys 2011-11-10 10:54:13 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-11-03 22:47:42 1798144 —-a-w- c:\windows\system32\jscript9.dll 2011-11-03 22:40:21 1427456 —-a-w- c:\windows\system32\inetcpl.cpl 2011-11-03 22:39:47 1127424 —-a-w- c:\windows\system32\wininet.dll 2011-11-03 22:31:57 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2011-10-13 15:24:42 72080 —-a-w- c:\users\duke\g2mdlhlpx.exe 2011-10-12 16:02:59 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl . ============= FINISH: 16:33:38.63 =============== Attache.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 9/26/2007 3:52:11 PM System Uptime: 1/8/2012 3:58:05 PM (1 hours ago) . Motherboard: Wistron | | 30CD Processor: Intel® Core™2 Duo CPU T5250 @ 1.50GHz | U2E1 | 1500/667mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 141 GiB total, 75.576 GiB free. D: is FIXED (NTFS) - 8 GiB total, 1.826 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft 6to4 Adapter Device ID: ROOT\*6TO4MP\0002 Manufacturer: Microsoft Name: Microsoft 6to4 Adapter #3 PNP Device ID: ROOT\*6TO4MP\0002 Service: tunnel . ==== System Restore Points =================== . . ==== Installed Programs ====================== . . Update for Microsoft Office 2007 (KB2508958) 32 Bit HP CIO Components Installer Acrobat.com Activation Assistant for the 2007 Microsoft Office suites ActiveCheck component for HP Active Support Library Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 8 Adobe Reader X (10.1.1) ArcSoft Panorama Maker 5 ArcSoft PhotoImpression 5 Bing Bar Bing Bar Platform Bing Maps 3D BufferChm Conexant HD Audio Coupon Printer for Windows D3DX10 Destinations DeviceDiscovery Dropbox EPSON Printer Software ESU for Microsoft Vista File2LinkIB Free Spider Google Chrome Google Earth Google Toolbar for Internet Explorer Google Update Helper GPBaseService2 HDAUDIO Soft Data Fax Modem with SmartCP Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Active Support Library HP Active Support Library 32 bit components HP Customer Experience Enhancements HP Doc Viewer HP Help and Support HP Imaging Device Functions 13.0 HP Photo Creations HP Photosmart Essential 3.5 HP Photosmart Plus B210 series Basic Device Software HP Photosmart Plus B210 series Help HP Photosmart Plus B210 series Product Improvement Study HP Quick Launch Buttons 6.20 B1 HP QuickPlay 3.2 HP Solution Center 13.0 HP Update HP User Guides 0060 HP Wireless Assistant HPAsset component for HP Active Support Library HPNetworkAssistant HPPhotoSmartDiscLabelContent1 HPPhotosmartEssential HPProductAssistant InstallBrain Updater Service Intel Matrix Storage Manager Intel® Graphics Media Accelerator Driver Java Auto Updater Java™ 6 Update 30 Junk Mail filter update LightScribe 1.4.136.1 Malwarebytes Anti-Malware version 1.60.0.1800 Marvell Miniport Driver Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2416447) Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Antimalware Microsoft Application Error Reporting Microsoft Default Manager Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Mozilla Firefox 9.0.1 (x86 en-US) MSCU for Microsoft Vista MSVCRT MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK My HP Games Nikon File Uploader 2 Nikon Message Center 2 OGA Notifier 2.0.0048.0 Picture Control Utility PSSWCORE RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer RealUpgrade 1.1 Rhapsody Player Engine RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 Roxio Activation Module Roxio Creator Audio Roxio Creator Basic v9 Roxio Creator Copy Roxio Creator Data Roxio Creator EasyArchive Roxio Creator Tools Roxio Express Labeler 3 Roxio MyDVD Basic v9 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Segoe UI SmartDraw VP SolSuite 2009 v9.3 SolutionCenter SpecialSavings Status SUPERAntiSpyware SupportSoft Assisted Service Touch Pad Driver TranslatorBar 3.2 Toolbar TrayApp Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) ViewNX 2 Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Mail Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinZip Yahoo! Detect Yahoo! Install Manager Yahoo! Software Update Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 1/8/2012 9:13:22 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2572067). 1/8/2012 9:07:02 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect. 1/8/2012 9:07:02 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/8/2012 9:07:01 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 1/8/2012 9:07:01 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 1/8/2012 9:06:49 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. 1/8/2012 9:06:49 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23). 1/8/2012 9:06:43 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/8/2012 8:22:11 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/8/2012 3:58:44 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/8/2012 3:58:42 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd 1/8/2012 3:58:42 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 1/8/2012 3:58:42 PM, Error: Service Control Manager [7001] - The IPsec Policy Agent service depends on the Base Filtering Engine service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 1/8/2012 3:58:42 PM, Error: Service Control Manager [7001] - The Internet Connection Sharing (ICS) service depends on the Base Filtering Engine service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 1/8/2012 3:58:42 PM, Error: Service Control Manager [7001] - The IKE and AuthIP IPsec Keying Modules service depends on the Base Filtering Engine service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 1/8/2012 3:58:42 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 1/7/2012 9:09:04 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/7/2012 5:45:39 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/7/2012 5:00:37 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/7/2012 4:46:27 PM, Error: ACPI [10] - ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation Region (0x5), Please contact your system vendor for technical assistance. 1/6/2012 8:20:48 AM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\Duke\AppData\Local\Microsoft\Windows\UsrClass.dat' was corrupted and it has been recovered. Some data might have been lost. 1/6/2012 8:20:14 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/6/2012 4:49:22 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/6/2012 4:22:32 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/6/2012 4:07:16 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/5/2012 8:25:29 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/5/2012 3:54:28 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/5/2012 3:53:30 PM, Error: EventLog [6008] - The previous system shutdown at 3:51:14 PM on 1/5/2012 was unexpected. 1/5/2012 3:34:57 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd MpFilter SASDIFSV SASKUTIL spldr Wanarpv6 1/5/2012 3:34:57 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 1/5/2012 3:34:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 1/5/2012 3:34:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 1/5/2012 3:34:19 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 1/5/2012 3:34:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 1/5/2012 3:34:07 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 1/5/2012 3:33:40 PM, Error: EventLog [6008] - The previous system shutdown at 3:31:16 PM on 1/5/2012 was unexpected. 1/5/2012 2:18:25 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/5/2012 2:04:30 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Real-time protection has stopped functioning for an unknown reason. Restart the service in order to recover. 1/5/2012 2:04:29 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/4/2012 8:14:45 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/4/2012 3:52:38 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/4/2012 12:51:27 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/4/2012 1:05:02 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/3/2012 9:57:17 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.2126.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode 1/3/2012 9:54:21 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.2126.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode 1/3/2012 9:53:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.117.2126.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7903.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode 1/3/2012 9:53:44 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 1/3/2012 9:26:51 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC Lbd MpFilter NetBIOS netbt nsiproxy PSched RasAcd rdbss SASDIFSV SASKUTIL Smb spldr tdx Wanarpv6 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/3/2012 9:26:51 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning. 1/3/2012 9:26:14 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 1/3/2012 9:26:14 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 1/3/2012 8:23:24 PM, Error: yukonwlh [101] - Driver has encountered an internal error 1/3/2012 8:14:15 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Installer service to connect. 1/3/2012 8:14:15 AM, Error: Service Control Manager [7000] - The Windows Installer service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/3/2012 8:14:15 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 1/3/2012 8:09:15 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/3/2012 5:13:06 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/3/2012 10:08:19 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/3/2012 10:00:08 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/2/2012 8:35:49 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/2/2012 5:52:33 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/2/2012 10:59:03 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/2/2012 10:45:16 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. 1/1/2012 10:13:24 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: Antimalware protection has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem. 1/1/2012 10:01:30 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection. . ==== End Of File =========================== aswMBR log: aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software Run date: 2012-01-08 16:38:26 —————————– 16:38:26.050 OS Version: Windows 6.0.6002 Service Pack 2 16:38:26.050 Number of processors: 2 586 0xF0D 16:38:26.051 ComputerName: DUKE-PC UserName: Duke 16:38:28.452 Initialize success 16:39:53.053 AVAST engine defs: 12010801 16:40:19.587 The log file has been saved successfully to "C:\Users\Duke\Downloads\aswMBR.txt" No MBR.dat file created… FSS log: Farbar Service Scanner Ran by [removed] (administrator) on 08-01-2012 at 16:48:05 Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Yahoo IP is accessible. Windows Firewall: ============= MpsSvc Service is not running. Checking service configuration: Checking Start type: Attention! Unable to open MpsSvc registry key. The service key does not exist. Checking ImagePath: Attention! Unable to open MpsSvc registry key. The service key does not exist. Checking ServiceDll: Attention! Unable to open MpsSvc registry key. The service key does not exist. Checking LEGACY_MpsSvc: Attention! Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist. bfe Service is not running. Checking service configuration: The start type of bfe service is set to Disabled. The default start type is Auto. The ImagePath of bfe service is OK. The ServiceDll of bfe service is OK. Checking LEGACY_bfe: Attention! Unable to open LEGACY_bfe\0000 registry key. The key does not exist. mpsdrv Service is not running. Checking service configuration: The start type of mpsdrv service is OK. The ImagePath of mpsdrv service is OK. Firewall Disabled Policy: ================== System Restore: ============ SDRSVC Service is not running. Checking service configuration: The start type of SDRSVC service is OK. The ImagePath of SDRSVC service is OK. The ServiceDll of SDRSVC service is OK. Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist. VSS Service is not running. Checking service configuration: The start type of VSS service is OK. The ImagePath of VSS service is OK. System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: =========== File Check: ======== C:\Windows\system32\nsisvc.dll => MD5 is legit C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit C:\Windows\system32\dhcpcsvc.dll => MD5 is legit C:\Windows\system32\Drivers\afd.sys => MD5 is legit C:\Windows\system32\Drivers\tdx.sys => MD5 is legit C:\Windows\system32\Drivers\tcpip.sys [2011-11-09 08:12] - [2011-09-20 16:02] - 0913280 ____A (Microsoft Corporation) 16731B631F28F63CD9F4CB60940E7DDD C:\Windows\system32\dnsrslvr.dll => MD5 is legit C:\Windows\system32\mpssvc.dll => MD5 is legit C:\Windows\system32\bfe.dll => MD5 is legit C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit C:\Windows\system32\SDRSVC.dll => MD5 is legit C:\Windows\system32\vssvc.exe => MD5 is legit C:\Windows\system32\wscsvc.dll [2009-08-03 06:18] - [2009-04-11 01:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\system32\wuaueng.dll => MD5 is legit C:\Windows\system32\qmgr.dll [2009-08-03 06:19] - [2009-04-11 01:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F C:\Windows\system32\es.dll [2009-08-03 06:19] - [2009-04-11 01:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F C:\Windows\system32\cryptsvc.dll [2009-08-03 06:18] - [2009-04-11 01:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit **** End of log **** Malwarebytes log: Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2011.12.31.01 Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 Duke :: DUKE-PC [administrator] 12/30/2011 9:50:48 PM mbam-log-2011-12-30 (21-50-48).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 264475 Time elapsed: 19 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer (PUM.Bad.Proxy) -> Data: http=127.0.0.1:5643 -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Users\Duke\Local Settings\flg.exe (Trojan.FakeAV) -> Quarantined and deleted successfully. C:\Users\Duke\Local Settings\Application Data\flg.exe (Trojan.FakeAV) -> Quarantined and deleted successfully. (end)

ComboFix 12-01-09.03 - Duke 01/09/2012 17:07:37.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.951 [GMT -5:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
c:\users\Duke\AppData\Local\assembly\tmp
c:\users\Duke\g2mdlhlpx.exe
c:\windows\$NtUninstallKB18700$
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\protector.dll.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
.
.
2012-01-09 22:26 . 2012-01-09 22:36 ——– d—–w- c:\users\Duke\AppData\Local\temp
2012-01-09 22:26 . 2012-01-09 22:26 ——– d—–w- c:\users\tech\AppData\Local\temp
2012-01-09 22:26 . 2012-01-09 22:26 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-09 22:04 . 2012-01-09 22:04 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5D3A62E3-1E3A-4F9E-84C2-03B98D38F674}\offreg.dll
2012-01-09 14:06 . 2011-11-21 07:47 6823496 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5D3A62E3-1E3A-4F9E-84C2-03B98D38F674}\mpengine.dll
2012-01-08 00:19 . 2012-01-08 00:19 ——– d—–w- c:\users\Duke\AppData\Local\Microsoft Corporation
2012-01-08 00:18 . 2012-01-08 00:18 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2012-01-05 20:39 . 2012-01-06 13:20 ——– d—–w- c:\users\Duke\AppData\Local\LogMeIn Rescue Applet
2012-01-05 19:57 . 2012-01-05 20:43 ——– d—–w- c:\users\Duke\AppData\Roaming\PCPro
2012-01-05 19:57 . 2012-01-05 19:57 ——– d—–w- c:\users\Duke\AppData\Roaming\PC Cleaners
2012-01-05 19:57 . 2012-01-05 19:53 5276432 —-a-w- c:\windows\uninst.exe
2012-01-05 19:57 . 2012-01-05 19:57 ——– d—–w- c:\programdata\PC1Data
2012-01-04 23:41 . 2012-01-04 23:41 ——– d—–w- c:\windows\system32\Extensions
2012-01-04 23:41 . 2012-01-05 01:13 748544 —-a-w- c:\windows\system32\protector.dll
2012-01-04 23:41 . 2012-01-04 23:41 ——– d—–w- c:\programdata\bProtector
2012-01-04 23:40 . 2012-01-04 23:40 ——– d—–w- c:\program files\file2linkib
2012-01-04 23:40 . 2012-01-04 23:40 ——– d—–w- c:\program files\SpecialSavings
2012-01-04 23:40 . 2012-01-05 01:12 ——– d—–w- c:\users\Duke\AppData\Roaming\PerformerSoft
2012-01-04 23:40 . 2012-01-04 00:11 17464 —-a-w- c:\windows\system32\roboot.exe
2012-01-04 23:39 . 2012-01-04 23:39 ——– d—–w- c:\program files\InstallBrainService
2012-01-03 00:39 . 2012-01-03 00:39 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-03 00:39 . 2012-01-03 00:39 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-03 00:39 . 2012-01-03 00:39 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-03 00:39 . 2012-01-03 00:39 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2011-12-31 13:47 . 2011-12-31 13:55 ——– d—–w- c:\users\Duke\AppData\Roaming\FixCleaner
2011-12-31 13:47 . 2012-01-04 00:41 ——– d—–w- c:\program files\FixCleaner
2011-12-31 02:49 . 2011-12-10 20:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-31 02:49 . 2011-12-31 02:49 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-12-31 01:17 . 2011-12-31 01:17 ——– d—–w- c:\programdata\PC Tools
2011-12-29 01:30 . 2011-12-29 01:30 ——– d—–w- c:\program files\Microsoft Works
2011-12-24 13:37 . 2011-11-21 07:47 6823496 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-12-23 00:32 . 2011-12-23 00:32 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FFBBE829-2C2F-4510-81C3-261CEDD26895}\gapaengine.dll
2011-12-23 00:23 . 2011-12-23 00:24 ——– d—–w- c:\program files\Microsoft Security Client
2011-12-23 00:22 . 2010-04-05 20:00 221568 —-a-w- c:\windows\system32\drivers\netio.sys
2011-12-22 23:45 . 2011-12-22 23:45 ——– d—–w- c:\users\Duke\AppData\Local\Ilivid Player
2011-12-22 23:43 . 2011-12-22 23:43 ——– d—–w- c:\users\Duke\AppData\Local\PackageAware
2011-12-22 16:00 . 2011-12-22 16:00 ——– d—–w- c:\users\Duke\AppData\Roaming\SUPERAntiSpyware.com
2011-12-22 15:59 . 2011-12-22 15:59 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2011-12-22 15:51 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-22 15:51 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-22 15:51 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-22 15:51 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-22 15:51 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-22 15:50 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-22 15:50 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-17 22:03 . 2011-12-17 22:03 ——– d—–w- c:\users\Duke\AppData\Roaming\QuickScan
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-06 23:23 . 2011-06-16 10:45 273408 —-a-w- c:\windows\system32\drivers\afd.sys
2011-12-06 17:40 . 2011-12-06 17:40 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{274431CA-79D1-4E9E-B292-712D034EADAE}\offreg.dll
2011-11-21 10:47 . 2011-12-06 17:40 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{274431CA-79D1-4E9E-B292-712D034EADAE}\mpengine.dll
2011-11-10 10:54 . 2011-05-20 11:51 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-12 16:02 . 2011-06-16 15:59 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-03 00:39 . 2011-05-11 13:00 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c55f5517-246e-4426-b745-ee25b08eb8b4}"= "c:\program files\TranslatorBar_3.2\prxtbTra0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{c55f5517-246e-4426-b745-ee25b08eb8b4}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c55f5517-246e-4426-b745-ee25b08eb8b4}]
2011-05-09 09:49 176936 —-a-w- c:\program files\TranslatorBar_3.2\prxtbTra0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c55f5517-246e-4426-b745-ee25b08eb8b4}"= "c:\program files\TranslatorBar_3.2\prxtbTra0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{c55f5517-246e-4426-b745-ee25b08eb8b4}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C55F5517-246E-4426-B745-EE25B08EB8B4}"= "c:\program files\TranslatorBar_3.2\prxtbTra0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{c55f5517-246e-4426-b745-ee25b08eb8b4}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Duke\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Duke\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\Duke\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-12-09 4616064]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-25 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-04 133912]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-04 138008]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-04 154392]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]
.
c:\users\Duke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=protector.dll
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders credssp.dll, digeste.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Duke^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Duke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 16:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bing Bar]
2010-04-27 20:39 243544 —-a-w- c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-10-09 11:58 75008 —-a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 06:41 49208 —-a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2008-08-20 14:54 150016 —-a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Message Center 2]
2010-05-25 23:16 619008 —-a-w- c:\program files\Nikon\Nikon Message Center 2\NkMC2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-02-13 18:38 159744 —-a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-04-24 01:11 176128 —-a-w- c:\program files\HP\QuickPlay\QPService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-01-25 21:20 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-07-26 15:39 273544 —-a-w- c:\program files\Real\realplayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2011-06-21 18:55 114176 —-a-w- c:\windows\System32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-06 13:41]
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-06 13:41]
.
2012-01-09 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2010-08-30 17:29]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/
uInternet Settings,ProxyOverride =
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - c:\program files\SpecialSavings\SpecialSavingsSinged.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Duke\AppData\Roaming\Mozilla\Firefox\Profiles\7t7csr2e.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-us:official
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 5643
FF - prefs.js: network.proxy.type - 4
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
HKU-Default-RunOnce-AutoLaunch - c:\program files\Lavasoft\Ad-Aware\AutoLaunch.exe
MSConfigStartUp-Apoint - c:\program files\Apoint2K\Apoint.exe
MSConfigStartUp-CanonMyPrinter - c:\program files\Canon\MyPrinter\BJMyPrt.exe
MSConfigStartUp-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
AddRemove-SolSuite_is1 - c:\program files\SolSuite\unins000.exe
AddRemove-{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD} - c:\program files\Apoint2K\Uninstap.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-09 17:36
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-915978820-4182682678-4078437421-1000\Software\AppDataLow\Software\Conduit\Community Alerts\Settings\Locales\e*n**U7Q']
"LP_LastUpdateTime"="1314552636"
"LP_LastCheckTime"=dword:4e5a7b27
"LP_ReloadIntervalInHours"=dword:000002a0
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-01-09 17:41:41
ComboFix-quarantined-files.txt 2012-01-09 22:41
.
Pre-Run: 82,379,620,352 bytes free
Post-Run: 85,433,151,488 bytes free
.
- - End Of File - - 328A3F530E34CA7581358F5419B237A3