patndoris
After the reboot is there any change in the behavior of the machine?
Spyware / Malware / Virus Removal
"The specified device does not exist as an installed service"
53 min read
maldini
There is no change.
USB works correctly, since the recent registry fix
Still can't connect to the internet
Still getting "The Specified device…" error
patndoris
Let's try again to make sure User Account Control is totally turned off.
Please boot into safe mode.
Open User Accounts by clicking the Start button > clicking Control Panel >clicking User Accounts
Select the option to Change User Account Control Settings > and move the slider all the way to the bottom
Then reboot the computer into normal mode. Let me know if this works now or not and if there is any change in behavior.
Please boot into safe mode.
Open User Accounts by clicking the Start button > clicking Control Panel >clicking User Accounts
Select the option to Change User Account Control Settings > and move the slider all the way to the bottom
Then reboot the computer into normal mode. Let me know if this works now or not and if there is any change in behavior.
maldini
ok this may be of some interest.
I am in the User Account screen in safe mode
Under the heading "Make changes to your user account", there are 6 choices
Create a password for your account
Change your picture
Change your account name*
Change your account type*
Manage another account*
Change User Account Control Settings*
* All of these have the admin symbol attached to the links.
For all of the items with the admin symbol attached to them, nothing happens when they are selected. It is almost like a dead link. The other two choices with out the admin symbol take me to a new screen to perform their actions.
No error message is given when selecting one of the * above, just nothing happens.
patndoris
Please download and run this file and let's see if that gets internet back for you.
http://download.bleepingcomputer.com/win-s…es/7/Netman.reg
Then I'd like you to try creating a new user account with full administrative privileges. (From what I've read, you should be able to do this in normal or safe mode). After doing so, please go in and see if you can disable UAC in this new account for both the new account and your niece's account.
Then reboot to normal mode and let me know if there are any changes.
http://download.bleepingcomputer.com/win-s…es/7/Netman.reg
Then I'd like you to try creating a new user account with full administrative privileges. (From what I've read, you should be able to do this in normal or safe mode). After doing so, please go in and see if you can disable UAC in this new account for both the new account and your niece's account.
Then reboot to normal mode and let me know if there are any changes.
maldini
Please download and run this file and let's see if that gets internet back for you.
http://download.bleepingcomputer.com/win-s…es/7/Netman.reg
ok, this is the second time changing the registry has shown progress!!
I can now connect to my wireless router and connect to the internet in normal mode!!
The error "The Specified Device….." is still present. I need to read up on how to create the new user account and then I will try that step next. While I am researching this if there are any internet scans you want to run, let me know.
maldini
Then I'd like you to try creating a new user account with full administrative privileges. (From what I've read, you should be able to do this in normal or safe mode). After doing so, please go in and see if you can disable UAC in this new account for both the new account and your niece's account.
Then reboot to normal mode and let me know if there are any changes.
I seem to be having the same problem here as before when we tried to access the Change User Account Control Settings.
When I find the control to "create a new account" and click on it, nothing happens. This is in safe mode.
Internet works in both safe mode and normal mode though in case that affects anything you request next.
patndoris
Are you able to click on the search box and type msconfig and launch it?
Then click on the Tools tab.
Choose Change UAC Settings and launch.
See if you can disable it from there.
Then click on the Tools tab.
Choose Change UAC Settings and launch.
See if you can disable it from there.
maldini
Are you able to click on the search box and type msconfig and launch it?
Then click on the Tools tab.
Choose Change UAC Settings and launch.
See if you can disable it from there.
I can launch msconfig
I can click on the Tools tab
But when I choose Change UAC Settings, the msconfig window disappears and nothing happens after that.
I have tried to access this feature multiple ways, including finding the executable c:\Windows\System32\UserAccountControlSettings.exe but even clicking on that low level file does nothing.
patndoris
Please download ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows 7as your operating system right-click the executable and Run as Administrator.
We are now going to try and disable UAC directly from the registry. A word of caution – incorrectly editing the registry may severely damage your system. These modifications are intended for Windows advanced users who are comfortable using the registry editor. If you are not comfortable doing so please stop now and let me know.
To start the registry editor, type regedit in the Start menu search text box and press enter.
In the left hand pane please navigate down to the subfolder for the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
In the right hand pane look for where it says REG_DWORD (32-bit) Value name in the headings and find the item:
EnableLUA
If you double click on it a box will pop up with the current value that is in there. It will probably say 1 for enabled. Please change that to 0 for disabled.
Then click OK
Then you can close the registry editor window.
Then reboot the machine and see if the behavior has changed.
Let me know if you are not comfortable doing this or if you have any troubles whatsoever. If you run into any problems doing this please just cancel out. Do not make any changes to the registry if you are not completely comfortable in what you are doing.
We are now going to try and disable UAC directly from the registry. A word of caution – incorrectly editing the registry may severely damage your system. These modifications are intended for Windows advanced users who are comfortable using the registry editor. If you are not comfortable doing so please stop now and let me know.
To start the registry editor, type regedit in the Start menu search text box and press enter.
In the left hand pane please navigate down to the subfolder for the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System
In the right hand pane look for where it says REG_DWORD (32-bit) Value name in the headings and find the item:
EnableLUA
If you double click on it a box will pop up with the current value that is in there. It will probably say 1 for enabled. Please change that to 0 for disabled.
Then click OK
Then you can close the registry editor window.
Then reboot the machine and see if the behavior has changed.
Let me know if you are not comfortable doing this or if you have any troubles whatsoever. If you run into any problems doing this please just cancel out. Do not make any changes to the registry if you are not completely comfortable in what you are doing.
maldini
regedit will not launch in normal mode. It is "the specified device…" error.
Can I make this edit in safe mode?
patndoris
You should be able to. Go ahead and give it a try please.
maldini
Excellent!!!!
I was able to make the change in safe mode.
I rebooted and for the first time since the problem appeared, I no longer see "The Specified Device….." error!! I tried about 10 different programs that showed the problem and all launch correctly in normal mode now.
Internet still works as does the USB port.
Internet still works as does the USB port.
patndoris
Fantastic! Can you please run me a fresh DDS log right from the machine and in normal mode please.
maldini
Here is the DDS log from normal mode. The second log is attached to this post
==============================
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 19:38:55.50 on Sun 11/25/2012
Internet Explorer: 9.0.8112.16421
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2039 [GMT -5:00]
.
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
C:\Windows\system32\conhost.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\rundll32.exe
C:\Users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wbem\WmiPrvSE.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\SoftwareDistribution\Download\Install\mpas-fe_bd.exe
c:\2ecd8d733aa7f05f2772c79308354d\MPSigStub.exe
C:\Users\T61p\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\WmiPrvSE.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20111004203608.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
StartupFolder: c:\users\t61p\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\t61p\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\users\t61p\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2011-10-4 436728]
R0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-10-4 162928]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-6-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-6-23 72944]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2011-1-12 120128]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-10-4 159320]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2011-1-12 209760]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-10-4 145936]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2011-10-4 171296]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2011-10-4 58456]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-10-4 85152]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-6-23 7408]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-8-26 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-8-26 1343400]
S4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-7-27 63960]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-28 250808]
S4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\nvidia corporation\performance drivers\nvPDsvc.exe [2009-7-19 4446752]
.
=============== Created Last 30 ================
.
2012-11-26 00:38:10 ——– d—–w- C:\2ecd8d733aa7f05f2772c79308354d
2012-11-24 19:02:28 14336 —-a-w- c:\windows\system32\drivers\TrueSight.sys
2012-11-23 16:35:16 ——– d-sh–w- C:\$RECYCLE.BIN
2012-11-22 18:45:48 ——– d—–w- c:\progra~2\Kaspersky Lab
2012-11-21 21:40:43 ——– d—–w- c:\windows\system32\catroot2
2012-11-21 21:19:11 303616 —-a-w- C:\SetACL.exe
2012-11-21 21:04:56 290304 —-a-w- C:\subinacl.exe
2012-11-21 21:02:25 ——– d—–w- C:\RegBackup
2012-11-21 20:47:34 ——– d—–w- C:\Tweaking.com_Windows_Repair_Logs
2012-11-21 20:47:28 ——– d—–w- c:\program files\Tweaking.com
2012-11-21 17:12:41 ——– d—–w- c:\windows\system32\appmgmt
2012-11-21 14:45:34 ——– d—–w- c:\users\t61p\appdata\local\temp
2012-11-20 17:26:58 ——– d—–w- C:\FRST
2012-11-20 00:23:55 98816 —-a-w- c:\windows\sed.exe
2012-11-20 00:23:55 518144 —-a-w- c:\windows\SWREG.exe
2012-11-20 00:23:55 256000 —-a-w- c:\windows\PEV.exe
2012-11-20 00:23:55 208896 —-a-w- c:\windows\MBR.exe
2012-11-15 03:41:44 ——– d—–w- c:\windows\pss
2012-11-09 22:13:40 ——– d—–w- c:\progra~2\SOPAgent
2012-11-09 21:55:38 ——– d—–w- c:\users\t61p\Applications
2012-11-09 21:45:09 6918632 ——w- c:\progra~2\microsoft\windows defender\definition updates\{c2ea3c82-6638-4962-bf63-c9b2b9c8b509}\mpengine.dll
.
==================== Find3M ====================
.
2012-10-08 23:20:15 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 23:20:15 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-14 18:28:53 2048 —-a-w- c:\windows\system32\tzres.dll
2012-08-30 17:12:02 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12:02 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
.
============= FINISH: 19:41:43.23 ===============
==============================
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 19:38:55.50 on Sun 11/25/2012
Internet Explorer: 9.0.8112.16421
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2039 [GMT -5:00]
.
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
C:\Windows\system32\conhost.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\rundll32.exe
C:\Users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wbem\WmiPrvSE.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\SoftwareDistribution\Download\Install\mpas-fe_bd.exe
c:\2ecd8d733aa7f05f2772c79308354d\MPSigStub.exe
C:\Users\T61p\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\WmiPrvSE.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20111004203608.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
StartupFolder: c:\users\t61p\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\t61p\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\users\t61p\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2011-10-4 436728]
R0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-10-4 162928]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-6-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-6-23 72944]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2011-1-12 120128]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-10-4 159320]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2011-1-12 209760]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-10-4 145936]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2011-10-4 171296]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2011-10-4 58456]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-10-4 85152]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-6-23 7408]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-8-26 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-8-26 1343400]
S4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-7-27 63960]
S4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-28 250808]
S4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\nvidia corporation\performance drivers\nvPDsvc.exe [2009-7-19 4446752]
.
=============== Created Last 30 ================
.
2012-11-26 00:38:10 ——– d—–w- C:\2ecd8d733aa7f05f2772c79308354d
2012-11-24 19:02:28 14336 —-a-w- c:\windows\system32\drivers\TrueSight.sys
2012-11-23 16:35:16 ——– d-sh–w- C:\$RECYCLE.BIN
2012-11-22 18:45:48 ——– d—–w- c:\progra~2\Kaspersky Lab
2012-11-21 21:40:43 ——– d—–w- c:\windows\system32\catroot2
2012-11-21 21:19:11 303616 —-a-w- C:\SetACL.exe
2012-11-21 21:04:56 290304 —-a-w- C:\subinacl.exe
2012-11-21 21:02:25 ——– d—–w- C:\RegBackup
2012-11-21 20:47:34 ——– d—–w- C:\Tweaking.com_Windows_Repair_Logs
2012-11-21 20:47:28 ——– d—–w- c:\program files\Tweaking.com
2012-11-21 17:12:41 ——– d—–w- c:\windows\system32\appmgmt
2012-11-21 14:45:34 ——– d—–w- c:\users\t61p\appdata\local\temp
2012-11-20 17:26:58 ——– d—–w- C:\FRST
2012-11-20 00:23:55 98816 —-a-w- c:\windows\sed.exe
2012-11-20 00:23:55 518144 —-a-w- c:\windows\SWREG.exe
2012-11-20 00:23:55 256000 —-a-w- c:\windows\PEV.exe
2012-11-20 00:23:55 208896 —-a-w- c:\windows\MBR.exe
2012-11-15 03:41:44 ——– d—–w- c:\windows\pss
2012-11-09 22:13:40 ——– d—–w- c:\progra~2\SOPAgent
2012-11-09 21:55:38 ——– d—–w- c:\users\t61p\Applications
2012-11-09 21:45:09 6918632 ——w- c:\progra~2\microsoft\windows defender\definition updates\{c2ea3c82-6638-4962-bf63-c9b2b9c8b509}\mpengine.dll
.
==================== Find3M ====================
.
2012-10-08 23:20:15 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-08 23:20:15 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-14 18:28:53 2048 —-a-w- c:\windows\system32\tzres.dll
2012-08-30 17:12:02 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12:02 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
.
============= FINISH: 19:41:43.23 ===============
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI