Spyware / Malware / Virus Removal

HP HDX Premium Series Laptop strange behaviour [Solved]

24 min read

Looking for the outcome? Ask AI

elmkd Topic Starter

Post #1August 23, 2012, 2:34 PM UTC

Please see the attached HJT Log. Would someone please tell me if I am infected. Avira Premium 2012 has found nothing.

SYMPTOMS
============
1. Trackpad Pointer freezes. Not in one specific application. After a minute or two the pointer begins responding again. Sometimes I have to log off to regain control.
Other times I have to shut down completely. (when I pasted the HJT Log into this message the mouse pointer froze. I was able to restore it by Alt+Tab to the desktop)

2. The machine wakes up from Sleep Mode on it's own.

Thank you for your help.
elmkd

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:38:31 AM, on 23/08/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16448)
Boot mode: Normal

Running processes:
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Users\Marcel\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
O4 - HKLM\..\Run: [TSMAgent] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [DVDAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe"
O4 - HKLM\..\Run: [TVAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RIMDeviceManager] C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -RunServer
O4 - HKUS\S-1-5-21-2238092807-3030197615-1941950054-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'QBDataServiceUser17')
O4 - HKUS\S-1-5-21-2238092807-3030197615-1941950054-1003\..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN (User 'QBDataServiceUser17')
O4 - HKUS\S-1-5-21-2238092807-3030197615-1941950054-1004\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'QBDataServiceUser20')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted IP range: http://208.138.22.10
O16 - DPF: {36299202-09EF-4ABF-ADB9-47C599DBE778} (HP Product Detection Control) - https://www.hpwindows7upgrade.arvato.com/no…PProdDetect.cab
O16 - DPF: {46D8BEE7-0B27-4466-ABA2-A5F1E157971C} (Remote200 Control) - http://208.138.22.10:81/RemoteWeb.cab
O16 - DPF: {5FFDFC21-AE40-4C7C-955C-415A1ACE01C8} (CViewerControl Object) - http://208.138.22.10:81/VideoViewer.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: intu-help-qb3 - {C5E479EA-0A65-4B05-8C6C-2FC8CC682EB4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Symantec pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files (x86)\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe,-128 (DpHost) - DigitalPersona, Inc. - C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Fortinet FortiExplorer (FortiExplorerDaemon) - Fortinet Inc. - C:\Program Files (x86)\Fortinet\FortiExplorer\FortiExplorerSvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxdx_device - Unknown owner - C:\Windows\system32\lxdxcoms.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QuickBooksDB17 - iAnywhere Solutions, Inc. - C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe
O23 - Service: QuickBooksDB20 - Intuit, Inc. - C:\PROGRA~2\Intuit\QUICKB~3\QBDBMgrN.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files (x86)\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Audio Service (STacSV) - Unknown owner - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe (file missing)
O23 - Service: TV Background Capture Service (TVBCS) (TVCapSvc) - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
O23 - Service: TV Task Scheduler (TVTS) (TVSched) - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 13783 bytes

CatByte

Post #2August 26, 2012, 4:06 PM UTC

Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
When asked if you want to download Avast's virus definitions please select Yes.
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well

elmkd

Post #3August 27, 2012, 2:00 PM UTC

Thank you for your reply. Here are the Log Files: . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.0 Run by [removed] at 8:41:29 on 2012-08-27 Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.4062.1796 [GMT -5:00] . AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\nvvsvc.exe C:\Windows\system32\Hpservice.exe C:\Windows\system32\vfsFPService.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Fortinet\FortiExplorer\FortiExplorerSvc.exe C:\Windows\system32\lxdxcoms.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe C:\Program Files (x86)\SMINST\BLService.exe C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\taskeng.exe C:\PROGRA~2\Intuit\QUICKB~3\QBDBMgrN.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\TrueCrypt\TrueCrypt.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe C:\Program Files\DigitalPersona\Bin\DPAgent.exe C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\conime.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll uRun: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe uRun: [RIMDeviceManager] C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -RunServer mRun: [TSMAgent] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" mRun: [CLMLServer for HP TouchSmart] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" mRun: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe mRun: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start mRun: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe mRun: [DVDAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" mRun: [TVAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe mRun: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-00105-0001-0005-ABCDEFFEDCBC} IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL DPF: {36299202-09EF-4ABF-ADB9-47C599DBE778} - hxxps://www.hpwindows7upgrade.arvato.com/north_america/Endcustomer/HPProdDetect.cab DPF: {46D8BEE7-0B27-4466-ABA2-A5F1E157971C} - hxxp://208.138.22.10:81/RemoteWeb.cab DPF: {5FFDFC21-AE40-4C7C-955C-415A1ACE01C8} - hxxp://208.138.22.10:81/VideoViewer.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = [removed] [removed] 4.2.2.1 TCP: Interfaces\{92D5B0AE-CC61-4EF8-86EC-B658303E79A1} : DhcpNameServer = [removed] [removed] 4.2.2.1 Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Notify: PCANotify - PCANotify.dll LSA: Notification Packages = scecli DPPWDFLT BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO-X64: Increase performance and video formats for your HTML5 - No File BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File BHO-X64: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB-X64: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll mRun-x64: [TSMAgent] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" mRun-x64: [CLMLServer for HP TouchSmart] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" mRun-x64: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe mRun-x64: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start mRun-x64: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe mRun-x64: [DVDAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" mRun-x64: [TVAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" mRun-x64: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe mRun-x64: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup mRun-x64: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\5bt4shr0.Public\ FF - prefs.js: browser.startup.homepage - www.google.com . ============= SERVICES / DRIVERS =============== . R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys –> C:\Windows\system32\DRIVERS\avkmgr.sys [?] R1 VBoxDrv;VirtualBox Service;C:\Windows\system32\DRIVERS\VBoxDrv.sys –> C:\Windows\system32\DRIVERS\VBoxDrv.sys [?] R1 VBoxUSBMon;VirtualBox USB Monitor Driver;C:\Windows\system32\DRIVERS\VBoxUSBMon.sys –> C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [?] R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/08/27 09:56:28];C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [2009-8-27 146928] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-18 86224] R2 AntiVirService;Avira Realtime Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-10-18 110032] R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys –> C:\Windows\system32\DRIVERS\avgntflt.sys [?] R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 FortiExplorerDaemon;Fortinet FortiExplorer;C:\Program Files (x86)\Fortinet\FortiExplorer\FortiExplorerSvc.exe [2010-6-9 84072] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?] R2 lxdx_device;lxdx_device;C:\Windows\system32\lxdxcoms.exe -service –> C:\Windows\system32\lxdxcoms.exe -service [?] R2 NPF;NetGroup Packet Filter Driver;C:\Windows\system32\drivers\npf.sys –> C:\Windows\system32\drivers\npf.sys [?] R2 QuickBooksDB17;QuickBooksDB17;C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 –> C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB17 [?] R2 Recovery Service for Windows;Recovery Service for Windows;C:\Program Files (x86)\SMINST\BLService.exe [2009-2-11 365952] R2 TVCapSvc;TV Background Capture Service (TVBCS);C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2009-2-9 296320] R2 TVSched;TV Task Scheduler (TVTS);C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2009-2-9 116096] R2 vfsFPService;Validity Fingerprint Service;C:\Windows\System32\vfsFPService.exe [2008-11-18 599344] R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-2-11 227896] R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys –> C:\Windows\system32\DRIVERS\enecir.sys [?] R3 JMCR;JMCR;C:\Windows\system32\DRIVERS\jmcr.sys –> C:\Windows\system32\DRIVERS\jmcr.sys [?] R3 NETw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\NETw5v64.sys –> C:\Windows\system32\DRIVERS\NETw5v64.sys [?] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys –> C:\Windows\system32\drivers\nvhda64v.sys [?] R3 QuickBooksDB20;QuickBooksDB20;C:\PROGRA~2\Intuit\QUICKB~3\QBDBMgrN.exe -hvQuickBooksDB20 –> C:\PROGRA~2\Intuit\QUICKB~3\QBDBMgrN.exe -hvQuickBooksDB20 [?] R3 VBoxNetFlt;VirtualBox Bridged Networking Service;C:\Windows\system32\DRIVERS\VBoxNetFlt.sys –> C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [?] S2 AntiVirMailService;Avira Mail Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-2-6 375760] S2 AntiVirWebService;Avira Web Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe [2011-10-18 465360] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-5-13 250056] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-5 113120] S3 NETw3v64;Intel® PRO/Wireless 3945ABG Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\NETw3v64.sys –> C:\Windows\system32\DRIVERS\NETw3v64.sys [?] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;C:\Windows\system32\DRIVERS\VBoxNetAdp.sys –> C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [?] S3 VBoxUSB;VirtualBox USB;C:\Windows\system32\Drivers\VBoxUSB.sys –> C:\Windows\system32\Drivers\VBoxUSB.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768] S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys –> C:\Windows\system32\DRIVERS\WSDPrint.sys [?] S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x64.sys –> C:\Windows\system32\DRIVERS\yk60x64.sys [?] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2010-3-18 89920] . =============== File Associations =============== . JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . 2012-08-16 17:49:40 ——– d—–w- C:\ProgramData\Research In Motion 2012-08-16 17:49:14 ——– d—–w- C:\Program Files (x86)\Common Files\XCPCSync.OEM 2012-08-16 03:31:22 2769408 —-a-w- C:\Windows\System32\win32k.sys 2012-08-16 00:31:41 788480 —-a-w- C:\Windows\System32\localspl.dll 2012-08-16 00:31:39 623616 —-a-w- C:\Windows\SysWow64\localspl.dll . ==================== Find3M ==================== . 2012-08-15 17:40:13 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-15 17:40:13 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-07-13 02:39:22 772592 —-a-w- C:\Windows\SysWow64\npdeployJava1.dll 2012-07-13 02:39:22 687600 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-06-28 03:28:35 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2012-06-28 03:21:17 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-06-28 03:20:41 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-06-28 03:16:25 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-06-28 03:12:35 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-06-28 00:27:12 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-06-28 00:19:52 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-06-28 00:18:16 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-06-28 00:12:08 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-06-28 00:07:44 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-06-07 01:59:42 1070152 —-a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2012-06-05 16:47:28 1401856 —-a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-05 16:47:27 1248768 —-a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-05 16:22:47 1797120 —-a-w- C:\Windows\System32\msxml6.dll 2012-06-05 16:22:46 1869824 —-a-w- C:\Windows\System32\msxml3.dll 2012-06-04 15:29:59 516480 —-a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 22:15:31 2622464 —-a-w- C:\Windows\System32\wucltux.dll 2012-06-02 22:15:08 99840 —-a-w- C:\Windows\System32\wudriver.dll 2012-06-02 22:12:13 88576 —-a-w- C:\Windows\SysWow64\wudriver.dll 2012-06-02 20:19:42 186752 —-a-w- C:\Windows\System32\wuwebv.dll 2012-06-02 20:19:42 171904 —-a-w- C:\Windows\SysWow64\wuwebv.dll 2012-06-02 20:15:12 36864 —-a-w- C:\Windows\System32\wuapp.exe 2012-06-02 20:12:20 33792 —-a-w- C:\Windows\SysWow64\wuapp.exe 2012-06-02 00:22:56 347136 —-a-w- C:\Windows\System32\schannel.dll 2012-06-02 00:22:10 254464 —-a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 00:05:11 77312 —-a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 00:04:25 278528 —-a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 00:03:42 204288 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2012-05-31 17:25:12 279656 ——w- C:\Windows\System32\MpSigStub.exe . ============= FINISH: 8:42:01.02 =============== aswMBR Log etc. follows: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-27 08:47:11 —————————– 08:47:11.552 OS Version: Windows x64 6.0.6002 Service Pack 2 08:47:11.552 Number of processors: 4 586 0x170A 08:47:11.552 ComputerName: COW-FOOT UserName: Marcel 08:47:15.173 Initialize success 08:48:03.209 AVAST engine defs: 12082700 08:48:14.110 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 08:48:14.113 Disk 0 Vendor: ST9250421AS HP15 Size: 238475MB BusType: 3 08:48:14.115 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 08:48:14.118 Disk 1 Vendor: ST9250421AS HP15 Size: 238475MB BusType: 3 08:48:14.292 Disk 2 \Device\Harddisk2\DR2 -> \Device\Scsi\JMCR1Port5Path0Target0Lun0 08:48:14.296 Disk 2 Vendor: JMCR Size: 7580MB BusType: 0 08:48:14.368 Disk 0 MBR read successfully 08:48:14.372 Disk 0 MBR scan 08:48:14.378 Disk 0 unknown MBR code 08:48:14.387 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 227462 MB offset 2048 08:48:14.431 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 11009 MB offset 465844224 08:48:14.442 Disk 0 scanning C:\Windows\system32\drivers 08:48:25.793 Service scanning 08:48:45.494 Modules scanning 08:48:45.507 Disk 0 trace - called modules: 08:48:45.591 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys acpi.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 08:48:45.596 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80065b2660] 08:48:45.601 3 CLASSPNP.SYS[fffffa6000a26c33] -> nt!IofCallDriver -> [0xfffffa80065b2040] 08:48:45.607 5 hpdskflt.sys[fffffa6001a02189] -> nt!IofCallDriver -> [0xfffffa8004cab520] 08:48:45.613 7 acpi.sys[fffffa60008c1fde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004c95940] 08:48:51.187 AVAST engine scan C:\Windows 08:48:57.318 AVAST engine scan C:\Windows\system32 08:52:28.954 AVAST engine scan C:\Windows\system32\drivers 08:52:44.491 AVAST engine scan C:\Users\Marcel 08:55:01.627 AVAST engine scan C:\ProgramData 08:58:13.083 Scan finished successfully 08:58:31.125 Disk 0 MBR has been saved successfully to "C:\Users\Marcel\Desktop\MBR.dat" 08:58:31.130 The log file has been saved successfully to "C:\Users\Marcel\Desktop\aswMBR.txt"

Attachments:

[attachment removed: attach.zip]
📎MBR.zip

CatByte

Post #4August 27, 2012, 4:18 PM UTC

Please run the following

Refer to the ComboFix User's Guide

Download ComboFix from the following location:

Link

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

———————————————————————————————
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

elmkd

Post #5August 27, 2012, 6:44 PM UTC

Here is the ComboFix Log: ComboFix 12-08-25.04 - Marcel 27/08/2012 13:24:09.1.4 - x64 Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.1.1033.18.4062.1160 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\SysWow64\URTTemp c:\windows\SysWow64\URTTemp\regtlib.exe . . ((((((((((((((((((((((((( Files Created from 2012-07-27 to 2012-08-27 ))))))))))))))))))))))))))))))) . . 2012-08-27 18:31 . 2012-08-27 18:31 ——– d—–w- c:\users\QBDataServiceUser20\AppData\Local\temp 2012-08-27 18:31 . 2012-08-27 18:31 ——– d—–w- c:\users\QBDataServiceUser17\AppData\Local\temp 2012-08-27 18:31 . 2012-08-27 18:31 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-08-27 18:31 . 2012-08-27 18:31 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-27 18:31 . 2012-08-27 18:31 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2012-08-16 17:49 . 2012-08-16 17:49 ——– d—–w- c:\programdata\Research In Motion 2012-08-16 17:49 . 2012-08-16 17:49 ——– d—–w- c:\program files (x86)\Common Files\XCPCSync.OEM 2012-08-16 03:32 . 2012-06-28 04:10 17809920 —-a-w- c:\windows\system32\mshtml.dll 2012-08-16 03:32 . 2012-06-28 03:39 10925568 —-a-w- c:\windows\system32\ieframe.dll 2012-08-16 03:31 . 2012-07-04 14:33 2769408 —-a-w- c:\windows\system32\win32k.sys 2012-08-16 00:31 . 2012-05-11 16:34 788480 —-a-w- c:\windows\system32\localspl.dll 2012-08-16 00:31 . 2012-05-11 15:57 623616 —-a-w- c:\windows\SysWow64\localspl.dll 2012-08-16 00:31 . 2012-06-29 16:20 648192 —-a-w- c:\windows\system32\netapi32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-16 03:27 . 2006-11-02 12:35 62134624 —-a-w- c:\windows\system32\mrt.exe 2012-08-15 17:40 . 2012-05-13 15:16 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-08-15 17:40 . 2011-05-18 13:08 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-13 02:39 . 2012-07-12 21:11 772592 —-a-w- c:\windows\SysWow64\npdeployJava1.dll 2012-07-13 02:39 . 2010-06-04 01:52 687600 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-06-08 17:59 . 2012-07-11 10:53 12899840 —-a-w- c:\windows\system32\shell32.dll 2012-06-07 01:59 . 2012-06-07 01:59 1070152 —-a-w- c:\windows\SysWow64\MSCOMCTL.OCX 2012-06-05 16:47 . 2012-07-11 10:53 1401856 —-a-w- c:\windows\SysWow64\msxml6.dll 2012-06-05 16:47 . 2012-07-11 10:53 1248768 —-a-w- c:\windows\SysWow64\msxml3.dll 2012-06-05 16:22 . 2012-07-11 10:53 1797120 —-a-w- c:\windows\system32\msxml6.dll 2012-06-05 16:22 . 2012-07-11 10:53 1869824 —-a-w- c:\windows\system32\msxml3.dll 2012-06-04 15:29 . 2012-07-11 10:53 516480 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-06-02 22:19 . 2012-06-19 11:01 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-19 11:02 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-19 11:02 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-19 11:02 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-19 11:01 35864 —-a-w- c:\windows\SysWow64\wups.dll 2012-06-02 22:19 . 2012-06-19 11:01 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:19 . 2012-06-19 11:01 577048 —-a-w- c:\windows\SysWow64\wuapi.dll 2012-06-02 22:15 . 2012-06-19 11:02 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-19 11:01 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 22:12 . 2012-06-19 11:01 88576 —-a-w- c:\windows\SysWow64\wudriver.dll 2012-06-02 20:19 . 2012-06-19 11:01 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 20:19 . 2012-06-19 11:01 171904 —-a-w- c:\windows\SysWow64\wuwebv.dll 2012-06-02 20:15 . 2012-06-19 11:01 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-02 20:12 . 2012-06-19 11:01 33792 —-a-w- c:\windows\SysWow64\wuapp.exe 2012-06-02 00:22 . 2012-07-11 10:53 347136 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 00:22 . 2012-07-11 10:53 254464 —-a-w- c:\windows\system32\ncrypt.dll 2012-06-02 00:05 . 2012-07-11 10:53 77312 —-a-w- c:\windows\SysWow64\secur32.dll 2012-06-02 00:04 . 2012-07-11 10:53 278528 —-a-w- c:\windows\SysWow64\schannel.dll 2012-06-02 00:03 . 2012-07-11 10:53 204288 —-a-w- c:\windows\SysWow64\ncrypt.dll 2012-05-31 17:25 . 2009-10-10 01:48 279656 ——w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TrueCrypt"="c:\program files\TrueCrypt\TrueCrypt.exe" [2010-12-14 1496528] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] "RIMDeviceManager"="c:\program files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" [2012-03-27 2066256] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-12-25 1316136] "CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-12-25 189736] "DpAgent"="c:\program files (x86)\DigitalPersona\Bin\dpagent.exe" [2008-12-11 842816] "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640] "HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008] "DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2009-03-11 1148200] "TVAgent"="c:\program files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-02-09 206120] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-10-19 1439496] "WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] 2007-04-27 17:10 18744 —-a-w- c:\windows\System32\PCANotify.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli DPPWDFLT . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 250056] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . Contents of the 'Scheduled Tasks' folder . 2012-08-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-13 17:40] . 2012-08-25 c:\windows\Tasks\HPCeeScheduleForMarcel.job - c:\program files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2009-02-11 19:34] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-04 442368] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] 4.2.2.1 DPF: {36299202-09EF-4ABF-ADB9-47C599DBE778} - hxxps://www.hpwindows7upgrade.arvato.com/north_america/Endcustomer/HPProdDetect.cab DPF: {46D8BEE7-0B27-4466-ABA2-A5F1E157971C} - hxxp://208.138.22.10:81/RemoteWeb.cab DPF: {5FFDFC21-AE40-4C7C-955C-415A1ACE01C8} - hxxp://208.138.22.10:81/VideoViewer.cab CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\5bt4shr0.Public\ FF - prefs.js: browser.startup.homepage - www.google.com . - - - - ORPHANS REMOVED - - - - . HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe AddRemove-LX Console 65.183.11.109 - c:\windows\system32\javaws.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}] "ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}] @Denied: (A) (Everyone) "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0] "Key"="ActionsPane" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe c:\program files (x86)\DigitalPersona\Bin\DpHostW.exe c:\program files (x86)\Avira\AntiVir Desktop\sched.exe c:\program files (x86)\Fortinet\FortiExplorer\FortiExplorerSvc.exe c:\program files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\progra~2\Intuit\QUICKB~1\QBDBMgrN.exe c:\program files (x86)\SMINST\BLService.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe c:\progra~2\Intuit\QUICKB~3\QBDBMgrN.exe c:\program files (x86)\Windows Media Player\wmplayer.exe . ************************************************************************** . Completion time: 2012-08-27 13:41:12 - machine was rebooted ComboFix-quarantined-files.txt 2012-08-27 18:41 . Pre-Run: 96,715,800,576 bytes free Post-Run: 97,947,172,864 bytes free . - - End Of File - - BB7574B799C1E78B699372F567EC9A49

CatByte

Post #6August 27, 2012, 8:00 PM UTC

Please do the following:

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

NEXT

Download AdwCleaner from here and save it to your desktop.

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

elmkd

Post #7August 27, 2012, 9:27 PM UTC

Once again thank you for your help with this. The Malwarebytes Log is below. ESET is taking a very long time. I will post the results tomorrow. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.27.05 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 Marcel :: COW-FOOT [administrator] 27/08/2012 03:06:47 PM mbam-log-2012-08-27 (15-06-47).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 248887 Time elapsed: 3 minute(s), 48 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

CatByte

Post #8August 27, 2012, 9:49 PM UTC

elmkd

Post #9August 28, 2012, 3:30 PM UTC

Hello: Thanks again for your help. No ESET Log was generated, as No Threats were Found. Here is the Log from the other cleaner: # AdwCleaner v1.801 - Logfile created 08/28/2012 at 10:23:40 # Updated 14/08/2012 by Xplode # Operating system : Windows ™ Vista Ultimate Service Pack 2 (64 bits) # User : Marcel - COW-FOOT # Boot Mode : Normal # Running from : C:\Users\Marcel\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Users\Marcel\AppData\LocalLow\boost_interprocess ***** [Registry] ***** Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6} ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119} ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v14.0.1 (en-US) Profile name : Normal File : C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\5bt4shr0.Public\prefs.js [OK] File is clean. Profile name : System Update [Profil par défaut] File : J:\Firefox_Profile\prefs.js [OK] File is clean. ************************* AdwCleaner[S1].txt - [1618 octets] - [28/08/2012 10:23:40] ########## EOF - C:\AdwCleaner[S1].txt - [1746 octets] ##########

CatByte

Post #10August 28, 2012, 7:11 PM UTC

how is the computer behaving now?

are there any outstanding issues?

Please download Farbar Service Scanner and run it on the computer.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

NEXT

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Installed Programs
List Devices
List Users, Partitions and Memory size.
List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

elmkd

Post #11August 29, 2012, 1:58 PM UTC

Hello: Unfortunately, there was an incidence of my mouse freezing in place yesterday. Also, my laptop went into hibernation in the middle of a skype call. I think the hibernation was a thermal issue (the laptop may have overheated) and since the various scans aren't finding any threats, perhaps my trackpad is defective (although I can't understand why using ALT+Tab sometimes unfreezes the mouse pointer). Once again, I really appreciate your help and patience with this. Here are the Logs of the two scans: Farbar Service Scanner Version: 06-08-2012 Ran by [removed] (administrator) on 29-08-2012 at 08:49:32 Running from "C:\Users\Marcel\Desktop" Microsoft® Windows Vista™ Ultimate Service Pack 2 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcsvc.dll [2010-03-18 06:45] - [2009-04-11 02:11] - 0268288 ____A (Microsoft Corporation) 3ED0321127CE70ACDAABBF77E157C2A7 C:\Windows\System32\drivers\afd.sys [2012-02-15 23:08] - [2012-01-03 09:25] - 0404992 ____A (Microsoft Corporation) C4F6CE6087760AD70960C9EB130E7943 C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys [2012-05-09 22:24] - [2012-03-30 07:45] - 1423744 ____A (Microsoft Corporation) 46D448E9117464E4D3BBF36D7E3FA48E C:\Windows\System32\dnsrslvr.dll [2011-04-13 20:05] - [2011-03-02 11:12] - 0117760 ____A (Microsoft Corporation) 06230F1B721494A6DF8D47FD395BB1B0 C:\Windows\System32\mpssvc.dll [2010-03-18 06:46] - [2009-04-11 02:11] - 0603136 ____A (Microsoft Corporation) 897E3BAF68BA406A61682AE39C83900C C:\Windows\System32\bfe.dll [2010-03-18 06:45] - [2009-04-11 02:11] - 0458240 ____A (Microsoft Corporation) FFB96C2589FFA60473EAD78B39FBDE29 C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe [2010-03-18 06:46] - [2009-04-11 02:11] - 1433600 ____A (Microsoft Corporation) B75232DAD33BFD95BF6F0A3E6BFF51E1 C:\Windows\System32\wscsvc.dll [2010-03-18 06:45] - [2009-04-11 02:11] - 0074752 ____A (Microsoft Corporation) 9EA3E6D0EF7A5C2B9181961052A4B01A C:\Windows\System32\wbem\WMIsvc.dll [2010-03-18 06:45] - [2009-04-11 02:11] - 0221696 ____A (Microsoft Corporation) D2E7296ED1BD26D8DB2799770C077A02 C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll [2010-03-18 06:46] - [2009-04-11 02:11] - 1081856 ____A (Microsoft Corporation) 6D316F4859634071CC25C4FD4589AD2C C:\Windows\System32\es.dll [2010-03-18 06:46] - [2009-04-11 02:11] - 0361984 ____A (Microsoft Corporation) E12F22B73F153DECE721CD45EC05B4AF C:\Windows\System32\cryptsvc.dll [2012-06-13 12:30] - [2012-04-23 11:25] - 0174592 ____A (Microsoft Corporation) 62740B9D2A137E8CED41A9E4239A7A31 C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll [2010-03-18 06:46] - [2009-04-11 02:11] - 0719872 ____A (Microsoft Corporation) CF8B9A3A5E7DC57724A89D0C3E8CF9EF **** End of log **** MiniToolBox by Farbar Version: 23-07-2012 Ran by [removed] (administrator) on 29-08-2012 at 08:52:08 Microsoft® Windows Vista™ Ultimate Service Pack 2 (X64) Boot Mode: Normal *************************************************************************** ========================= Flush DNS: =================================== Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========================= IE Proxy Settings: ============================== Proxy is not enabled. No Proxy Server is set. "Reset IE Proxy Settings": IE Proxy Settings were reset. ========================= FF Proxy Settings: ============================== "Reset FF Proxy Settings": Firefox Proxy settings were reset. ========================= Hosts content: ================================= 127.0.0.1 localhost ========================= IP Configuration: ================================ VirtualBox Host-Only Ethernet Adapter = VirtualBox Host-Only Network (Disconnected) Intel® WiFi Link 5100 AGN = Wireless Network Connection (Connected) Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected) # ———————————- # IPv4 Configuration # ———————————- pushd interface ipv4 reset set global popd # End of IPv4 configuration Windows IP Configuration Host Name . . . . . . . . . . . . : Cow-Foot Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : PowerLink.com Wireless LAN adapter Wireless Network Connection: Connection-specific DNS Suffix . : PowerLink.com Description . . . . . . . . . . . : Intel® WiFi Link 5100 AGN Physical Address. . . . . . . . . : 00-22-FA-E5-17-72 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::dc0d:1e4e:2cc:fdd2%11(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.1.101(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Wednesday, August 29, 2012 08:45:48 AM Lease Expires . . . . . . . . . . : Thursday, August 30, 2012 08:45:48 AM Default Gateway . . . . . . . . . : 192.168.1.1 DHCP Server . . . . . . . . . . . : 192.168.1.1 DHCPv6 IAID . . . . . . . . . . . : 268444410 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-D2-59-E6-00-23-8B-E6-C4-48 DNS Servers . . . . . . . . . . . : [removed] 65.183.0.78 4.2.2.1 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : 00-23-8B-E6-C4-48 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 14: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.cm.flowja.com Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 7: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 11: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 02-00-54-55-4E-01 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:d:37f2:3f57:fe9a(Preferred) Link-local IPv6 Address . . . . . : fe80:

:37f2:3f57:fe9a%12(Preferred) Default Gateway . . . . . . . . . : :: NetBIOS over Tcpip. . . . . . . . : Disabled Tunnel adapter Local Area Connection* 12: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 6: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.PowerLink.com Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 13: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.{A8AFD7C2-2EBB-4236-8194-94F1D5FF25F7} Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 15: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.{3EF62683-55D3-4AFF-80F1-B429F541EC79} Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 17: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.cm.flowja.com Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 16: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : isatap.PowerLink.com Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 18: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : PowerLink.com Description . . . . . . . . . . . : Microsoft ISATAP Adapter #9 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Tunnel adapter Local Area Connection* 21: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft ISATAP Adapter #10 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Server: ns2.flowja.com Address: [removed] Name: google.com Addresses: 2001:4860:4006:802::1005 [removed] [removed] [removed] [removed] 74.125.229.101 74.125.229.102 74.125.229.103 74.125.229.104 74.125.229.105 74.125.229.110 74.125.229.96 Pinging google.com [74.125.229.96] with 32 bytes of data: Reply from 74.125.229.96: bytes=32 time=27ms TTL=54 Reply from 74.125.229.96: bytes=32 time=26ms TTL=54 Ping statistics for 74.125.229.96: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 26ms, Maximum = 27ms, Average = 26ms Server: ns2.flowja.com Address: 65.183.0.84 Name: yahoo.com Addresses: 98.139.183.24 72.30.38.140 98.138.253.109 Pinging yahoo.com [98.138.253.109] with 32 bytes of data: Reply from 98.138.253.109: bytes=32 time=93ms TTL=48 Reply from 98.138.253.109: bytes=32 time=83ms TTL=48 Ping statistics for 98.138.253.109: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 83ms, Maximum = 93ms, Average = 88ms Server: ns2.flowjamaica.com Address: 65.183.0.84 Name: bleepingcomputer.com Address: 208.43.87.2 Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data: Reply from 208.43.87.2: Destination host unreachable. Reply from 208.43.87.2: Destination host unreachable. Ping statistics for 208.43.87.2: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Pinging 127.0.0.1 with 32 bytes of data: Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 Ping statistics for 127.0.0.1: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms =========================================================================== Interface List 11 …00 22 fa e5 17 72 …… Intel® WiFi Link 5100 AGN 10 …00 23 8b e6 c4 48 …… Realtek PCIe GBE Family Controller 1 ……………………… Software Loopback Interface 1 15 …00 00 00 00 00 00 00 e0 isatap.cm.flowja.com 13 …00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 12 …02 00 54 55 4e 01 …… Teredo Tunneling Pseudo-Interface 14 …00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3 16 …00 00 00 00 00 00 00 e0 isatap.PowerLink.com 17 …00 00 00 00 00 00 00 e0 isatap.{A8AFD7C2-2EBB-4236-8194-94F1D5FF25F7} 22 …00 00 00 00 00 00 00 e0 isatap.{3EF62683-55D3-4AFF-80F1-B429F541EC79} 18 …00 00 00 00 00 00 00 e0 isatap.cm.flowja.com 23 …00 00 00 00 00 00 00 e0 isatap.PowerLink.com 25 …00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #9 24 …00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #10 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.101 25 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.1.0 255.255.255.0 On-link 192.168.1.101 281 192.168.1.101 255.255.255.255 On-link 192.168.1.101 281 192.168.1.255 255.255.255.255 On-link 192.168.1.101 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.1.101 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.1.101 281 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 12 18 ::/0 On-link 1 306 ::1/128 On-link 12 18 2001::/32 On-link 12 266 2001:0:4137:9e76:d:37f2:3f57:fe9a/128 On-link 11 281 fe80::/64 On-link 12 266 fe80::/64 On-link 12 266 fe80:

:37f2:3f57:fe9a/128 On-link 11 281 fe80::dc0d:1e4e:2cc:fdd2/128 On-link 1 306 ff00::/8 On-link 12 266 ff00::/8 On-link 11 281 ff00::/8 On-link =========================================================================== Persistent Routes: None ========================= Winsock entries ===================================== Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [48128] (Microsoft Corporation) Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [50176] (Microsoft Corporation) Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [62464] (Microsoft Corporation) Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [62464] (Microsoft Corporation) Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [19968] (Microsoft Corporation) Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation) x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [61440] (Microsoft Corporation) x64-Catalog5 02 C:\Windows\System32\napinsp.dll [62976] (Microsoft Corporation) x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [78848] (Microsoft Corporation) x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [78848] (Microsoft Corporation) x64-Catalog5 05 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog5 06 C:\Windows\System32\winrnr.dll [27648] (Microsoft Corporation) x64-Catalog9 01 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 02 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 03 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 04 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 05 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 06 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 07 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 08 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 09 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) x64-Catalog9 10 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation) ========================= Event log errors: =============================== Application errors: ================== Error: (08/28/2012 10:34:28 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/28/2012 10:26:08 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/28/2012 10:17:10 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/27/2012 03:00:14 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/27/2012 01:34:00 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/27/2012 05:02:36 AM) (Source: Application Error) (User: ) Description: Faulting application DivX Plus Player.exe, version 10.3.3.10, time stamp 0x4fc81d6c, faulting module QtCore4.dll, version 4.5.0.0, time stamp 0x49a6280b, exception code 0xc0000005, fault offset 0x000e1b16, process id 0xe84, application start time 0xDivX Plus Player.exe0. Error: (08/27/2012 05:00:25 AM) (Source: Application Error) (User: ) Description: Faulting application DivX Plus Player.exe, version 10.3.3.10, time stamp 0x4fc81d6c, faulting module QtCore4.dll, version 4.5.0.0, time stamp 0x49a6280b, exception code 0xc0000005, fault offset 0x000e1b16, process id 0x10dc, application start time 0xDivX Plus Player.exe0. Error: (08/27/2012 04:54:39 AM) (Source: Application Error) (User: ) Description: Faulting application DivX Plus Player.exe, version 10.3.3.10, time stamp 0x4fc81d6c, faulting module QtCore4.dll, version 4.5.0.0, time stamp 0x49a6280b, exception code 0xc0000005, fault offset 0x000e1b16, process id 0x17dc, application start time 0xDivX Plus Player.exe0. Error: (08/26/2012 08:45:37 PM) (Source: Application Hang) (User: ) Description: The program firefox.exe version 14.0.1.4577 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 17ac Start Time: 01cd83da143020a0 Termination Time: 9 Error: (08/26/2012 05:54:38 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (08/28/2012 09:06:55 PM) (Source: Dhcp) (User: ) Description: The IP address lease 192.168.1.101 for the Network Card with network address 0022FAE51772 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error: (08/28/2012 10:35:12 AM) (Source: DCOM) (User: NT AUTHORITY) Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (08/28/2012 10:34:53 AM) (Source: Ntfs) (User: ) Description: The default transaction resource manager on volume J: encountered a non-retryable error and could not start. The data contains the error code. Error: (08/28/2012 10:34:28 AM) (Source: Service Control Manager) (User: ) Description: Beep Error: (08/28/2012 10:34:28 AM) (Source: Service Control Manager) (User: ) Description: Avira Mail Protection1 (0x1) Error: (08/28/2012 10:26:52 AM) (Source: DCOM) (User: NT AUTHORITY) Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (08/28/2012 10:26:34 AM) (Source: Ntfs) (User: ) Description: The default transaction resource manager on volume J: encountered a non-retryable error and could not start. The data contains the error code. Error: (08/28/2012 10:26:09 AM) (Source: Service Control Manager) (User: ) Description: Beep Error: (08/28/2012 10:26:09 AM) (Source: Service Control Manager) (User: ) Description: Avira Mail Protection1 (0x1) Error: (08/28/2012 10:20:02 AM) (Source: Ntfs) (User: ) Description: The default transaction resource manager on volume J: encountered a non-retryable error and could not start. The data contains the error code. Microsoft Office Sessions: ========================= =========================== Installed Programs ============================ CCleaner (Version: 3.22) DigitalPersona Personal 4.0 (Version: 4.00.3733) GNS3 VirtualBox Edition HP MediaSmart SmartMenu (Version: 2.1.7) Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) MySQL Connector/ODBC 5.1 (Version: 5.1.8) NVIDIA Drivers (Version: 1.10) Oracle VM VirtualBox 4.1.14 (Version: 4.1.14) ProtectSmart Hard Drive Protection (Version: 3.10.1.7) PVSonyDll (Version: 1.00.0001) PyQt GPL v4.8.3 for Python v2.6 (x64) (Version: 4.8.3-1) Python 2.6 pywin32-216 Python 2.6.6 (64-bit) (Version: 2.6.6150) Synaptics Pointing Device Driver (Version: 15.0.17.4) Validity Sensors software (Version: 2.8.109) WinDirStat 1.1.2 Windows Driver Package - ENE (enecir) HIDClass (09/04/2008 2.6.0.0) (Version: 09/04/2008 2.6.0.0) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Language Selector (Version: 15.4.3538.0513) WinRAR archiver ========================= Devices: ================================ Name: VirtualBox Host-Only Ethernet Adapter Description: VirtualBox Host-Only Ethernet Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Oracle Corporation Service: VBoxNetAdp Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ========================= Memory info: =================================== Percentage of memory in use: 52% Total physical RAM: 4062.25 MB Available physical RAM: 1945.96 MB Total Pagefile: 8331.78 MB Available Pagefile: 5698.98 MB Total Virtual: 4095.88 MB Available Virtual: 3995.9 MB ========================= Partitions: ===================================== 1 Drive c: (OS) (Fixed) (Total:222.13 GB) (Free:90.17 GB) NTFS 2 Drive d: (DATA) (Fixed) (Total:232.88 GB) (Free:180.04 GB) NTFS 3 Drive e: (RECOVERY) (Fixed) (Total:10.75 GB) (Free:1.81 GB) NTFS 5 Drive g: () (Removable) (Total:7.4 GB) (Free:3.34 GB) NTFS 7 Drive j: () (Fixed) (Total:20 GB) (Free:15.99 GB) NTFS ========================= Users: ======================================== User accounts for \\COW-FOOT Administrator ASPNET Guest Marcel QBDataServiceUser17 QBDataServiceUser20 ========================= Minidump Files ================================== No minidump file found **** End of log ****

elmkd

Post #12August 29, 2012, 2:10 PM UTC

Also, I don't know if this is a factor, but ever since I installed Avira Antivirus 2012 Premium, I have been unable to update Windows Defender. I understand that some Virus Scanners disable Windows Defender. Do you know if Avira is one of them? I disabled active web and mail scanning because it drastically slowed my browsing experience. I still have not been able to successfully update Windows Defender. Regards, elmkd

CatByte

Post #13August 29, 2012, 9:01 PM UTC

Farbar Services Scanner is not showing Windows Defender as disabled, so it may very well be something with Avira.

Try uninstalling it completely, then see if it will run, if it does, then you know it is Avira.

I personally use Microsoft Security essentials and I know that disables Defender.

There was some very minor adware on the system, but not enough to cause the symptoms you are describing.

I suggest starting a new topic in our hardware forum here at WTT and see if any of our expert techs can solve the remaining issues, link back to this malware topic so they can see what we have done, in the mean time, we need to clean up our tools

please do the following:

You can delete the DDS, aswMBR and all the Farbar logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Press the WinKey +R to open a run box
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

elmkd

Post #14August 30, 2012, 1:40 PM UTC

Once again, thank you for your analysis, help, and advice. All the best. Regards, Elmkd

CatByte

Post #15August 31, 2012, 1:31 AM UTC

you are welcome stay safe

~CB

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

HP HDX Premium Series Laptop strange behaviour [Solved]

✨ Ask AI

Ask AI