What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

FBI Moneypak [Solved]

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have a Dell laptop with Window 7 upgrade from XP. I cannot access the computer at all as this malware covers the entire screen while I'm logged in. It also covers the entire screen while I'm in Safe Mode or Safe Mode with networking. Any help would be greatly appreciated.
Post #2
Hello and welcome to What the Tech.

My name is Michael and I will be helping you with your computer problems.

Be aware that I am currently in training, which means that my replies must first be approved by one of my teachers. This may cause a slight delay in my responses, but keep in mind that this process is only to ensure you are receiving advice of the utmost accuracy.

Please keep the following points in mind:
  • Malware research is often a time consuming process and sometimes multiple tools/methods will have to be employed before an infection is completely dealt with. Please be patient during the process of removal.
  • Read my instructions carefully before carrying them out. Also, consider printing out any instructions in case you lose your Internet connection.
  • If you have any questions, please ask before carrying out a fix. Clearing up any confusion beforehand will save time in the long run. That said, I will try to post instructions as clearly and concisely as possible.
  • Please reply to this thread. Do not start a new topic, and do not request help on other forums during the course of the cleaning process.
  • If you do not reply after three (3) days, your thread will be closed.
IMPORTANT NOTE: Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

I will be back as soon as possible with a response.
Post #4
As you have no access to your current PC you will need to download and save this tool to a flash drive from another PC. Note that you will need to choose between a 32-bit and a 64-bit version; 32-bit for a 32-bit operating system, 64-bit for a 64-bit operating system.

Download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to the disclaimer.

[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there

[*]Press Scan button.

[*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:

services.exe
[*]now press the search button

[*]when the search is complete, search.txt will also be written to your USB

[*]type exit and shut down your PC. Grab the flash drive and plug it back into the working PC.

[*]please copy and paste both logs in your reply. (FRST.txt and Search.txt)

Post #5
I'm having one heck of a time here. I can get as far as the "enter admin password" and the password I use to log into windows isn't working. That is the only current admin password. Would the system have stored something older from a possible deleted user name, or is there a default password? Pam
Post #7 last edited
I did that. I went into the bios and saw that neither system or admin passwords are set so maybe it's possible I've tried too many times making guesses that I may be locked out. Hopefully if I try in a few hours or in the morning enough time will have passed, otherwise I don't know what to do.
Post #8
At what point are you encountering the prompt for an admin password? Is it after pressing F8 and selecting the Repair your computer menu item?
Post #9
I was using a Windows XP Pro disk (that is what the original OS was until I upgraded) to boot into repair because the Windows 7 Home Premium upgrade disk was hanging. After I chose repair and then chose my OS I was asked for a password. I changed the boot options in bios and now got the Windows 7 disk to work but there is no operating system to choose for repair. If I use the "Use recovery tools… option and then "Load Driver" option, I'm prompted for a disk. I just clicked next anyway and was able to follow all of your instructions. Hopefully the information you need was captured. Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 25-07-2012 01 Ran by [removed] at 05-08-2012 16:06:04 Running from E:\ Windows 7 Home Premium (X86) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry (Whitelisted) ============= HKLM\…\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe [176128 2005-10-07] (Alps Electric Co., Ltd.) HKLM\…\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1557800 2009-08-28] (Synaptics Incorporated) HKLM\…\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe -all [741376 2007-05-19] (Hewlett-Packard) HKLM\…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.) HKLM\…\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [49152 2005-12-09] (CyberLink Corp.) HKLM\…\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [141848 2009-09-23] (Intel Corporation) HKLM\…\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [173592 2009-09-23] (Intel Corporation) HKLM\…\Run: [Persistence] C:\Windows\system32\igfxpers.exe [150552 2009-09-23] (Intel Corporation) HKLM\…\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-26] (Microsoft Corporation) HKLM\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated) HKLM\…\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated) HKLM\…\Run: [3ktQnKPKDDuPsCd] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [334848 2012-08-03] () HKU\Awrcs 2\…\Run: [senrmodk70.exe] "C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF\senrmodk70.exe" [x] HKU\Awrcs 2\…\Run: [mQJSNgUoXMb.exe] C:\ProgramData\mQJSNgUoXMb.exe [x] HKU\Awrcs 2\…\Run: [XGRhUqmYuB99Pa] C:\ProgramData\XGRhUqmYuB99Pa.exe [x] HKU\Scherer Electric 3\…\Run: [3ktQnKPKDDuPsCd] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [334848 2012-08-03] () HKU\Scherer Electric 3\…\Policies\system: [DisableTaskMgr] 1 HKU\Scherer Electric 3\…\Policies\system: [DisableRegistryTools] 1 HKU\Scherer Electric 3\…\Policies\Explorer: [NoDesktop] 1 HKU\Scherer Electric 3\…\Winlogon: [Shell] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [334848 2012-08-03] () HKLM\…\Winlogon: [Shell] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [x ] () Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ================================ Services (Whitelisted) ================== 2 AccubidSecurityServer2; "C:\Program Files\Accubid\Accubid Security\SecurityService2.exe" [1082368 2009-05-29] (Accubid Systems) 2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation) 2 hasplms; C:\Windows\system32\hasplms.exe -run [4180576 2010-09-27] (SafeNet Inc.) 2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x] 3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x] ========================== Drivers (Whitelisted) ============= 2 aksfridge; C:\Windows\System32\DRIVERS\aksfridge.sys [356864 2010-09-27] (SafeNet Inc.) 3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [238208 2009-12-17] (Aladdin Knowledge Systems Ltd.) 3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [46336 2009-12-17] (Aladdin Knowledge Systems Ltd.) 3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [16384 2009-12-17] (Aladdin Knowledge Systems Ltd.) 2 hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [588800 2009-12-17] (SafeNet Inc.) 0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation) 3 QSerBus; C:\Windows\System32\DRIVERS\qserbus.sys [48976 2009-12-22] (Quatech, Incorporated) 3 QTSerial; C:\Windows\System32\DRIVERS\qtserial.sys [97488 2009-12-22] (Quatech, Incorporated) ========================== NetSvcs (Whitelisted) =========== ============ One Month Created Files and Folders ============== 2012-08-05 16:05 - 2012-08-05 16:06 - 00000000 ____D C:\FRST 2012-08-03 08:11 - 2012-08-03 08:11 - 00334848 ____A C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe 2012-08-03 06:59 - 2010-02-08 07:51 - 00000957 ____A C:\Users\Public\Desktop\Bidwinner 9.lnk 2012-08-03 06:59 - 2010-02-08 07:51 - 00000950 ____A C:\Users\Public\Desktop\Time & Material Billing 9.lnk 2012-08-03 06:51 - 2012-08-03 06:59 - 00002216 ____A C:\Users\Scherer Electric 3\Desktop\unhide.txt 2012-08-03 06:50 - 2012-08-03 06:49 - 00399264 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\unhide.exe 2012-08-03 04:57 - 2012-08-03 04:56 - 01051552 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\iExplore.exe 2012-08-03 04:29 - 2012-08-03 04:29 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{83874BAE-17F6-4C2F-943A-A0138C4A3934} 2012-08-03 04:28 - 2012-08-03 04:29 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{FBAD8EE5-A7EA-4B36-A405-CC02E49A5F69} 2012-08-02 09:24 - 2012-08-02 09:24 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-02 09:21 - 2012-08-03 07:28 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-08-02 09:21 - 2012-08-02 09:21 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2012-08-02 08:20 - 2012-08-02 08:21 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{87259039-7E21-4094-9E2E-BC27A7662AA2} 2012-08-02 04:57 - 2012-08-02 04:57 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{8D84F2C7-87E7-4A83-AB91-4E5A49535F4D} 2012-08-02 04:44 - 2012-08-02 04:44 - 00000368 ____A C:\Users\All Users\XGRhUqmYuB99Pa 2012-08-02 04:44 - 2012-08-02 04:44 - 00000072 ____A C:\Users\All Users\-XGRhUqmYuB99Par 2012-08-02 04:44 - 2012-08-02 04:44 - 00000072 ____A C:\Users\All Users\-XGRhUqmYuB99Pa 2012-07-12 02:42 - 2012-07-12 02:42 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{E938B115-D3BC-4CBF-85C5-FD113DBFAB51} 2012-07-12 02:29 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-07-12 02:29 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-07-12 02:29 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-07-12 02:29 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-07-12 02:29 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-07-12 02:29 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-07-12 02:29 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-07-12 02:29 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-07-12 02:29 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-07-12 02:29 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-07-12 02:28 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-07-12 02:28 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-07-12 02:28 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-07-12 02:28 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-07-12 02:22 - 2012-06-11 18:40 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-07-11 02:32 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-07-11 02:32 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-07-11 02:32 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-07-11 02:32 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll 2012-07-11 02:32 - 2012-06-01 20:45 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-07-11 02:32 - 2012-06-01 20:45 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-07-11 02:32 - 2012-06-01 20:40 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-07-11 02:32 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-07-11 02:32 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2012-07-11 02:32 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll ============ 3 Months Modified Files ======================== 2012-08-04 14:12 - 2010-02-05 14:35 - 01386807 ____A C:\Windows\WindowsUpdate.log 2012-08-03 08:42 - 2010-02-05 11:56 - 00743162 ____A C:\Windows\System32\PerfStringBackup.INI 2012-08-03 08:11 - 2012-08-03 08:11 - 00334848 ____A C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe 2012-08-03 07:28 - 2012-08-02 09:21 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-08-03 07:13 - 2009-07-13 20:34 - 00013760 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-08-03 07:13 - 2009-07-13 20:34 - 00013760 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-08-03 07:03 - 2010-02-08 05:05 - 00022542 ____A C:\Windows\PFRO.log 2012-08-03 07:03 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-08-03 07:03 - 2009-07-13 20:39 - 00025453 ____A C:\Windows\setupact.log 2012-08-03 06:59 - 2012-08-03 06:51 - 00002216 ____A C:\Users\Scherer Electric 3\Desktop\unhide.txt 2012-08-03 06:49 - 2012-08-03 06:50 - 00399264 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\unhide.exe 2012-08-03 05:10 - 2011-10-18 05:24 - 00000361 ____A C:\rkill.log 2012-08-03 04:56 - 2012-08-03 04:57 - 01051552 ____A (Bleeping Computer, LLC) C:\Users\Scherer Electric 3\Downloads\iExplore.exe 2012-08-02 09:24 - 2012-08-02 09:24 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-02 09:21 - 2012-08-02 09:21 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2012-08-02 09:21 - 2011-07-05 09:15 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2012-08-02 04:44 - 2012-08-02 04:44 - 00000368 ____A C:\Users\All Users\XGRhUqmYuB99Pa 2012-08-02 04:44 - 2012-08-02 04:44 - 00000072 ____A C:\Users\All Users\-XGRhUqmYuB99Par 2012-08-02 04:44 - 2012-08-02 04:44 - 00000072 ____A C:\Users\All Users\-XGRhUqmYuB99Pa 2012-07-12 02:38 - 2009-07-13 20:33 - 00386384 ____A C:\Windows\System32\FNTCACHE.DAT 2012-07-12 02:23 - 2010-02-08 05:24 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-07-12 02:21 - 2009-07-13 18:04 - 00000534 ____A C:\Windows\win.ini 2012-06-11 18:40 - 2012-07-12 02:22 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-06-08 20:41 - 2012-07-11 02:32 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-06-05 21:05 - 2012-07-11 02:32 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-06-05 21:05 - 2012-07-11 02:32 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-06-05 21:03 - 2012-07-11 02:32 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe 2012-06-02 14:19 - 2012-06-21 02:13 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll 2012-06-02 14:19 - 2012-06-21 02:13 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll 2012-06-02 14:12 - 2012-06-21 02:13 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll 2012-06-02 14:12 - 2012-06-21 02:13 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll 2012-06-02 11:19 - 2012-06-21 02:12 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll 2012-06-02 11:12 - 2012-06-21 02:12 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe 2012-06-02 01:07 - 2012-07-12 02:28 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-06-02 00:43 - 2012-07-12 02:28 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-06-02 00:33 - 2012-07-12 02:29 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-06-02 00:26 - 2012-07-12 02:28 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-06-02 00:25 - 2012-07-12 02:29 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-06-02 00:25 - 2012-07-12 02:28 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-06-02 00:23 - 2012-07-12 02:29 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-06-02 00:21 - 2012-07-12 02:29 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-06-02 00:20 - 2012-07-12 02:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-06-02 00:19 - 2012-07-12 02:29 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-06-02 00:19 - 2012-07-12 02:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-06-02 00:17 - 2012-07-12 02:29 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-06-02 00:16 - 2012-07-12 02:29 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-06-02 00:14 - 2012-07-12 02:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-06-01 20:45 - 2012-07-11 02:32 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-06-01 20:45 - 2012-07-11 02:32 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-06-01 20:40 - 2012-07-11 02:32 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-06-01 20:40 - 2012-07-11 02:32 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-06-01 20:39 - 2012-07-11 02:32 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll ========================= Known DLLs (Whitelisted) ============ ========================= Bamital & volsnap Check ============ C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ========================= Memory info ====================== Percentage of memory in use: 35% Total physical RAM: 1014.44 MB Available physical RAM: 654.82 MB Total Pagefile: 1014.44 MB Available Pagefile: 664.17 MB Total Virtual: 2047.88 MB Available Virtual: 1969.95 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:55.82 GB) (Free:21.13 GB) NTFS ==>[System with boot components (obtained from reading drive)] 2 Drive d: (GRMCHPFRER_EN_DVD) (CDROM) (Total:2.33 GB) (Free:0 GB) UDF 3 Drive e: (CRUZER) (Removable) (Total:7.5 GB) (Free:6.12 GB) FAT32 4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 55 GB 4096 KB Disk 1 Online 7691 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 54 MB 31 KB Partition 2 Primary 55 GB 54 MB Partition 3 Primary 10 MB 55 GB ================================================================================ == Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 3 FAT Partition 54 MB Healthy Hidden ================================================================================ == Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 C NTFS Partition 55 GB Healthy ================================================================================ == Disk: 0 Partition 3 Type : 17 (Suspicious Type) Hidden: Yes Active: Yes There is no volume associated with this partition. ================================================================================ == Partitions of Disk 1: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 7691 MB 16 KB ================================================================================ == Disk: 1 Partition 1 Type : 0B Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 E CRUZER FAT32 Removable 7691 MB Healthy ================================================================================ == ========================================================== Last Boot: 2012-07-30 05:17 ======================= End Of Log ========================== Farbar Recovery Scan Tool Version: 25-07-2012 01 Ran by [removed] at 2012-08-05 16:08:50 Running from E:\ ================== Search: "services.exe" =================== C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe [2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 C:\Windows\System32\services.exe [2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 C:\i386\services.exe [2007-06-06 04:57] - [2004-08-04 02:00] - 0108032 ____A (Microsoft Corporation) C6CE6EEC82F187615D1002BB3BB50ED4 === End Of Search ===
Post #10
Good job getting the tool to run. :thumbup:

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

HKLM\…\Run: [3ktQnKPKDDuPsCd] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [334848 2012-08-03] ()
C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe
HKU\Awrcs 2\…\Run: [senrmodk70.exe] "C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF\senrmodk70.exe" [x]
C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF\senrmodk70.exe
HKU\Awrcs 2\…\Run: [mQJSNgUoXMb.exe] C:\ProgramData\mQJSNgUoXMb.exe [x]
C:\ProgramData\mQJSNgUoXMb.exe
HKU\Awrcs 2\…\Run: [XGRhUqmYuB99Pa] C:\ProgramData\XGRhUqmYuB99Pa.exe [x]
C:\ProgramData\XGRhUqmYuB99Pa.exe
HKU\Scherer Electric 3\…\Run: [3ktQnKPKDDuPsCd] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [334848 2012-08-03] ()
C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe
HKU\Scherer Electric 3\…\Policies\system: [DisableTaskMgr] 1
HKU\Scherer Electric 3\…\Policies\system: [DisableRegistryTools] 1
HKU\Scherer Electric 3\…\Policies\Explorer: [NoDesktop] 1
HKU\Scherer Electric 3\…\Winlogon: [Shell] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [334848 2012-08-03] ()
HKLM\…\Winlogon: [Shell] C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe [x ] ()
2012-08-03 08:11 - 2012-08-03 08:11 - 00334848 ____A C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe
2012-08-03 04:29 - 2012-08-03 04:29 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{83874BAE-17F6-4C2F-943A-A0138C4A3934}
2012-08-03 04:28 - 2012-08-03 04:29 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{FBAD8EE5-A7EA-4B36-A405-CC02E49A5F69}
2012-08-02 08:20 - 2012-08-02 08:21 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{87259039-7E21-4094-9E2E-BC27A7662AA2}
2012-08-02 04:57 - 2012-08-02 04:57 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{8D84F2C7-87E7-4A83-AB91-4E5A49535F4D}
2012-08-02 04:44 - 2012-08-02 04:44 - 00000368 ____A C:\Users\All Users\XGRhUqmYuB99Pa
2012-08-02 04:44 - 2012-08-02 04:44 - 00000072 ____A C:\Users\All Users\-XGRhUqmYuB99Par
2012-08-02 04:44 - 2012-08-02 04:44 - 00000072 ____A C:\Users\All Users\-XGRhUqmYuB99Pa
2012-07-12 02:42 - 2012-07-12 02:42 - 00000000 ____D C:\Users\Awrcs 2\AppData\Local\{E938B115-D3BC-4CBF-85C5-FD113DBFAB51}

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
Post #11
Here's the log. Thanks! Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 25-07-2012 01 Ran by [removed] at 2012-08-05 19:29:01 Run:1 Running from E:\ ============================================== HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\3ktQnKPKDDuPsCd Value deleted successfully. C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe moved successfully. HKEY_USERS\Awrcs 2\Software\Microsoft\Windows\CurrentVersion\Run\\senrmodk70.exe Value deleted successfully. C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF\senrmodk70.exe not found. HKEY_USERS\Awrcs 2\Software\Microsoft\Windows\CurrentVersion\Run\\mQJSNgUoXMb.exe Value deleted successfully. C:\ProgramData\mQJSNgUoXMb.exe not found. HKEY_USERS\Awrcs 2\Software\Microsoft\Windows\CurrentVersion\Run\\XGRhUqmYuB99Pa Value deleted successfully. C:\ProgramData\XGRhUqmYuB99Pa.exe not found. HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows\CurrentVersion\Run\\3ktQnKPKDDuPsCd Value deleted successfully. C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe not found. HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableTaskMgr Value deleted successfully. HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableRegistryTools Value deleted successfully. HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoDesktop Value deleted successfully. HKEY_USERS\Scherer Electric 3\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value was restored successfully . C:\Users\Scherer Electric 3\AppData\Roaming\xF9HhFtI.exe not found. C:\Users\Awrcs 2\AppData\Local\{83874BAE-17F6-4C2F-943A-A0138C4A3934} moved successfully. C:\Users\Awrcs 2\AppData\Local\{FBAD8EE5-A7EA-4B36-A405-CC02E49A5F69} moved successfully. C:\Users\Awrcs 2\AppData\Local\{87259039-7E21-4094-9E2E-BC27A7662AA2} moved successfully. C:\Users\Awrcs 2\AppData\Local\{8D84F2C7-87E7-4A83-AB91-4E5A49535F4D} moved successfully. C:\Users\All Users\XGRhUqmYuB99Pa moved successfully. C:\Users\All Users\-XGRhUqmYuB99Par moved successfully. C:\Users\All Users\-XGRhUqmYuB99Pa moved successfully. C:\Users\Awrcs 2\AppData\Local\{E938B115-D3BC-4CBF-85C5-FD113DBFAB51} moved successfully. ==== End of Fixlog ====
Post #12
You should be able to access your PC now. There is still some work to be done, however, so please do the following:

  • OTL

    Download OTL to your desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    %systemroot%\*. /rp /s
    DRIVES
    CREATERESTOREPOINT
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

[*]aswMBR


Please download aswMBR and save it to your desktop.

  • Double click aswMBR.exe to start the tool.
  • When prompted to download virus definitions, please do so.
  • Click Scan. Note: Do NOT attempt any Fix yet.
  • When the scan completes, click Save log, save it to your desktop and post it in your next reply.
  • There should also be another file that is created on your desktop named MBR.dat. Please right-click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

[*]ListParts


Please download ListParts.

  • Run the tool
  • check the "list BCD" box
  • click "Scan" and post the log (Result.txt) it makes.
Post #13
Here are the OTL logs

OTL logfile created on: 8/6/2012 9:10:07 AM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Scherer Electric 3\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.44 Mb Total Physical Memory | 313.05 Mb Available Physical Memory | 30.86% Memory free
1.99 Gb Paging File | 0.96 Gb Available in Paging File | 48.18% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 55.82 Gb Total Space | 20.03 Gb Free Space | 35.88% Space Free | Partition Type: NTFS

Computer Name: SCHERERELECT3 | User Name: Scherer Electric 3 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/06 09:05:24 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Scherer Electric 3\Desktop\OTL.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2010/09/27 17:42:18 | 004,180,576 | —- | M] (SafeNet Inc.) – C:\Windows\System32\hasplms.exe
PRC - [2007/07/06 20:12:00 | 000,212,992 | —- | M] (Hewlett-Packard) – C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
PRC - [2007/04/03 17:58:56 | 000,020,572 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
PRC - [2005/10/22 21:47:00 | 000,069,632 | —- | M] (HP) – C:\Windows\System32\HPZipm12.exe


========== Modules (No Company Name) ==========

MOD - [2010/06/11 08:17:19 | 000,108,320 | —- | M] () – C:\Program Files\Java\jre6\bin\jp2iexp.dll
MOD - [2010/06/11 08:17:19 | 000,008,192 | —- | M] () – C:\Program Files\Java\jre6\bin\jp2native.dll
MOD - [2007/04/03 17:58:58 | 000,053,349 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\zip.dll
MOD - [2007/04/03 17:58:58 | 000,053,342 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\verify.dll
MOD - [2007/04/03 17:58:58 | 000,032,864 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\net.dll
MOD - [2007/04/03 17:58:56 | 000,802,901 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\hotspot\jvm.dll
MOD - [2007/04/03 17:58:56 | 000,094,308 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\java.dll
MOD - [2007/04/03 17:58:56 | 000,028,776 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\hpi.dll
MOD - [2007/04/03 17:58:56 | 000,020,572 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
MOD - [2004/08/20 08:02:52 | 000,102,400 | —- | M] () – C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\PMLJNI.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/08/02 13:21:38 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/03/26 17:03:40 | 000,214,952 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Microsoft Security Client\NisSrv.exe – (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2010/09/27 17:42:18 | 004,180,576 | —- | M] (SafeNet Inc.) [Auto | Running] – C:\Windows\System32\hasplms.exe – (hasplms)
SRV - [2010/05/18 03:01:30 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/05/29 21:13:10 | 001,082,368 | —- | M] (Accubid Systems) [Auto | Stopped] – C:\Program Files\Accubid\Accubid Security\SecurityService2.exe – (AccubidSecurityServer2)
SRV - [2005/10/22 21:47:00 | 000,069,632 | —- | M] (HP) [Auto | Running] – C:\Windows\System32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - [2012/03/20 20:44:12 | 000,074,112 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2010/11/20 06:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/09/27 17:42:24 | 000,356,864 | —- | M] (SafeNet Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\aksfridge.sys – (aksfridge)
DRV - [2009/12/22 13:56:46 | 000,097,488 | —- | M] (Quatech, Incorporated) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\qtserial.sys – (QTSerial)
DRV - [2009/12/22 13:56:46 | 000,048,976 | —- | M] (Quatech, Incorporated) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\qserbus.sys – (QSerBus)
DRV - [2009/12/17 08:10:48 | 000,046,336 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\akshhl.sys – (akshhl)
DRV - [2009/12/17 07:10:54 | 000,238,208 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\akshasp.sys – (akshasp)
DRV - [2009/12/17 07:10:52 | 000,588,800 | —- | M] (SafeNet Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\hardlock.sys – (hardlock)
DRV - [2009/12/17 07:10:50 | 000,016,384 | —- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\aksusb.sys – (aksusb)
DRV - [2009/07/13 18:02:49 | 000,046,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2005/09/28 21:57:18 | 000,113,847 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070531
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/hws/sb/dell-usuk-rel…html?channel=us
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070531
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070531
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/hws/sb/dell-usuk-rel…html?channel=us
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com/hws/sb/dell-usuk-rel…html?channel=us
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3B FF 65 25 9D A6 CA 01 [binary data]
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\..\SearchScopes,DefaultScope = {B5ECE786-A51D-46E5-8337-AEB3BC43AF25}
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\..\SearchScopes\{B5ECE786-A51D-46E5-8337-AEB3BC43AF25}: "URL" = http://www.google.com/search?q={searchTerm…age={startPage}
IE - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2010/02/08 10:46:53 | 000,000,849 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 192.168.1.200 NPI9863BA
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-2239707657-612507658-2920094788-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://accubid.webex.com/client/T27L/webex/ieatgpc1.cab (GpcContainer Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: vzTCPConfig http://www2.verizon.net/help/fios_settings…vzTCPConfig.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EE720880-D405-4E99-8546-99B2823AFA87}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{2cd250c5-12a6-11df-9ebb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2cd250c5-12a6-11df-9ebb-806e6f6e6963}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL msiexec.exe /package \Installs\v91\v91Full.msi
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/08/06 09:05:34 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\Scherer Electric 3\Desktop\OTL.exe
[2012/08/05 22:55:46 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\AppData\Local\Diagnostics
[2012/08/05 20:05:29 | 000,000,000 | —D | C] – C:\FRST
[2012/08/03 12:11:50 | 000,000,000 | —D | C] – C:\Users\Scherer Electric 3\AppData\Roaming\Roaming

========== Files - Modified Within 30 Days ==========

[2012/08/06 09:05:24 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\Scherer Electric 3\Desktop\OTL.exe
[2012/08/06 08:28:05 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/06 08:17:43 | 000,013,760 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/06 08:17:43 | 000,013,760 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/06 08:13:21 | 000,635,046 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/08/06 08:13:21 | 000,111,548 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/08/06 08:08:44 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/08/06 08:08:36 | 797,786,112 | -HS- | M] () – C:\hiberfil.sys
[2012/08/02 13:24:04 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/12 06:38:27 | 000,386,384 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012/08/03 10:59:35 | 000,000,957 | —- | C] () – C:\Users\Public\Desktop\Bidwinner 9.lnk
[2012/08/03 10:59:35 | 000,000,950 | —- | C] () – C:\Users\Public\Desktop\Time & Material Billing 9.lnk
[2012/08/03 10:59:34 | 000,002,069 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/08/03 10:59:34 | 000,002,001 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerDVD.lnk
[2012/08/03 10:59:34 | 000,001,515 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/08/03 10:59:34 | 000,001,352 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/08/03 10:59:34 | 000,001,330 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/08/03 10:59:34 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012/08/03 10:59:34 | 000,001,246 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/08/03 10:59:34 | 000,001,210 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/08/03 10:59:33 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012/08/03 10:59:33 | 000,001,024 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR Registration.lnk
[2012/08/03 10:59:32 | 000,000,977 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat_com.lnk
[2012/08/03 08:43:20 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/08/02 13:24:04 | 000,001,067 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/02 13:21:42 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2011/07/05 13:20:00 | 000,000,036 | —- | C] () – C:\Users\Scherer Electric 3\AppData\Local\housecall.guid.cache

========== LOP Check ==========

[2011/10/18 09:02:49 | 000,000,000 | —D | M] – C:\Users\Awrcs 2\AppData\Roaming\2127D6B1D5E74E34D0E2F055A88FAFDF
[2010/02/08 12:13:04 | 000,000,000 | —D | M] – C:\Users\Awrcs 2\AppData\Roaming\Accubid
[2012/08/03 12:11:50 | 000,000,000 | —D | M] – C:\Users\Scherer Electric 3\AppData\Roaming\Roaming
[2010/02/08 11:40:49 | 000,000,000 | —D | M] – C:\Users\Scherer Electric 3\AppData\Roaming\webex
[2009/07/14 00:53:46 | 000,022,850 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2007/11/07 09:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2011/01/16 16:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX0\procs\explorer.exe
[2011/01/16 16:55:21 | 000,255,488 | —- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX1\procs\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 01:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2005/08/16 02:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX0\h\explorer.exe
[2005/08/16 02:54:58 | 000,001,536 | —- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX1\h\explorer.exe
[2009/08/03 01:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 02:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\System32\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2004/08/04 06:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\i386\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 06:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\i386\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/05/26 19:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX0\userinit.exe
[2009/05/26 19:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX1\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\i386\winlogon.exe
[2009/10/28 02:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 01:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2009/05/26 19:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX0\winlogon.exe
[2009/05/26 19:47:22 | 000,031,232 | —- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F – C:\Users\Scherer Electric 3\AppData\Local\Temp\RarSFX1\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST960813AS ATA Device
Partitions: 2
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 56.00GB
Starting Offset: 57576960
Hidden sectors: 0


< End of report >


OTL Extras logfile created on: 8/6/2012 9:10:07 AM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Scherer Electric 3\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.44 Mb Total Physical Memory | 313.05 Mb Available Physical Memory | 30.86% Memory free
1.99 Gb Paging File | 0.96 Gb Available in Paging File | 48.18% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 55.82 Gb Total Space | 20.03 Gb Free Space | 35.88% Space Free | Partition Type: NTFS

Computer Name: SCHERERELECT3 | User Name: Scherer Electric 3 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03893F04-A202-4C6C-A658-D8637CD1C999}" = lport=139 | protocol=6 | dir=in | app=system |
"{0526DC55-D98E-4BC3-9BB1-5F6314DFB43D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{07BAC53D-253C-42E2-BC2D-788A49690F95}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{15C0AC2D-D7BF-4D34-9F62-6F5FA9B26DF4}" = lport=137 | protocol=17 | dir=in | app=system |
"{1D5C0B2F-DD76-4780-8372-38E5B2108394}" = rport=10243 | protocol=6 | dir=out | app=system |
"{1E766032-8020-4AC4-9725-EF926CB195C4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1FE7EA20-223F-4AD2-A3A2-02D7ED352141}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2227DB2D-1E2C-4CCE-B55D-DC7A380D8505}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{23C27826-A70C-40D2-A7BA-84D2DAC2E4CA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{24E71B5A-7622-41AB-8B23-F06F7EA00AF0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5325903D-5320-4D53-859A-1E28DD78A851}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5445A9C1-5731-4B89-A329-726DCA21E4F2}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{55F231DA-FC93-46BF-A3A5-6A25EDF75E15}" = rport=138 | protocol=17 | dir=out | app=system |
"{56D16B09-AE41-4A63-8437-2B45BB258499}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5924D26F-FE5F-4445-ABAC-A47E5431149A}" = lport=445 | protocol=6 | dir=in | app=system |
"{5FC60577-09EC-4AEB-84F4-C5282FDEA757}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7611D478-FE6B-41DC-8893-A44A896BAB31}" = rport=137 | protocol=17 | dir=out | app=system |
"{973FB2D5-A491-4A2E-AA9D-55843C29805B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{AF4317D9-F5BA-4E89-9C97-3C18D793BC1E}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{AFA1E565-E270-43B8-8E54-3A074CFDB437}" = rport=139 | protocol=6 | dir=out | app=system |
"{B7543F82-5C8C-4EE2-94FE-78B95720E0DB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DA58FF96-51B0-486B-82AE-4D0AE6317B97}" = lport=138 | protocol=17 | dir=in | app=system |
"{E802F678-EA4D-452A-B691-6408AD6A6AEF}" = rport=445 | protocol=6 | dir=out | app=system |
"{FA0601AA-AE31-419B-9F77-39AE96E424B2}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{FF9648FC-6CEC-4E4A-85E7-3435DE0BA0C2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{041C77E4-6E6F-4172-BE7F-3B6F3D687802}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{218EB7BC-B6FF-47E4-B482-386BC18E12A7}" = protocol=6 | dir=out | app=system |
"{298FEBD5-1617-4DAB-A8DD-38A767F8AD7C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2ADE9794-8D78-4178-B86E-152B7155414B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{3109CFA8-C637-41A2-B117-F3A591A4B1DE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5E6BA6CE-76CF-4D62-BB30-FEAA78ED79CE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{654C0B17-43B3-47CF-9841-9DCF9AA6C250}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{701FFCF9-4AA7-4A97-93C2-4A018518CD02}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7D4B961C-DC6E-40F6-B45E-EBE994644238}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{82A63220-8AAA-4E47-8128-73419A00E820}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9DF23F52-D05D-46EA-A26E-2050257C6BD2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A5A013E0-D800-4049-BAD3-9AD14E833F05}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A881DA4F-F0E3-428C-AA1F-56094AED07D1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{AD239B3E-1C15-4F3B-AA3B-318ABF5EC352}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BFEEA94E-18A3-4780-977A-2E5A6454927D}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{CE36B5E9-A780-4ABC-AF87-74F822A44F2C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D0F5A8B6-0F49-40D5-8970-C70887BAEF8D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{F9BAC3DC-838B-4E21-AB23-36765D098673}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{73269882-2374-4D67-A2B7-12CCF1A3C1F8}C:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe |
"TCP Query User{E18FC953-24E9-42FB-B669-6A370E7692CC}C:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe |
"TCP Query User{F2A5F666-7536-4759-B1C3-6355757978AF}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{6B39FC4E-22C1-4D70-9AD5-BCD42080A59C}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{7F39CB8E-5922-4228-985B-B06BBE718704}C:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe |
"UDP Query User{AB6414A1-FCC0-4D55-AFDF-C5118AE78434}C:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\hewlett-packard\toolbox\jre\bin\javaw.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0B023593-E50E-4B7F-868A-68553D8DFAF5}" = hppscan2800
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BEA216B-D17C-47E1-A932-0289D54F35F1}" = hppScanTo
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2F471509-1144-4997-8E22-6F19496723BA}" = hppTLBX2840Help
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4186D834-F970-497B-A41F-30C0C3B9A1D2}" = Ready Connect 5.0
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{57DA304D-27B0-40D1-A796-92CEFF20FA32}" = hppIOFiles
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.7
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6B72304B-8204-4819-ABE4-3837485D1BF8}" = hppFaxDrv
"{70B0459A-6BFB-45B4-AF97-3799B8FE8A10}" = hppTooCool
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AD8CD806-45C6-4A8C-95B5-4C55778FEBEB}" = hppSendFax
"{B13F9676-15B9-4F5D-9FF3-C3CC56BAC641}" = hppCLJ2800
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B8910E04-E0A0-4FC4-9E0A-E8259239F10E}" = hppTLBX2840
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C2F34782-CE15-4524-951D-75204560F75A}" = hppDustDevil
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D8AC1EB5-E8B0-44A0-B113-899407188A2F}" = hppFonts
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B2CBE2-BBA4-4409-B246-EC64BCB33BD3}" = Accubid Security 2.60
"{F423FA4E-D2BC-4FE4-B8F9-1BFC26A5DE9C}" = hppManuals2800
"{FDB4334C-387A-476E-8EFD-5F829E0AA59A}" = Accubid v9.1
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP Color LaserJet 2820/2830/2840" = HP Color LaserJet 2820/2830/2840 3.1
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPOCR" = HP OCR Software 8.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinLiveSuite" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2239707657-612507658-2920094788-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/30/2012 4:39:51 PM | Computer Name = Schererelect3 | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 7/31/2012 12:32:06 AM | Computer Name = Schererelect3 | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 7/31/2012 11:28:11 AM | Computer Name = Schererelect3 | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 8/1/2012 6:46:08 AM | Computer Name = Schererelect3 | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 8/1/2012 11:06:55 AM | Computer Name = Schererelect3 | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 8/2/2012 6:23:24 AM | Computer Name = Schererelect3 | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16447 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: cdc Start
Time: 01cd7095e4585fd5 Termination Time: 1329 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id:

Error - 8/2/2012 6:47:03 AM | Computer Name = Schererelect3 | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 8/2/2012 12:25:11 PM | Computer Name = Schererelect3 | Source = ESENT | ID = 488
Description = wlcomm (1228) C:\Users\Awrcs 2\AppData\Local\Microsoft\Windows Live\Contacts\[removed]\15.4\:
An attempt to create the file "C:\Users\Awrcs 2\AppData\Local\Microsoft\Windows
Live\Contacts\[removed]\15.4\DBStore\contacts.pat" failed with system
error 5 (0x00000005): "Access is denied. ". The create file operation will fail
with error -1032 (0xfffffbf8).

Error - 8/2/2012 12:25:11 PM | Computer Name = Schererelect3 | Source = ESENT | ID = 217
Description = wlcomm (1228) C:\Users\Awrcs 2\AppData\Local\Microsoft\Windows Live\Contacts\[removed]\15.4\:
Error (-1032) during backup of a database (file C:\Users\Awrcs 2\AppData\Local\Microsoft\Windows
Live\Contacts\[removed]\15.4\DBStore\contacts.edb). The database will
be unable to restore.

Error - 8/2/2012 12:25:11 PM | Computer Name = Schererelect3 | Source = ESENT | ID = 215
Description = wlcomm (1228) C:\Users\Awrcs 2\AppData\Local\Microsoft\Windows Live\Contacts\[removed]\15.4\:
The backup has been stopped because it was halted by the client or the connection
with the client failed.

[ Media Center Events ]
Error - 5/26/2010 3:33:00 AM | Computer Name = Schererelect3 | Source = MCUpdate | ID = 0
Description = 3:32:48 AM - Error connecting to the internet. 3:32:50 AM - Unable
to contact server..

Error - 5/26/2010 4:33:34 AM | Computer Name = Schererelect3 | Source = MCUpdate | ID = 0
Description = 4:33:32 AM - Error connecting to the internet. 4:33:32 AM - Unable
to contact server..

Error - 5/26/2010 5:34:07 AM | Computer Name = Schererelect3 | Source = MCUpdate | ID = 0
Description = 5:34:06 AM - Error connecting to the internet. 5:34:06 AM - Unable
to contact server..

Error - 5/26/2010 6:34:42 AM | Computer Name = Schererelect3 | Source = MCUpdate | ID = 0
Description = 6:34:40 AM - Error connecting to the internet. 6:34:40 AM - Unable
to contact server..

Error - 12/20/2010 7:00:58 AM | Computer Name = Schererelect3 | Source = MCUpdate | ID = 0
Description = 6:00:42 AM - Failed to retrieve SportsV2 (Error: The underlying connection
was closed: Could not establish trust relationship for the SSL/TLS secure channel.)


[ System Events ]
Error - 8/5/2012 10:53:52 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:53:52 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:54:13 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:54:43 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:55:13 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:55:44 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:56:14 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:56:44 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/5/2012 10:57:14 PM | Computer Name = Schererelect3 | Source = DCOM | ID = 10009
Description =

Error - 8/6/2012 9:02:29 AM | Computer Name = Schererelect3 | Source = BROWSER | ID = 8032
Description =


< End of report >
Post #14
Here is the Listparts scan results. Answmbr won't run. I'm going to try one more thing and if successful wil post results. If it still doesn't work, I'll let you know. ListParts by Farbar Version: 25-07-2012 Ran by [removed] (administrator) on 06-08-2012 at 09:50:12 Windows 7 (X86) Running From: C:\Users\[removed]\Downloads Language: 0409 ************************************************************ ========================= Memory info ====================== Percentage of memory in use: 82% Total physical RAM: 1014.44 MB Available physical RAM: 176.04 MB Total Pagefile: 2038.44 MB Available Pagefile: 752.53 MB Total Virtual: 2047.88 MB Available Virtual: 1958.72 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:55.82 GB) (Free:19.89 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 55 GB 14 MB Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 54 MB 31 KB Partition 2 Primary 55 GB 54 MB ================================================================================ ====================== Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No There is no volume associated with this partition. ================================================================================ ====================== Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 C NTFS Partition 55 GB Healthy System (partition with boot components) ================================================================================ ====================== Windows Boot Manager ——————– identifier {9dea862c-5cdd-4e70-acc1-f32b344d4795} device partition=C: description Windows Boot Manager locale en-US inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} default {07b26152-12a6-11df-ab8d-e6e714c9e925} resumeobject {07b26151-12a6-11df-ab8d-e6e714c9e925} displayorder {466f5a88-0af2-4f76-9038-095b170dc21c} {07b26152-12a6-11df-ab8d-e6e714c9e925} toolsdisplayorder {b2721d73-1db4-4c62-bf78-c548a880142d} timeout 30 Windows Boot Loader ——————- identifier {07b26152-12a6-11df-ab8d-e6e714c9e925} device partition=C: path \Windows\system32\winload.exe description Windows 7 locale en-US inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7} recoverysequence {07b26153-12a6-11df-ab8d-e6e714c9e925} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {07b26151-12a6-11df-ab8d-e6e714c9e925} nx OptIn Windows Boot Loader ——————- identifier {07b26153-12a6-11df-ab8d-e6e714c9e925} device ramdisk=[C:]\Recovery\07b26153-12a6-11df-ab8d-e6e714c9e925\Winre.wim,{07b26154-12a6-11df-ab8d-e6e714c9e925} path \windows\system32\winload.exe description Windows Recovery Environment inherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7} osdevice ramdisk=[C:]\Recovery\07b26153-12a6-11df-ab8d-e6e714c9e925\Winre.wim,{07b26154-12a6-11df-ab8d-e6e714c9e925} systemroot \windows nx OptIn winpe Yes custom:46000010 Yes Resume from Hibernate ——————— identifier {07b26151-12a6-11df-ab8d-e6e714c9e925} device partition=C: path \Windows\system32\winresume.exe description Windows Resume Application locale en-US inherit {1afa9c49-16ab-4a5c-901b-212802da9460} filedevice partition=C: filepath \hiberfil.sys pae Yes debugoptionenabled No Windows Memory Tester ——————— identifier {b2721d73-1db4-4c62-bf78-c548a880142d} device partition=C: path \boot\memtest.exe description Windows Memory Diagnostic locale en-US inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} badmemoryaccess Yes Windows Legacy OS Loader ———————— identifier {466f5a88-0af2-4f76-9038-095b170dc21c} device partition=C: path \ntldr description Earlier Version of Windows EMS Settings ———— identifier {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9} bootems Yes Debugger Settings —————– identifier {4636856e-540f-4170-a130-a84776f4c654} debugtype Serial debugport 1 baudrate 115200 RAM Defects ———– identifier {5189b25c-5558-4bf2-bca4-289b11bd29e2} Global Settings ————— identifier {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} inherit {4636856e-540f-4170-a130-a84776f4c654} {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9} {5189b25c-5558-4bf2-bca4-289b11bd29e2} Boot Loader Settings ——————– identifier {6efb52bf-1766-41db-a6b3-0ee5eff72bd7} inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} {7ff607e0-4395-11db-b0de-0800200c9a66} Hypervisor Settings ——————- identifier {7ff607e0-4395-11db-b0de-0800200c9a66} hypervisordebugtype Serial hypervisordebugport 1 hypervisorbaudrate 115200 Resume Loader Settings ———————- identifier {1afa9c49-16ab-4a5c-901b-212802da9460} inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e} Device options ————– identifier {07b26154-12a6-11df-ab8d-e6e714c9e925} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\07b26153-12a6-11df-ab8d-e6e714c9e925\boot.sdi ****** End Of Log ******
Post #15 last edited
aswMBR will not run. I get a message asking if I want to allow unknown publisher to make changes to computer. When I click yes, the program will will not run. I have tried running as administrator and choosing the run option at download. I'm a little hesitant to change my User Account Control Settings without your okay, to allow anything to install while this computer is so infected with junk.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI