What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Firefox constantly freezing, something to do with Feed Reader? [Solved

37 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello inkster

Since there is nothing obvious jumping out from your logs, lets see what the following scan can tell us (if anything):

  • Combofix


  • Download ComboFix from one of the following locations:

    Link 1
    Link 2

  • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
  • Right click on ComboFix.exe and select "Run as Administrator" to run the program. Follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  • Should there be issues with internet afterward:

    In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.
Post #17
Hi JonTom, Oh a very frustrating afternoon. Have had to restart a few times just to get going (new pop up message on start up: "Application cannot start (16), operating system directive CreateFile failed. The system cannot find the file specified."). Finally got it going, turned off all my anti virus, firewall etc, downloaded and ran the ComboFix, it took quite a while, rebooted itself, finally left me with a logfile, but froze, so I ended up having to force another re-start, and seem to have lost the log (though I tried to save as before it froze). Doesn't seem to be on the desktop, am just doing a search for it using *.txt in the search engine. Should I re-run ComboFix? I assume the log will be different to the original……
Post #18
Hello inkster

It certainly sounds as though you are up against it…

Lets check to make sure that a log was not produced after the first attempt at the run:

Take a look on your C drive and see if you can see the following:


C:\ComboFix.txt

If its there, please post the log in your next reply.

If it is not there just come back here and let me know. :)
Post #19
Fantastic! You found it, MANY thanks! Here it is:

ComboFix 13-04-01.01 - Katerina 01/04/2013 15:54:11.2.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.44.1033.18.3065.926 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\a
c:\windows\system32\TPAPSLOG.LOG
c:\windows\system32\TPHDLOG0.LOG
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_uvnc_service
.
.
((((((((((((((((((((((((( Files Created from 2013-03-01 to 2013-04-01 )))))))))))))))))))))))))))))))
.
.
2013-04-01 15:07 . 2013-04-01 15:07 ——– d—–w- c:\users\Public\AppData\Local\temp
2013-04-01 15:07 . 2013-04-01 15:07 ——– d—–w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2013-04-01 15:07 . 2013-04-01 15:07 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-03-31 17:24 . 2013-03-31 17:24 ——– d—–w- c:\program files\VS Revo Group
2013-03-31 16:25 . 2013-03-31 16:26 ——– d—–w- c:\users\Katerina\AppData\Roaming\QuickScan
2013-03-31 16:24 . 2013-03-31 16:24 ——– d—–w- c:\program files\Common Files\Java
2013-03-31 16:19 . 2013-03-31 16:18 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-31 16:19 . 2013-03-31 16:19 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-30 23:24 . 2013-03-30 23:24 ——– d—–w- c:\windows\ERUNT
2013-03-30 23:24 . 2013-03-30 23:24 ——– d—–w- C:\JRT
2013-03-21 21:55 . 2013-03-21 21:55 ——– d—–w- C:\B
2013-03-21 09:04 . 2013-03-21 09:04 102008 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2013-03-20 21:37 . 2013-02-12 01:57 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-07 11:59 . 2013-03-07 11:59 ——– d—–w- c:\program files\iPod
2013-03-07 11:59 . 2013-03-07 12:01 ——– d—–w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-03-07 11:59 . 2013-03-07 12:01 ——– d—–w- c:\program files\iTunes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-31 16:18 . 2010-09-02 10:53 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-03-15 07:21 . 2013-03-29 20:12 7108640 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BE6C25D2-F7F8-4A2A-ACBF-DD3B5230A174}\mpengine.dll
2013-03-13 14:52 . 2012-10-24 12:44 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-13 14:52 . 2011-08-11 10:19 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 01:28 . 2009-10-05 08:43 232336 ——w- c:\windows\system32\MpSigStub.exe
2013-01-05 05:26 . 2013-02-13 08:18 3550072 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-01-05 05:26 . 2013-02-13 08:18 3602808 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 11:28 . 2013-02-13 08:18 905576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-01-04 01:38 . 2013-02-13 08:19 2048512 —-a-w- c:\windows\system32\win32k.sys
2013-03-12 09:31 . 2013-03-12 09:31 263064 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"feedreader.exe"="c:\program files\FeedReader30\feedreader.exe" [2009-03-29 2058240]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Akamai NetSession Interface"="c:\users\Katerina\AppData\Local\Akamai\netsession_win.exe" [2013-01-26 4480768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FingerPrintSoftware"="c:\program files\Lenovo Fingerprint Software\fpapp.exe \s" [X]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-10-07 256576]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-05-28 61728]
"TpShocks"="TpShocks.exe" [2009-02-03 181536]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-03-13 68976]
"LENOVO.TPFNF6R"="c:\program files\Lenovo\HOTKEY\TPFNF6R.exe" [2009-04-14 15136]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-24 487424]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2009-01-28 185688]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2009-01-28 124248]
"RoxioDragToDisc"="c:\program files\Lenovo\Drag-to-Disc\DrgToDsc.exe" [2007-03-13 1116920]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2009-04-15 660768]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BTVLogEx.DLL" [2009-04-15 214576]
"CreateLMBCShortCut"="c:\program files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe" [2009-05-15 40960]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-04-16 435488]
"ACWlIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWlIcon.exe" [2009-04-16 177440]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2009-03-05 3093816]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [2010-04-27 243544]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2012-02-05 383424]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\users\Katerina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
L'atelier des Chefs.lnk - c:\program files\L'atelier des Chefs\L'atelier des Chefs.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-2-20 789032]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2009-7-2 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
R3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-24 14:52]
.
2013-04-01 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 14:54]
.
2013-03-05 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2009-02-20 20:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://kingscollege.blackboard.com/webct/logonDisplay.dowebct?insId=20830&glcid=137.73.2.51-1103039060259-2000821000&insName=King%27s0College0London0e-Learning0Service&loginpage=customkclinstitutionentrywithlogin-addjavaerror.html
uInternet Settings,ProxyOverride = *.local;
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.guardian.co.uk/
FF - ExtSQL: 2013-03-31 17:25; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF - ExtSQL: !HIDDEN! 2009-08-27 16:33; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
——- File Associations ——-
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-MobileDocuments - c:\program files\Common Files\Apple\Internet Services\ubd.exe
HKLM-Run-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-01 16:14
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(1588)
c:\program files\ThinkPad\Bluetooth Software\btmmhook.dll
c:\program files\ThinkPad\Bluetooth Software\btncopy.dll
c:\program files\Lenovo\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\program files\Lenovo\Drag-to-Disc\ShellRes.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\DTS.exe
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\AtService.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Apoint2K\ApRunSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WLANExt.exe
c:\program files\LENOVO\HOTKEY\TPHKSVC.exe
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Autodesk\Content Service\Connect.Service.ContentService.exe
c:\program files\Apoint2K\Apoint.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ThinkPad\Bluetooth Software\btwdins.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Lenovo\Client Security Solution\tvttcsd.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\program files\Spybot - Search & Destroy\SDWinSec.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\ThinkPad\Utilities\EZEJMNAP.EXE
c:\windows\System32\TpShocks.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\ThinkVantage\PrdCtr\LPMGR.EXE
c:\program files\ThinkVantage\PrdCtr\LPMLCHK.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\System32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ThinkPad\Bluetooth Software\BtStackServer.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\System32\TPHDEXLG.exe
c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
.
**************************************************************************
.
Completion time: 2013-04-01 16:23:20 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-01 15:23
.
Pre-Run: 119,837,782,016 bytes free
Post-Run: 121,236,070,400 bytes free
.
- - End Of File - - A9CC8E3D091A0BDEB4575A7D48CF7E3A
Post #20
Hello inkster

Good job finding the Combofix log :thumbup:

The log itself does not look too bad, so we are going to have to spend a little time doing some troubleshooting.

Feedreader is still listed as present on your machine. Can you confirm that you did indeed try to uninstall it?
Post #21
Hi JonTom, Yes, it is still there. Every time I try to uninstall it the conventional way (via the control panel), it just says "C:\Programe Files\Feedreader 30\unin000.dat does not exist. Cannot uninstall." I have tried to google how to uninstall it when it won't uninstall, but without much success I'm afraid…….
Post #22
Hello inkster

Yes, it is still there.

Okay. Lets try this to begin with:


  • Please work through the following steps


  • Hold down the Windows key (has the Windows symbol on it) and press the "R" key. A Run box will open. Type in Notepad then click on "OK").
  • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
  • Copy and Paste the text in the quotebox below into the open Notepad window:

    File::
    c:\program files\FeedReader30\feedreader.exe

    Folder::
    c:\program files\FeedReader30

    Registry::
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "feedreader.exe"=-

  • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
  • Close any open browsers.
  • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Refering to the picture below, drag CFScript.txt into ComboFix.exe

    [external image: Posted Image]

  • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
  • Once the log is produced, re-engage your resident anti virus.

Please post the new Combofix log in your next reply and let me know if you are still experiencing the problems with feedreader.
Post #23
Hi JonTom,

Thanks so much for your continued help. I had to re-start the computer again a few times before I could run the combofix as you asked, but I have done it now, and here is the log:

ComboFix 13-04-01.01 - Katerina 03/04/2013 21:18:50.3.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.44.1033.18.3065.1576 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Katerina\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\FeedReader30\feedreader.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\FeedReader30
c:\program files\FeedReader30\fbclient.dll
c:\program files\FeedReader30\feedreader.exe
c:\program files\FeedReader30\feedreaderbackup.exe
c:\program files\FeedReader30\fixdatabase.bat
c:\program files\FeedReader30\gbak.exe
c:\program files\FeedReader30\gfix.exe
c:\program files\FeedReader30\ib_util.dll
c:\program files\FeedReader30\icudt30.dll
c:\program files\FeedReader30\icuin30.dll
c:\program files\FeedReader30\icuuc30.dll
c:\program files\FeedReader30\intl\fbintl.dll
c:\program files\FeedReader30\libeay32.dll
c:\program files\FeedReader30\msvcp71.dll
c:\program files\FeedReader30\msvcr71.dll
c:\program files\FeedReader30\opensearch\000000069889.ico
c:\program files\FeedReader30\opensearch\000000842C8F.ico
c:\program files\FeedReader30\opensearch\0000023AF8B7.ico
c:\program files\FeedReader30\opensearch\0000023B2903.ico
c:\program files\FeedReader30\opensearch\0000059EA098.ico
c:\program files\FeedReader30\opensearch\00000612BB13.ico
c:\program files\FeedReader30\opensearch\00000736415F.ico
c:\program files\FeedReader30\opensearch\00000BE0BA92.ico
c:\program files\FeedReader30\opensearch\00000F532339.ico
c:\program files\FeedReader30\opensearch\00000FF6BA83.ico
c:\program files\FeedReader30\ssleay32.dll
c:\program files\FeedReader30\udf\FBHlpUdf.dll
c:\program files\FeedReader30\udf\fbudf.dll
c:\program files\FeedReader30\udf\ib_udf.dll
c:\program files\FeedReader30\unins000.exe
c:\windows\system32\TPAPSLOG.LOG
c:\windows\system32\TPHDLOG0.LOG
.
.
((((((((((((((((((((((((( Files Created from 2013-03-03 to 2013-04-03 )))))))))))))))))))))))))))))))
.
.
2013-04-03 20:33 . 2013-04-03 20:33 ——– d—–w- c:\users\Public\AppData\Local\temp
2013-04-03 20:33 . 2013-04-03 20:33 ——– d—–w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2013-04-03 20:33 . 2013-04-03 20:33 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-04-02 22:03 . 2013-03-15 07:21 7108640 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{35606177-0020-4F85-B69A-5CAA9AE9C6FD}\mpengine.dll
2013-04-02 12:16 . 2013-04-02 12:16 102008 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2013-03-31 17:24 . 2013-03-31 17:24 ——– d—–w- c:\program files\VS Revo Group
2013-03-31 16:25 . 2013-03-31 16:26 ——– d—–w- c:\users\Katerina\AppData\Roaming\QuickScan
2013-03-31 16:24 . 2013-03-31 16:24 ——– d—–w- c:\program files\Common Files\Java
2013-03-31 16:19 . 2013-03-31 16:18 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-31 16:19 . 2013-03-31 16:19 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-30 23:24 . 2013-03-30 23:24 ——– d—–w- c:\windows\ERUNT
2013-03-30 23:24 . 2013-03-30 23:24 ——– d—–w- C:\JRT
2013-03-25 20:39 . 2013-03-25 20:39 4546560 —-a-w- c:\windows\system32\GPhotos.scr
2013-03-21 21:55 . 2013-03-21 21:55 ——– d—–w- C:\B
2013-03-20 21:37 . 2013-02-12 01:57 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys
2013-03-07 11:59 . 2013-03-07 11:59 ——– d—–w- c:\program files\iPod
2013-03-07 11:59 . 2013-03-07 12:01 ——– d—–w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-03-07 11:59 . 2013-03-07 12:01 ——– d—–w- c:\program files\iTunes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-31 16:18 . 2010-09-02 10:53 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-03-13 14:52 . 2012-10-24 12:44 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-13 14:52 . 2011-08-11 10:19 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 01:28 . 2009-10-05 08:43 232336 ——w- c:\windows\system32\MpSigStub.exe
2013-01-05 05:26 . 2013-02-13 08:18 3550072 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-01-05 05:26 . 2013-02-13 08:18 3602808 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 11:28 . 2013-02-13 08:18 905576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-01-04 01:38 . 2013-02-13 08:19 2048512 —-a-w- c:\windows\system32\win32k.sys
2013-03-12 09:31 . 2013-03-12 09:31 263064 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Akamai NetSession Interface"="c:\users\Katerina\AppData\Local\Akamai\netsession_win.exe" [2013-01-26 4480768]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-12-17 59872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FingerPrintSoftware"="c:\program files\Lenovo Fingerprint Software\fpapp.exe \s" [X]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-10-07 256576]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-05-28 61728]
"TpShocks"="TpShocks.exe" [2009-02-03 181536]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-03-13 68976]
"LENOVO.TPFNF6R"="c:\program files\Lenovo\HOTKEY\TPFNF6R.exe" [2009-04-14 15136]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-24 487424]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2009-01-28 185688]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2009-01-28 124248]
"RoxioDragToDisc"="c:\program files\Lenovo\Drag-to-Disc\DrgToDsc.exe" [2007-03-13 1116920]
"Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2009-04-15 660768]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BTVLogEx.DLL" [2009-04-15 214576]
"CreateLMBCShortCut"="c:\program files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe" [2009-05-15 40960]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2009-04-16 435488]
"ACWlIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWlIcon.exe" [2009-04-16 177440]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2009-03-05 3093816]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [2010-04-27 243544]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2012-02-05 383424]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\users\Katerina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
L'atelier des Chefs.lnk - c:\program files\L'atelier des Chefs\L'atelier des Chefs.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-2-20 789032]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2009-7-2 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
R3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - RAPPORTIASO
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-24 14:52]
.
2013-04-03 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 14:54]
.
2013-03-05 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2009-02-20 20:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://kingscollege.blackboard.com/webct/logonDisplay.dowebct?insId=20830&glcid=137.73.2.51-1103039060259-2000821000&insName=King%27s0College0London0e-Learning0Service&loginpage=customkclinstitutionentrywithlogin-addjavaerror.html
uInternet Settings,ProxyOverride = *.local;
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.guardian.co.uk/
FF - ExtSQL: 2013-03-31 17:25; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\Katerina\AppData\Roaming\Mozilla\Firefox\Profiles\wmnr2a3x.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF - ExtSQL: !HIDDEN! 2009-08-27 16:33; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-03 21:33
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2013-04-03 21:39:41
ComboFix-quarantined-files.txt 2013-04-03 20:39
ComboFix2.txt 2013-04-01 15:23
.
Pre-Run: 102,677,192,704 bytes free
Post-Run: 102,529,404,928 bytes free
.
- - End Of File - - 85A399A8049D6E30ED89A94D1812D36C

I have NOT got feedreader any more (but I should like to re-download the latest version in due course, as I found it really useful), do you think that would be ok? I didn't get a pop up when I re-started, and so far I have had no freezing problems with my browsing.

I'm going away tomorrow for a week and leaving the old laptop behind. Can I possibly keep this thread open until I'm back, just so I can make sure that things seem to be ok? Depending on what you find in the log above, of course……

Many thanks, inkster
Post #24
Hello inkster

Thanks so much for your continued help

No problem :)

I have NOT got feedreader any more (but I should like to re-download the latest version in due course, as I found it really useful), do you think that would be ok?

Of course, but lets wait until we have taken care of everything here first before you re-install it.

I didn't get a pop up when I re-started, and so far I have had no freezing problems with my browsing

:thumbup:

Can I possibly keep this thread open until I'm back, just so I can make sure that things seem to be ok? Depending on what you find in the log above, of course……

Thats fine. I will leave the log open until you get back :)

Once you are back, give me an update on how the machine is running and post a new set of DDS scan logs for me to review.
Post #25
Hi JonTom, Thanks again for your continued help! I have tried to do the DDS thing (which I didn't do to start with), but I can't seem to make it work. I can download the DDS thing from the relevant link here, but it is described as an autocad add on, and when double clicked (after putting it on the desktop), it just gives me a notepad of complete gobbledegook. Which I could cut and paste here if you want me to, but I'm not sure you'll thank me for it….. :D Do you have another link for the DDS scan? Or should I do one of the others? Many thanks, inkster
Post #26
Ok, sorry, cancel the above, have found the DDS application (or whatever it is called) downloaded previously, and have run it now. Here are the logs: From Notepad "Attach" . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft® Windows Vista™ Business Boot Device: \Device\HarddiskVolume1 Install Date: 02/07/2009 22:03:01 System Uptime: 13/04/2013 14:13:16 (4 hours ago) . Motherboard: LENOVO | | 27327KG Processor: Intel® Core™2 Duo CPU P8700 @ 2.53GHz | None | 2533/266mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 287 GiB total, 85.671 GiB free. E: is CDROM () Q: is FIXED (NTFS) - 10 GiB total, 3.22 GiB free. S: is FIXED (NTFS) - 1 GiB total, 0.691 GiB free. . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP796: 25/03/2013 23:24:05 - Scheduled Checkpoint RP797: 26/03/2013 21:20:50 - Windows Update RP798: 27/03/2013 23:14:15 - Scheduled Checkpoint RP799: 28/03/2013 11:31:39 - Scheduled Checkpoint RP801: 29/03/2013 19:54:26 - Installed Rapport RP802: 30/03/2013 10:42:45 - Scheduled Checkpoint RP803: 31/03/2013 03:37:57 - Scheduled Checkpoint RP804: 31/03/2013 17:16:01 - Removed Java™ 6 Update 29 RP805: 31/03/2013 17:18:18 - Installed Java 7 Update 17 RP807: 31/03/2013 18:25:07 - Revo Uninstaller's restore point - FeedReader RP809: 31/03/2013 18:26:04 - Revo Uninstaller's restore point - FeedReader RP810: 02/04/2013 22:56:54 - Windows Update RP812: 03/04/2013 09:19:37 - Installed Rapport RP813: 12/04/2013 11:38:30 - Windows Update RP814: 13/04/2013 09:47:17 - Windows Update . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 2007 Microsoft Office system 32 Bit HP CIO Components Installer Access Help Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9.2 Akamai NetSession Interface Apple Application Support Apple Mobile Device Support Apple Software Update AT&T; Service Activation ATI Catalyst Install Manager ATI Uninstaller AutoCAD 2009 - English Autodesk Content Service Autodesk Content Service Language Pack Autodesk Material Library 2013 Autodesk Material Library Base Resolution Image Library 2013 Autodesk Sync BBC iPlayer Desktop Bing Bar Bing Bar Platform BlackBerry Desktop Software 7.0 Bonjour bpd_scan Business Contact Manager for Outlook 2007 SP2 Camera Center Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization Chinese Standard Catalyst Control Center Localization Chinese Traditional Catalyst Control Center Localization Dutch Catalyst Control Center Localization French Catalyst Control Center Localization German Catalyst Control Center Localization Italian Catalyst Control Center Localization Japanese Catalyst Control Center Localization Korean Catalyst Control Center Localization Portuguese Catalyst Control Center Localization Spanish Catalyst Control Center Localization Swedish ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Dutch CCC Help English CCC Help French CCC Help German CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Portuguese CCC Help Spanish CCC Help Swedish Client Security - Password Manager Conexant HD Audio DocProc Drag-to-Disc ESET NOD32 Antivirus Help Center Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) iCloud Integrated Camera Intel PROSet Wireless Intel® Management Engine Interface Intel® PROSet/Wireless WiFi Software InterVideo Register Manager InterVideo WinDVD iTunes Java 7 Update 17 Java Auto Updater Lenovo Fingerprint Software Lenovo Registration Lenovo System Interface Driver Lenovo System Toolbox Lenovo Welcome Malwarebytes Anti-Malware version 1.70.0.1100 Message Center Message Center Plus Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Default Manager Microsoft Office 2003 Web Components Microsoft Office 2007 Primary Interop Assemblies Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Hybrid 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Small Business Connectivity Components Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Mobile Broadband Connect Mozilla Firefox 19.0 (x86 en-GB) Mozilla Maintenance Service MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) OCR Software by I.R.I.S. 12.0 OGA Notifier 2.0.0048.0 On Screen Display Pando Picasa 3 Presentation Director Product Recovery Disc Burning Utility Productivity Center Supplement for ThinkPad QuickTime Rapport Registry patch for Windows Vista USB S3 PM Enablement Registry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows Vista Registry patch to improve USB device detection on resume from sleep for Windows Vista Repronet Rescue and Recovery Revo Uninstaller 1.94 RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02 RICOH R5U230 Media Driver ver.2.02.02.01 Roxio Activation Module Roxio Central Audio Roxio Central Copy Roxio Central Core Roxio Central Data Roxio Central Tools Roxio Creator Business Edition Roxio Express Labeler 3 runPCrun 'Total Support' Version 7.01 Silent Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2736428) Security Update for Microsoft .NET Framework 4 Extended (KB2742595) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Skins Skype web features Skype™ 5.10 Sonic CinePlayer Decoder Pack Sonic Icons for Lenovo Spybot - Search & Destroy System Update ThinkPad Bluetooth with Enhanced Data Rate Software ThinkPad EasyEject Utility ThinkPad FullScreen Magnifier ThinkPad Mobility Center Customization ThinkPad Modem Adapter ThinkPad Power Management Driver ThinkPad Power Manager ThinkPad UltraNav Driver ThinkPad UltraNav Utility ThinkVantage Access Connections ThinkVantage Active Protection System ThinkVantage Productivity Center ThinkVantage Status Gadget Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VBA (2627.01) Verizon Wireless Mobile Broadband Self Activation Wallpapers Windows Driver Package - AuthenTec Inc. (ATSwpWDF) Biometric (10/02/2008 8.1.2.37) Windows Driver Package - Broadcom (b57nd60x) Net (11/29/2007 10.62.1.2) Windows Driver Package - Intel (iaStor) hdc (02/11/2009 8.8.0.1009) Windows Driver Package - Intel hdc (02/20/2008 6.9.1.1001) Windows Driver Package - Intel System (01/30/2008 8.6.1.1001) Windows Driver Package - Intel System (02/20/2008 8.6.1.1002) Windows Driver Package - Intel System (02/20/2008 8.7.0.1007) Windows Driver Package - Intel System (09/15/2006 7.0.0.1011) Windows Driver Package - Intel USB (02/05/2007 8.3.0.1011) Windows Driver Package - Lenovo 1.53 (03/19/2009 1.53) Windows Driver Package - Ricoh Company MMC Host Controller (02/15/2008 6.00.03.05) Windows Driver Package - Ricoh Company MS Host Controller (07/30/2007 6.00.01.11) Windows Driver Package - Ricoh Company xD Host Controller (07/30/2007 6.00.01.13) Windows Live ID Sign-in Assistant Windows Live Toolbar Yahoo! Detect . ==== Event Viewer Messages From Past Week ======== . 13/04/2013 15:24:03, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period. 13/04/2013 14:28:23, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service. 13/04/2013 14:27:53, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service. 13/04/2013 14:26:52, Error: Service Control Manager [7010] - A timeout (30000 milliseconds) was reached while waiting for ReadFile. 13/04/2013 14:15:55, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: tvtumon 13/04/2013 14:15:42, Error: Service Control Manager [7023] - The Lenovo Microphone Mute service terminated with the following error: The system cannot find the file specified. 13/04/2013 14:15:42, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the LMIGuardianSvc service to connect. 13/04/2013 14:15:42, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 13/04/2013 14:15:42, Error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the file specified. 13/04/2013 14:15:42, Error: Service Control Manager [7000] - The LMIGuardianSvc service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 13/04/2013 14:15:15, Error: EventLog [6008] - The previous system shutdown at 14:12:10 on 13/04/2013 was unexpected. 13/04/2013 10:06:36, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Windows Vista (KB2813170). 13/04/2013 09:43:41, Error: EventLog [6008] - The previous system shutdown at 21:47:46 on 12/04/2013 was unexpected. 12/04/2013 20:04:12, Error: EventLog [6008] - The previous system shutdown at 20:02:39 on 12/04/2013 was unexpected. 12/04/2013 16:18:31, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{DD5C9873-A429-436D-8B57-F475BCEACECC} because another computer on the network has the same name. The server could not start. 12/04/2013 16:17:57, Error: EventLog [6008] - The previous system shutdown at 15:50:52 on 12/04/2013 was unexpected. 12/04/2013 11:49:54, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition 1.147.1685.0). 12/04/2013 11:21:00, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Eventlog service. . ==== End Of File =========================== From Notepad "DDS" DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.6001.19412 BrowserJavaVersion: 10.17.2 Run by [removed] at 18:33:45 on 2013-04-13 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.44.1033.18.3065.1048 [GMT 1:00] . AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5} SP: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\DTS.exe C:\Windows\system32\ibmpmsvc.exe C:\Windows\system32\AtService.exe C:\Windows\system32\Ati2evxx.exe C:\Program Files\Apoint2K\ApRunSvc.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\WLANExt.exe C:\Windows\System32\spoolsv.exe C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe C:\Program Files\Apoint2K\Apoint.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe c:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE C:\Program Files\Lenovo\NPDIRECT\tpfnf7sp.exe C:\Windows\System32\TpShocks.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE C:\Program Files\ThinkVantage\PrdCtr\LPMLCHK.EXE C:\Program Files\Lenovo\Drag-to-Disc\DrgToDsc.exe C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe C:\Windows\System32\rundll32.exe C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe C:\Program Files\Lenovo\Client Security Solution\cssauth.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe C:\Program Files\Lenovo\System Update\SUService.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Katerina\AppData\Local\Akamai\netsession_win.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\taskeng.exe C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\Windows\System32\TPHDEXLG.exe C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe C:\Windows\system32\notepad.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . uStart Page = hxxp://kingscollege.blackboard.com/webct/logonDisplay.dowebct?insId=20830&glcid;=137.73.2.51-1103039060259-2000821000&insName;=King%27s0College0London0e-Learning0Service&loginpage;=customkclinstitutionentrywithlogin-addjavaerror.html BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Spybot-S&D; IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Toolbar Helper: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll BHO: IePasswordManagerHelper Class: {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll TB: Windows Live Toolbar: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll TB: Windows Live Toolbar: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll TB: @c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Akamai NetSession Interface] "c:\users\katerina\appdata\local\akamai\netsession_win.exe" uRun: [iCloudServices] c:\program files\common files\apple\internet services\iCloudServices.exe mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe mRun: [TPFNF7] c:\program files\lenovo\npdirect\TPFNF7SP.exe /r mRun: [TpShocks] TpShocks.exe mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe mRun: [LENOVO.TPFNF6R] c:\program files\lenovo\hotkey\TPFNF6R.exe mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [FingerPrintSoftware] "c:\program files\lenovo fingerprint software\fpapp.exe" \s mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe mRun: [LPManager] c:\progra~1\thinkv~1\prdctr\LPMGR.exe mRun: [LPMailChecker] c:\progra~1\thinkv~1\prdctr\LPMLCHK.exe mRun: [RoxioDragToDisc] "c:\program files\lenovo\drag-to-disc\DrgToDsc.exe" mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor mRun: [BLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BTVLogEx.DLL,StartBattLog mRun: [CreateLMBCShortCut] "c:\program files\lenovo\mobile broadband connect\UserShortcutCreator.exe" mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe mRun: [ACWlIcon] c:\program files\thinkpad\connectutilities\ACWlIcon.exe mRun: [cssauth] "c:\program files\lenovo\client security solution\cssauth.exe" silent mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe mRun: [Bing Bar] "c:\program files\msn toolbar\platform\5.0.1449.0\mswinext.exe" mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [Autodesk Sync] c:\program files\autodesk\autodesk sync\AdSync.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" StartupFolder: c:\users\katerina\appdata\roaming\micros~1\windows\startm~1\programs\startup\l'atel~1.lnk - c:\program files\l'atelier des chefs\L'atelier des Chefs.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: DisableCAD = dword:1 IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: E&xport; to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth; Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth; Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll IE: {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . . INFO: HKLM has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . TCP: NameServer = 192.168.0.1 TCP: Interfaces\{049789CE-B3CC-4919-9E17-DD3E1FA222F9} : DHCPNameServer = 192.168.0.1 TCP: Interfaces\{DD5C9873-A429-436D-8B57-F475BCEACECC} : DHCPNameServer = 192.168.0.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg . ================= FIREFOX =================== . FF - ProfilePath - c:\users\katerina\appdata\roaming\mozilla\firefox\profiles\wmnr2a3x.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.guardian.co.uk/ FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll FF - plugin: c:\program files\msn toolbar\platform\5.0.1449.0\npwinext.dll FF - plugin: c:\users\katerina\appdata\roaming\mozilla\firefox\profiles\wmnr2a3x.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npmproxy.dll FF - ExtSQL: 2013-03-31 17:25; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\katerina\appdata\roaming\mozilla\firefox\profiles\wmnr2a3x.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} FF - ExtSQL: !HIDDEN! 2009-08-27 16:33; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension . ============= SERVICES / DRIVERS =============== . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2013-4-2 102008] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-1-29 20520] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256] R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2008-10-23 13480] R1 RapportCerberus_51755;RapportCerberus_51755;c:\programdata\trusteer\rapport\store\exts\rapportcerberus\baseline\RapportCerberus32_51755.sys [2013-3-29 317112] R1 RapportEI;RapportEI;c:\program files\trusteer\rapport\bin\RapportEI.sys [2013-4-2 102680] R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2013-4-2 173880] R2 ApRunSvc;Alps Application Launcher Service;c:\program files\apoint2k\ApRunSvc.exe [2009-7-2 36864] R2 ATService;AuthenTec Fingerprint Service;c:\windows\system32\AtService.exe [2008-10-27 1676536] R2 Autodesk Content Service;Autodesk Content Service;c:\program files\autodesk\content service\Connect.Service.ContentService.exe [2012-1-31 19232] R2 dtsvc;Data Transfer Service;c:\windows\system32\DTS.exe [2008-10-27 98304] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840] R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2009-5-14 93312] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-9-14 47640] R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2009-7-2 66848] R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2013-4-2 1124184] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-8-16 1153368] R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-5-15 62320] R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2008-5-25 520192] R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2008-10-27 482176] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-2 181760] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2009-7-2 29736] R3 MUXMP;My WiFi PAN MUX-IM Virtual Miniport Driver;c:\windows\system32\drivers\mux.sys [2009-2-9 29232] R3 mv2;mv2;c:\windows\system32\drivers\mv2.sys [2009-8-27 11712] R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2009-2-9 3715072] R3 RapportIaso;RapportIaso;c:\programdata\trusteer\rapport\store\exts\rapportms\baseline\RapportIaso.sys [2012-5-20 55448] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2008-2-22 37312] S1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [2009-7-2 48192] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-5-15 45424] S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-11-10 374152] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944] S3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [2008-10-27 106496] S3 MUXP;My WiFi PAN Mux-IM Protocol Driver;c:\windows\system32\drivers\mux.sys [2009-2-9 29232] S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\intel\wifi\bin\PanDhcpDns.exe [2009-2-11 204800] S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2008-4-25 1120752] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\lenovo\rescue and recovery\UpdateMonitor.exe [2008-5-24 360448] . =============== File Associations =============== . FileExt: .scr: AutoCADScriptFile=c:\windows\system32\notepad.exe "%1" . =============== Created Last 30 ================ . 2013-04-12 10:51:04 7108640 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{edfb815d-7169-43c3-a52c-46bb708b25c9}\mpengine.dll 2013-04-12 10:43:59 376320 —-a-w- c:\windows\system32\winsrv.dll 2013-04-12 10:40:05 2049024 —-a-w- c:\windows\system32\win32k.sys 2013-04-03 20:39:55 ——– d-sh–w- C:\$RECYCLE.BIN 2013-04-02 12:16:10 102008 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2013-04-01 14:51:46 98816 —-a-w- c:\windows\sed.exe 2013-04-01 14:51:46 256000 —-a-w- c:\windows\PEV.exe 2013-04-01 14:51:46 208896 —-a-w- c:\windows\MBR.exe 2013-03-31 17:24:05 ——– d—–w- c:\program files\VS Revo Group 2013-03-31 16:25:24 ——– d—–w- c:\users\katerina\appdata\roaming\QuickScan 2013-03-31 16:19:51 861088 —-a-w- c:\windows\system32\npDeployJava1.dll 2013-03-31 16:19:22 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-03-30 23:24:57 ——– d—–w- c:\windows\ERUNT 2013-03-30 23:24:43 ——– d—–w- C:\JRT 2013-03-25 20:39:46 4546560 —-a-w- c:\windows\system32\GPhotos.scr 2013-03-21 21:55:49 ——– d—–w- C:\B 2013-03-20 21:37:40 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys . ==================== Find3M ==================== . 2013-04-13 13:33:19 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-04-13 13:33:19 691592 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-31 16:18:54 782240 —-a-w- c:\windows\system32\deployJava1.dll 2013-03-12 00:10:56 237088 ——w- c:\windows\system32\MpSigStub.exe 2013-03-08 03:52:22 2067968 —-a-w- c:\windows\system32\mstscax.dll 2013-03-01 12:23:51 916480 —-a-w- c:\windows\system32\wininet.dll 2013-03-01 12:18:29 43520 —-a-w- c:\windows\system32\licmgr10.dll 2013-03-01 12:17:59 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2013-03-01 12:17:42 71680 —-a-w- c:\windows\system32\iesetup.dll 2013-03-01 12:17:42 109056 —-a-w- c:\windows\system32\iesysprep.dll 2013-03-01 10:37:25 385024 —-a-w- c:\windows\system32\html.iec 2013-03-01 08:52:50 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2013-03-01 08:50:31 1638912 —-a-w- c:\windows\system32\mshtml.tlb . ============= FINISH: 18:34:39.43 =============== Many thanks!
Post #27
Oh, and by the way, I had a hard time getting logged on today, I had to restart 3 times before it stopped "not respond"-ing, but it has been ok this last time……. Many thanks!
Post #28
Hello inkster I'm back now (thank you for your patience). Give me a little time to check through your logs and I'll get back to you as soon as I can. JonTom
Post #29
Hi Jontom, Thanks so much for getting back to me. Just a quick update on things here….. I have had quite a bit of trouble over the past few days. New pop up messages ("warning, unreasoned script: js/ff-browser:29), lots of forced restarts and the same message coming back quite a few times… "Logon process has failed to create the security options dialog. Failure - security options" …. I thought I had a bit of a lightbulb moment last night and decided that Firefox was at the root of all my problems, so downloaded google chrome instead, but I am sitting looking at a non responsive google chrome at the moment (typing on an iPad now…) , so my quick fix solution didn't materialise unfortunately. Have forced restart at least twice today on chrome. Any help would be very gratefully received…. Am sorely tempted to hurl this machine from the top of a building. Well, the laptop anyway (will keep hold of the ipad!)…. Thank you!
Post #30
Sorry, just spotted typos in the post above…. Should be unresponsive script (though unreasoned script would make as much sense to me as anything else…..)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI