What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Winsock error causing internet connectivity issues [Solved]

42 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My internet connection has become very unstable. Sometimes it doesn't work; other times only IE works; other times IE and Chrome take a while to load a page and then kick back connection error. I've tried the netstack reset codes and checked my Internet Option settings.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:15:32 AM, on 2/2/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10t_ActiveX.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\notepad.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DgnWebIE - {2843DAC1-05EF-11D2-95BA-0060083493D6} - C:\Windows\Speech\Dragon\web_ie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O9 - Extra button: Crawler Smileys - {16FE352D-F643-4A81-BC61-2C051F3A757D} - C:\PROGRA~1\Crawler\Smileys\CSMILE~1.DLL
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Crawler eCards - {82E2B317-7C9C-4F12-B920-AC37D928CD43} - C:\PROGRA~1\Crawler\Smileys\CSMILE~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: WinSock Extention Manager (WinExtManager) - Unknown owner - C:\Windows\system32\mdmcls32.exe
O23 - Service: WinSock Svchost Manager (WinSvchostManager) - Unknown owner - C:\Windows\System32\svcprs32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7171 bytes

LSPFix
Keep
NLAapi.dll
napinsp.dll
pnrpnsp.dll
mswsock.dll
winrnr.dll

Remove
winsflt.dll
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

First we need to make all files and folders VISIBLE:

  • Go to Start >> Control Panel >> Folder Options >> View
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-


Please download aswMBR to your desktop.

  • Right click and Run as Administrator the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post the logs created by DDS and aswMBR.exe. :)
Post #3
Hello Jeff and thank you for you help.

DDS.txt.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run at 10:14:03 on 2012-02-03
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1015.244 [GMT -5:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\dllhost.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\msiexec.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\locator.exe
C:\Windows\System32\tcpsvcs.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\System32\svcprs32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10t_ActiveX.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DgnWebIE: {2843dac1-05ef-11d2-95ba-0060083493d6} - c:\windows\speech\dragon\web_ie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: CA Anti-Phishing Toolbar: {0123b506-0ad9-43aa-b0cf-916c122ad4c5} -
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
uRun: [Power2GoExpress]
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: []
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
StartupFolder: c:\users\euclid\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {16FE352D-F643-4A81-BC61-2C051F3A757D} - {16FE352D-F643-4A81-BC61-2C051F3A757D} - c:\progra~1\crawler\smileys\CSMILE~1.DLL
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {82E2B317-7C9C-4F12-B920-AC37D928CD43} - {82E2B317-7C9C-4F12-B920-AC37D928CD43} - c:\progra~1\crawler\smileys\CSMILE~1.DLL
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: winsflt.dll
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{9EFC9010-3568-4693-BE1B-87612F30C0F8} : DhcpNameServer = 192.168.1.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: UmxSbxExw.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\euclid\appdata\roaming\mozilla\firefox\profiles\pc6uva85.default\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 KmxAMRT;KmxAMRT;c:\windows\system32\drivers\KmxAMRT.sys [2011-5-10 164944]
R0 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [2011-4-24 107088]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2012-2-1 64512]
R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2011-3-23 83536]
R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [2011-3-23 63056]
R1 KmxFilter;HIPS Core Filter Driver;c:\windows\system32\drivers\KmxFilter.sys [2011-5-2 66128]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-18 21504]
R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2011-5-12 152656]
R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [2011-2-24 82000]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-2-1 652360]
R2 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt60.sys [2007-9-12 28160]
R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2011-5-12 331344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-2-1 20464]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-12-23 15232]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-2-2 40776]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024]
S3 PCD5SRVC{BD6912E3-AC9D80E8-05040000};PCD5SRVC{BD6912E3-AC9D80E8-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\PCD5SRVC.pkms [2007-9-12 25760]
S3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [2008-6-18 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\system32\drivers\VSTBS23.SYS [2008-6-18 251904]
S4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
S4 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
S4 CAAMSvc;CAAMSvc;c:\program files\ca\ca internet security suite\ca anti-virus plus\CAAMSvc.exe [2010-10-28 206152]
S4 CAISafe;CAISafe;c:\program files\ca\ca internet security suite\ca anti-virus plus\isafe.exe [2010-9-8 222544]
S4 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\ca\ca internet security suite\ccschedulersvc.exe [2010-9-8 206160]
S4 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S4 CyberLink Live Monitor Service;CyberLink Live Monitor Service;c:\program files\cyberlink\cyberlink live\CLSomaMonitorService.exe [2008-8-14 179232]
S4 CyberLink Live Push Update Service;CyberLink Live Push Update Service;c:\program files\cyberlink\cyberlink live\CLPushUpdateService.exe [2008-8-14 105504]
S4 CyberLink Live Service;CyberLink Live Service;c:\program files\cyberlink\cyberlink live\CLSomaService.exe [2008-8-14 322592]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-8-1 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-8-1 135664]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-12-23 2152688]
S4 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2012-1-31 1153368]
.
=============== Created Last 30 ================
.
2012-02-02 06:11:57 388096 —-a-r- c:\users\euclid\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-02-02 06:11:55 ——– d—–w- c:\program files\Trend Micro
2012-02-02 05:57:54 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-02-02 05:34:02 6557240 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{229e233a-9211-4be8-9760-afc00a2b7b50}\mpengine.dll
2012-02-01 19:55:51 64512 —-a-w- c:\windows\system32\drivers\Lbd.sys
2012-02-01 19:53:58 ——– d—–w- c:\program files\Lavasoft
2012-02-01 19:17:30 ——– d—–w- c:\program files\Wise PC Engineer
2012-02-01 19:12:59 ——– d—–w- c:\users\euclid\appdata\roaming\Malwarebytes
2012-02-01 19:12:54 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-01 19:12:54 ——– d—–w- c:\programdata\Malwarebytes
2012-02-01 19:12:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-02-01 18:36:34 ——– d—–w- c:\users\euclid\appdata\local\Mozilla
2012-02-01 08:52:09 6557240 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-02-01 05:25:41 703824 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0475815f-3dd3-4d37-a4c4-6027165c9dca}\gapaengine.dll
2012-02-01 05:12:29 ——– d—–w- c:\program files\Microsoft Security Client
2012-02-01 05:11:16 221568 —-a-w- c:\windows\system32\drivers\netio.sys
2012-02-01 04:39:36 ——– d—–w- c:\users\euclid\appdata\local\VS Revo Group
2012-02-01 02:08:13 ——– d—–w- c:\programdata\CA-SupportBridge
2012-02-01 01:33:02 ——– d—–w- C:\305477e34a2f45f507
2012-02-01 00:30:12 ——– d—–w- c:\windows\pss
2012-02-01 00:12:12 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2012-02-01 00:12:12 ——– d—–w- c:\program files\Spybot - Search & Destroy
2012-01-31 22:28:05 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-01-31 22:28:04 194048 —-a-w- c:\program files\internet explorer\IEShims.dll
2012-01-31 22:28:04 141112 —-a-w- c:\program files\internet explorer\sqmapi.dll
2012-01-31 22:28:03 1127424 —-a-w- c:\windows\system32\wininet.dll
2012-01-31 22:28:00 1798144 —-a-w- c:\windows\system32\jscript9.dll
2012-01-31 22:27:59 678912 —-a-w- c:\program files\internet explorer\iedvtool.dll
2012-01-31 22:27:57 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2012-01-31 21:53:59 429056 —-a-w- c:\windows\system32\EncDec.dll
2012-01-31 21:53:07 66560 —-a-w- c:\windows\system32\packager.dll
2012-01-31 21:53:01 376320 —-a-w- c:\windows\system32\winsrv.dll
2012-01-31 21:52:55 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat
2012-01-31 21:52:44 2043904 —-a-w- c:\windows\system32\win32k.sys
2012-01-31 21:52:38 49152 —-a-w- c:\windows\system32\csrsrv.dll
2012-01-31 21:52:31 497152 —-a-w- c:\windows\system32\qdvd.dll
2012-01-31 21:52:31 1314816 —-a-w- c:\windows\system32\quartz.dll
2012-01-31 21:45:57 2048 —-a-w- c:\windows\system32\tzres.dll
2012-01-31 21:15:00 ——– d—–w- c:\program files\CCleaner
2012-01-31 01:05:15 ——– d—–w- c:\program files\SpywareBlaster
.
==================== Find3M ====================
.
2012-01-31 12:44:05 237072 ——w- c:\windows\system32\MpSigStub.exe
2011-11-18 20:23:34 1205064 —-a-w- c:\windows\system32\ntdll.dll
2011-11-17 06:48:37 440192 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2011-11-16 16:23:44 377344 —-a-w- c:\windows\system32\winhttp.dll
2011-11-16 16:23:08 72704 —-a-w- c:\windows\system32\secur32.dll
2011-11-16 16:23:05 278528 —-a-w- c:\windows\system32\schannel.dll
2011-11-16 16:21:57 1259008 —-a-w- c:\windows\system32\lsasrv.dll
2011-11-16 14:12:25 9728 —-a-w- c:\windows\system32\lsass.exe
.
============= FINISH: 10:19:52.10 ===============

Attach.txt
.

DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/20/2007 1:20:22 PM
System Uptime: 2/3/2012 10:04:30 AM (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | Lancaster8
Processor: Intel® Pentium® Dual CPU E2140 @ 1.60GHz | CPU 1 | 1600/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 224 GiB total, 122.377 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 0.994 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e968-e325-11ce-bfc1-08002be10318}
Description: Intel® 82852/82855 GM/GME Graphics Controller (Microsoft Corporation - XDDM)
Device ID: ROOT\DISPLAY\0000
Manufacturer: Intel Corporation
Name: Intel® 82852/82855 GM/GME Graphics Controller (Microsoft Corporation - XDDM)
PNP Device ID: ROOT\DISPLAY\0000
Service: ialm
.
Class GUID: {4d36e968-e325-11ce-bfc1-08002be10318}
Description: Intel® 82852/82855 GM/GME Graphics Controller (Microsoft Corporation - XDDM)
Device ID: ROOT\DISPLAY\0001
Manufacturer: Intel Corporation
Name: Intel® 82852/82855 GM/GME Graphics Controller (Microsoft Corporation - XDDM)
PNP Device ID: ROOT\DISPLAY\0001
Service: ialm
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
.
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer
5600
5600_Help
5600Trb
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Media Player
Adobe Reader X (10.1.2)
Adobe Shockwave Player 11.5
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
AOL Point & Speak 5.0
APH placeholder
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Bing Bar
Bing Rewards Client Installer
BlackBerry Desktop Software 4.7
Bonjour
BufferChm
CA Anti-Virus Plus
Cards_Calendar_OrderGift_DoMorePlugout
CCleaner
Compatibility Pack for the 2007 Office system
Copy
Crawler Smileys
CustomerResearchQFolder
CyberLink DVD Suite Deluxe
CyberLink Live
D3DX10
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
eSupportQFolder
Fanbase
Fax
FinePixViewer Ver.4.2
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
Hardware Diagnostic Tools
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HiJackThis
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Advisor
HP Customer Experience Enhancements
HP Customer Feedback
HP Customer Participation Program 8.0
HP Games
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential
HP Photosmart Essential 2.5
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
HP Product Assistant
HP Solution Center 8.0
HP Update
HPDiagnosticAlert
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
HPSSupply
ImageMixer VCD2 for FinePix
Intel® Graphics Media Accelerator Driver
iTunes
Java™ 6 Update 24
Java™ SE Runtime Environment 6 Update 1
Junk Mail filter update
LabelPrint
LightScribe System Software 1.10.16.1
LightScribe Template Labeler
magicJack
Malwarebytes Anti-Malware version 1.60.1.1000
MarketResearch
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
MobileMe Control Panel
Mozilla Firefox 10.0 (x86 en-US)
MP3 Player Utilities 4.18
MSN
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.1
MyPublisher BookMaker
Nanovor
OGA Notifier 2.0.0048.0
PictureMover
Power2Go
PowerDesk 5.0
PowerDirector
PSSWCORE
Python 2.5
QuickTime
RAW FILE CONVERTER LE
Realtek High Definition Audio Driver
RegWork
Rhapsody Player Engine
Rhapsody provided by Optimum Online
Safari
Scan
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Segoe UI
Soft Data Fax Modem with SmartCP
SolutionCenter
Sony Media Manager for PSP 2.0
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
SpywareBlaster 4.5
Status
Theophilos 3
Toolbox
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VideoToolkit01
WeatherBug Gadget
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Vista Upgrade Advisor
Wise PC Engineer 6.3.9
Yahoo! Messenger
Yahoo! Search Protection
.
==== Event Viewer Messages From Past Week ========
.
2/3/2012 10:11:49 AM, Error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Secure Socket Tunneling Protocol Service service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
2/3/2012 10:07:29 AM, Error: Service Control Manager [7022] - The Diagnostic Service Host service hung on starting.
2/3/2012 10:06:30 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the WinSock Extention Manager service to connect.
2/3/2012 10:06:30 AM, Error: Service Control Manager [7001] - The Server service depends on the Security Accounts Manager service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
2/3/2012 10:06:30 AM, Error: Service Control Manager [7000] - The WinSock Extention Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/2/2012 2:53:04 PM, Error: Service Control Manager [7022] - The Diagnostic System Host service hung on starting.
2/2/2012 12:18:41 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {5F36DC27-B076-4D0C-BD8C-7AEE14022193} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
.
==== End Of File ===========================

aswMBR
aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software
Run date: 2012-02-03 10:22:57
—————————–
10:22:57.634 OS Version: Windows 6.0.6002 Service Pack 2
10:22:57.634 Number of processors: 2 586 0xF0D
10:22:57.634 ComputerName: EUCLID-PC UserName: Euclid
10:23:00.832 Initialize success
10:25:05.943 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
10:25:05.943 Disk 0 Vendor: ST3250310AS 3.AHA Size: 238475MB BusType: 3
10:25:05.958 Disk 0 MBR read successfully
10:25:05.958 Disk 0 MBR scan
10:25:05.958 Disk 0 unknown MBR code
10:25:05.958 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 228910 MB offset 63
10:25:05.990 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 9562 MB offset 468808830
10:25:06.005 Disk 0 scanning sectors +488392065
10:25:06.052 Disk 0 scanning C:\Windows\system32\drivers
10:25:15.209 Service scanning
10:25:17.237 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
10:25:18.111 Modules scanning
10:25:30.840 Disk 0 trace - called modules:
10:25:30.872 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS intelide.sys
10:25:31.449 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x856c9ac8]
10:25:31.496 3 CLASSPNP.SYS[86fa98b3] -> nt!IofCallDriver -> [0x850f6918]
10:25:31.527 5 acpi.sys[8689b6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0x850ed5e0]
10:25:31.558 Scan finished successfully
10:27:48.666 Disk 0 MBR has been saved successfully to "C:\Users\Euclid\Desktop\MBR.dat"
10:27:48.666 The log file has been saved successfully to "C:\Users\Euclid\Desktop\aswMBR.txt"
Post #4
Hi qwick,

Let's make sure your System Restore Point is set to On and Manually Set a Restore Point.
  • Go to Start
  • Select Control Panel
  • Select System
  • Select the System Protection link in the left-hand task list
  • Check the disk drive for which you would like to turn system restore on
  • Click the "Apply" button. System Restore will now monitor and create restore points for the checked
    disk drive.
  • Press Create button
  • Type a description of the Restore Point of your choosing
  • Press the Create button
  • Press Finish

Now we have turned On your System Restore and Manually set a Restore Point.
———-

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #5
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: ASUSTeK Computer INC. BIOS Manufacturer: American Megatrends Inc. System Manufacturer: Compaq-Presario System Product Name: GX617AA-ABA SR5310F Logical Drives Mask: 0x0000003c Kernel Drivers (total 150): 0x82636000 \SystemRoot\system32\ntkrnlpa.exe 0x82603000 \SystemRoot\system32\hal.dll 0x80600000 \SystemRoot\system32\kdcom.dll 0x80607000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x80677000 \SystemRoot\system32\PSHED.dll 0x80688000 \SystemRoot\system32\BOOTVID.dll 0x80690000 \SystemRoot\system32\CLFS.SYS 0x806D1000 \SystemRoot\system32\CI.dll 0x8680A000 \SystemRoot\system32\drivers\Wdf01000.sys 0x86886000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x86893000 \SystemRoot\system32\drivers\acpi.sys 0x868D9000 \SystemRoot\system32\drivers\WMILIB.SYS 0x868E2000 \SystemRoot\system32\drivers\msisadrv.sys 0x868EA000 \SystemRoot\system32\drivers\pci.sys 0x86911000 \SystemRoot\System32\drivers\partmgr.sys 0x86920000 \SystemRoot\system32\drivers\volmgr.sys 0x8692F000 \SystemRoot\System32\drivers\volmgrx.sys 0x86979000 \SystemRoot\system32\drivers\intelide.sys 0x86980000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x8698E000 \SystemRoot\System32\drivers\mountmgr.sys 0x8699E000 \SystemRoot\system32\drivers\atapi.sys 0x869A6000 \SystemRoot\system32\drivers\ataport.SYS 0x869C4000 \SystemRoot\system32\drivers\fltmgr.sys 0x807B1000 \SystemRoot\system32\drivers\fileinfo.sys 0x807C1000 \SystemRoot\system32\DRIVERS\Lbd.sys 0x86A01000 \SystemRoot\system32\DRIVERS\KmxAMRT.sys 0x86A3B000 \SystemRoot\System32\DRIVERS\kmxfw.sys 0x86A59000 \SystemRoot\System32\DRIVERS\msrpc.sys 0x86A84000 \SystemRoot\System32\DRIVERS\NETIO.SYS 0x86ABF000 \SystemRoot\System32\DRIVERS\NDIS.SYS 0x86BCA000 \SystemRoot\System32\DRIVERS\TDI.SYS 0x86BD5000 \SystemRoot\System32\DRIVERS\fwpkclnt.sys 0x86C00000 \SystemRoot\System32\Drivers\ksecdd.sys 0x86C72000 \SystemRoot\System32\drivers\tcpip.sys 0x86E0C000 \SystemRoot\System32\Drivers\Ntfs.sys 0x86F1C000 \SystemRoot\system32\drivers\volsnap.sys 0x86F55000 \SystemRoot\System32\Drivers\spldr.sys 0x86F5D000 \SystemRoot\System32\Drivers\mup.sys 0x86F6C000 \SystemRoot\System32\drivers\ecache.sys 0x86F93000 \SystemRoot\system32\drivers\disk.sys 0x86FA4000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x86FC5000 \SystemRoot\system32\drivers\crcdisk.sys 0x86FEE000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x86E00000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x86D5F000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x90807000 \SystemRoot\system32\DRIVERS\igdkmd32.sys 0x90EC4000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x90F64000 \SystemRoot\System32\drivers\watchdog.sys 0x90F70000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x86D6E000 \SystemRoot\system32\DRIVERS\Rtlh86.sys 0x86D88000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x86D93000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x86DD1000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x9020C000 \SystemRoot\system32\DRIVERS\HSXHWBS2.sys 0x90258000 \SystemRoot\system32\DRIVERS\ks.sys 0x90282000 \SystemRoot\system32\DRIVERS\HSX_DP.sys 0x8FC0C000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys 0x8FCC1000 \SystemRoot\system32\drivers\modem.sys 0x8FCCE000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8FCE1000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8FCEC000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8FD04000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys 0x91002000 \SystemRoot\system32\DRIVERS\ialmnt5.sys 0x91140000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0x91161000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x91190000 \SystemRoot\system32\DRIVERS\storport.sys 0x911D1000 \SystemRoot\System32\Drivers\RootMdm.sys 0x911D9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x911F0000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8FD0A000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8FD2D000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8FD3C000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8FD50000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8FD65000 \SystemRoot\system32\DRIVERS\RimSerial.sys 0x8FD6C000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8FD7C000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x911FB000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8FD87000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8FD91000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8FD9E000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x91A01000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x91C38000 \SystemRoot\system32\drivers\portcls.sys 0x91C65000 \SystemRoot\system32\drivers\drmk.sys 0x91C8A000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x91C9B000 \SystemRoot\system32\DRIVERS\MpFilter.sys 0x91CC2000 \SystemRoot\System32\DRIVERS\KmxFile.sys 0x91CD5000 \SystemRoot\System32\DRIVERS\kmxagent.sys 0x91CED000 \SystemRoot\System32\DRIVERS\kmxcfg.sys 0x91D42000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x91D4B000 \SystemRoot\System32\Drivers\Null.SYS 0x91D52000 \SystemRoot\System32\Drivers\Beep.SYS 0x91D62000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x91D69000 \SystemRoot\System32\drivers\vga.sys 0x91D75000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x91D7D000 \SystemRoot\system32\drivers\rdpencdd.sys 0x91D85000 \SystemRoot\System32\Drivers\Msfs.SYS 0x91D90000 \SystemRoot\System32\Drivers\Npfs.SYS 0x91D9E000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x91DA7000 \SystemRoot\system32\DRIVERS\tdx.sys 0x91DBD000 \SystemRoot\system32\DRIVERS\smb.sys 0x90384000 \SystemRoot\system32\drivers\afd.sys 0x903CC000 \SystemRoot\System32\DRIVERS\netbt.sys 0x91DD1000 \SystemRoot\system32\drivers\ws2ifsl.sys 0x91DDA000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8FDD3000 \SystemRoot\system32\DRIVERS\KmxFilter.sys 0x91DF0000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8FDE7000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x94606000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x94642000 \SystemRoot\system32\drivers\nsiproxy.sys 0x9464C000 \SystemRoot\System32\Drivers\dfsc.sys 0x94663000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x9467A000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x9467C000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x94685000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x94695000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x9469E000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x946A6000 \SystemRoot\System32\Drivers\crashdmp.sys 0x946B3000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x946BE000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xA3A50000 \SystemRoot\System32\win32k.sys 0x946C6000 \SystemRoot\System32\drivers\Dxapi.sys 0x946D0000 \SystemRoot\system32\DRIVERS\monitor.sys 0xA3C70000 \SystemRoot\System32\TSDDD.dll 0xA3C90000 \SystemRoot\System32\cdd.dll 0x946DF000 \SystemRoot\system32\drivers\luafv.sys 0x946FA000 \SystemRoot\System32\DRIVERS\KmxSbx.sys 0x9471A000 \SystemRoot\system32\DRIVERS\irda.sys 0x94738000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x94748000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x94772000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x9478B000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x9479E000 \SystemRoot\system32\DRIVERS\RtNdPt60.sys 0x81E04000 \SystemRoot\system32\drivers\HTTP.sys 0x81E71000 \SystemRoot\system32\drivers\spsys.sys 0x81F21000 \SystemRoot\system32\drivers\mrxdav.sys 0x81F42000 \SystemRoot\System32\DRIVERS\KmxCF.sys 0x81F6B000 \SystemRoot\System32\Drivers\MCSTRM.SYS 0x81F6D000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xB7003000 \SystemRoot\system32\drivers\peauth.sys 0xB70E1000 \SystemRoot\System32\Drivers\secdrv.SYS 0xB70EB000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xB7108000 \SystemRoot\System32\drivers\tcpipreg.sys 0xB7114000 \SystemRoot\system32\DRIVERS\xaudio.sys 0xB711C000 \SystemRoot\System32\DRIVERS\srv2.sys 0xB7144000 \SystemRoot\System32\DRIVERS\srv.sys 0xB7193000 \SystemRoot\system32\DRIVERS\cdfs.sys 0xB71A9000 \??\C:\Windows\system32\drivers\mbam.sys 0xB71AD000 \??\C:\Users\Euclid\AppData\Local\Temp\mbr.sys 0xB71B4000 \??\C:\Users\Euclid\AppData\Local\Temp\aswMBR.sys 0x778C0000 \Windows\System32\ntdll.dll Processes (total 57): 0 System Idle Process 4 System 444 C:\Windows\System32\smss.exe 512 csrss.exe 548 C:\Windows\System32\wininit.exe 568 csrss.exe 600 C:\Windows\System32\services.exe 612 C:\Windows\System32\lsass.exe 620 C:\Windows\System32\lsm.exe 696 C:\Windows\System32\winlogon.exe 820 C:\Windows\System32\svchost.exe 884 C:\Windows\System32\svchost.exe 956 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe 1152 C:\Windows\System32\svchost.exe 1184 C:\Windows\System32\svchost.exe 1204 C:\Windows\System32\svchost.exe 1280 C:\Windows\System32\audiodg.exe 1304 C:\Windows\System32\svchost.exe 1320 C:\Windows\System32\SLsvc.exe 1384 C:\Windows\System32\svchost.exe 1552 C:\Windows\System32\svchost.exe 1852 C:\Windows\System32\spoolsv.exe 1880 C:\Windows\System32\taskeng.exe 1908 C:\Windows\System32\dwm.exe 1952 C:\Windows\explorer.exe 1980 C:\Windows\System32\svchost.exe 2044 C:\Windows\System32\taskeng.exe 456 C:\Windows\System32\alg.exe 812 C:\Program Files\Microsoft Security Client\msseces.exe 1032 C:\Program Files\Windows Media Player\wmpnscfg.exe 1220 C:\Windows\ehome\ehtray.exe 1272 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE 2224 C:\Windows\System32\Locator.exe 2244 C:\Windows\System32\TCPSVCS.EXE 2336 C:\Windows\System32\svchost.exe 2388 C:\Windows\System32\svchost.exe 2480 C:\Windows\System32\svcprs32.exe 2512 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE 2524 C:\Windows\System32\SearchIndexer.exe 2572 C:\Windows\System32\drivers\XAudio.exe 2608 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE 2780 C:\Windows\ehome\ehmsas.exe 3144 C:\Program Files\Internet Explorer\iexplore.exe 3188 C:\Program Files\Internet Explorer\iexplore.exe 3908 C:\Program Files\Windows Media Player\wmpnetwk.exe 4060 C:\Windows\System32\svchost.exe 788 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe 3448 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 3364 C:\Windows\System32\Macromed\Flash\FlashUtil10t_ActiveX.exe 520 C:\Windows\System32\wuauclt.exe 2444 C:\Windows\System32\notepad.exe 3248 C:\Windows\System32\VSSVC.exe 1708 C:\Windows\System32\svchost.exe 3604 C:\Program Files\Internet Explorer\iexplore.exe 2344 C:\Windows\System32\SearchProtocolHost.exe 2776 C:\Windows\System32\SearchFilterHost.exe 2136 C:\Users\Euclid\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000037`e2e8fc00 (NTFS) PhysicalDrive0 Model Number: ST3250310AS, Rev: 3.AHA Size Device Name MBR Status ——————————————– 232 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: CEFD837A02A1F4445A136688B10013AE4399C2CF Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #6
Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #7
got Warning message saying ComboFix cannot run when CA Anti-Virus is installed. It would be dangerous to continue. Please uninstall CA Anti-VIrus or use another tool. [ok]
Post #14
Hi,

Please download and run this tool to completely remove CA. When you are finished run ComboFix again and if there is a log created post that to your next reply. If you have problems try to boot to safe mode and run ComboFix.
Post #15
I get this reply from that link "An error has occurred: Invalid result from SelfServeMgr.validateScriptRequest : generated by processScriptRequest" - i tried it on the desktop and my laptop

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI