What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

"The specified device does not exist as an installed service"

53 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46 last edited
I downloaded the Window Repair file on a clean machine I copied it to a CD Infected machine has been booted into normal mode I took the CD to the infected machine and copied the file from the CD to the desktop I launched the file and I get the same error I always do "The specified service does not exist as an installed service" =================== Would you like for me to try in safe mode?
Post #48
Hmm, it actually installed and launched in safe mode. It did say though that some fixes may not work correctly in safe mode. I am going to go ahead with steps 2,3, and 4 and see what happens.
Post #49
I have completed steps 2, 3 and 4 along with the Repair step. It went smoothly and no errors were encountered in the process Computer was booted back into normal. All the original symptoms are still present.
Post #50
I've been doing some reading up on this and I really do believe this is all the result of the infection I've been thinking we are dealing with. Humor me and boot into safe mode with networking and then plug in a USB flash drive and see if it will recognize it now please. I want to see if we've made any progress at all even in Safe mode.
Post #51 last edited
Is User Account Control (UAC) enabled on this computer? See this post for the various ways to disable it and let's see if that get's us working in normal mode for our tools. I found a similar problem where UAC was an issue. It's a long shot but possible.
Post #52
> Humor me and boot into safe mode with networking and then plug in a USB flash drive and see if it will recognize it now please. I booted into safe mode with networking and a USB Flash stick is not recognized in any of the USB ports on the laptop >Is User Account Control (UAC) enabled on this computer? I am unsure if this is on or not. When I try to click on "Change User Account Control Settings" in the Control Panel nothing happens. Similarly, when I launch the following from the run command, nothing happens C:\Windows\System32\UserAccountControlSettings.exe I almost looks like this is being blocked immediately. I don't get our normal error of "specified device does not exist"
Post #53
Well, not getting the message is sort of progress ^_^

I'd like to try one more thing and then we are going to get another scan from another tool if this doesn't help at all. This "should" reset all the default registry entries for the NetSvcs in Windows 7. Sometimes malware will hide there or make changes. This fix will merge in a "clean" set of default values. I'm hoping it might fix some of the things that may have been changed or blocked…..but this is a stubborn one so again - it's hard to tell if this will work or not.

You can create this notepad file on your computer and then transfer it to the desktop of the infected computer. Ideally you'll boot into normal mode on the infected computer and then you'll just double click the icon on the desktop and follow the instructions from that point below on the infected machine. Let me know if you have any questions.


Please work your way through the following steps
  • Hold down the Windows key (has the Windows symbol on it) and press the "R" key. A Run box will open. Type in Notepad and press Enter.
  • Copy the text provided in the code box below and paste it into Notepad (make sure you include Windows Registry Editor Version 5.00.
Windows Registry Editor Version 5.00

"netsvcs"=hex(7):41,00,65,00,4c,00,6f,00,6f,00,6b,00,75,00,70,00,53,00,76,00,\
  63,00,00,00,43,00,65,00,72,00,74,00,50,00,72,00,6f,00,70,00,53,00,76,00,63,\
  00,00,00,53,00,43,00,50,00,6f,00,6c,00,69,00,63,00,79,00,53,00,76,00,63,00,\
  00,00,6c,00,61,00,6e,00,6d,00,61,00,6e,00,73,00,65,00,72,00,76,00,65,00,72,\
  00,00,00,67,00,70,00,73,00,76,00,63,00,00,00,49,00,4b,00,45,00,45,00,58,00,\
  54,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,46,00,61,\
  00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
  69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
  00,69,00,74,00,79,00,00,00,49,00,61,00,73,00,00,00,49,00,72,00,6d,00,6f,00,\
  6e,00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,\
  00,00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,\
  69,00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,\
  00,74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,\
  73,00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,\
  00,63,00,65,00,73,00,73,00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,\
  61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,52,\
  00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,54,00,61,00,70,00,69,00,\
  73,00,72,00,76,00,00,00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,\
  00,6d,00,53,00,70,00,00,00,54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,\
  69,00,63,00,65,00,00,00,77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,\
  00,42,00,49,00,54,00,53,00,00,00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,\
  44,00,65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,00,00,00,4c,00,6f,00,67,\
  00,6f,00,6e,00,48,00,6f,00,75,00,72,00,73,00,00,00,50,00,43,00,41,00,75,00,\
  64,00,69,00,74,00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,\
  00,70,00,6c,00,6f,00,61,00,64,00,6d,00,67,00,72,00,00,00,69,00,70,00,68,00,\
  6c,00,70,00,73,00,76,00,63,00,00,00,73,00,65,00,63,00,6c,00,6f,00,67,00,6f,\
  00,6e,00,00,00,41,00,70,00,70,00,49,00,6e,00,66,00,6f,00,00,00,6d,00,73,00,\
  69,00,73,00,63,00,73,00,69,00,00,00,4d,00,4d,00,43,00,53,00,53,00,00,00,77,\
  00,65,00,72,00,63,00,70,00,6c,00,73,00,75,00,70,00,70,00,6f,00,72,00,74,00,\
  00,00,45,00,61,00,70,00,48,00,6f,00,73,00,74,00,00,00,50,00,72,00,6f,00,66,\
  00,53,00,76,00,63,00,00,00,73,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,\
  00,00,68,00,6b,00,6d,00,73,00,76,00,63,00,00,00,53,00,65,00,73,00,73,00,69,\
  00,6f,00,6e,00,45,00,6e,00,76,00,00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,\
  74,00,00,00,62,00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,54,00,68,00,65,\
  00,6d,00,65,00,73,00,00,00,42,00,44,00,45,00,53,00,56,00,43,00,00,00,41,00,\
  70,00,70,00,4d,00,67,00,6d,00,74,00,00,00,00,00
  • Save the text in Notepad as fix.reg, change the "Save as Type" to "All Files" and select your desktop as the save location.
  • An icon will appear on your desktop called "fix.reg".
  • Double click on the "fix.reg" icon.
  • You will be asked if you wish to merge the contents of the file to the registry. Click "Yes" or "OK".
  • You should then receive a message informing you that the merge was successful.
  • Next, please reboot your machine.
  • Once you have rebooted, you may delete the fix.reg file.
Once you have completed the steps above, please disable your security programs and run ComboFix again. If it asks you to allow it to update please do so.

Please post the log that is created in your next reply.
Post #54 last edited
>You can create this notepad file on your computer and then transfer it to the desktop of the infected computer. Ideally you'll boot into normal mode on the infected computer and then you'll just double click the icon on the desktop and follow the instructions from that point below on the infected machine. Let me know if you have any questions.



When I double click the icon in normal mode, I get the normal "The specified service does not exist…." error. Let me know if I should try this in safe mode.



Please note I have discovered (by luck really) something that might be of interest .

You previously asked me to boot into normal mode and then check to see if the USB ports were active. They were not.

However, if I leave the USB stick plugged in and then reboot and allow the machine to fully reboot without removing the USB stick, once it finishes booting to normal mode, I can now access the USB stick that was left plugged in.

Not sure that means anything but I wanted to mention it anyway.
Post #55
Fantastic! Let's get a fresh copy of Combofix on the flash drive. Then delete the one on the desktop of the infected machine. When you reboot into normal mode with the USB plugged in, see if you can go ahead and launch Combofix right from the flash drive. Don't try to put it on the desktop to run it. See if we can get a run in normal mode that way. In all the logs, they've looked a little skimpy. Unless your niece doesn't have much on this machine, it's like some of the stuff I'd normally see in the logs isn't being shown in the logs. So I'd really like to get a run in normal mode if we can.
Post #56
ok I got a new copy of combofix and saved it right to the USB flash stick. I plugged the flash stick into the infected machine and booted into normal mode. When the machine booted, I was able to access the flash stick as mentioned before. When I tried to launch combofix from the flash stick I get the same "The specified service does not exist…." error.
Post #57
Let's try a scan that should produce a more detailed log. Run in Safe mode since that appears to be all we are going to get for tonight :)


OTL Custom Scan

  • Download OTL to your desktop.
  • Right-click and choose Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %USERPROFILE%\..|smtmp;true;true;true /FP
    %temp%\smtmp\*.* /s >
    /md5start
    iexplore.*
    explorer.*
    winlogon.*
    dll
    zx.dll
    hlp.dat
    consrv.dll
    services.*
    /md5stop
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #58
I ran OTL in safe mode. Here are the two logs (one in this post and one in the next post)

==========================

OTL logfile created on: 11/21/2012 9:02:52 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T61p\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 2.62 Gb Available Physical Memory | 87.78% Memory free
5.96 Gb Paging File | 5.63 Gb Available in Paging File | 94.41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 169.95 Gb Free Space | 72.98% Space Free | Partition Type: NTFS
Drive D: | 656.69 Mb Total Space | 592.96 Mb Free Space | 90.30% Space Free | Partition Type: UDF
Drive E: | 984.72 Mb Total Space | 721.50 Mb Free Space | 73.27% Space Free | Partition Type: FAT

Computer Name: T61P-PC | User Name: T61p | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\T61p\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (mfevtp) – C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (McTaskManager) – C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
SRV - (McAfeeFramework) – C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
SRV - (NVIDIA Performance Driver Service) – C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe ()
SRV - (StorSvc) – C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AEADIFilters) – C:\Windows\System32\AEADISRV.EXE (Andrea Electronics Corporation)


========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\Users\T61p\AppData\Local\Temp\catchme.sys File not found
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (vmbus) – C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (TPM) – C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (netw5v32) – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (e1express) – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 57 47 95 16 64 CC 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://blekko.com/ws/?source=f45f13b3&…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2012/11/21 16:21:19 | 000,000,855 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20111004203608.dll (McAfee, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: C:\Users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{49816BA3-5BA2-46F3-9D3D-6F846FB975D1}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B0B445B-86E4-4CDD-8183-13D88700B587}: DhcpNameServer = 10.55.55.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: SessionEnv - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084

========== Files/Folders - Created Within 30 Days ==========

[2012/11/21 20:58:12 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\T61p\Desktop\OTL.exe
[2012/11/21 16:40:47 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2012/11/21 16:40:43 | 000,000,000 | —D | C] – C:\Windows\System32\catroot2
[2012/11/21 16:40:10 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/11/21 16:04:56 | 000,290,304 | —- | C] (Microsoft Corporation) – C:\subinacl.exe
[2012/11/21 16:02:25 | 000,000,000 | —D | C] – C:\RegBackup
[2012/11/21 15:47:34 | 000,000,000 | —D | C] – C:\Tweaking.com_Windows_Repair_Logs
[2012/11/21 15:47:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
[2012/11/21 15:47:28 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2012/11/21 12:12:41 | 000,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2012/11/21 09:45:36 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/11/21 09:45:34 | 000,000,000 | —D | C] – C:\Users\T61p\AppData\Local\temp
[2012/11/20 12:26:58 | 000,000,000 | —D | C] – C:\FRST
[2012/11/19 19:23:55 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/11/19 19:23:55 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/11/19 19:23:55 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/11/19 19:08:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/11/19 19:07:59 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/11/19 18:31:39 | 000,000,000 | —D | C] – C:\Users\T61p\Desktop\tdsskiller
[2012/11/19 18:07:48 | 001,754,528 | —- | C] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.scr
[2012/11/19 18:07:44 | 001,754,528 | —- | C] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.exe
[2012/11/19 18:05:45 | 001,754,528 | —- | C] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.com
[2012/11/16 13:36:16 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\T61p\Desktop\HiJackThis.exe
[2012/11/14 22:41:44 | 000,000,000 | —D | C] – C:\Windows\pss
[2012/11/14 19:52:05 | 000,649,864 | —- | C] (Sysinternals - www.sysinternals.com) – C:\Users\T61p\Desktop\autoruns.exe
[2012/11/09 17:13:40 | 000,000,000 | —D | C] – C:\ProgramData\SOPAgent
[2012/11/09 16:55:38 | 000,000,000 | —D | C] – C:\Users\T61p\Applications

========== Files - Modified Within 30 Days ==========

[2012/11/21 20:59:59 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/11/21 20:59:47 | 2401,996,800 | -HS- | M] () – C:\hiberfil.sys
[2012/11/21 20:58:33 | 000,014,256 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/21 20:58:33 | 000,014,256 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/21 20:54:44 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\T61p\Desktop\OTL.exe
[2012/11/21 20:44:18 | 000,000,017 | —- | M] () – C:\Users\T61p\AppData\Roaming\mbam.context.scan
[2012/11/21 20:43:38 | 000,624,178 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/11/21 20:43:38 | 000,106,522 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/11/21 20:20:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/21 20:08:52 | 000,002,889 | —- | M] () – C:\Users\T61p\Desktop\fix.reg
[2012/11/21 16:40:36 | 000,293,720 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/11/21 16:21:19 | 000,000,855 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/11/21 16:02:57 | 000,000,207 | —- | M] () – C:\Windows\tweaking.com-regbackup-T61P-PC-Microsoft-Windows-7-Professional-(32-bit).dat
[2012/11/21 15:47:30 | 000,002,237 | —- | M] () – C:\Users\Public\Desktop\Tweaking.com - Windows Repair (All in One).lnk
[2012/11/21 14:25:21 | 005,345,318 | —- | M] () – C:\Users\T61p\Desktop\tweaking.com_windows_repair_aio_setup.exe
[2012/11/21 09:43:54 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts_bak_160
[2012/11/19 18:07:32 | 001,754,528 | —- | M] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.scr
[2012/11/19 18:07:16 | 001,754,528 | —- | M] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.exe
[2012/11/19 18:05:00 | 001,754,528 | —- | M] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.com
[2012/11/17 13:01:52 | 000,625,664 | —- | M] () – C:\Users\T61p\Desktop\dds.scr
[2012/11/16 13:35:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\T61p\Desktop\HiJackThis.exe
[2012/11/14 23:54:52 | 000,001,010 | —- | M] () – C:\Users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/11/14 18:57:44 | 000,024,576 | —- | M] () – C:\Windows\System32\umstartup.etl
[2012/11/07 20:39:14 | 000,758,362 | —- | M] () – C:\Users\T61p\Desktop\APEnzymes.pdf
[2012/11/07 20:35:24 | 007,550,937 | —- | M] () – C:\Users\T61p\Desktop\APFats12.pdf

========== Files Created - No Company Name ==========

[2012/11/21 20:11:55 | 000,002,889 | —- | C] () – C:\Users\T61p\Desktop\fix.reg
[2012/11/21 16:19:11 | 000,303,616 | —- | C] ( ) – C:\SetACL.exe
[2012/11/21 16:02:57 | 000,000,207 | —- | C] () – C:\Windows\tweaking.com-regbackup-T61P-PC-Microsoft-Windows-7-Professional-(32-bit).dat
[2012/11/21 15:47:30 | 000,002,237 | —- | C] () – C:\Users\Public\Desktop\Tweaking.com - Windows Repair (All in One).lnk
[2012/11/21 14:27:11 | 005,345,318 | —- | C] () – C:\Users\T61p\Desktop\tweaking.com_windows_repair_aio_setup.exe
[2012/11/19 19:23:55 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/11/19 19:23:55 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/11/19 19:23:55 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/11/19 19:23:55 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/11/19 19:23:55 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/11/17 13:02:02 | 000,625,664 | —- | C] () – C:\Users\T61p\Desktop\dds.scr
[2012/11/14 23:54:52 | 000,001,010 | —- | C] () – C:\Users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/11/14 22:34:02 | 000,000,017 | —- | C] () – C:\Users\T61p\AppData\Roaming\mbam.context.scan
[2012/11/07 20:39:12 | 000,758,362 | —- | C] () – C:\Users\T61p\Desktop\APEnzymes.pdf
[2012/11/07 20:35:23 | 007,550,937 | —- | C] () – C:\Users\T61p\Desktop\APFats12.pdf
[2011/08/26 20:52:43 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/08/26 11:09:07 | 001,731,104 | —- | C] () – C:\Windows\System32\nvwdmcpl.dll
[2011/08/26 11:09:07 | 001,657,376 | —- | C] () – C:\Windows\System32\nwiz.exe
[2011/08/26 11:09:07 | 001,514,016 | —- | C] () – C:\Windows\System32\nView.dll
[2011/08/26 11:09:07 | 001,108,512 | —- | C] () – C:\Windows\System32\nvwimg.dll
[2011/08/26 11:09:07 | 000,473,632 | —- | C] () – C:\Windows\System32\nvShell.dll
[2011/08/26 11:09:07 | 000,449,056 | —- | C] () – C:\Windows\System32\nvAppBar.exe
[2011/08/26 11:09:07 | 000,267,296 | —- | C] () – C:\Windows\System32\nvTaskbar.exe

========== ZeroAccess Check ==========

[2009/07/13 23:42:31 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"ThreadingModel" = Both
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\Windows\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\Windows\system32\wbem\wbemess.dll – [2009/07/13 20:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/11/21 20:58:02 | 000,000,000 | —D | M] – C:\Users\T61p\AppData\Roaming\Dropbox

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/10 16:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/06/22 12:22:07 | 000,000,211 | -H– | M] () – C:\Boot.BAK
[2011/08/26 13:36:39 | 000,000,355 | RHS- | M] () – C:\Boot.ini.saved
[2010/11/20 07:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2011/08/26 13:36:42 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/11/21 09:45:33 | 000,008,046 | —- | M] () – C:\ComboFix.txt
[2009/06/10 16:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2012/11/21 20:59:47 | 2401,996,800 | -HS- | M] () – C:\hiberfil.sys
[2009/04/22 17:44:33 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/08/22 19:49:01 | 000,794,552 | —- | M] () – C:\MBUSA-T61P.reg
[2009/04/22 17:44:33 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/03 22:38:34 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/01/11 13:25:05 | 000,250,032 | RHS- | M] () – C:\ntldr
[2012/11/21 20:59:56 | 3202,662,400 | -HS- | M] () – C:\pagefile.sys
[2008/05/08 01:03:22 | 000,303,616 | —- | M] ( ) – C:\SetACL.exe
[2004/06/11 19:33:28 | 000,290,304 | —- | M] (Microsoft Corporation) – C:\subinacl.exe
[2012/11/19 18:39:33 | 000,123,720 | —- | M] () – C:\TDSSKiller.2.8.15.0_19.11.2012_18.35.04_log.txt
[2011/10/04 19:26:44 | 000,206,312 | RHS- | M] () – C:\XELDZ

< %systemroot%\Fonts\*.com >
[2009/07/13 23:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 20:15:26 | 000,090,624 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPWN7.DLL
[2009/07/13 20:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2010/11/20 07:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/08/26 12:35:41 | 000,000,221 | -HS- | M] () – C:\Users\T61p\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/09/10 09:16:28 | 000,649,864 | —- | M] (Sysinternals - www.sysinternals.com) – C:\Users\T61p\Desktop\autoruns.exe
[2012/11/16 13:35:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\T61p\Desktop\HiJackThis.exe
[2012/11/21 20:54:44 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\T61p\Desktop\OTL.exe
[2012/11/19 18:07:16 | 001,754,528 | —- | M] (Bleeping Computer, LLC) – C:\Users\T61p\Desktop\rkill.exe
[2012/11/21 14:25:21 | 005,345,318 | —- | M] () – C:\Users\T61p\Desktop\tweaking.com_windows_repair_aio_setup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2009/07/13 21:07:10 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\PolicyDefinitions\en-US\Explorer.adml
[2009/07/13 21:07:10 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\x86_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_22d6d5b5cba907ce\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 16:34:46 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\PolicyDefinitions\Explorer.admx
[2009/06/10 16:34:46 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\x86_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_1590ffd752297581\Explorer.admx

< MD5 for: EXPLORER.EX_ >
[2004/08/04 03:56:50 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\i386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2011/02/26 00:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 00:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\Windows.old\Windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\erdnt\cache\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\Windows.old\Windows\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\Windows.old\Windows\system32\dllcache\explorer.exe
[2009/08/03 00:49:47 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2004/08/04 00:56:50 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\Windows.old\Windows\$NtUninstallKB938828$\explorer.exe
[2009/08/03 00:35:50 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 01:00:51 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\en-US\explorer.exe.mui
[2009/07/13 21:06:56 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\x86_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_05c8dd40d4f56065\explorer.exe.mui

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2011/08/26 08:43:45 | 000,021,974 | —- | M] () MD5=CA8543E4128A574318292C7F3F41BE21 – C:\Windows.old\Windows\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.EXE-7A3328DA.PF >
[2012/11/09 17:01:49 | 000,034,994 | —- | M] () MD5=4094265DE769FD61C7BD210F47C7B009 – C:\Windows\Prefetch\EXPLORER.EXE-7A3328DA.pf

< MD5 for: EXPLORER.HTM >
[2003/05/19 12:37:54 | 000,002,160 | —- | M] () MD5=40C6F4D57261630B95830FBACD05EE91 – C:\Windows.old\Program Files\av\docs\de\html\wwhelp\wwhimpl\java\html\explorer.htm
[2003/05/19 12:37:54 | 000,002,160 | —- | M] () MD5=40C6F4D57261630B95830FBACD05EE91 – C:\Windows.old\Program Files\av\docs\en\html\wwhelp\wwhimpl\java\html\explorer.htm
[2003/05/19 12:37:54 | 000,002,160 | —- | M] () MD5=40C6F4D57261630B95830FBACD05EE91 – C:\Windows.old\Program Files\av\docs\fr\html\wwhelp\wwhimpl\java\html\explorer.htm

< MD5 for: EXPLORER.LOG >
[2011/06/22 14:47:09 | 000,001,245 | —- | M] () MD5=F08B1396454F43710EB55398B6A75A3B – C:\Windows.old\Documents and Settings\mbusa\Local Settings\Temp\explorer.log

< MD5 for: EXPLORER.SC_ >
[2001/08/18 05:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\i386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2002/08/29 07:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\Windows.old\Windows\explorer.scf

< MD5 for: IEXPLORE.CH_ >
[2004/07/17 14:40:18 | 000,199,077 | —- | M] () MD5=5F64795662F162CCD8B30969B6682029 – C:\i386\IEXPLORE.CH_

< MD5 for: IEXPLORE.CHM >
[2009/02/21 00:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\Windows.old\Windows\Help\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2004/08/04 03:56:52 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\i386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2012/05/17 18:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_b12560b1c817cfde\iexplore.exe
[2012/08/24 02:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Program Files\Internet Explorer\iexplore.exe
[2012/08/24 02:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\erdnt\cache\iexplore.exe
[2012/08/24 02:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_b1148f09c82553c5\iexplore.exe
[2012/05/17 17:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_b19f2c1ee1420ce6\iexplore.exe
[2009/07/13 20:17:29 | 000,673,048 | —- | M] (Microsoft Corporation) MD5=2C32E3E596CFE660353753EABEFB0540 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16385_none_b346f9b4861b55c2\iexplore.exe
[2012/06/02 04:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_b12660fbc816e935\iexplore.exe
[2012/08/24 02:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_b1a52ddae13ca4f0\iexplore.exe
[2011/06/21 00:25:30 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=6BB506124872ACDFAC5BD912CA1334CE – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.20992_none_b3c2cf339f43b73b\iexplore.exe
[2012/09/29 19:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2011/08/26 12:34:01 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_b135ff17c80c1949\iexplore.exe
[2012/06/28 20:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_b1276145c816028c\iexplore.exe
[2011/06/21 00:37:00 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=A3AB0A260049BE22AB52E302D9220A92 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7600.16839_none_b38113f685ef212c\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows.old\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Windows.old\Windows\system32\dllcache\iexplore.exe
[2012/06/02 03:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_b1a12cb2e1403f94\iexplore.exe
[2010/11/20 07:22:51 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_b5780d7c8309d95c\iexplore.exe
[2004/08/04 00:56:52 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\Windows.old\Windows\ie8\iexplore.exe
[2012/06/28 18:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\x86_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_b1a22cfce13f58eb\iexplore.exe

< MD5 for: IEXPLORE.EXE.HDMP >
[2009/10/06 11:55:23 | 006,880,525 | —- | M] () MD5=33FA9AE118838DAC68F3D76C1053798D – C:\Windows.old\Documents and Settings\mbusa\Local Settings\Temp\WER43c9.dir00\iexplore.exe.hdmp

< MD5 for: IEXPLORE.EXE.MDMP >
[2009/11/06 16:10:44 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Windows.old\Documents and Settings\mbusa\Local Settings\Temp\WERb26d.dir00\iexplore.exe.mdmp
[2009/10/06 11:55:21 | 000,095,381 | —- | M] () MD5=EED69AADB2CC46DD20AD8C6B6E859833 – C:\Windows.old\Documents and Settings\mbusa\Local Settings\Temp\WER43c9.dir00\iexplore.exe.mdmp

< MD5 for: IEXPLORE.EXE.MUI >
[2011/08/26 12:34:01 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/08/26 12:34:01 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_aae2948effb95a30\iexplore.exe.mui
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows.old\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Windows.old\Program Files\Internet Explorer\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_en-us_acf38f2bbdc896a9\iexplore.exe.mui
[2009/07/13 21:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\x86_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_af24a2f3bab71a43\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-1B894AFB.PF >
[2012/11/09 17:01:49 | 000,421,072 | —- | M] () MD5=DC9067037FDEA14EE3472952DBC9D140 – C:\Windows\Prefetch\IEXPLORE.EXE-1B894AFB.pf

< MD5 for: IEXPLORE.EXE-27122324.PF >
[2011/08/24 08:04:52 | 000,111,644 | —- | M] () MD5=B3600B31659EB3B31E9C752399025A46 – C:\Windows.old\Windows\Prefetch\IEXPLORE.EXE-27122324.pf

< MD5 for: IEXPLORE.HL_ >
[2001/08/18 05:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\i386\IEXPLORE.HL_

< MD5 for: IEXPLORE.HLP >
[2002/08/29 07:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\Windows.old\Windows\Help\iexplore.hlp

< MD5 for: IEXPLORE.LOG >
[2011/01/18 14:03:32 | 000,000,830 | —- | M] () MD5=721BCDC0FBBEB6973F93A2196B7D75E5 – C:\Windows.old\Documents and Settings\mbusa\Local Settings\Temp\IEXPLORE.log

< MD5 for: SERVICES >
[2002/08/29 07:00:00 | 000,007,116 | —- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A – C:\Windows.old\Windows\system32\drivers\etc\services
[2009/06/10 16:39:37 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\System32\drivers\etc\services
[2009/06/10 16:39:37 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_045b589158ae90da\services

< MD5 for: SERVICES._ >
[2001/08/18 05:00:00 | 000,001,989 | —- | M] () MD5=29BB3BBBE3D49156A42BFB3DD000F554 – C:\i386\SERVICES._

< MD5 for: SERVICES.CFG >
[2012/07/27 15:51:34 | 000,586,083 | —- | M] () MD5=6DE4EA437EC1FE6DB27CADB0A7EA8DC2 – C:\Program Files\Adobe\Reader 10.0\Reader\Services\Services.cfg
[2011/06/06 11:55:30 | 000,584,045 | R— | M] () MD5=B82DD53FA8C260DDD7FDC42182DB816E – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\services.cfg

< MD5 for: SERVICES.DLL >
[2006/11/24 15:19:24 | 000,020,480 | —- | M] ( ) MD5=17AD4A8A51AECE2EC20D8CF7994BC9F4 – C:\Windows.old\Program Files\Lenovo\System Update\egather\local\collect\services.dll

< MD5 for: SERVICES.EX_ >
[2004/08/04 03:56:56 | 000,049,955 | —- | M] () MD5=85A738BA493104ED103B26CADEB8B543 – C:\i386\SERVICES.EX_

< MD5 for: SERVICES.EXE >
[2009/02/06 06:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\Windows.old\Windows\$hf_mig$\KB956572\SP3QFE\services.exe
[2009/02/06 12:14:03 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE – C:\Windows.old\Windows\system32\dllcache\services.exe
[2009/02/06 12:14:03 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE – C:\Windows.old\Windows\system32\services.exe
[2009/02/06 05:22:21 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD – C:\Windows.old\Windows\$hf_mig$\KB956572\SP2QFE\services.exe
[2009/07/13 20:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\erdnt\cache\services.exe
[2009/07/13 20:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\System32\services.exe
[2009/07/13 20:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\Windows.old\Windows\$hf_mig$\KB956572\SP3GDR\services.exe
[2004/08/04 00:56:56 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\Windows.old\Windows\$NtUninstallKB956572$\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2009/07/13 21:03:06 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 – C:\Windows\System32\en-US\services.exe.mui
[2009/07/13 21:03:06 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=0DA5F221169DEB5AC3A22465CD6F0281 – C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_69d39d3a8748c332\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/13 23:41:45 | 000,001,288 | —- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 23:41:45 | 000,001,288 | —- | M] () MD5=021B1B178776500E54560EDCFFE0EE21 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/04/22 17:44:34 | 000,001,602 | —- | M] () MD5=D4F4414B09B680C014EBD527567CCCAC – C:\Windows.old\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 16:26:14 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\System32\wbem\services.mof
[2009/06/10 16:26:14 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.mof

< MD5 for: SERVICES.MS_ >
[2001/08/18 05:00:00 | 000,003,649 | —- | M] () MD5=64E9F61D2ED093C361862DE36433B5E1 – C:\i386\SERVICES.MS_

< MD5 for: SERVICES.MSC >
[2009/07/13 21:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\en-US\services.msc
[2009/06/10 16:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\System32\services.msc
[2009/07/13 21:08:50 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 16:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc
[2002/08/29 07:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\Windows.old\Windows\system32\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 15:20:01 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\System32\wdi\perftrack\Services.ptxml
[2009/07/13 15:20:01 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\Services.ptxml

< MD5 for: WINLOGON.ADML >
[2009/07/13 21:05:00 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\PolicyDefinitions\en-US\WinLogon.adml
[2009/07/13 21:05:00 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\x86_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_94da67ab3e358f3a\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 16:43:18 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\PolicyDefinitions\WinLogon.admx
[2009/06/10 16:43:18 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\x86_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_7ae3b2e5da95d117\WinLogon.admx

< MD5 for: WINLOGON.EX_ >
[2004/08/04 03:56:58 | 000,261,115 | —- | M] () MD5=F41C4F5745589D0BB8268C02B71594CA – C:\i386\WINLOGON.EX_

< MD5 for: WINLOGON.EXE >
[2004/08/04 00:56:58 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\Windows.old\Windows\system32\dllcache\winlogon.exe
[2004/08/04 00:56:58 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\Windows.old\Windows\system32\winlogon.exe
[2009/10/28 01:17:59 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 00:52:08 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 07:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\erdnt\cache\winlogon.exe
[2010/11/20 07:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 07:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012/09/29 19:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/07/13 20:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/20 07:12:53 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=65C2C2EE8F334EE07F66876551DE1827 – C:\Windows\System32\en-US\winlogon.exe.mui
[2010/11/20 07:12:53 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=65C2C2EE8F334EE07F66876551DE1827 – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_ccfffb7662588b45\winlogon.exe.mui
[2009/07/13 21:05:28 | 000,022,528 | —- | M] (Microsoft Corporation) MD5=DB61D28A59DEE68F77811B291D83AD1B – C:\Windows\winsxs\x86_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cacee7ae656a07ab\winlogon.exe.mui

< MD5 for: WINLOGON.LOG >
[2011/08/25 20:34:09 | 000,703,632 | —- | M] () MD5=1588859F6A1787CE89DD4E0C6C87766F – C:\Windows.old\Windows\security\logs\winlogon.log

< MD5 for: WINLOGON.MFL >
[2009/07/13 21:09:40 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\System32\wbem\en-US\winlogon.mfl
[2009/07/13 21:09:40 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2891397980a26140\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 15:37:34 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\System32\wbem\winlogon.mof
[2009/07/13 15:37:34 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\x86_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_800f1ff3d73b72d9\winlogon.mof

< MD5 for: WINLOGON.OLD >
[2011/03/18 08:46:43 | 001,052,860 | —- | M] () MD5=006472AF4937A72BF30A5DECB00447C7 – C:\Windows.old\Windows\security\logs\winlogon.old

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
Post #59
and here is the second log

OTL Extras logfile created on: 11/21/2012 9:02:52 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T61p\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 2.62 Gb Available Physical Memory | 87.78% Memory free
5.96 Gb Paging File | 5.63 Gb Available in Paging File | 94.41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 169.95 Gb Free Space | 72.98% Space Free | Partition Type: NTFS
Drive D: | 656.69 Mb Total Space | 592.96 Mb Free Space | 90.30% Space Free | Partition Type: UDF
Drive E: | 984.72 Mb Total Space | 721.50 Mb Free Space | 73.27% Space Free | Partition Type: FAT

Computer Name: T61P-PC | User Name: T61p | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\Easy Media Player\emp.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\Easy Media Player\emp.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{2AAB21C2-4CDA-4189-A0EC-5ED666113F84}" = McAfee Agent
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C0A8D65-4286-4B58-87FE-18AD24289285}" = NVIDIA Performance Drivers
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5U8xx Media Driver ver.3.64.02
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0000-0000-0000000FF1CE}" = Microsoft Office Excel 2007
"{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_EXCEL_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0000-0000-0000000FF1CE}" = Microsoft Office PowerPoint 2007
"{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_POWERPOINT_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0000-0000-0000000FF1CE}" = Microsoft Office Word 2007
"{90120000-001B-0000-0000-0000000FF1CE}_WORD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_WORD_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_EXCEL_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_POWERPOINT_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_WORD_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_EXCEL_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_POWERPOINT_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_WORD_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_EXCEL_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}_POWERPOINT_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}_WORD_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_EXCEL_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}_POWERPOINT_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}_WORD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_EXCEL_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}_POWERPOINT_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}_WORD_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}" = McAfee VirusScan Enterprise
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588" = ThinkPad Modem
"EXCEL" = Microsoft Office Excel 2007
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Power Management Driver" = ThinkPad Power Management Driver
"POWERPOINT" = Microsoft Office PowerPoint 2007
"SynTPDeinstKey" = ThinkPad UltraNav Driver
"Tweaking.com - Windows Repair (All in One)" = Tweaking.com - Windows Repair (All in One)
"WORD" = Microsoft Office Word 2007

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/21/2012 10:37:16 AM | Computer Name = T61P-PC | Source = VSS | ID = 18
Description = Volume Shadow Copy Service error: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623}
and name IVssCoordinatorEx2 cannot be started during Safe Mode. The Volume Shadow
Copy service cannot start while in safe mode. [0x8007043c, This service cannot
be started in Safe Mode ] Operation: Instantiating VSS server

Error - 11/21/2012 10:37:16 AM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x8007043c, This service cannot be started in Safe Mode
.


Operation:

Instantiating VSS server

Error - 11/21/2012 10:37:17 AM | Computer Name = T61P-PC | Source = System Restore | ID = 8193
Description = Failed to create restore point (Process = C:\Windows\system32\wbem\wmiprvse.exe;
Description = ComboFix created restore point; Error = 0x8007043c).

Error - 11/21/2012 11:36:56 AM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
IVssAsrWriterBackup::GetDiskComponents. hr = 0x8007000d, The data is invalid. .


Operation:

OnIdentify event Gathering Writer Data Context: Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Name: ASR Writer

Writer Instance ID: {dc1d63ca-5e0a-4956-9cf8-63d4cda71ac1}

Error - 11/21/2012 1:12:17 PM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
IVssAsrWriterBackup::GetDiskComponents. hr = 0x8007000d, The data is invalid. .


Operation:

OnIdentify event Gathering Writer Data Context: Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Name: ASR Writer

Writer Instance ID: {0c58ef23-dee2-4e0e-bcf1-414469beead3}

Error - 11/21/2012 1:12:59 PM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
IVssAsrWriterBackup::GetDiskComponents. hr = 0x8007000d, The data is invalid. .


Operation:

OnIdentify event Gathering Writer Data Context: Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Name: ASR Writer

Writer Instance ID: {0c58ef23-dee2-4e0e-bcf1-414469beead3}

Error - 11/21/2012 1:15:28 PM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
IVssAsrWriterBackup::GetDiskComponents. hr = 0x8007000d, The data is invalid. .


Operation:

OnIdentify event Gathering Writer Data Context: Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Name: ASR Writer

Writer Instance ID: {0c58ef23-dee2-4e0e-bcf1-414469beead3}

Error - 11/21/2012 5:02:12 PM | Computer Name = T61P-PC | Source = System Restore | ID = 8193
Description = Failed to create restore point (Process = C:\Windows\system32\wbem\wmiprvse.exe;
Description = Tweaking.com - Windows Repair; Error = 0x8007043c).

Error - 11/21/2012 6:10:30 PM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
IVssAsrWriterBackup::GetDiskComponents. hr = 0x8007000d, The data is invalid. .


Operation:

OnIdentify event Gathering Writer Data Context: Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Name: ASR Writer

Writer Instance ID: {376ff3fa-cfba-441c-a801-c5e4790a4e90}

Error - 11/21/2012 9:05:28 PM | Computer Name = T61P-PC | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
IVssAsrWriterBackup::GetDiskComponents. hr = 0x8007000d, The data is invalid. .


Operation:

OnIdentify event Gathering Writer Data Context: Execution Context: ASR Writer

Writer Class Id: {be000cbe-11fe-4426-9c58-531aa6355fc4} Writer Name: ASR Writer

Writer Instance ID: {38e1b240-a05b-4f49-acbf-6bb6cf835b33}

[ Media Center Events ]
Error - 12/13/2011 4:06:56 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 3:06:55 AM - Error connecting to the internet. 3:06:55 AM - Unable
to contact server..

Error - 12/13/2011 4:07:05 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 3:07:01 AM - Error connecting to the internet. 3:07:01 AM - Unable
to contact server..

Error - 12/13/2011 5:07:13 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 4:07:13 AM - Error connecting to the internet. 4:07:13 AM - Unable
to contact server..

Error - 12/13/2011 5:07:19 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 4:07:18 AM - Error connecting to the internet. 4:07:18 AM - Unable
to contact server..

Error - 12/13/2011 6:07:27 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 5:07:27 AM - Error connecting to the internet. 5:07:27 AM - Unable
to contact server..

Error - 12/13/2011 6:07:33 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 5:07:32 AM - Error connecting to the internet. 5:07:32 AM - Unable
to contact server..

Error - 12/13/2011 7:11:29 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 6:11:29 AM - Error connecting to the internet. 6:11:29 AM - Unable
to contact server..

Error - 12/13/2011 7:11:35 AM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 6:11:34 AM - Error connecting to the internet. 6:11:34 AM - Unable
to contact server..

Error - 12/15/2011 7:46:01 PM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 6:46:01 PM - Failed to retrieve Directory (Error: Unable to connect
to the remote server)

Error - 1/17/2012 8:54:07 PM | Computer Name = T61p-PC | Source = MCUpdate | ID = 0
Description = 7:54:07 PM - Failed to retrieve MCEClientUX (Error: Unable to connect
to the remote server)

[ System Events ]
Error - 11/15/2012 12:00:04 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7001
Description = The Windows Audio service depends on the Windows Audio Endpoint Builder
service which failed to start because of the following error: %%1075

Error - 11/15/2012 12:00:05 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7003
Description = The Windows Driver Foundation - User-mode Driver Framework service
depends the following service: PlugPlay. This service might not be installed.

Error - 11/15/2012 12:00:06 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7003
Description = The DHCP Client service depends the following service: NSI. This service
might not be installed.

Error - 11/15/2012 12:00:06 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7003
Description = The DNS Client service depends the following service: NSI. This service
might not be installed.

Error - 11/15/2012 12:00:10 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7003
Description = The Workstation service depends the following service: NSI. This service
might not be installed.

Error - 11/15/2012 12:00:11 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024882

Error - 11/15/2012 12:00:17 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7003
Description = The Network Location Awareness service depends the following service:
NSI. This service might not be installed.

Error - 11/15/2012 12:00:22 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7003
Description = The Windows Driver Foundation - User-mode Driver Framework service
depends the following service: PlugPlay. This service might not be installed.

Error - 11/15/2012 12:00:25 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7023
Description = The Server service terminated with the following error: %%1062

Error - 11/15/2012 12:00:25 AM | Computer Name = T61P-PC | Source = Service Control Manager | ID = 7023
Description = The Power service terminated with the following error: %%1062


< End of report >
Post #60
It's going to take me a bit to get thru these logs. I'll be back to you tomorrow. I know it's Gobble Gobble day, but I'll get something back to you just as soon as I can. You can respond when you get time. Have a happy Thanksgiving!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI