Spyware / Malware / Virus Removal

Computer keeps shutting down [Solved]

12 min read

Looking for the outcome? Ask AI

elmkd Topic Starter

Post #1March 2, 2012, 5:01 AM UTC

Hello:
I have gotten a lot of great help here in the past. I'm hoping that someone can take a look at my logs and help me fix this computer. Sometimes the machine will shut itself down for no apparent reason. When I try to run a virus scanner the scan will start and then somewhere in the middle, the machine will shut itself down. I have also seen Windows Media Player open on the desktop. I have included my HJT Logs below. Thank you for any help that you might give me.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:50:00 PM, on 3/1/2012
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir Server\sched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Server\avguard.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINDOWS\system32\Dfssvc.exe
C:\WINDOWS\System32\dns.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\ismserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\system\ms-java.exe
C:\Program Files\Microsoft SQL Server\MSSQL$SHAREPOINT\Binn\sqlservr.exe
C:\WINDOWS\system32\ntfrs.exe
C:\WINDOWS\system32\rserver30\RServer3.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\GLDS\UpgradeManager\UpgradeManagerSvc.exe
C:\WINDOWS\System32\wins.exe
C:\Program Files\RealVNC\VNC4\winvnc4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fb_inet_server.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rserver30\FamItrfc.Exe
C:\WINDOWS\lsass.exe
C:\Program Files\Avira\AntiVir Server\avgnt.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fb_inet_server.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fb_inet_server.exe
C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE -a
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Server\avgnt.exe" /min
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" –logon
O4 - HKLM\..\Run: [KNVV Agent] C:\WINDOWS\system32\28463\KNVV.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O14 - IERESET.INF: START_PAGE_URL=http://companyweb
O15 - ESC Trusted Zone: http://view.atdmt.com
O15 - ESC Trusted Zone: http://www.box.net
O15 - ESC Trusted Zone: http://www.google.com.jm
O15 - ESC Trusted Zone: http://apps.new.facebook.com
O15 - ESC Trusted Zone: http://static.ak.facebook.com
O15 - ESC Trusted Zone: http://www.facebook.com
O15 - ESC Trusted Zone: http://www.new.facebook.com
O15 - ESC Trusted Zone: ftp.glds.com
O15 - ESC Trusted Zone: http://www.iaaf.org
O15 - ESC Trusted Zone: http://mozilla.isc.org
O15 - ESC Trusted Zone: http://www.juropnet.hu
O15 - ESC Trusted Zone: http://bl122w.blu122.mail.live.com
O15 - ESC Trusted Zone: http://im.live.com
O15 - ESC Trusted Zone: http://login.live.com
O15 - ESC Trusted Zone: http://pv-mirror01.mozilla.org
O15 - ESC Trusted Zone: http://pv-mirror02.mozilla.org
O15 - ESC Trusted Zone: http://runonce.msn.com
O15 - ESC Trusted Zone: http://www.msn.com
O15 - ESC Trusted Zone: http://www.nbcolympics.com
O15 - ESC Trusted Zone: http://ads.pointroll.com
O15 - ESC Trusted Zone: http://hate.psybnc.org
O15 - ESC Trusted Zone: http://www.rarlab.com
O15 - ESC Trusted Zone: http://www.realvnc.com
O15 - ESC Trusted Zone: http://www.roboform.com
O15 - ESC Trusted Zone: http://rya.rockyou.com
O15 - ESC Trusted Zone: http://hivelocity.dl.sourceforge.net
O15 - ESC Trusted Zone: http://voxel.dl.sourceforge.net
O15 - ESC Trusted Zone: http://mail.sozu.co.uk
O15 - ESC Trusted Zone: http://www.thecash4offer.com
O15 - ESC Trusted Zone: http://fwt.txdnl.com
O15 - ESC Trusted Zone: http://ftp.uni-kl.de
O15 - ESC Trusted Zone: http://*.whatismyip.com
O15 - ESC Trusted Zone: http://download.windowsupdate.com
O15 - ESC Trusted Zone: http://*.windowsupdate.com
O15 - ESC Trusted Zone: http://ad.yieldmanager.com
O15 - ESC Trusted Zone: http://ys-i.ys168.com
O15 - ESC Trusted Zone: http://ad.z5x.net
O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)
O15 - ESC Trusted IP range: http://192.168.1.1
O15 - ESC Trusted IP range: http://202.102.64.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = telstarcablelimited.local
O17 - HKLM\Software\..\Telephony: DomainName = telstarcablelimited.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{6FA2C94B-F0FB-4AC3-B8A6-8FFA3E101B72}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = telstarcablelimited.local
O20 - AppInit_DLLs: C:\WINDOWS\system32\rserver30\newtstop.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Server scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir Server\sched.exe
O23 - Service: Avira AntiVir Server (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Server\avguard.exe
O23 - Service: Symantec pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fb_inet_server.exe
O23 - Service: Proxy Service (HTran) - Unknown owner - C:\WINDOWS\m.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft Security Center - Unknown owner - C:\WINDOWS\Help\MUI\Debug\svchost.exe (file missing)
O23 - Service: Ms-java - Unknown owner - C:\WINDOWS\system32\system\ms-java.exe
O23 - Service: Radmin Server V3 (RServer3) - Famatech International Corp. - C:\WINDOWS\system32\rserver30\RServer3.exe
O23 - Service: Serv-U FTP Server (Serv-U) - Unknown owner - C:\WINDOWS\Help\MUI\Debug\smss.exe (file missing)
O23 - Service: Upgrade Manager (UpgradeManager) - Great Lakes Data Systems, Inc. - C:\Program Files\GLDS\UpgradeManager\UpgradeManagerSvc.exe
O23 - Service: WC Addressable Server (WCAddrServer) - Great Lakes Data Systems, Inc. - D:\Program Files\GLDS\WCAddrServer\WCAddrServer.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\winvnc4.exe

–
End of file - 8306 bytes

jeffce

Post #2March 2, 2012, 7:47 PM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
Please subscribe to this topic, if you haven't already.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

First we need to make all files and folders VISIBLE:

Go to Start>Control Panel>Folder Options>View
Choose to "Show hidden files and folders,"
Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
Close the window with OK

———-

Please download DDS from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

———-

Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.
Vista and Windows 7 users right click the icon and choose "Run as administrator".
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post both of the logs created by DDS and the log created by aswMBR.exe.

elmkd

Post #3March 2, 2012, 8:51 PM UTC

Thank you for your response. I have completed the following: Make all files and folders visible Download dds.scr Download aswMBR The dds.scr tool indicated that it would not run on Windows Server 2003. I will try the aswMBR in 5 hours when I can safely risk the computer spontaneously rebooting. Is there an alternative tool to dds.scr that will run on Windows Server 2003? Regards, elmkd

elmkd

Post #4March 2, 2012, 8:56 PM UTC

I have an additional question: aswMBR asks to download Avast! Free Antivirus for scanning. Should I ignore this message or should I click YES to download the latest Avast! virus definitions? Regards, elmkd

jeffce

Post #5March 2, 2012, 9:23 PM UTC

Hi,

aswMBR asks to download Avast! Free Antivirus for scanning. Should I ignore this message or should I click YES to download the latest Avast! virus definitions?

Yes please do so.

Try this tool instead of DDS…

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

elmkd

Post #6March 2, 2012, 11:37 PM UTC

Just to clarify, "yes please do so" means that I should go ahead and download the Avast! virus definitions? elmkd

jeffce

Post #7March 3, 2012, 12:07 AM UTC

Yes please download the virus definitions.

elmkd

Post #8March 3, 2012, 12:14 AM UTC

Please find included below, the Log Files:

aswMBR version 0.9.9.1649 Copyright© 2011 AVAST Software
Run date: 2012-03-02 18:49:26
—————————–
18:49:26.062 OS Version: Windows 5.2.3790 Service Pack 2
18:49:26.062 Number of processors: 2 586 0x80A
18:49:26.062 ComputerName: WINCABLESERVER UserName: administrator
18:49:26.687 Initialize success
18:49:45.375 AVAST engine defs: 12030201
18:50:07.031 The log file has been saved successfully to "C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\aswMBR.txt"
18:51:01.891 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\perc21Port3Path4Target0Lun0
18:51:01.906 Disk 0 Vendor: DELL____ V1.0 Size: 10240MB BusType: 1
18:51:01.922 Disk 1 \Device\Harddisk1\DR1 -> \Device\Scsi\perc21Port3Path4Target1Lun0
18:51:01.922 Disk 1 Vendor: DELL____ V1.0 Size: 5120MB BusType: 1
18:51:01.938 Disk 2 \Device\Harddisk2\DR2 -> \Device\Scsi\perc21Port3Path4Target2Lun0
18:51:01.969 Disk 2 Vendor: DELL____ V1.0 Size: 19352MB BusType: 1
18:51:02.000 Device \Driver\perc2 -> DriverStartIo SCSIPORT.SYS f734b214
18:51:02.031 Disk 0 MBR read successfully
18:51:02.047 Disk 0 MBR scan
18:51:02.109 Disk 0 Windows XP default MBR code
18:51:02.125 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 31 MB offset 63
18:51:02.156 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 10197 MB offset 64260
18:51:02.172 Disk 0 scanning sectors +20948760
18:51:02.250 Disk 0 scanning C:\WINDOWS\system32\drivers
18:51:10.375 Service scanning
18:51:16.047 Service Irmon C:\WINDOWS\Irmonsrc.dll **INFECTED** Win32:Dialer-gen [Dialer]
18:51:16.266 Service kmbvnk C:\WINDOWS\System32\bzyhzq.dll **INFECTED** Win32:PcClient-ACE [Trj]
18:51:33.141 Modules scanning
18:51:37.125 Disk 0 trace - called modules:
18:51:37.156 ntoskrnl.exe CLASSPNP.SYS disk.sys SCSIPORT.SYS hal.dll perc2.sys
18:51:37.172 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a35c9c0]
18:51:37.203 3 CLASSPNP.SYS[f7337601] -> nt!IofCallDriver -> \Device\Scsi\perc21Port3Path4Target0Lun0[0x8a3f0030]
18:51:37.891 AVAST engine scan C:\WINDOWS
18:51:38.813 File: C:\WINDOWS\Irmonsrc.dll **INFECTED** Win32:Dialer-gen [Dialer]
18:51:41.563 AVAST engine scan C:\WINDOWS\system32
18:51:48.422 File: C:\WINDOWS\system32\bzyhzq.dll **INFECTED** Win32:PcClient-ACE [Trj]
18:55:33.953 AVAST engine scan C:\WINDOWS\system32\drivers
18:55:53.656 AVAST engine scan C:\Documents and Settings\Administrator.WINCABLESERVER
18:56:47.609 AVAST engine scan C:\Documents and Settings\All Users
18:56:48.984 File: C:\Documents and Settings\All Users\.clamwin\quarantine\AKV.exe.infected **INFECTED** Win32:Ardamax-EK [Trj]
18:56:50.703 File: C:\Documents and Settings\All Users\.clamwin\quarantine\smss.exe.infected **INFECTED** Win32:Trojan-gen
18:57:17.531 Scan finished successfully
18:57:28.109 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\MBR.dat"
18:57:28.234 The log file has been saved successfully to "C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\aswMBR.txt"

OTL Extras logfile created on: 3/2/2012 7:01:30 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop
Windows Server 2003 Standard Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 70.18% Memory free
5.05 Gb Paging File | 4.63 Gb Available in Paging File | 91.70% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 9.96 Gb Total Space | 1.94 Gb Free Space | 19.48% Space Free | Partition Type: NTFS
Drive D: | 18.89 Gb Total Space | 9.91 Gb Free Space | 52.48% Space Free | Partition Type: NTFS
Drive X: | 4.99 Gb Total Space | 1.97 Gb Free Space | 39.42% Space Free | Partition Type: NTFS

Computer Name: WINCABLESERVER | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\lsass.exe" = C:\WINDOWS\lsass.exe:*:Enabled:lsass – ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0C753D2F-C64A-44B9-8FF4-A7752D8F2EC7}" = Windows Small Business Server Admin
"{12018183-866A-11D3-97DF-0000F8D8F2E9}" = Symantec pcAnywhere
"{1468862C-2178-42AC-83A3-AAE994359894}" = Avira AntiVir Server
"{2734011B-3709-45B2-A946-5A1ADB1AFCFE}" = Windows Small Business Server Documents
"{31271095-CD3A-4C9F-89F6-B5F6F3B35636}" = Windows Small Business Server Remote Portal
"{53BE2241-531B-49FB-B03D-06C377179548}" = Windows Small Business Server IE Client App
"{5D622FC5-B037-4505-AD5A-60555C2A05E9}" = Microsoft Connector for POP3 Mailboxes
"{64A411C9-DB09-4F01-A8D4-2D5227D7A074}" = Windows Small Business Server Licensing
"{65657C59-23A8-4974-B8E0-BA04EBD04E4F}" = Microsoft SQL Server Desktop Engine (SHAREPOINT)
"{66C8DA1B-9156-44B6-B222-2219BC6F21A9}" = Windows Small Business Server Client Setup
"{8681E826-9DC6-4EAC-84B7-971EA795BD36}" = Microsoft Group Policy Management Console
"{88A6C12D-DED9-412B-9CC2-643F03674EDF}" = Windows Small Business Server Fax Cfg
"{8EFE8B68-29E3-4F11-980B-1CDC9E21B258}" = Windows Small Business Server Connectivity
"{91140409-7000-11D3-8CFE-0150048383C9}" = Microsoft Windows SharePoint Services 2.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{AAD51583-6D43-4444-A1FF-0C8345345526}" = Radmin Server 3.0
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
"{ACCB890A-C291-4157-92A1-5A56D71AB047}" = Windows Small Business Server Fax
"{ACE0B250-0370-42D3-B137-16BB4BC0BD61}" = Windows Small Business Server ActiveSync
"{ADCFD3CB-BC9D-4B19-8AD7-3D2196FE9207}" = Microsoft .NET Framework 1.1 – Device Update 2.0
"{B7300824-E68F-45F1-BAC1-5F15636C346F}" = Microsoft SQL Server Desktop Engine (SBSMONITORING)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E3DD8B4D-D2B2-457A-B5D6-66B5031535A2}" = Windows Small Business Server Backup
"{EB132F7D-C614-40F5-952C-ED7391638A1B}" = Windows Small Business Server Client Experience
"{FFFFED3C-5E7E-4C6C-A7B9-8BAB6181852B}" = Windows Small Business Server Monitoring
"5717D53E-DD6D-4d1e-8A1F-C7BE620F65AA" = Windows Small Business Server 2003
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Mass Sender 4.3" = Advanced Mass Sender 4.3
"CCleaner" = CCleaner
"ClamWin Free Antivirus_is1" = ClamWin Free Antivirus 0.96.2.1
"FBDBServer_1_5_is1" = Firebird 1.5.3.4870
"ie8" = Windows Internet Explorer 8
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 3.0 (Symantec Corporation)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Health Monitor 2.1" = Microsoft Health Monitor 2.1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"PocketRAR" = Pocket RAR documentation
"PROSet" = Intel® PRO Network Connections Drivers
"RealVNC_is1" = VNC Free Edition 4.1.2
"Server Processes [removed]" = Server Processes [removed]
"Server Processes [removed]" = Server Processes [removed]
"Totalcmd" = Total Commander (Remove or Repair)
"WIC" = Windows Imaging Component
"WinCable Client [removed]" = WinCable Client [removed]
"WinCable Client [removed]" = WinCable Client [removed]
"WinCable Client [removed]" = WinCable Client [removed]
"Windows Server 2003 Service Pack" = Windows Server 2003 Service Pack 2
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"WinDirStat" = WinDirStat 1.1.2

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/26/2012 4:35:49 AM | Computer Name = WINCABLESERVER | Source = sSMTP | ID = 0
Description =

Error - 2/27/2012 4:35:52 AM | Computer Name = WINCABLESERVER | Source = sSMTP | ID = 0
Description =

Error - 2/28/2012 4:35:25 AM | Computer Name = WINCABLESERVER | Source = sSMTP | ID = 0
Description =

Error - 2/29/2012 12:12:08 AM | Computer Name = WINCABLESERVER | Source = WinVNC4 | ID = 1
Description = DeviceFrameBuffer: BitBlt failed:5

Error - 2/29/2012 12:26:39 AM | Computer Name = WINCABLESERVER | Source = WinVNC4 | ID = 1
Description = HTTPServer: error writing HTTP document:write: Connection aborted
(10053)

Error - 2/29/2012 12:42:19 AM | Computer Name = WINCABLESERVER | Source = WinVNC4 | ID = 1
Description = HTTPServer: error writing HTTP document:write: Connection aborted
(10053)

Error - 2/29/2012 4:37:57 AM | Computer Name = WINCABLESERVER | Source = sSMTP | ID = 0
Description =

Error - 3/1/2012 4:35:30 AM | Computer Name = WINCABLESERVER | Source = sSMTP | ID = 0
Description =

Error - 3/2/2012 4:36:15 AM | Computer Name = WINCABLESERVER | Source = sSMTP | ID = 0
Description =

Error - 3/2/2012 7:47:57 PM | Computer Name = WINCABLESERVER | Source = WinVNC4 | ID = 1
Description = HTTPServer: error writing HTTP document:write: Connection aborted
(10053)

[ DNS Server Events ]
Error - 7/2/2010 2:52:51 PM | Computer Name = WINCABLESERVER | Source = DNS | ID = 4015
Description = The DNS server has encountered a critical error from the Active Directory.
Check
that the Active Directory is functioning properly. The extended error debug information
(which may be empty) is "". The event data contains the error.

Error - 7/2/2010 2:52:51 PM | Computer Name = WINCABLESERVER | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
of zone .. This DNS server is configured to use information obtained from Active
Directory
for this zone and is unable to load the zone without it. Check that the Active
Directory is functioning properly and repeat enumeration of the zone. The extended
error debug information (which may be empty) is "". The event data contains the
error.

Error - 10/1/2011 1:43:53 PM | Computer Name = WINCABLESERVER | Source = DNS | ID = 4015
Description = The DNS server has encountered a critical error from the Active Directory.
Check
that the Active Directory is functioning properly. The extended error debug information
(which may be empty) is "". The event data contains the error.

Error - 10/1/2011 1:43:53 PM | Computer Name = WINCABLESERVER | Source = DNS | ID = 4004
Description = The DNS server was unable to complete directory service enumeration
of zone .. This DNS server is configured to use information obtained from Active
Directory
for this zone and is unable to load the zone without it. Check that the Active
Directory is functioning properly and repeat enumeration of the zone. The extended
error debug information (which may be empty) is "". The event data contains the
error.

[ System Events ]
Error - 3/1/2012 5:30:21 PM | Computer Name = WINCABLESERVER | Source = Service Control Manager | ID = 7000
Description = The Microsoft Security Center service failed to start due to the following
error: %%3

Error - 3/1/2012 5:30:21 PM | Computer Name = WINCABLESERVER | Source = Service Control Manager | ID = 7000
Description = The Serv-U FTP Server service failed to start due to the following
error: %%3

Error - 3/1/2012 5:30:21 PM | Computer Name = WINCABLESERVER | Source = Service Control Manager | ID = 7023
Description = The systen service terminated with the following error: %%126

Error - 3/2/2012 7:46:42 PM | Computer Name = WINCABLESERVER | Source = EventLog | ID = 6008
Description = The previous system shutdown at 6:43:52 PM on 3/2/2012 was unexpected.

Error - 3/2/2012 7:46:59 PM | Computer Name = WINCABLESERVER | Source = ACPI | ID = 327685
Description = AMLI: ACPI BIOS is attempting to write to an illegal IO port address
(0x70), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 3/2/2012 7:46:59 PM | Computer Name = WINCABLESERVER | Source = ACPI | ID = 327684
Description = AMLI: ACPI BIOS is attempting to read from an illegal IO port address
(0x71), which lies in the 0x70 - 0x71 protected address range. This could lead to
system instability. Please contact your system vendor for technical assistance.

Error - 3/2/2012 7:48:01 PM | Computer Name = WINCABLESERVER | Source = Service Control Manager | ID = 7000
Description = The Microsoft Security Center service failed to start due to the following
error: %%3

Error - 3/2/2012 7:48:01 PM | Computer Name = WINCABLESERVER | Source = Service Control Manager | ID = 7000
Description = The Serv-U FTP Server service failed to start due to the following
error: %%3

Error - 3/2/2012 7:48:01 PM | Computer Name = WINCABLESERVER | Source = Service Control Manager | ID = 7023
Description = The systen service terminated with the following error: %%126

Error - 3/2/2012 7:48:07 PM | Computer Name = WINCABLESERVER | Source = System Error | ID = 1003
Description = Error code 1000008e, parameter1 c0000005, parameter2 8089c5bb, parameter3
b7a96bec, parameter4 00000000.

< End of report >

OTL logfile created on: 3/2/2012 7:01:30 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop
Windows Server 2003 Standard Edition Service Pack 2 (Version = 5.2.3790) - Type = NTDomainController
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 70.18% Memory free
5.05 Gb Paging File | 4.63 Gb Available in Paging File | 91.70% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 9.96 Gb Total Space | 1.94 Gb Free Space | 19.48% Space Free | Partition Type: NTFS
Drive D: | 18.89 Gb Total Space | 9.91 Gb Free Space | 52.48% Space Free | Partition Type: NTFS
Drive X: | 4.99 Gb Total Space | 1.97 Gb Free Space | 39.42% Space Free | Partition Type: NTFS

Computer Name: WINCABLESERVER | User Name: administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\ClamWin\bin\ClamTray.exe (alch)
PRC - C:\WINDOWS\system32\wins.exe (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Server\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Server\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\system32\dns.exe (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Server\sched.exe (Avira GmbH)
PRC - C:\Program Files\GLDS\UpgradeManager\UpgradeManagerSvc.exe (Great Lakes Data Systems, Inc.)
PRC - C:\WINDOWS\system32\llssrv.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\sbscrexe.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\ntfrs.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\ismserv.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\dfssvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\rserver30\FamItrfc.Exe (Famatech International Corp.)
PRC - C:\WINDOWS\system32\rserver30\rserver3.exe (Famatech International Corp.)
PRC - C:\Program Files\RealVNC\VNC4\winvnc4.exe (RealVNC Ltd.)
PRC - C:\Program Files\Symantec\pcAnywhere\awhost32.exe (Symantec Corporation)
PRC - C:\Program Files\Firebird\Firebird_1_5\bin\fb_inet_server.exe (The Firebird Project)
PRC - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe (The Firebird Project)
PRC - C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe (Microsoft Corporation)
PRC - C:\WINDOWS\lsass.exe ()
PRC - C:\WINDOWS\system32\system\ms-java.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Avira\AntiVir Server\sqlite3.dll ()
MOD - C:\Program Files\Firebird\Firebird_1_5\UDF\GLDS_UDFlib.dll ()
MOD - C:\WINDOWS\system32\rserver30\newtstop.dll ()
MOD - C:\Program Files\ClamWin\bin\ExpShell.dll ()
MOD - C:\Program Files\ClamWin\bin\python23.dll ()
MOD - C:\Program Files\ClamWin\lib\shell.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32gui.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32file.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32api.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32security.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32process.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32pipe.pyd ()
MOD - C:\Program Files\ClamWin\lib\win32event.pyd ()
MOD - C:\Program Files\ClamWin\lib\pythoncom23.dll ()
MOD - C:\Program Files\ClamWin\lib\pywintypes23.dll ()
MOD - C:\Program Files\ClamWin\lib\_winreg.pyd ()
MOD - C:\Program Files\ClamWin\lib\datetime.pyd ()
MOD - C:\Program Files\ClamWin\lib\_ssl.pyd ()
MOD - C:\Program Files\ClamWin\lib\_sre.pyd ()
MOD - C:\Program Files\ClamWin\lib\_socket.pyd ()
MOD - C:\Program Files\ClamWin\lib\_bsddb.pyd ()
MOD - C:\Program Files\ClamWin\lib\_ctypes.pyd ()
MOD - C:\Program Files\ClamWin\lib\wxc.pyd ()
MOD - C:\Program Files\ClamWin\lib\wxmsw24h.dll ()
MOD - C:\WINDOWS\system32\bzyhzq.dll ()
MOD - C:\Program Files\ClamWin\lib\mxDateTime.pyd ()
MOD - C:\WINDOWS\lsass.exe ()
MOD - C:\WINDOWS\AdmDll.dll ()
MOD - C:\WINDOWS\system32\system\ms-java.exe ()

========== Win32 Services (SafeList) ==========

SRV - (WinHttpAutoProxySvc) – File not found
SRV - (systen) – File not found
SRV - (Serv-U) – File not found
SRV - (Microsoft Security Center) – File not found
SRV - (HTran) – File not found
SRV - (HidServ) – File not found
SRV - (WINS) Windows Internet Name Service (WINS) – C:\WINDOWS\system32\wins.exe (Microsoft Corporation)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Server\avguard.exe (Avira GmbH)
SRV - (DNS) – C:\WINDOWS\system32\dns.exe (Microsoft Corporation)
SRV - (AntiVirScheduler) – C:\Program Files\Avira\AntiVir Server\sched.exe (Avira GmbH)
SRV - (UpgradeManager) – C:\Program Files\GLDS\UpgradeManager\UpgradeManagerSvc.exe (Great Lakes Data Systems, Inc.)
SRV - (WCAddrServer) – D:\Program Files\GLDS\WCAddrServer\WCAddrServer.exe (Great Lakes Data Systems, Inc.)
SRV - (LicenseService) – C:\WINDOWS\system32\llssrv.exe (Microsoft Corporation)
SRV - (Tssdis) – C:\WINDOWS\system32\tssdis.exe (Microsoft Corporation)
SRV - (SBCore) – C:\WINDOWS\system32\sbscrexe.exe (Microsoft Corporation)
SRV - (RSoPProv) – C:\WINDOWS\system32\rsopprov.exe (Microsoft Corporation)
SRV - (NtFrs) – C:\WINDOWS\system32\ntfrs.exe (Microsoft Corporation)
SRV - (IsmServ) – C:\WINDOWS\system32\ismserv.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (NntpSvc) Network News Transfer Protocol (NNTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (Dfs) – C:\WINDOWS\system32\dfssvc.exe (Microsoft Corporation)
SRV - (RServer3) – C:\WINDOWS\System32\rserver30\RServer3.exe (Famatech International Corp.)
SRV - (WinVNC4) – C:\Program Files\RealVNC\VNC4\winvnc4.exe (RealVNC Ltd.)
SRV - (awhost32) – C:\Program Files\Symantec\pcAnywhere\awhost32.exe (Symantec Corporation)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)
SRV - (FirebirdServerDefaultInstance) – C:\Program Files\Firebird\Firebird_1_5\bin\fb_inet_server.exe (The Firebird Project)
SRV - (FirebirdGuardianDefaultInstance) – C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe (The Firebird Project)
SRV - (Irmon) – C:\WINDOWS\Irmonsrc.dll (Microsoft Corporation)
SRV - (MSPOP3Connector) – C:\Program Files\Microsoft Windows Small Business Server\Networking\POP3\imbservice.exe (Microsoft Corporation)
SRV - (MSSEARCH) – C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe (Microsoft Corporation)
SRV - (kmbvnk) – C:\WINDOWS\system32\bzyhzq.dll ()
SRV - (TrkSvr) – C:\WINDOWS\system32\trksvr.dll (Microsoft Corporation)
SRV - (sacsvr) – C:\WINDOWS\system32\sacsvr.dll (Microsoft Corporation)
SRV - (Ms-java) – C:\WINDOWS\system32\system\ms-java.exe ()

========== Driver Services (SafeList) ==========

DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Server\avgio.sys (Avira GmbH)
DRV - (perc2) – C:\WINDOWS\system32\drivers\perc2.sys (Adaptec, Inc.)
DRV - (perc2cin) – C:\WINDOWS\system32\drivers\perc2cin.dll (Adaptec, Inc.)
DRV - (WLBS) – C:\WINDOWS\system32\drivers\wlbs.sys (Microsoft Corporation)
DRV - (DfsDriver) – C:\WINDOWS\system32\drivers\Dfs.sys (Microsoft Corporation)
DRV - (ClusDisk) – C:\WINDOWS\system32\drivers\clusdisk.sys (Microsoft Corporation)
DRV - (raddrvv3) – C:\WINDOWS\system32\rserver30\raddrvv3.sys (Famatech International Corp.)
DRV - (mirrorv3) – C:\WINDOWS\system32\drivers\rminiv3.sys (Famatech International Corp.)
DRV - (AW_HOST) – C:\WINDOWS\system32\drivers\AW_HOST5.sys (Symantec Corporation)
DRV - (awlegacy) – C:\WINDOWS\System32\Drivers\awlegacy.sys (Symantec Corporation)
DRV - (Gernuwa) – C:\WINDOWS\System32\drivers\GERNUWA.sys (Symantec Corporation)
DRV - (dlttape) – C:\WINDOWS\system32\drivers\dlttape.sys (Microsoft Corporation)
DRV - (ati2mpad) – C:\WINDOWS\system32\drivers\ati2mpad.sys (ATI Technologies Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/20 12:20:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/20 12:20:02 | 000,000,000 | —D | M]

[2008/10/24 09:51:40 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator.WINCABLESERVER\Application Data\Mozilla\Extensions
[2008/10/24 09:51:40 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator.WINCABLESERVER\Application Data\Mozilla\Firefox\Profiles\6wc3qqsw.default\extensions
[2008/10/24 09:51:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/02/10 13:43:05 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

O1 HOSTS File: ([2003/09/10 09:27:12 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Server\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ClamWin] C:\Program Files\ClamWin\bin\ClamTray.exe (alch)
O4 - HKLM..\Run: [KNVV Agent] C:\WINDOWS\system32\28463\KNVV.exe File not found
O4 - HKLM..\Run: [lsass] C:\WINDOWS\lsass.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = telstarcablelimited.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6FA2C94B-F0FB-4AC3-B8A6-8FFA3E101B72}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: (C:\WINDOWS\system32\rserver30\newtstop.dll) -C:\WINDOWS\system32\rserver30\newtstop.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\PCANotify: DllName - (PCANotify.dll) - C:\WINDOWS\System32\PCANotify.dll (Symantec Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (pwdssp.dll) -C:\WINDOWS\System32\pwdssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/28 17:25:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/02 18:46:24 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2012/03/02 15:43:10 | 004,730,880 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\aswMBR.exe
[2012/03/02 15:31:46 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\dds.scr
[2012/02/28 22:47:08 | 000,414,368 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[20 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/03/02 18:57:54 | 000,002,584 | —- | M] () – C:\WINDOWS\System32\licstr.cpa
[2012/03/02 18:57:28 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\MBR.dat
[2012/03/02 18:51:49 | 000,689,980 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/03/02 18:51:49 | 000,152,962 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/03/02 18:47:55 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/03/02 18:47:51 | 000,006,144 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\beep.sys
[2012/03/02 18:47:43 | 000,065,536 | —- | M] () – C:\WINDOWS\NETLOGON.CHG
[2012/03/02 18:46:24 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/03/02 18:46:22 | 094,208,000 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2012/03/02 15:42:49 | 004,730,880 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\aswMBR.exe
[2012/03/02 15:30:54 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\dds.scr
[2012/03/02 03:36:16 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2012/03/02 01:00:33 | 000,013,030 | —- | M] () – C:\PDOXUSRS.NET
[2012/02/28 23:20:01 | 000,002,994 | RHS- | M] () – C:\Documents and Settings\All Users\ntuser.pol
[2012/02/28 22:47:08 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[20 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/03/02 18:57:28 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator.WINCABLESERVER\Desktop\MBR.dat
[2010/05/30 07:37:45 | 000,000,068 | —- | C] () – C:\WINDOWS\Awpr.ini
[2009/06/03 09:27:56 | 000,000,215 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2009/06/03 09:19:26 | 000,000,151 | —- | C] () – C:\Documents and Settings\Administrator.WINCABLESERVER\Local Settings\Application Data\fusioncache.dat
[2008/12/13 11:25:27 | 000,100,352 | —- | C] () – C:\WINDOWS\System32\abc.exe
[2008/11/19 17:15:29 | 000,241,664 | —- | C] () – C:\WINDOWS\lsass.exe
[2008/11/19 17:15:29 | 000,090,112 | —- | C] () – C:\WINDOWS\AdmDll.dll
[2008/10/24 09:51:41 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/10/08 10:51:14 | 000,041,984 | —- | C] () – C:\WINDOWS\System32\az.exe
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 23:57:33 | 000,011,597 | —- | C] () – C:\WINDOWS\System32\dnsperf.ini
[2008/04/19 19:03:07 | 000,003,080 | —- | C] () – C:\WINDOWS\RBuilder.ini
[2008/03/03 12:06:29 | 000,205,718 | —- | C] () – C:\WINDOWS\System32\oncrpc.dll
[2008/03/03 12:06:27 | 000,696,320 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2008/03/03 12:06:27 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2008/03/03 11:02:40 | 000,000,159 | —- | C] () – C:\WINDOWS\wcx_ftp.ini
[2008/03/03 11:00:14 | 000,002,648 | —- | C] () – C:\WINDOWS\wincmd.ini
[2008/02/29 15:09:28 | 000,000,498 | —- | C] () – C:\WINDOWS\System32\glds_udflib.ini
[2008/02/29 14:53:38 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\delete_if_exists.exe
[2008/02/28 18:01:36 | 000,000,000 | —- | C] () – C:\WINDOWS\frontpg.ini
[2008/02/28 18:00:34 | 000,021,792 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2008/02/28 18:00:33 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2008/02/28 18:00:31 | 000,017,579 | —- | C] () – C:\WINDOWS\System32\nntpctrs.ini
[2008/02/28 18:00:15 | 000,050,666 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2008/02/28 18:00:14 | 000,010,793 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2008/02/28 18:00:02 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2008/02/28 17:36:08 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/02/28 17:20:25 | 000,021,160 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/02/28 12:17:12 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/02/28 12:16:33 | 000,095,864 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/02/28 11:59:46 | 000,096,392 | —- | C] () – C:\WINDOWS\System32\bzyhzq.dll
[2008/02/28 11:57:48 | 000,179,577 | —- | C] () – C:\WINDOWS\System32\schema.ini
[2008/02/28 11:56:28 | 000,689,980 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/02/28 11:56:28 | 000,275,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/02/28 11:56:26 | 000,152,962 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/02/28 11:56:26 | 000,029,710 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/02/28 11:56:02 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/02/28 11:56:02 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/02/28 11:55:18 | 000,020,386 | —- | C] () – C:\WINDOWS\System32\ntfrsrep.ini
[2008/02/28 11:55:18 | 000,005,597 | —- | C] () – C:\WINDOWS\System32\ntfrscon.ini
[2008/02/28 11:55:12 | 000,024,819 | —- | C] () – C:\WINDOWS\System32\ntdsctrs.ini
[2008/02/28 11:54:50 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/02/28 11:52:26 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/02/28 11:52:22 | 000,046,907 | —- | C] () – C:\WINDOWS\mib.bin
[2008/02/28 11:50:14 | 000,011,030 | —- | C] () – C:\WINDOWS\System32\ipsecprf.ini
[2008/02/28 11:49:46 | 000,011,817 | —- | C] () – C:\WINDOWS\System32\iasperf.ini
[2008/02/28 11:48:36 | 000,216,006 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/02/28 11:46:52 | 000,005,644 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/02/28 11:46:18 | 000,000,041 | —- | C] () – C:\WINDOWS\System32\mqtgsvc.exe.cfg
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/02/18 00:26:18 | 000,004,725 | —- | C] () – C:\WINDOWS\System32\secupd.dat

========== LOP Check ==========

[2010/02/10 13:34:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator.WINCABLESERVER\Application Data\Windows Desktop Search
[2010/03/20 08:30:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator.WINCABLESERVER\Application Data\Windows Search
[2008/10/23 20:04:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2012/03/02 03:36:16 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\At1.job
[2011/12/13 03:32:56 | 000,032,594 | —- | M] () – C:\WINDOWS\Tasks\SchedLgU.Txt

========== Purity Check ==========

< End of report >

jeffce

Post #9March 3, 2012, 12:59 AM UTC

Hi,

Looks like we have some work to do…

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
———-

elmkd

Post #10March 3, 2012, 2:24 AM UTC

ComboFix alert message: This operating system is not supported! ComboFix is not meant for Servers OK Is there an alternative? Regards, elmkd

jeffce

Post #11March 3, 2012, 1:39 PM UTC

Hi, Let me work up a fix using OTL and I will return as quickly as I can.

jeffce

Post #12March 3, 2012, 7:03 PM UTC

Hi,

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click VirusTotal

copy and paste the following into the upload a file box (one at a time if more than one file is listed)

C:\WINDOWS\System32\abc.exe

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.
———-

elmkd

Post #13March 3, 2012, 9:20 PM UTC

Here are the Virustotal results: SHA256: e7d3b4b2f429bbce7fc780d900a427106d9150fabb35171cb8b03a18bf6a374a SHA1: 93987459882de7e52fcf1784f6dbde1582f938fa MD5: f48bed3ecceaef40ac7303a5474c98f5 File size: 98.0 KB ( 100352 bytes ) File name: abc.exe File type: Win32 EXE Detection ratio: 6 / 43 Analysis date: 2012-03-03 21:14:27 UTC ( 0 minutes ago ) 0 0 Antivirus Result Update AhnLab-V3 - 20120303 AntiVir - 20120302 Antiy-AVL Backdoor/Win32.Hupigon.gen 20120303 Avast - 20120303 AVG Suspicion: unknown virus 20120303 BitDefender - 20120303 ByteHero - 20120302 CAT-QuickHeal - 20120303 ClamAV - 20120303 Commtouch W32/Damaged_File.gen!Eldorado 20120303 Comodo Heur.Corrupt.PE 20120303 DrWeb - 20120303 Emsisoft - 20120303 eSafe - 20120229 eTrust-Vet - 20120302 F-Prot W32/Damaged_File.gen!Eldorado 20120303 F-Secure - 20120303 Fortinet - 20120303 GData - 20120303 Ikarus - 20120303 Jiangmin - 20120301 K7AntiVirus - 20120302 Kaspersky - 20120303 McAfee - 20120301 McAfee-GW-Edition - 20120303 Microsoft - 20120303 NOD32 - 20120303 Norman - 20120302 nProtect - 20120303 Panda - 20120303 PCTools - 20120228 Prevx - 20120303 Rising - 20120302 Sophos - 20120303 SUPERAntiSpyware - 20120302 Symantec - 20120303 TheHacker W32/Behav-Heuristic-CorruptFile-EP 20120303 TrendMicro - 20120303 TrendMicro-HouseCall - 20120303 VBA32 - 20120302 VIPRE - 20120303 ViRobot - 20120303 VirusBuster - 20120303 * Comments * Additional information No comments More comments Leave your comment… ? Rich Text Area Toolbar Bold (Ctrl+

Italic (Ctrl+I) Underline (Ctrl+U) Undo (Ctrl+Z) Redo (Ctrl+Y) StylesStyles ? Remove Formatting Post comment You have not signed in. Only registered users can leave comments, sign in and have a voice! Sign in Join the community An error occurred ssdeep 3072:8JTyQberMC2YqK6EojqIwtRYae8CWTaw7cF8o:AHev45EZtaaNLTpAF8o TrID Win32 Dynamic Link Library (generic) (55.4%) Win16/32 Executable Delphi generic (15.1%) Generic Win/DOS Executable (14.6%) DOS Executable Generic (14.6%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ExifTool MIMEType……………..: application/octet-stream Subsystem…………….: Windows GUI MachineType…………..: Intel 386 or later, and compatibles TimeStamp…………….: 1992:06:19 23:22:17+01:00 FileType……………..: Win32 EXE PEType……………….: PE32 CodeSize……………..: 290816 LinkerVersion…………: 2.25 Warning………………: Error processing PE data dictionary EntryPoint……………: 0xb7197 InitializedDataSize……: 8192 SubsystemVersion………: 4.0 ImageVersion………….: 0.0 OSVersion…………….: 4.0 UninitializedDataSize….: 458752 Portable Executable structural information PE Sections……………….: Name Virtual Address Virtual Size Raw Size Entropy MD5 uTlq 4096 458752 0 0.00 d41d8cd98f00b204e9800998ecf8427e uTlq 462848 290816 287232 7.92 5f2d34ebb6afb2f9c5a0e5725103050c .rsrc 753664 8192 5632 0.00 d41d8cd98f00b204e9800998ecf8427e First seen by VirusTotal 2012-03-03 21:14:27 UTC ( 2 minutes ago ) Last seen by VirusTotal 2012-03-03 21:14:27 UTC ( 2 minutes ago ) File names (max. 25) 1. abc.exe

jeffce

Post #14March 3, 2012, 11:06 PM UTC

Hi elmkd,

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
MOD - C:\WINDOWS\system32\rserver30\newtstop.dll ()
MOD - C:\WINDOWS\system32\bzyhzq.dll ()
SRV - (WinHttpAutoProxySvc) – File not found
SRV - (systen) – File not found
SRV - (Serv-U) – File not found
SRV - (Microsoft Security Center) – File not found
SRV - (HTran) – File not found
SRV - (HidServ) – File not found
SRV - (Irmon) – C:\WINDOWS\Irmonsrc.dll (Microsoft Corporation)
SRV - (kmbvnk) – C:\WINDOWS\system32\bzyhzq.dll ()
O4 - HKLM..\Run: [KNVV Agent] C:\WINDOWS\system32\28463\KNVV.exe File not found
O20 - AppInit_DLLs: (C:\WINDOWS\system32\rserver30\newtstop.dll) -C:\WINDOWS\system32\rserver30\newtstop.dll ()
[2012/03/02 03:36:16 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2008/10/08 10:51:14 | 000,041,984 | —- | C] () – C:\WINDOWS\System32\az.exe
[2008/02/28 11:59:46 | 000,096,392 | —- | C] () – C:\WINDOWS\System32\bzyhzq.dll
[20 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

elmkd

Post #15March 4, 2012, 12:03 AM UTC

Thank you for all you work so far, I just have one question before I carry out your instructions: This computer has a nightly backup which it performs automatically. Does the following line in your script remove this job? [2012/03/02 03:36:16 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\At1.job regards, elmkd

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Computer keeps shutting down [Solved]

✨ Ask AI

Ask AI