# Possible System Hi-Jack or Virus



## Danstang (Aug 4, 2011)

Hello,

Thanks in advance for any helpon the following.

I am running XP-sp3 and have Trend Micro Titanium up and running.

Over the last week, at random times, the screen will flash with various installed programs such as the start menue, the calculator, MS Draw (until I uninstalled it) and several others. Suring this time, the mouse is uncontrollable. I have even killed the internet connection and it continues. Eventually it stops. Sometimes the programs remain open, sometimes not. All the time Trend is running and find nothing but a few cookies.

Just before I ran the logs I did discover that there were several suspicious cookies hanging out in the Temp Internet folder -for instance - Dan @ www 999 . shopping... (spaces to avoid a link).

I could not delete these from the folder - but believe was able to by going to the control panel and deleting cookies from there. The temp internet folder is now gone.

Here are the logs:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:53:35 PM, on 8/5/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Unknown owner - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (file missing)
--
End of file - 10780 bytes

.
DDS (Ver_2011-06-23.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702
Run by Dan at 13:57:53 on 2011-08-05
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2438 [GMT -4:00]
.
AV: Trend Micro Titanium Internet Security *Enabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: ActiveArmor Firewall *Enabled* 
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [Trend Micro Titanium] c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe -set Silent "1" SplashURL ""
mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe"
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272584659703
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{8B6CA0C5-AA6D-492B-86A2-AC769EFCC3A0} : DhcpNameServer = 192.168.1.1
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2011-8-3 188272]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2011-6-2 64080]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-30 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-4-28 1691480]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
S3 cpuz132;cpuz132;\??\c:\docume~1\dan\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\dan\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 esgiguard;esgiguard;\??\c:\program files\enigma software group\spyhunter\esgiguard.sys --> c:\program files\enigma software group\spyhunter\esgiguard.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-4-30 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
=============== Created Last 30 ================
.
2011-08-04 03:39:58 696320 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2011-08-04 03:39:58 57344 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2011-08-04 03:39:58 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2011-08-04 03:39:58 237568 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2011-08-04 03:39:58 155648 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2011-08-04 03:39:53 282756 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2011-08-04 03:39:53 163972 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2011-08-04 03:13:01 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-08-04 03:13:01 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-02 19:50:16 -------- d-----w- C:\sh4ldr
2011-08-02 19:50:16 -------- d-----w- c:\program files\Enigma Software Group
2011-08-02 19:49:54 -------- d-----w- c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP
2011-07-31 14:47:08 388096 ----a-r- c:\documents and settings\dan\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-07-31 13:30:14 -------- d-----w- c:\program files\common files\L&H
2011-07-31 13:29:14 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-07-31 02:43:50 -------- d-----w- c:\documents and settings\all users\CrypKey
2011-07-31 02:43:04 27648 ----a-r- c:\windows\Setup_ck.exe
2011-07-31 02:43:04 19584 ----a-w- c:\windows\system32\Ckldrv.sys
2011-07-31 02:43:04 18432 ----a-w- c:\windows\Setup_ck.dll
2011-07-31 02:43:04 165888 ----a-w- c:\windows\Ckconfig.exe
2011-07-31 02:43:04 122880 ----a-w- c:\windows\system32\Crypserv.exe
2011-07-31 02:43:04 11776 ----a-w- c:\windows\Ckrfresh.exe
2011-07-31 02:43:00 178176 ----a-w- c:\windows\system32\StellarProfile.dll
2011-07-31 02:43:00 1207808 ----a-w- c:\windows\system32\PhoenixDll.dll
2011-07-31 02:42:57 -------- d-----w- c:\program files\Stellar Phoenix Outlook PST Repair
2011-07-30 04:31:03 -------- d-----w- c:\windows\pss
.
==================== Find3M ====================
.
2011-08-04 01:07:54 92112 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2011-08-04 01:07:54 80464 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2011-08-04 01:07:54 64080 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2011-08-04 01:07:54 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-07-31 15:17:13 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-30 02:57:22 90112 ----a-w- c:\windows\DUMP2cbd.tmp
2011-06-21 10:43:26 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-06-21 10:43:26 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 14:00:23.64 ===============

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2011-08-05 14:06:32
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\00000066 WDC_WD2500JS-58NCB1 rev.10.02E02
Running: eq11pwk0.exe; Driver: C:\DOCUME~1\Dan\LOCALS~1\Temp\fwtdapow.sys

---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip NVTcp.sys (NVIDIA Networking Protocol Driver./NVIDIA Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp NVTcp.sys (NVIDIA Networking Protocol Driver./NVIDIA Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
---- EOF - GMER 1.0.15 ----


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## Danstang (Aug 4, 2011)

Hi and thanks for your help so far - I spent over 2 hours on the phone with Trend Micro AGAIN last nightand they insist it is a hardware issue - possibly the wired HP mouse - they had me run the combofix - they claim to have found nothing - if it is absolutely needed, I will run a new combofix, but am reluctant to do so as it (or the Trend Micro support tech) did not disconnect - this caused some headaches trying to get a mouse to work - having to go to last good setting etc...

In any case, here is the Hijack this log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:49:42 PM, on 8/6/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Unknown owner - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (file missing)
--
End of file - 11046 bytes


----------



## Cookiegal (Aug 27, 2003)

Please post the Combofix log. It should be located at C:\combofix.txt.


----------



## Danstang (Aug 4, 2011)

The system acted "normal" over the weekend, but as of this morning all the symptoms started up again. I changed my log in password and also made everything private.

I re-ran Combofix - and then re-ran HiJackThis - both logs posted below. Thanks for your help.

ComboFix 11-08-07.03 - Dan 08/08/2011 9:20.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2480 [GMT -4:00]
Running from: c:\documents and settings\Dan\Desktop\ComboFix.exe
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: ActiveArmor Firewall *Enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.
.
((((((((((((((((((((((((( Files Created from 2011-07-08 to 2011-08-08 )))))))))))))))))))))))))))))))
.
.
2011-08-05 21:01 . 2011-08-05 21:07 -------- d-----w- c:\windows\system32\NtmsData
2011-08-04 03:39 . 2003-02-27 20:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-08-04 03:39 . 2002-12-05 18:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-08-04 03:39 . 2002-12-02 19:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-08-04 03:39 . 2002-12-02 17:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-08-04 03:39 . 2002-12-02 17:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-08-04 03:39 . 2011-08-04 03:39 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-08-04 03:39 . 2011-08-04 03:39 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-08-04 03:13 . 2011-08-04 03:13 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-04 01:09 . 2011-08-04 01:09 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Trend Micro
2011-08-02 19:50 . 2011-08-05 03:12 -------- d-----w- C:\sh4ldr
2011-08-02 19:50 . 2011-08-02 19:50 -------- d-----w- c:\program files\Enigma Software Group
2011-08-02 19:49 . 2011-08-05 03:12 -------- d-----w- c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP
2011-07-31 14:47 . 2011-07-31 14:47 388096 ----a-r- c:\documents and settings\Dan\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-07-31 13:30 . 2011-07-31 13:30 -------- d-----w- c:\program files\Common Files\L&H
2011-07-31 13:29 . 2011-07-31 13:29 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-07-31 13:27 . 2011-07-31 13:27 -------- d-----w- c:\program files\Microsoft Works
2011-07-31 02:43 . 2011-07-31 02:43 -------- d-----w- c:\documents and settings\All Users\CrypKey
2011-07-31 02:43 . 2008-05-07 23:29 122880 ----a-w- c:\windows\system32\Crypserv.exe
2011-07-31 02:43 . 2008-03-17 16:45 19584 ----a-w- c:\windows\system32\Ckldrv.sys
2011-07-31 02:43 . 1999-06-18 20:49 165888 ----a-w- c:\windows\Ckconfig.exe
2011-07-31 02:43 . 1996-05-03 16:21 27648 ----a-r- c:\windows\Setup_ck.exe
2011-07-31 02:43 . 1996-05-03 14:36 18432 ----a-w- c:\windows\Setup_ck.dll
2011-07-31 02:43 . 1995-07-04 17:33 11776 ----a-w- c:\windows\Ckrfresh.exe
2011-07-31 02:43 . 2006-04-17 15:56 1207808 ----a-w- c:\windows\system32\PhoenixDll.dll
2011-07-31 02:43 . 2004-10-17 01:46 178176 ----a-w- c:\windows\system32\StellarProfile.dll
2011-07-31 02:42 . 2011-07-31 03:23 -------- d-----w- c:\program files\Stellar Phoenix Outlook PST Repair
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-04 01:07 . 2011-06-22 22:59 92112 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2011-08-04 01:07 . 2011-06-03 02:10 80464 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2011-08-04 01:07 . 2011-06-03 02:10 64080 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2011-08-04 01:07 . 2011-06-03 02:10 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-08-02 21:30 . 2011-08-02 21:30 1802455 ----a-w- C:\DAN-01_2011.08.02-1723.58_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-08-02 13:50 . 2011-08-02 13:50 1721200 ----a-w- C:\DAN-01_2011.08.02-0938.14_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-08-02 03:55 . 2011-08-02 03:55 1729931 ----a-w- C:\DAN-01_2011.08.01-2342.03_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-08-01 13:22 . 2011-08-01 13:22 1728375 ----a-w- C:\DAN-01_2011.08.01-0914.36_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-07-31 15:17 . 2011-05-18 12:23 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-31 13:11 . 2011-07-31 13:11 21354 ----a-w- C:\DAN-01_2011.07.31-0911.00_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 12:16 . 2011-07-31 12:16 21404 ----a-w- C:\DAN-01_2011.07.31-0816.06_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 04:39 . 2011-07-31 04:39 21302 ----a-w- C:\DAN-01_2011.07.31-0039.07_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 04:15 . 2011-07-31 04:15 21329 ----a-w- C:\DAN-01_2011.07.31-0014.58_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 04:13 . 2011-07-31 04:13 718409 ----a-w- C:\DAN-01_2011.07.31-0012.35_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-30 02:57 . 2010-04-28 16:25 90112 ----a-w- c:\windows\DUMP2cbd.tmp
2011-06-21 10:43 . 2009-05-22 00:21 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-06-21 10:43 . 2009-05-21 22:57 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-06-02 14:02 . 2008-04-14 05:00 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( [email protected]_02.11.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-08 12:59 . 2011-08-08 12:59 16384 c:\windows\Temp\Perflib_Perfdata_2bc.dat
+ 2010-08-08 01:23 . 2011-08-06 22:09 233804 c:\windows\system32\nvdrsdb1.bin
+ 2010-08-08 01:23 . 2011-08-06 22:17 233812 c:\windows\system32\nvdrsdb0.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-01 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2010-03-17 19520544]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-06-06 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-02-17 1111568]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SpyHunter 4 Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [6/2/2011 10:10 PM 64080]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [8/3/2011 9:08 PM 188272]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/30/2010 10:47 PM 136176]
S2 LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258;LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258);"c:\docume~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe" -service -sid c9ac5d2e-a940-48c9-ab70-e68c08553258 --> c:\docume~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/28/2010 5:15 PM 1691480]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 6:44 PM 183560]
S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/30/2010 10:47 PM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-01 02:47]
.
2011-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-01 02:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-08 09:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-583907252-436374069-1801674531-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(808)
c:\windows\system32\nvappfilter.dll
.
- - - - - - - > 'explorer.exe'(2316)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\program files\WinZip\wzshlstb.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-08-08 09:30:32
ComboFix-quarantined-files.txt 2011-08-08 13:30
ComboFix2.txt 2011-08-06 02:23
.
Pre-Run: 134,854,971,392 bytes free
Post-Run: 134,895,443,968 bytes free
.
- - End Of File - - 7F0E32C8CFD02B2D1A95192F9FF88BE2

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:31:51 AM, on 8/8/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Unknown owner - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (file missing)
--
End of file - 10555 bytes


----------



## Cookiegal (Aug 27, 2003)

Since you ran ComboFix again, I'd like to see the first log please. You should find it in this location:

C:\qoobox\ComboFix2.txt

Also, please do this:

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click *Scan*.

Upon completion of the scan, click *Save log* then save it to your desktop and post that log in your next reply for review. 
*Note - do NOT attempt any Fix yet. *


----------



## Danstang (Aug 4, 2011)

OK - Here you go;

ComboFix 11-08-05.03 - Dan 08/05/2011 22:05:59.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2462 [GMT -4:00]
Running from: c:\documents and settings\Dan\Desktop\ComboFix.exe
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: ActiveArmor Firewall *Enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMIRhook.000.dll
c:\documents and settings\Dan\Local Settings\Temp\LMIR0001.tmp\LMIRhook.000.dll
c:\documents and settings\Dan\WINDOWS
c:\windows\system32\regobj.dll
c:\windows\system32\service
c:\windows\system32\service\01052010_TIS17_SfFniAU.log
c:\windows\system32\service\02072010_TIS17_SfFniAU.log
c:\windows\system32\service\03082010_TIS17_SfFniAU.log
c:\windows\system32\service\04082010_TIS17_SfFniAU.log
c:\windows\system32\service\06082010_TIS17_SfFniAU.log
c:\windows\system32\service\08042011_TIS17_SfFniAU.log
c:\windows\system32\service\09062010_TIS17_SfFniAU.log
c:\windows\system32\service\09082010_TIS17_SfFniAU.log
c:\windows\system32\service\09092010_TIS17_SfFniAU.log
c:\windows\system32\service\12072010_TIS17_SfFniAU.log
c:\windows\system32\service\15072010_TIS17_SfFniAU.log
c:\windows\system32\service\15082010_TIS17_SfFniAU.log
c:\windows\system32\service\18052010_TIS17_SfFniAU.log
.
.
((((((((((((((((((((((((( Files Created from 2011-07-06 to 2011-08-06 )))))))))))))))))))))))))))))))
.
.
2011-08-05 21:01 . 2011-08-05 21:07 -------- d-----w- c:\windows\system32\NtmsData
2011-08-04 03:39 . 2003-02-27 20:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-08-04 03:39 . 2002-12-05 18:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-08-04 03:39 . 2002-12-02 19:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-08-04 03:39 . 2002-12-02 17:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-08-04 03:39 . 2002-12-02 17:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-08-04 03:39 . 2011-08-04 03:39 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-08-04 03:39 . 2011-08-04 03:39 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-08-04 03:13 . 2011-08-04 03:13 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-04 01:09 . 2011-08-04 01:09 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Trend Micro
2011-08-02 19:50 . 2011-08-05 03:12 -------- d-----w- C:\sh4ldr
2011-08-02 19:50 . 2011-08-02 19:50 -------- d-----w- c:\program files\Enigma Software Group
2011-08-02 19:49 . 2011-08-05 03:12 -------- d-----w- c:\windows\820C0EEB9B124AD5B39DD15ED1DBDD06.TMP
2011-07-31 14:47 . 2011-07-31 14:47 388096 ----a-r- c:\documents and settings\Dan\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-07-31 13:30 . 2011-07-31 13:30 -------- d-----w- c:\program files\Common Files\L&H
2011-07-31 13:29 . 2011-07-31 13:29 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-07-31 13:27 . 2011-07-31 13:27 -------- d-----w- c:\program files\Microsoft Works
2011-07-31 02:43 . 2011-07-31 02:43 -------- d-----w- c:\documents and settings\All Users\CrypKey
2011-07-31 02:43 . 2008-05-07 23:29 122880 ----a-w- c:\windows\system32\Crypserv.exe
2011-07-31 02:43 . 2008-03-17 16:45 19584 ----a-w- c:\windows\system32\Ckldrv.sys
2011-07-31 02:43 . 1999-06-18 20:49 165888 ----a-w- c:\windows\Ckconfig.exe
2011-07-31 02:43 . 1996-05-03 16:21 27648 ----a-r- c:\windows\Setup_ck.exe
2011-07-31 02:43 . 1996-05-03 14:36 18432 ----a-w- c:\windows\Setup_ck.dll
2011-07-31 02:43 . 1995-07-04 17:33 11776 ----a-w- c:\windows\Ckrfresh.exe
2011-07-31 02:43 . 2006-04-17 15:56 1207808 ----a-w- c:\windows\system32\PhoenixDll.dll
2011-07-31 02:43 . 2004-10-17 01:46 178176 ----a-w- c:\windows\system32\StellarProfile.dll
2011-07-31 02:42 . 2011-07-31 03:23 -------- d-----w- c:\program files\Stellar Phoenix Outlook PST Repair
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-04 01:07 . 2011-06-22 22:59 92112 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2011-08-04 01:07 . 2011-06-03 02:10 80464 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2011-08-04 01:07 . 2011-06-03 02:10 64080 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2011-08-04 01:07 . 2011-06-03 02:10 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-08-02 21:30 . 2011-08-02 21:30 1802455 ----a-w- C:\DAN-01_2011.08.02-1723.58_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-08-02 13:50 . 2011-08-02 13:50 1721200 ----a-w- C:\DAN-01_2011.08.02-0938.14_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-08-02 03:55 . 2011-08-02 03:55 1729931 ----a-w- C:\DAN-01_2011.08.01-2342.03_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-08-01 13:22 . 2011-08-01 13:22 1728375 ----a-w- C:\DAN-01_2011.08.01-0914.36_734998df-92c9-47a9-8976-161382b11cce_3600.zip
2011-07-31 15:17 . 2011-05-18 12:23 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-31 13:11 . 2011-07-31 13:11 21354 ----a-w- C:\DAN-01_2011.07.31-0911.00_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 12:16 . 2011-07-31 12:16 21404 ----a-w- C:\DAN-01_2011.07.31-0816.06_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 04:39 . 2011-07-31 04:39 21302 ----a-w- C:\DAN-01_2011.07.31-0039.07_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 04:15 . 2011-07-31 04:15 21329 ----a-w- C:\DAN-01_2011.07.31-0014.58_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-31 04:13 . 2011-07-31 04:13 718409 ----a-w- C:\DAN-01_2011.07.31-0012.35_734998df-92c9-47a9-8976-161382b11cce_3592.zip
2011-07-30 02:57 . 2010-04-28 16:25 90112 ----a-w- c:\windows\DUMP2cbd.tmp
2011-06-21 10:43 . 2009-05-22 00:21 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-06-21 10:43 . 2009-05-21 22:57 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-06-02 14:02 . 2008-04-14 05:00 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-01 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2010-03-17 19520544]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-06-06 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-02-17 1111568]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SpyHunter 4 Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
.
R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [8/3/2011 9:08 PM 188272]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [6/2/2011 10:10 PM 64080]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/30/2010 10:47 PM 136176]
S2 LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258;LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258);"c:\docume~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe" -service -sid c9ac5d2e-a940-48c9-ab70-e68c08553258 --> c:\docume~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/28/2010 5:15 PM 1691480]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 6:44 PM 183560]
S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/30/2010 10:47 PM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-01 02:47]
.
2011-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-01 02:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-TkBellExe - c:\program files\Real\RealPlayer\update\realsched.exe
AddRemove-RealPlayer 12.0 - c:\program files\Real\RealPlayer\Update\r1puninst.exe
AddRemove-Yahoo! Toolbar - c:\progra~1\Yahoo!\Common\UNYT_W~1.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-05 22:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-583907252-436374069-1801674531-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(808)
c:\windows\system32\nvappfilter.dll
.
- - - - - - - > 'explorer.exe'(3028)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Trend Micro\AMSP\coreFrameworkHost.exe
c:\program files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-08-05 22:23:18 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-06 02:23
.
Pre-Run: 133,171,019,776 bytes free
Post-Run: 133,365,358,592 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 559958C13599961C3C7899C5BEB7D2F2


----------



## Danstang (Aug 4, 2011)

Sorry - Jumped the gun and forgot to post the aswMBR log - here it is;

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-08 11:21:15
-----------------------------
11:21:15.265 OS Version: Windows 5.1.2600 Service Pack 3
11:21:15.265 Number of processors: 2 586 0x4B02
11:21:15.265 ComputerName: DAN-01 UserName: Dan
11:21:15.937 Initialize success
11:21:21.625 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-c
11:21:21.625 Disk 0 Vendor: WDC_WD1600JB-00REA0 20.00K20 Size: 152626MB BusType: 3
11:21:21.625 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\00000067
11:21:21.625 Disk 1 Vendor: WDC_WD2500JS-58NCB1 10.02E02 Size: 238475MB BusType: 3
11:21:21.625 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000068
11:21:21.625 Disk 2 Vendor: WDC_WD2500JS-58NCB1 10.02E02 Size: 238475MB BusType: 3
11:21:21.640 Disk 1 MBR read successfully
11:21:21.640 Disk 1 MBR scan
11:21:21.640 Disk 1 Windows XP default MBR code
11:21:21.640 Disk 1 scanning sectors +488392065
11:21:21.718 Disk 1 scanning C:\WINDOWS\system32\drivers
11:21:26.765 Service scanning
11:21:27.703 Modules scanning
11:21:32.796 Disk 1 trace - called modules:
11:21:32.812 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys 
11:21:32.812 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x8ae94ab8]
11:21:32.812 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\00000069[0x8aefbac0]
11:21:32.812 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\00000067[0x8adf1030]
11:21:32.812 Scan finished successfully
11:21:52.859 Disk 1 MBR has been saved successfully to "C:\Documents and Settings\Dan\Desktop\MBR.dat"
11:21:52.859 The log file has been saved successfully to "C:\Documents and Settings\Dan\Desktop\aswMBR.txt"


----------



## Cookiegal (Aug 27, 2003)

Thanks.

Please download Malwarebytes' Anti-Malware from *Here*.

Double Click *mbam-setup.exe* to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish, so please be patient.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.
Extra Note:

*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.*


----------



## Danstang (Aug 4, 2011)

Here is the mbamlog;

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7410
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/8/2011 12:33:02 PM
mbam-log-2011-08-08 (12-33-02).txt
Scan type: Quick scan
Objects scanned: 170453
Time elapsed: 54 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## Danstang (Aug 4, 2011)

Hi Cookiegal,

First, thanks for helping! It is much appreciated.

2nd, I'll ask you please to understand any run together words or small typos - have to use an OLD OLD keyboard at present and it "sticks".

I want to let you know a few points here;

Today (Aug, 8th, at aprox 1:30 - 1:45 EDT, my 8 year old son moved the mouse and up popped the following:
- Microsoft Excel Book 1 
- CrypKey
- Toolbar & Start Menu
- Also, email settings (date received, size, from, etc) were changed

At this point I deleted as many cookies and temp files as possible. In one of the temp ore cookie folders, I could not delete 6 or 7. They were the same ones as I first saw at the beginning of this issue (www999 dot shopping dot com, plus there are others which are referencing 2 bank acounts I have - If you need the specifics, I can tyry and find a way to get them to you).

Then today, Aug 8th at aprox 8:30 EDT,upon the computer, I had open the latest message in outlook from tech support guy forum from you - before I executed the instruction to run OTS, I was tattempting to making a credit card payment to a site calld Uncle Bobs Self Storage. The payment attempt failed (due to using an outdated card, my fault) and when it was attempted again, the following resulted:

- 3 Microsoft Office Windows opened - could not view which ones
- The toolbar moved again to the top of the PC
- Unable to click on any icons on the toolbar -including Trend which was running at the time
- WAS able to click in MS Outlook messages section

- Had to do a HARD restart

- Also, when attempting to cc and paste text from previous posts by mein this forum, it willlock up.

Also - have an HP Photosmart Printer / Scanner / Copier #B209A - connected via wireless - not always powered on - has been a problem child for some time (HP did a reg edit at one point to get it to work)

Sorry to throw all this at you, but I want to make sure we are chasing the correct issue.

Attached is the log

Thanks Again!!!!


----------



## Cookiegal (Aug 27, 2003)

Did all that occur before or after you ran OTS?

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new HijackThis log please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" [HKLM] -> [Google Toolbar]
YN -> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> [Yahoo! Toolbar]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> [Google Toolbar]
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
YN -> "C:\Program Files\HP\HP Software Update\HPWUCli.exe" -> [C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe]
YN -> "E:\setup\hpznui01.exe" -> [E:\setup\hpznui01.exe:*:Enabled:hpznui01.exe]
[Files/Folders - Created Within 30 Days]
NY ->  6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY ->  3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY ->  1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp
[Files/Folders - Modified Within 30 Days]
NY ->  6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY ->  3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY ->  1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp
[Empty Temp Folders]
[EmptyFlash]
[Start Explorer]
[Reboot]
```


----------



## Danstang (Aug 4, 2011)

All of that occurred before I ran OTS.

I cc'd and pasted the fix into OTS and ran it, but did not turn off Trend a/v. When the computer rebooted, the log came up, but when I tried to save it to notepad, notepad stopped responding. I then realized I hadn'tgiven trend a/v enough timeto load - so that log is gone so far as I know (unless you know where it may be stored) - I'll be more careful going forward, I promise - and thank you for your continued help.

Here is the log for HiJackThis (ran this one w/ Trend turned OFF)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:31:39 PM, on 8/10/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Unknown owner - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (file missing)
--
End of file - 10366 bytes


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## Danstang (Aug 4, 2011)

OK - I have done this but when I try and save it to notepad I get the following warning - 
This filec ontains characters in Unicode formatwhich will be lost if you save this file in an ANSI encoded text file. To keep the unicode information click cancel and selectonr of the unicode options fromthe encoding frop down list.
The options are as follows-
ANSI
Unicode
Unicode big endian
UTF-8

So...how shalI save this? - I still have this upon my screen, but fear I will loose this if the system goes haywire again...


----------



## Cookiegal (Aug 27, 2003)

Just leave it save to the default ANSI.


----------



## Danstang (Aug 4, 2011)

OK - log below - A few observations;

There are ALOT of the 7023 event ID's in the system errors.
The times of the application erros for today (8-10) coincide with the times the computer displyed the symptoms.

APPLICATION ERRORS:
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/9/2011
Time: 5:24:41 PM
User: N/A
Computer: DAN-01
Description:
Hanging application mbam.exe, version 1.51.1.1076, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 6d 62 61 6d 2e 65 mbam.e
0018: 78 65 20 31 2e 35 31 2e xe 1.51.
0020: 31 2e 31 30 37 36 20 69 1.1076 i
0028: 6e 20 68 75 6e 67 61 70 n hungap
0030: 70 20 30 2e 30 2e 30 2e p 0.0.0.
0038: 30 20 61 74 20 6f 66 66 0 at off
0040: 73 65 74 20 30 30 30 30 set 0000
0048: 30 30 30 30 0000 
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/9/2011
Time: 5:24:42 PM
User: N/A
Computer: DAN-01
Description:
Hanging application mbam.exe, version 1.51.1.1076, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 6d 62 61 6d 2e 65 mbam.e
0018: 78 65 20 31 2e 35 31 2e xe 1.51.
0020: 31 2e 31 30 37 36 20 69 1.1076 i
0028: 6e 20 68 75 6e 67 61 70 n hungap
0030: 70 20 30 2e 30 2e 30 2e p 0.0.0.
0038: 30 20 61 74 20 6f 66 66 0 at off
0040: 73 65 74 20 30 30 30 30 set 0000
0048: 30 30 30 30 0000 
Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 8/9/2011
Time: 5:24:46 PM
User: N/A
Computer: DAN-01
Description:
Fault bucket -1769735916.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket: 
0008: 2d 31 37 36 39 37 33 35 -1769735
0010: 39 31 36 0d 0a 916.. 
Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 8/9/2011
Time: 5:24:48 PM
User: N/A
Computer: DAN-01
Description:
Fault bucket -1769735916.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket: 
0008: 2d 31 37 36 39 37 33 35 -1769735
0010: 39 31 36 0d 0a 916.. 
Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3001
Date: 8/9/2011
Time: 7:31:12 PM
User: N/A
Computer: DAN-01
Description:
The performance counter name string value in the registry is incorrectly formatted. The bogus string is 9392, the bogus index value is the first DWORD in Data section while the last valid index values are the second and third DWORD in Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b0 24 00 00 3c 22 00 00 °$..<"..
0008: 3d 22 00 00 cf 01 00 00 ="..Ï...
Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3011
Date: 8/9/2011
Time: 7:31:12 PM
User: N/A
Computer: DAN-01
Description:
Unloading the performance counter strings for service ASP.NET_2.0.50727 (ASP.NET_2.0.50727) failed. The Error code is the first DWORD in Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: f2 03 00 00 3b 07 00 00 ò...;...
Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3001
Date: 8/9/2011
Time: 7:31:13 PM
User: N/A
Computer: DAN-01
Description:
The performance counter name string value in the registry is incorrectly formatted. The bogus string is 9392, the bogus index value is the first DWORD in Data section while the last valid index values are the second and third DWORD in Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b0 24 00 00 3c 22 00 00 °$..<"..
0008: 3d 22 00 00 cf 01 00 00 ="..Ï...
Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3011
Date: 8/9/2011
Time: 7:31:13 PM
User: N/A
Computer: DAN-01
Description:
Unloading the performance counter strings for service aspnet_state (ASP.NET State Service) failed. The Error code is the first DWORD in Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: f2 03 00 00 3b 07 00 00 ò...;...
Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3001
Date: 8/9/2011
Time: 7:31:13 PM
User: N/A
Computer: DAN-01
Description:
The performance counter name string value in the registry is incorrectly formatted. The bogus string is 9392, the bogus index value is the first DWORD in Data section while the last valid index values are the second and third DWORD in Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b0 24 00 00 3c 22 00 00 °$..<"..
0008: 3d 22 00 00 97 02 00 00 ="..?...
Event Type: Error
Event Source: .NET Runtime Optimization Service
Event Category: None
Event ID: 1101
Date: 8/9/2011
Time: 7:58:33 PM
User: N/A
Computer: DAN-01
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to compile: C:\Program Files\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe . Error code = 0x80131047

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: .NET Runtime
Event Category: None
Event ID: 1023
Date: 8/9/2011
Time: 9:06:10 PM
User: N/A
Computer: DAN-01
Description:
.NET Runtime version 2.0.50727.3623 - Fatal Execution Engine Error (7A0BC58E) (80131506)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000
Date: 8/9/2011
Time: 9:06:11 PM
User: N/A
Computer: DAN-01
Description:
Faulting application mscorsvw.exe, version 2.0.50727.3053, stamp 4889dc4b, faulting module mscorwks.dll, version 2.0.50727.3623, stamp 4d8c187e, debug? 0, fault address 0x00003f94.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 6d 00 73 00 63 00 .m.s.c.
0030: 6f 00 72 00 73 00 76 00 o.r.s.v.
0038: 77 00 2e 00 65 00 78 00 w...e.x.
0040: 65 00 20 00 32 00 2e 00 e. .2...
0048: 30 00 2e 00 35 00 30 00 0...5.0.
0050: 37 00 32 00 37 00 2e 00 7.2.7...
0058: 33 00 30 00 35 00 33 00 3.0.5.3.
0060: 20 00 34 00 38 00 38 00 .4.8.8.
0068: 39 00 64 00 63 00 34 00 9.d.c.4.
0070: 62 00 20 00 69 00 6e 00 b. .i.n.
0078: 20 00 6d 00 73 00 63 00 .m.s.c.
0080: 6f 00 72 00 77 00 6b 00 o.r.w.k.
0088: 73 00 2e 00 64 00 6c 00 s...d.l.
0090: 6c 00 20 00 32 00 2e 00 l. .2...
0098: 30 00 2e 00 35 00 30 00 0...5.0.
00a0: 37 00 32 00 37 00 2e 00 7.2.7...
00a8: 33 00 36 00 32 00 33 00 3.6.2.3.
00b0: 20 00 34 00 64 00 38 00 .4.d.8.
00b8: 63 00 31 00 38 00 37 00 c.1.8.7.
00c0: 65 00 20 00 66 00 44 00 e. .f.D.
00c8: 65 00 62 00 75 00 67 00 e.b.u.g.
00d0: 20 00 30 00 20 00 61 00 .0. .a.
00d8: 74 00 20 00 6f 00 66 00 t. .o.f.
00e0: 66 00 73 00 65 00 74 00 f.s.e.t.
00e8: 20 00 30 00 30 00 30 00 .0.0.0.
00f0: 30 00 33 00 66 00 39 00 0.3.f.9.
00f8: 34 00 0d 00 0a 00 4..... 
Event Type: Error
Event Source: .NET Runtime Optimization Service
Event Category: None
Event ID: 1101
Date: 8/9/2011
Time: 9:06:12 PM
User: N/A
Computer: DAN-01
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to compile: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll . Error code = 0x800706be

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: .NET Runtime
Event Category: None
Event ID: 1023
Date: 8/10/2011
Time: 6:39:42 AM
User: N/A
Computer: DAN-01
Description:
.NET Runtime version 2.0.50727.3623 - Fatal Execution Engine Error (7A0BC58E) (80131506)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000
Date: 8/10/2011
Time: 6:39:44 AM
User: N/A
Computer: DAN-01
Description:
Faulting application mscorsvw.exe, version 2.0.50727.3053, stamp 4889dc4b, faulting module mscorwks.dll, version 2.0.50727.3623, stamp 4d8c187e, debug? 0, fault address 0x00003f94.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 6d 00 73 00 63 00 .m.s.c.
0030: 6f 00 72 00 73 00 76 00 o.r.s.v.
0038: 77 00 2e 00 65 00 78 00 w...e.x.
0040: 65 00 20 00 32 00 2e 00 e. .2...
0048: 30 00 2e 00 35 00 30 00 0...5.0.
0050: 37 00 32 00 37 00 2e 00 7.2.7...
0058: 33 00 30 00 35 00 33 00 3.0.5.3.
0060: 20 00 34 00 38 00 38 00 .4.8.8.
0068: 39 00 64 00 63 00 34 00 9.d.c.4.
0070: 62 00 20 00 69 00 6e 00 b. .i.n.
0078: 20 00 6d 00 73 00 63 00 .m.s.c.
0080: 6f 00 72 00 77 00 6b 00 o.r.w.k.
0088: 73 00 2e 00 64 00 6c 00 s...d.l.
0090: 6c 00 20 00 32 00 2e 00 l. .2...
0098: 30 00 2e 00 35 00 30 00 0...5.0.
00a0: 37 00 32 00 37 00 2e 00 7.2.7...
00a8: 33 00 36 00 32 00 33 00 3.6.2.3.
00b0: 20 00 34 00 64 00 38 00 .4.d.8.
00b8: 63 00 31 00 38 00 37 00 c.1.8.7.
00c0: 65 00 20 00 66 00 44 00 e. .f.D.
00c8: 65 00 62 00 75 00 67 00 e.b.u.g.
00d0: 20 00 30 00 20 00 61 00 .0. .a.
00d8: 74 00 20 00 6f 00 66 00 t. .o.f.
00e0: 66 00 73 00 65 00 74 00 f.s.e.t.
00e8: 20 00 30 00 30 00 30 00 .0.0.0.
00f0: 30 00 33 00 66 00 39 00 0.3.f.9.
00f8: 34 00 0d 00 0a 00 4..... 
Event Type: Error
Event Source: .NET Runtime Optimization Service
Event Category: None
Event ID: 1101
Date: 8/10/2011
Time: 6:39:46 AM
User: N/A
Computer: DAN-01
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to compile: System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x800706be

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/10/2011
Time: 2:30:04 PM
User: N/A
Computer: DAN-01
Description:
Hanging application NOTEPAD.EXE, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 4e 4f 54 45 50 41 NOTEPA
0018: 44 2e 45 58 45 20 35 2e D.EXE 5.
0020: 31 2e 32 36 30 30 2e 35 1.2600.5
0028: 35 31 32 20 69 6e 20 68 512 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0 
Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 8/10/2011
Time: 2:30:28 PM
User: N/A
Computer: DAN-01
Description:
Fault bucket 736166847.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket: 
0008: 37 33 36 31 36 36 38 34 73616684
0010: 37 0d 0a 7..

SYSTEM ERRORS:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/7/2011
Time: 7:18:12 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/7/2011
Time: 7:18:12 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 8/7/2011
Time: 8:09:39 AM
User: DAN-01\Dan
Computer: DAN-01
Description:
DCOM got error "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/7/2011
Time: 8:09:39 AM
User: N/A
Computer: DAN-01
Description:
The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/7/2011
Time: 10:21:39 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/7/2011
Time: 10:21:39 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 8/7/2011
Time: 10:36:23 PM
User: DAN-01\Dan
Computer: DAN-01
Description:
DCOM got error "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/7/2011
Time: 10:36:23 PM
User: N/A
Computer: DAN-01
Description:
The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 8/7/2011
Time: 10:37:00 PM
User: DAN-01\Dan
Computer: DAN-01
Description:
DCOM got error "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/7/2011
Time: 10:37:00 PM
User: N/A
Computer: DAN-01
Description:
The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 8/7/2011
Time: 10:39:11 PM
User: DAN-01\Dan
Computer: DAN-01
Description:
DCOM got error "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/7/2011
Time: 10:39:11 PM
User: N/A
Computer: DAN-01
Description:
The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 8/7/2011
Time: 10:43:03 PM
User: DAN-01\Dan
Computer: DAN-01
Description:
DCOM got error "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/7/2011
Time: 10:43:03 PM
User: N/A
Computer: DAN-01
Description:
The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 7:04:57 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 7:04:57 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 7:04:57 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 8:19:18 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 8:19:18 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 8:59:36 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 8:59:36 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Print
Event Category: None
Event ID: 6161
Date: 8/8/2011
Time: 10:03:07 AM
User: DAN-01\Dan
Computer: DAN-01
Description:
The document Microsoft Word - Ebay info slips 8.17.doc owned by Dan failed to print on printer HP B209a New. Data type: NT EMF 1.008. Size of the spool file in bytes: 131072. Number of bytes printed: 76864. Total number of pages in the document: 1. Number of pages printed: 1. Client machine: \\DAN-01. Win32 error code returned by the print processor: 13 (0xd). 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Print
Event Category: None
Event ID: 6161
Date: 8/8/2011
Time: 12:00:17 PM
User: DAN-01\Dan
Computer: DAN-01
Description:
The document Microsoft Office Outlook - Memo Style owned by Dan failed to print on printer HP B209a New. Data type: NT EMF 1.008. Size of the spool file in bytes: 65536. Number of bytes printed: 0. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\DAN-01. Win32 error code returned by the print processor: 2250 (0x8ca). 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:45 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:45 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:45 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:46 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:47 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:48 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:49 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:50 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:51 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:52 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:53 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:54 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:55 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:56 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:57 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:58 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:45:59 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:00 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:01 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:02 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:03 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:04 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:05 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:06 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/8/2011
Time: 1:46:07 PM
User: N/A
Computer: DAN-01
Description:
The Application Management service terminated with the following error: 
The specified module could not be found. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 8:46:12 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/8/2011
Time: 8:46:12 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 6:26:15 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 6:26:15 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 5:09:03 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 5:09:03 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 5:28:44 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 5:28:44 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 7:34:22 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/9/2011
Time: 7:34:22 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7022
Date: 8/9/2011
Time: 7:36:00 PM
User: N/A
Computer: DAN-01
Description:
The ForceWare Intelligent Application Manager (IAM) service hung on starting.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 6:30:45 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 6:30:45 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 7:51:43 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 7:51:43 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 10:00:22 AM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 10:00:22 AM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:17 PM
User: N/A
Computer: DAN-01
Description:
The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 8/10/2011
Time: 2:21:17 PM
User: N/A
Computer: DAN-01
Description:
The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:17 PM
User: N/A
Computer: DAN-01
Description:
The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:17 PM
User: N/A
Computer: DAN-01
Description:
The Forceware Web Interface service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:17 PM
User: N/A
Computer: DAN-01
Description:
The Crypkey License service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:17 PM
User: N/A
Computer: DAN-01
Description:
The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:18 PM
User: N/A
Computer: DAN-01
Description:
The ForceWare IP service service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:18 PM
User: N/A
Computer: DAN-01
Description:
The ForceWare user log service service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:18 PM
User: N/A
Computer: DAN-01
Description:
The ForceWare Intelligent Application Manager (IAM) service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:18 PM
User: N/A
Computer: DAN-01
Description:
The SeaPort service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 8/10/2011
Time: 2:21:18 PM
User: N/A
Computer: DAN-01
Description:
The iPod Service service terminated unexpectedly. It has done this 1 time(s).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 2:25:18 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 2:25:18 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Error 7023 is a common problem with XP Home. Please see this MS article:

http://support.microsoft.com/kb/328213

Click on the button at the top obtain and apply the Hotfix.

Let me know when that's been done and how things are with the system after.

Also, do you have your XP installation CD?


----------



## Danstang (Aug 4, 2011)

Should I run the hot fix with trend on or off? 
Wouldn't this have been included in any of the windows updates?
I do have the CD with the key code, which includes SP2.


----------



## Cookiegal (Aug 27, 2003)

I don't think it was pushed out as an update as not all systems seem to be affected. Since you're having the symptoms, I would apply the hotfix. It shouldn't be necessary to disable Trend Micro unless the instructions tell you to do so.


----------



## Danstang (Aug 4, 2011)

OK -Thanks - I'll apply the hotfix and put the maching through it'spaces where the symptoms usually show themselves - though they do seem to be sporadic.
I also noticed that the 7023 errors did seem to stop on the 8th. Most recent system errors were mostly 7000 and 7034. Application errors variable #'s.


----------



## Danstang (Aug 4, 2011)

OK - I went to the link, got the email with the link to the zip file, unzipped to C, and tried to run the exe which is Q328213_WXP_SP2_x86_ENU but got an error saying:
the service pack already installed is newer than the update you are applying to it. You can only install this updateon a computer with no Service Packs installed.


----------



## Cookiegal (Aug 27, 2003)

Another alternative would be to just set the Application Management Service to Disabled if you prefer. To do that, go to *Start *- *Run *- type in *services.msc* and click OK. Double-click the Application Manager Service to open it and change the startup type to Disabled then click "Apply" and OK.


----------



## Cookiegal (Aug 27, 2003)

Also, please do this:

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.


----------



## Danstang (Aug 4, 2011)

Cookiegal said:


> Another alternative would be to just set the Application Management Service to Disabled if you prefer. To do that, go to *Start *- *Run *- type in *services.msc* and click OK. Double-click the Application Manager Service to open it and change the startup type to Disabled then click "Apply" and OK.


OK - When I was doing this the system showed it's symptoms - left hand start menu popped up and I was unableto close any of the windows I had open which included this forum, Outlook, the application manager.When I tried to use task manager to close the pages, that became locked also. Had to do a hard restart of the system. I just went back to verify that the application management startup type is disabled.

I also just went backto the event viewer and the only thing new is the following;

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 6:07:34 PM
User: N/A
Computer: DAN-01
Description:
The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/10/2011
Time: 6:07:34 PM
User: N/A
Computer: DAN-01
Description:
The Yahoo! Updater service failed to start due to the following error: 
The system cannot find the path specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Here is the Hi-Jack list:
32 Bit HP CIO Components Installer
737-700 Southwest Airlines Liveries Package v2.2
Acrobat.com
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader X (10.0.1)
Adobe Reader X (10.1.0)
Adobe Shockwave Player 11.5
aerosoft's - USCitiesX - Niagara Falls-Buffalo
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Big Biz Tycoon
Bing Bar
Bing Maps 3D
Bonjour
Cruise Ship Tycoon
Frogger v3.0e
FSX Booster 2.9.9.7
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 13.0
HP Imaging Device Functions 13.0
HP Photosmart Plus B209a-m All-In-One Driver Software 13.0 Rel .6
HP Print Projects 1.0
HP Product Detection
HP Smart Web Printing 4.5
HP Solution Center 13.0
iTunes
Java(TM) 6 Update 24
Jet City Aircraft 717-200
Kid Pix Deluxe 3
Kidspiration 3
Lernout & Hauspie TruVoice American English TTS Engine
Logitech Gaming Software
Logitech Gaming Software 5.09
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Flight Simulator X
Microsoft Flight Simulator X: Acceleration
Microsoft Flight Simulator X: Acceleration
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Disc 2
Microsoft Office 2000 Premium
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft PhotoDraw 2000
Microsoft Primary Interoperability Assemblies 2005
Microsoft Silverlight
Microsoft Train Simulator
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Windows XP Video Decoder Checkup Utility
Microsoft Zoo Tycoon
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
NVIDIA nView Desktop Manager
NVIDIA PhysX
QuickTime
RCS B-25J RAF MkII for FSX
RealNetworks - Microsoft Visual C++ 2008 Runtime
Realtek High Definition Audio Driver
RealUpgrade 1.1
Sales Manager Pro
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Shop for HP Supplies
Sonic CinePlayer DVD Pack
Stellar Phoenix Outlook PST Repair
System Requirements Lab
TeamSpeak 3 Client
Text to Speech XP
Tonka Search and Rescue
Trend Micro Titanium Internet Security
Trend Micro Titanium Internet Security
Ulead Photo Explorer 7.0 SE
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2492386)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
Vendio XPress Image Publisher
Windows Internet Explorer 8
Windows Live ID Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
WinZip 12.1


----------



## Cookiegal (Aug 27, 2003)

Did Trend (or someone else) use LogMeIn to remote into your computer to try to help? Because that's one of the errors, the service is calling the file, which is missing.


----------



## Danstang (Aug 4, 2011)

Yes - Trend used logmein - they in fact left it running. When I turned on the PC the next day (after they insisted that ithe issue is a mouse problem) the chat window popped up and I had a heckof a time getting rid of it and getting the computer back to the regular screen etc. 

Have you in your mind ruled out a trojan or virusor hi-jack at this point?


----------



## Cookiegal (Aug 27, 2003)

Danstang said:


> Yes - Trend used logmein - they in fact left it running. When I turned on the PC the next day (after they insisted that ithe issue is a mouse problem) the chat window popped up and I had a heckof a time getting rid of it and getting the computer back to the regular screen etc.
> 
> Have you in your mind ruled out a trojan or virusor hi-jack at this point?


Not quite yet. Let's just get rid of those services though (LogMeIn and the Yahoo Updater which is causing the same problem) first:

Go to *Start *- *Run * type in *cmd *then click OK. The MSDOS window will be displayed. At the prompt type the following:

*SC Delete "LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258)"*

Then press Enter

Type:

*SC Delete YahooAUService*

Press enter

Type:

*Exit*

Press Enter

Then please do this:

Please run the following on-line scanner. Note that you must use Internet Explorer to perform the scan.

Note: If you're running a 64-bit system you have to choose the 32-bit option in IE. To do that, go to the Start Menu and right-click the Internet Explorer (32-bit) icon and then select 'Run as administrator' from the right-click menu.

http://www.eset.com/online-scanner

Accept the Terms of Use and then press the Start button

Allow the ActiveX control to be installed.

Put a check by Remove found threats and then run the scan.

When the scan is finished, you will see the results in a window.

A log.txt file is created here: C:\Program Files\EsetOnlineScanner\log.txt.

Open the log file with Notepad and copy and paste the contents here please.


----------



## Danstang (Aug 4, 2011)

Cookiegal said:


> Not quite yet. Let's just get rid of those services though (LogMeIn and the Yahoo Updater which is causing the same problem) first:
> 
> Go to *Start *- *Run *type in *cmd *then click OK. The MSDOS window will be displayed. At the prompt type the following:
> 
> ...


OK - got rid of the YahooAU, but it could not find LogMeIn... I tried it in just about every variation I could think of (with and without spaces, " marks, etc)

I am running the scan now, but I also left Trend Micro on, will that present an issue?


----------



## Cookiegal (Aug 27, 2003)

Trend shouldn't be an issue.

Please post a new HijackThis log as well as the Eset scan lot.


----------



## Danstang (Aug 4, 2011)

OK - Here is the Eset Scan:

[email protected] as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=1c78bee5232b7d40b936c644cc377997
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-11 02:46:18
# local_time=2011-08-10 10:46:18 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777175 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=389610
# found=0
# cleaned=0
# scan_time=10177

Here is the new HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:55:45 PM, on 8/10/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 10803 bytes


----------



## Cookiegal (Aug 27, 2003)

Please open HijackThis.
Click on *Open Misc Tools Section*
Make sure that both boxes beside "Generate StartupList Log" are checked:

*List all minor sections(Full)*
*List Empty Sections(Complete)*
Click *Generate StartupList Log*.
Click *Yes* at the prompt.
It will open a text file. Please copy the entire contents of that page and paste it here.


----------



## Danstang (Aug 4, 2011)

StartupList report, 8/11/2011, 4:58:54 PM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HiJackThis\HiJackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\Dan\Start Menu\Programs\Startup]
*No files*
Shell folders AltStartup:
*Folder not found*
User shell folders Startup:
*Folder not found*
User shell folders AltStartup:
*Folder not found*
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
*No files*
Shell folders Common AltStartup:
*Folder not found*
User shell folders Common Startup:
*Folder not found*
User shell folders Alternate Common Startup:
*Folder not found*
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*
[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RTHDCPL = RTHDCPL.EXE
HP Software Update = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
nwiz = C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Trend Micro Titanium = C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
Trend Micro Client Framework = "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
swg = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
[OptionalComponents]
= 
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*
--------------------------------------------------
File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .COM:
HKEY_CLASSES_ROOT\ComFile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command
(Default) = "%1" /S
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) = "%1" %*
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1
--------------------------------------------------
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe
[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP
[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
--------------------------------------------------
Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps
*Registry key not found*
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=*Registry value not found*
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present
--------------------------------------------------
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
--------------------------------------------------
Verifying REGEDIT.EXE integrity:
- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'
Registry check passed
--------------------------------------------------
Enumerating Browser Helper Objects:
AcroIEHelperStub - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll - {18DF081C-E8AD-4283-A596-FA578C2EBDC3}
Trend Micro NSC BHO - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\TmIEPlg.dll - {1CA1377B-DC1D-4A52-9585-6E06050FAC53}
(no name) - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
TmBpIeBHO - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC}
(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}
--------------------------------------------------
Enumerating Task Scheduler jobs:
GoogleUpdateTaskMachineCore.job
GoogleUpdateTaskMachineUA.job
--------------------------------------------------
Enumerating Download Program Files:
[Device Detection]
InProcServer32 = C:\WINDOWS\DOWNLO~1\LOGITE~1.OCX
CODEBASE = http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Adobe\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\LegitCheckControl.DLL
CODEBASE = http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab
[System Requirements Lab Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\sysreqlab_nvd.dll
CODEBASE = http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
OSD = C:\WINDOWS\Downloaded Program Files\sysreqlab.osd
[SysData Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SysInfo.dll
CODEBASE = https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
[GMNRev Class]
InProcServer32 = C:\Program Files\HP\Common\HPGMNRev.dll
CODEBASE = http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
[OnlineScanner Control]
InProcServer32 = C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX
CODEBASE = http://download.eset.com/special/eos/OnlineScanner.cab
[Java Plug-in 1.6.0_24]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
[Java Plug-in 1.6.0_24]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
[Java Plug-in 1.6.0_24]
InProcServer32 = C:\Program Files\Java\jre6\bin\npjpi160_24.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10u.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
[{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
CODEBASE = http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dll
Protocol #1: C:\WINDOWS\system32\nvappfilter.dll
Protocol #2: C:\WINDOWS\system32\nvappfilter.dll
Protocol #3: C:\WINDOWS\system32\nvappfilter.dll
Protocol #4: C:\WINDOWS\system32\mswsock.dll
Protocol #5: C:\WINDOWS\system32\mswsock.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\rsvpsp.dll
Protocol #8: C:\WINDOWS\system32\rsvpsp.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\nvappfilter.dll
--------------------------------------------------
Enumerating Windows NT/2000/XP services
Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
Ambfilt: system32\drivers\Ambfilt.sys (manual start)
Trend Micro Solution Platform: "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 (autostart)
Apple Mobile Device: "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" (autostart)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
1394 ARP Client Protocol: system32\DRIVERS\arp1394.sys (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
Bing Bar Update Service: "C:\Program Files\Microsoft\BingBar\BBSvc.EXE" (manual start)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
BVRPMPR5 NDIS Protocol Driver: \??\C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (manual start)
catchme: \??\C:\DOCUME~1\Dan\LOCALS~1\Temp\catchme.sys (manual start)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)
.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
COM+ System Application: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
cpuz132: \??\C:\DOCUME~1\Dan\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys (manual start)
Crypkey License: crypserv.exe (autostart)
CryptSvc: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
esgiguard: \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys (manual start)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: system32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: system32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\DRIVERS\fltMgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
ForceWare Intelligent Application Manager (IAM): C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe (autostart)
Forceware Web Interface: "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (autostart)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
GEAR ASPI Filter Driver: system32\DRIVERS\GEARAspiWDM.sys (manual start)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Google Update Service (gupdate): C:\Program Files\Google\Update\GoogleUpdate.exe /svc (autostart)
Google Update Service (gupdatem): C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc (manual start)
Google Software Updater: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (manual start)
Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
hpqcxs08: %SystemRoot%\system32\svchost.exe -k hpdevmgmt (manual start)
HP CUE DeviceDiscovery Service: %SystemRoot%\system32\svchost.exe -k hpdevmgmt (autostart)
HP Network Devices Support: %SystemRoot%\system32\svchost.exe -k HPService (autostart)
IEEE-1284.4 Driver HPZid412: system32\DRIVERS\HPZid412.sys (manual start)
Print Class Driver for IEEE-1284.4 HPZipr12: system32\DRIVERS\HPZipr12.sys (manual start)
USB to IEEE-1284.4 Translation Driver HPZius12: system32\DRIVERS\HPZius12.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
Windows CardSpace: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: %systemroot%\system32\imapi.exe (manual start)
Service for Realtek HD Audio (WDM): system32\drivers\RtkHDAud.sys (manual start)
IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Java Quick Starter: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" (autostart)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258): "C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe" -service -sid c9ac5d2e-a940-48c9-ab70-e68c08553258 (autostart)
Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Monfilt: system32\drivers\Monfilt.sys (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: %systemroot%\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
Net Driver HPZ12: %SystemRoot%\System32\svchost.exe -k HPZ12 (autostart)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)
NetworkX: \SystemRoot\system32\ckldrv.sys (system)
1394 Net Driver: system32\DRIVERS\nic1394.sys (manual start)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
ForceWare IP service: C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (autostart)
ForceWare user log service: C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe (autostart)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
nvata: system32\DRIVERS\nvata.sys (system)
NVIDIA nForce Networking Controller Driver: system32\DRIVERS\NVENETFD.sys (manual start)
NVIDIA Network Bus Enumerator: system32\DRIVERS\nvnetbus.sys (manual start)
NVIDIA Display Driver Service: C:\WINDOWS\system32\nvsvc32.exe (autostart)
NVIDIA TCP/IP Protocol Driver: System32\DRIVERS\NVTcp.sys (system)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
Texas Instruments OHCI Compliant IEEE 1394 Host Controller: system32\DRIVERS\ohci1394.sys (system)
Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)
Parallel port driver: system32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
Pml Driver HPZ12: %SystemRoot%\System32\svchost.exe -k HPZ12 (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Processor Driver: system32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost.exe -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SeaPort: "C:\Program Files\Microsoft\BingBar\SeaPort.EXE" (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)
Serial port driver: system32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Still Serial Digital Camera Driver: system32\DRIVERS\serscan.sys (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{EFDDD699-E4C4-4D8F-9B6C-5515C86BD77B} (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
tmactmon: system32\DRIVERS\tmactmon.sys (autostart)
tmcomm: system32\DRIVERS\tmcomm.sys (autostart)
tmevtmgr: system32\DRIVERS\tmevtmgr.sys (autostart)
Trend Micro TDI Driver: system32\DRIVERS\tmtdi.sys (system)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
USB Audio Driver (WDM): system32\drivers\usbaudio.sys (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
Microsoft USB Standard Hub Driver: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB Open Host Controller Miniport Driver: system32\DRIVERS\usbohci.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Live ID Sign-in Assistant: "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" (autostart)
Logitech Virtual Bus Enumerator Driver: system32\drivers\WmBEnum.sys (manual start)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Logitech Gaming HID Filter Driver: system32\drivers\WmFilter.sys (manual start)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)
Logitech Virtual Hid Device Driver: system32\drivers\WmVirHid.sys (manual start)
Logitech Translation Layer Driver: system32\drivers\WmXlCore.sys (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\shell32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*No values found*
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*No values found*
--------------------------------------------------
End of report, 40,492 bytes
Report generated in 0.078 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Cookiegal (Aug 27, 2003)

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*
Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:regfind
LMIRescue
LogMeIn
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## Danstang (Aug 4, 2011)

SystemLook 30.07.11 by jpshortstuff
Log created at 20:00 on 11/08/2011 by Dan
Administrator - Elevation successful
========== regfind ==========
Searching for "LMIRescue"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LMIRESCUE_C9AC5D2E-A940-48C9-AB70-E68C08553258]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LMIRESCUE_C9AC5D2E-A940-48C9-AB70-E68C08553258\0000]
"Service"="LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258]
Searching for "LogMeIn"
[HKEY_LOCAL_MACHINE\SOFTWARE\LogMeIn Rescue]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_LMIRESCUE_C9AC5D2E-A940-48C9-AB70-E68C08553258\0000]
"DeviceDesc"="LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258)"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258]
"DisplayName"="LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258)"
-= EOF =-


----------



## Danstang (Aug 4, 2011)

Thought you should know about this - Just received an email from snewellherm @ aol . com addressed to an old email address of mine which is still being forwarded (my emailsuffix used to be @adelphia.net, then Time Warner bought Adelphia, so now my email is @roadrunner.com, but I still get all of the old @Adelphia.net emails)

The email I received stated the following:

"Dear Friends,
I learned this morning that my home email account has been compromised.
Apparently everyone in my address book is being sent an email from my account. I'm not sure if the link has a virus, whether it's a link to a porno site, or some other form of advertisement. But if you haven't already opened an earlier email from this address PLEASE DO NOT OPEN IT.
Too bad there are creeps that do things like this and have nothing more constructive to do.
I've changed my password so hopefully this will not happen again.
Very sorry for the inconvenience.
Hope you are having a great summer.
Steve"

I did an outlook search for this email addy, but came up empty - when this whole thing started, I lost all my emails and contacts - lost outlook all-together which is when I called Trend Micro before I started this thread- Trend was of no help.


----------



## Cookiegal (Aug 27, 2003)

Please run DDS again and post the new log.


----------



## Danstang (Aug 4, 2011)

.
DDS (Ver_2011-06-23.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702
Run by Dan at 17:38:27 on 2011-08-12
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2524 [GMT -4:00]
.
AV: Trend Micro Titanium Internet Security *Enabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: ActiveArmor Firewall *Enabled* 
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Trend Micro Titanium] c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe -set Silent "1" SplashURL ""
mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe"
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272584659703
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{8B6CA0C5-AA6D-492B-86A2-AC769EFCC3A0} : DhcpNameServer = 192.168.1.1
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2011-8-3 188272]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2011-6-2 64080]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-30 136176]
S2 LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258;LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258);"c:\docume~1\dan\locals~1\temp\lmir0001.tmp\lmi_rescue_srv.exe" -service -sid c9ac5d2e-a940-48c9-ab70-e68c08553258 --> c:\docume~1\dan\locals~1\temp\lmir0001.tmp\LMI_Rescue_srv.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-4-28 1691480]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
S3 cpuz132;cpuz132;\??\c:\docume~1\dan\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\dan\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 esgiguard;esgiguard;\??\c:\program files\enigma software group\spyhunter\esgiguard.sys --> c:\program files\enigma software group\spyhunter\esgiguard.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-4-30 136176]
.
=============== Created Last 30 ================
.
2011-08-10 23:53:59 -------- d-----w- c:\program files\ESET
2011-08-10 21:41:20 229736 ----a-w- C:\Q328213_WXP_SP2_x86_ENU.exe
2011-08-10 18:21:16 -------- d-----w- C:\_OTS
2011-08-10 11:57:17 -------- d-----w- c:\documents and settings\dan\local settings\application data\PCHealth
2011-08-08 16:06:50 -------- d-----w- c:\documents and settings\dan\application data\Malwarebytes
2011-08-08 16:06:35 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-08-08 16:06:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-06 02:04:38 -------- d-sha-r- C:\cmdcons
2011-08-06 02:02:04 98816 ----a-w- c:\windows\sed.exe
2011-08-06 02:02:04 518144 ----a-w- c:\windows\SWREG.exe
2011-08-06 02:02:04 256000 ----a-w- c:\windows\PEV.exe
2011-08-06 02:02:04 208896 ----a-w- c:\windows\MBR.exe
2011-08-05 21:01:44 -------- d-----w- c:\windows\system32\NtmsData
2011-08-04 03:39:58 696320 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2011-08-04 03:39:58 57344 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2011-08-04 03:39:58 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2011-08-04 03:39:58 237568 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2011-08-04 03:39:58 155648 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2011-08-04 03:39:53 282756 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2011-08-04 03:39:53 163972 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2011-08-04 03:13:01 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-08-04 03:13:01 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-02 19:50:16 -------- d-----w- c:\program files\Enigma Software Group
2011-07-31 14:47:08 388096 ----a-r- c:\documents and settings\dan\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-07-31 13:30:14 -------- d-----w- c:\program files\common files\L&H
2011-07-31 13:29:14 -------- d-----w- c:\program files\Microsoft ActiveSync
2011-07-31 02:43:50 -------- d-----w- c:\documents and settings\all users\CrypKey
2011-07-31 02:43:04 27648 ----a-r- c:\windows\Setup_ck.exe
2011-07-31 02:43:04 19584 ----a-w- c:\windows\system32\Ckldrv.sys
2011-07-31 02:43:04 18432 ----a-w- c:\windows\Setup_ck.dll
2011-07-31 02:43:04 165888 ----a-w- c:\windows\Ckconfig.exe
2011-07-31 02:43:04 122880 ----a-w- c:\windows\system32\Crypserv.exe
2011-07-31 02:43:04 11776 ----a-w- c:\windows\Ckrfresh.exe
2011-07-31 02:43:00 178176 ----a-w- c:\windows\system32\StellarProfile.dll
2011-07-31 02:43:00 1207808 ----a-w- c:\windows\system32\PhoenixDll.dll
2011-07-31 02:42:57 -------- d-----w- c:\program files\Stellar Phoenix Outlook PST Repair
2011-07-30 04:31:03 -------- d-----w- c:\windows\pss
.
==================== Find3M ====================
.
2011-08-06 22:17:27 233812 ----a-w- c:\windows\system32\nvdrsdb0.bin
2011-08-06 22:17:27 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-08-06 22:09:46 233804 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-08-04 01:07:54 92112 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2011-08-04 01:07:54 80464 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2011-08-04 01:07:54 64080 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2011-08-04 01:07:54 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-07-31 15:17:13 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\windows\system32\html.iec
2011-06-21 10:43:26 499712 ----a-w- c:\windows\system32\msvcp71.dll
2011-06-21 10:43:26 348160 ----a-w- c:\windows\system32\msvcr71.dll
2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 17:39:58.60 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 4/28/2010 4:46:16 PM
System Uptime: 8/12/2011 4:22:02 PM (1 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | M57SLI-S4
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ | Socket M2 | 2412/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 123.21 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 232.517 GiB free.
E: is CDROM ()
F: is FIXED (NTFS) - 149 GiB total, 134.361 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}
Description: Photosmart Plus B209a-m
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart Plus B209a-m
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service: 
.
==== System Restore Points ===================
.
RP1: 8/2/2011 7:21:37 PM - System Checkpoint
RP2: 8/2/2011 7:28:12 PM - Removed USB Wireless Keyboard Driver
RP3: 8/2/2011 7:37:50 PM - Installed USB Wireless Keyboard Driver
RP4: 8/3/2011 3:00:14 AM - Software Distribution Service 3.0
RP5: 8/3/2011 6:30:51 PM - Removed Driver Detective.
RP6: 8/3/2011 6:36:46 PM - Removed USB Wireless Keyboard Driver
RP7: 8/3/2011 8:06:22 PM - back-up
RP8: 8/3/2011 8:14:55 PM - Installed Windows Installer Clean Up
RP9: 8/3/2011 9:15:26 PM - Removed Windows Installer Clean Up
RP10: 8/3/2011 9:18:53 PM - Software Distribution Service 3.0
RP11: 8/3/2011 9:41:18 PM - Software Distribution Service 3.0
RP12: 8/3/2011 10:17:36 PM - 8-3-11 Prior to trying to get USB's working
RP13: 8/3/2011 11:12:39 PM - Restore Operation
RP14: 8/3/2011 11:34:36 PM - Installed Logitech Gaming Software
RP15: 8/3/2011 11:36:54 PM - Removed Logitech Gaming Software
RP16: 8/3/2011 11:40:23 PM - Installed Logitech Gaming Software
RP17: 8/4/2011 11:54:22 AM - Removed Google Earth Plug-in.
RP18: 8/4/2011 11:12:48 PM - Removed SpyHunter
RP19: 8/6/2011 11:20:27 PM - System Checkpoint
RP20: 8/8/2011 7:18:27 AM - System Checkpoint
RP21: 8/9/2011 9:34:28 AM - System Checkpoint
RP22: 8/9/2011 7:26:20 PM - Software Distribution Service 3.0
RP23: 8/10/2011 5:39:27 PM - 8-10 5:38pm Before Hotfix for7023 errors
RP24: 8/11/2011 6:23:20 PM - System Checkpoint
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
737-700 Southwest Airlines Liveries Package v2.2
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader X (10.0.1)
Adobe Reader X (10.1.0)
Adobe Shockwave Player 11.5
aerosoft's - USCitiesX - Niagara Falls-Buffalo
Apple Application Support
Apple Mobile Device Support
Apple Software Update
B209a-m
Big Biz Tycoon
Bing Bar
Bing Maps 3D
Bonjour
BufferChm
Carenado C U206G Stationair 6 II Full FSX
Cruise Ship Tycoon
Destinations
DeviceDiscovery
ESET Online Scanner v3
Flight Simulator X
Flight Simulator X Service Pack 1
Frogger v3.0e
FSX Booster 2.9.9.7
Golden Age Simulations WACO F Package for FSX
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService2
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 13.0
HP Imaging Device Functions 13.0
HP Photosmart Plus B209a-m All-In-One Driver Software 13.0 Rel .6
HP Print Projects 1.0
HP Product Detection
HP Smart Web Printing 4.5
HP Solution Center 13.0
hpPrintProjects
HPProductAssistant
HPSSupply
hpWLPGInstaller
iTunes
Java Auto Updater
Java(TM) 6 Update 24
Jet City Aircraft 717-200
Kid Pix Deluxe 3
Kidspiration 3
Lernout & Hauspie TruVoice American English TTS Engine
Logitech Gaming Software
Logitech Gaming Software 5.09
MarketResearch
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Flight Simulator X
Microsoft Flight Simulator X: Acceleration
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Disc 2
Microsoft Office 2000 Premium
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft PhotoDraw 2000
Microsoft Primary Interoperability Assemblies 2005
Microsoft Silverlight
Microsoft Train Simulator
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Windows XP Video Decoder Checkup Utility
Microsoft Zoo Tycoon
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Network
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
NVIDIA nView Desktop Manager
NVIDIA PhysX
PS_AIO_06_B209a-m_SW_Min
QuickTime
RCS B-25J RAF MkII for FSX
RealNetworks - Microsoft Visual C++ 2008 Runtime
Realtek High Definition Audio Driver
RealUpgrade 1.1
Sales Manager Pro
Scan
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Shop for HP Supplies
SmartWebPrinting
SolutionCenter
Sonic CinePlayer DVD Pack
Status
Stellar Phoenix Outlook PST Repair
System Requirements Lab
TeamSpeak 3 Client
Text to Speech XP
Tonka Search and Rescue
Toolbox
TrayApp
Trend Micro Titanium Internet Security
Trend Micro™ Titanium™ Internet Security
Ulead Photo Explorer 7.0 SE
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2492386)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
Vendio XPress Image Publisher
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live ID Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
WinZip 12.1
.
==== Event Viewer Messages From Past Week ========
.
8/8/2011 12:00:17 PM, error: Print [6161] - The document Microsoft Office Outlook - Memo Style owned by Dan failed to print on printer HP B209a New. Data type: NT EMF 1.008. Size of the spool file in bytes: 65536. Number of bytes printed: 0. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\DAN-01. Win32 error code returned by the print processor: 2250 (0x8ca). 
8/8/2011 10:03:07 AM, error: Print [6161] - The document Microsoft Word - Ebay info slips 8.17.doc owned by Dan failed to print on printer HP B209a New. Data type: NT EMF 1.008. Size of the spool file in bytes: 131072. Number of bytes printed: 76864. Total number of pages in the document: 1. Number of pages printed: 1. Client machine: \\DAN-01. Win32 error code returned by the print processor: 13 (0xd). 
8/8/2011 1:45:45 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
8/7/2011 8:09:39 AM, error: Service Control Manager [7001] - The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/7/2011 8:09:39 AM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
8/7/2011 10:21:39 PM, error: Service Control Manager [7000] - The Yahoo! Updater service failed to start due to the following error: The system cannot find the path specified.
8/7/2011 10:21:39 PM, error: Service Control Manager [7000] - The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service failed to start due to the following error: The system cannot find the path specified.
8/6/2011 5:37:12 PM, error: Dhcp [1002] - The IP address lease 192.168.1.4 for the Network Card with network address 001A4D7BFC09 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
8/6/2011 10:14:37 PM, error: Print [6161] - The document outbind://3-000000004CC08C84615FAF4081D31D8DC227EC4CE41A2000/ owned by Dan failed to print on printer HP B209a New. Data type: NT EMF 1.008. Size of the spool file in bytes: 102556. Number of bytes printed: 0. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\DAN-01. Win32 error code returned by the print processor: 2250 (0x8ca). 
8/5/2011 11:05:50 PM, error: Service Control Manager [7022] - The ForceWare Intelligent Application Manager (IAM) service hung on starting.
8/5/2011 10:54:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/5/2011 10:52:08 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
8/5/2011 10:48:39 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips NetworkX Processor tmtdi
8/5/2011 10:29:00 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the nvsvc service.
8/5/2011 10:01:55 PM, error: Service Control Manager [7034] - The LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) service terminated unexpectedly. It has done this 1 time(s).
8/11/2011 9:01:24 AM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.
8/11/2011 11:34:01 AM, error: System Error [1003] - Error code c000021a, parameter1 e31099e0, parameter2 c0000006, parameter3 75b7cfad, parameter4 0053f98c.
8/10/2011 2:21:18 PM, error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:18 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:18 PM, error: Service Control Manager [7034] - The ForceWare user log service service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:18 PM, error: Service Control Manager [7034] - The ForceWare IP service service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:18 PM, error: Service Control Manager [7034] - The ForceWare Intelligent Application Manager (IAM) service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:17 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:17 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:17 PM, error: Service Control Manager [7034] - The Forceware Web Interface service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:17 PM, error: Service Control Manager [7034] - The Crypkey License service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:17 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
8/10/2011 2:21:17 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
.
==== End Of File ===========================


----------



## Cookiegal (Aug 27, 2003)

Please go to the following link and run TDSSKiller:

http://support.kaspersky.com/viruses/solutions?qid=208280684

Allow it cure anything if prompted.

Please post the log back here.


----------



## Danstang (Aug 4, 2011)

Does not appear to have found anything - log below - ALSO, the symptoms appeared when I first brought the site via the link. Once again it went to start menu, lately it has been going to user accounts, this time it wanted to run the following HPHNDU_3053.exe - I did not run it - once again I could notclose anything and had to do a hard re-start.

2011/08/13 07:03:09.0484 3172 TDSS rootkit removing tool 2.5.15.0 Aug 11 2011 16:32:13
2011/08/13 07:03:09.0859 3172 ================================================================================
2011/08/13 07:03:09.0859 3172 SystemInfo:
2011/08/13 07:03:09.0859 3172 
2011/08/13 07:03:09.0859 3172 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/13 07:03:09.0859 3172 Product type: Workstation
2011/08/13 07:03:09.0859 3172 ComputerName: DAN-01
2011/08/13 07:03:09.0859 3172 UserName: Dan
2011/08/13 07:03:09.0859 3172 Windows directory: C:\WINDOWS
2011/08/13 07:03:09.0859 3172 System windows directory: C:\WINDOWS
2011/08/13 07:03:09.0859 3172 Processor architecture: Intel x86
2011/08/13 07:03:09.0859 3172 Number of processors: 2
2011/08/13 07:03:09.0859 3172 Page size: 0x1000
2011/08/13 07:03:09.0859 3172 Boot type: Normal boot
2011/08/13 07:03:09.0859 3172 ================================================================================
2011/08/13 07:03:10.0093 3172 Initialize success
2011/08/13 07:03:14.0437 3060 ================================================================================
2011/08/13 07:03:14.0437 3060 Scan started
2011/08/13 07:03:14.0437 3060 Mode: Manual; 
2011/08/13 07:03:14.0437 3060 ================================================================================
2011/08/13 07:03:14.0703 3060 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/13 07:03:14.0750 3060 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/08/13 07:03:14.0812 3060 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/13 07:03:14.0859 3060 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/13 07:03:14.0984 3060 Ambfilt (267fc636801edc5ab28e14036349e3be) C:\WINDOWS\system32\drivers\Ambfilt.sys
2011/08/13 07:03:15.0109 3060 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/13 07:03:15.0265 3060 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/13 07:03:15.0328 3060 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/13 07:03:15.0343 3060 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/13 07:03:15.0406 3060 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/13 07:03:15.0468 3060 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/13 07:03:15.0515 3060 BVRPMPR5 (248dfa5762dde38dfddbbd44149e9d7a) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/08/13 07:03:15.0687 3060 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/13 07:03:15.0718 3060 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/13 07:03:15.0765 3060 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/13 07:03:15.0843 3060 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/13 07:03:16.0062 3060 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/13 07:03:16.0109 3060 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/13 07:03:16.0156 3060 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/13 07:03:16.0187 3060 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/13 07:03:16.0250 3060 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/13 07:03:16.0296 3060 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/13 07:03:16.0453 3060 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/13 07:03:16.0546 3060 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/08/13 07:03:16.0609 3060 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/13 07:03:16.0687 3060 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/08/13 07:03:16.0750 3060 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/08/13 07:03:16.0796 3060 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/13 07:03:16.0812 3060 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/13 07:03:16.0875 3060 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/08/13 07:03:16.0921 3060 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/13 07:03:16.0984 3060 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/13 07:03:17.0046 3060 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/13 07:03:17.0109 3060 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/08/13 07:03:17.0203 3060 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/08/13 07:03:17.0218 3060 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/08/13 07:03:17.0296 3060 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/13 07:03:17.0421 3060 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/13 07:03:17.0468 3060 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/13 07:03:17.0671 3060 IntcAzAudAddService (c472fc1d265346e9500095f88a0345f9) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/08/13 07:03:17.0734 3060 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/08/13 07:03:17.0781 3060 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/13 07:03:17.0796 3060 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/13 07:03:17.0843 3060 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/13 07:03:17.0906 3060 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/13 07:03:18.0015 3060 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/13 07:03:18.0125 3060 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/13 07:03:18.0156 3060 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/13 07:03:18.0187 3060 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/08/13 07:03:18.0250 3060 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/13 07:03:18.0281 3060 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/13 07:03:18.0421 3060 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/13 07:03:18.0453 3060 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/13 07:03:18.0500 3060 Monfilt (c7d9f9717916b34c1b00dd4834af485c) C:\WINDOWS\system32\drivers\Monfilt.sys
2011/08/13 07:03:18.0656 3060 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/13 07:03:18.0734 3060 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/13 07:03:18.0781 3060 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/13 07:03:18.0796 3060 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/13 07:03:18.0890 3060 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/13 07:03:18.0921 3060 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/13 07:03:18.0968 3060 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/13 07:03:19.0000 3060 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/13 07:03:19.0015 3060 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/13 07:03:19.0078 3060 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/13 07:03:19.0125 3060 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/13 07:03:19.0140 3060 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/13 07:03:19.0171 3060 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/13 07:03:19.0187 3060 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/13 07:03:19.0312 3060 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/13 07:03:19.0390 3060 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/13 07:03:19.0500 3060 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/13 07:03:19.0531 3060 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/13 07:03:19.0625 3060 NetworkX (5ef7dd401771693245d46f4b0b69fe2b) C:\WINDOWS\system32\ckldrv.sys
2011/08/13 07:03:19.0671 3060 NIC1394  (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/13 07:03:19.0687 3060 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/13 07:03:19.0734 3060 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/13 07:03:19.0812 3060 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/13 07:03:20.0109 3060 nv (ed9816dbaf6689542ea7d022631906a1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/08/13 07:03:20.0453 3060 nvata (c03e15101f6d9e82cd9b0e7d715f5de3) C:\WINDOWS\system32\DRIVERS\nvata.sys
2011/08/13 07:03:20.0531 3060 NVENETFD (cc34564bca235ebad8b308d871efa2df) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2011/08/13 07:03:20.0546 3060 nvnetbus (46fdb8d07dd4fc81093b0acb243a525d) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2011/08/13 07:03:20.0593 3060 NVTCP (57d0fb1b75420db651a71d5517afdf8a) C:\WINDOWS\system32\DRIVERS\NVTcp.sys
2011/08/13 07:03:20.0625 3060 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/13 07:03:20.0640 3060 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/13 07:03:20.0687 3060 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/13 07:03:20.0765 3060 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/08/13 07:03:20.0796 3060 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/13 07:03:20.0812 3060 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/13 07:03:20.0843 3060 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/13 07:03:20.0875 3060 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/13 07:03:20.0906 3060 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/08/13 07:03:21.0093 3060 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/13 07:03:21.0125 3060 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/08/13 07:03:21.0156 3060 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/13 07:03:21.0187 3060 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/13 07:03:21.0281 3060 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/13 07:03:21.0312 3060 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/13 07:03:21.0328 3060 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/13 07:03:21.0359 3060 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/13 07:03:21.0406 3060 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/13 07:03:21.0453 3060 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/13 07:03:21.0484 3060 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/13 07:03:21.0531 3060 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/13 07:03:21.0656 3060 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/13 07:03:21.0734 3060 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/08/13 07:03:21.0781 3060 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/08/13 07:03:21.0828 3060 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/13 07:03:21.0906 3060 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/13 07:03:21.0953 3060 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/13 07:03:22.0015 3060 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/13 07:03:22.0062 3060 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
2011/08/13 07:03:22.0093 3060 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/13 07:03:22.0125 3060 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/13 07:03:22.0296 3060 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/13 07:03:22.0328 3060 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/13 07:03:22.0359 3060 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/13 07:03:22.0375 3060 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/13 07:03:22.0390 3060 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/13 07:03:22.0437 3060 tmactmon (de87a23d2ddc7378d1c7ab681e20de47) C:\WINDOWS\system32\DRIVERS\tmactmon.sys
2011/08/13 07:03:22.0453 3060 tmcomm (540c2b5dc47651c572c2804dc72fdda8) C:\WINDOWS\system32\DRIVERS\tmcomm.sys
2011/08/13 07:03:22.0500 3060 tmevtmgr (2de1fa64ebaff376f2c038f64492f62c) C:\WINDOWS\system32\DRIVERS\tmevtmgr.sys
2011/08/13 07:03:22.0531 3060 tmtdi (5a61679b2277b9ad550e30479a69503b) C:\WINDOWS\system32\DRIVERS\tmtdi.sys
2011/08/13 07:03:22.0593 3060 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/13 07:03:22.0687 3060 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/13 07:03:22.0718 3060 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/13 07:03:22.0750 3060 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/13 07:03:22.0781 3060 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/13 07:03:22.0781 3060 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/13 07:03:22.0796 3060 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/08/13 07:03:22.0828 3060 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/13 07:03:22.0843 3060 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/13 07:03:22.0875 3060 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/13 07:03:22.0890 3060 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/13 07:03:22.0968 3060 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/13 07:03:23.0015 3060 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/13 07:03:23.0062 3060 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/13 07:03:23.0156 3060 WmBEnum (5d410936831f7fb58eff941eac3f6d3d) C:\WINDOWS\system32\drivers\WmBEnum.sys
2011/08/13 07:03:23.0234 3060 WmFilter (7a13cfde92956ca61a0927d766c5ad4f) C:\WINDOWS\system32\drivers\WmFilter.sys
2011/08/13 07:03:23.0265 3060 WmVirHid (6f04646bc690f8bbfc344be32a60796d) C:\WINDOWS\system32\drivers\WmVirHid.sys
2011/08/13 07:03:23.0281 3060 WmXlCore (1d6ca43d562333f4dfb40bcef2453f3a) C:\WINDOWS\system32\drivers\WmXlCore.sys
2011/08/13 07:03:23.0312 3060 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/08/13 07:03:23.0328 3060 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/13 07:03:23.0359 3060 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/13 07:03:23.0390 3060 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/08/13 07:03:23.0484 3060 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1
2011/08/13 07:03:23.0531 3060 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk2\DR2
2011/08/13 07:03:23.0531 3060 Boot (0x1200) (b91cd7ceb5df271c976152b7b0035913) \Device\Harddisk0\DR0\Partition0
2011/08/13 07:03:23.0546 3060 Boot (0x1200) (54a59d324bf90b2bd220d636a0b481cd) \Device\Harddisk1\DR1\Partition0
2011/08/13 07:03:23.0562 3060 Boot (0x1200) (09f79bcc52c163160463608221d23218) \Device\Harddisk2\DR2\Partition0
2011/08/13 07:03:23.0562 3060 ================================================================================
2011/08/13 07:03:23.0562 3060 Scan finished
2011/08/13 07:03:23.0562 3060 ================================================================================
2011/08/13 07:03:23.0578 2344 Detected object count: 0
2011/08/13 07:03:23.0578 2344 Actual detected object count: 0


----------



## Cookiegal (Aug 27, 2003)

That file belongs to the HP Home Network Diagnostic Utility. Did you download that recently to troubleshoot problems with a printer or something else?

Please run a scan with OTS again and post the new log.


----------



## Danstang (Aug 4, 2011)

No, I have not downloaded anythingto do with HP recently, though I did need to reset my IP connection to the wireless printer. I got those setting off of the printers touch screen. The only thing I have tried to download were drivers for a Microsoft Itellimouse to see if I could get it to work in a USB port (it didn't) but I deleted those. 

Also, when opening Google Chrome, windows media player opened, the task bar and start wndow opened along with a blank windows page, Internet explorer and IBM Tools. Outlook closed itself out. 

Should I run a quick or complete OTS Scan, and should I check the "scan all users" and "MD5" boxes?


----------



## Cookiegal (Aug 27, 2003)

Do the full scan and check "Scan all users" but not MD5.

Under Basic Scans change both Services and Drivers from "Safe List" to "All".

Then under Additional Scans, check everything listed there and leave the check mark in the box beside "Safe List".


----------



## Danstang (Aug 4, 2011)

Having trouble posting results on the forum


----------



## Cookiegal (Aug 27, 2003)

The log is probably too large. Please zip it first. To do that, right-click the log file and select "Send to" and then choose "Compressed (zipped) Folder". It will create a new file with a .zip file extension in the same location. Please upload the zipped file as an attachment.


----------



## Danstang (Aug 4, 2011)

I have attached the zipped OTS log - thanks. Another thing - I have noticed the the system is largely symptom free on Sundays.


----------



## Cookiegal (Aug 27, 2003)

Go to *Start *- *Run * type in *cmd *then click OK. The MSDOS window will be displayed. At the prompt type the following:

*SC Delete LMIRescue*

Then press Enter

Type:

*Exit*

Then press Enter.

Try running chkdsk.

Click Start and My Computer. Right-click the hard drive you want to check, and click Properties. Select the Tools tab and click Check Now. Check both boxes. Click Start. You'll get a message that the computer must be rebooted to run a complete check. Click Yes and reboot. Chkdsk will take a while, so run it when you don't need to use the computer for something else.

To view results log:

Go to *Start *- *Run *and type in *eventvwr.msc*, and hit enter.
When Event Viewer opens, click on "Application", then scroll
down to "Winlogon" and double-click on it to open it up. This is the log
created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.


----------



## Danstang (Aug 4, 2011)

followed your instructions to remove LMIRescue. Here is what came up when I typed in SC Delete LMIRescue:
[SC] Open Service FAIILED 1060: The specified Service does not exist as an installed Service

Ran chkdsk. Here is the log:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 8/16/2011
Time: 12:58:22 AM
User: N/A
Computer: DAN-01
Description:
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk. 
Cleaning up minor inconsistencies on the drive.
Cleaning up 192 unused index entries from index $SII of file 0x9.
Cleaning up 192 unused index entries from index $SDH of file 0x9.
Cleaning up 192 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
244196000 KB total disk space.
114881624 KB in 270745 files.
98036 KB in 19261 indexes.
0 KB in bad sectors.
598888 KB in use by the system.
65536 KB occupied by the log file.
128617452 KB available on disk.
4096 bytes in each allocation unit.
61049000 total allocation units on disk.
32154363 allocation units available on disk.
Internal Info:
00 77 05 00 e2 6c 04 00 fb dd 06 00 00 00 00 00 .w...l..........
96 06 00 00 02 00 00 00 ac 03 00 00 00 00 00 00 ................
fc 42 58 18 00 00 00 00 8e e0 17 ab 00 00 00 00 .BX.............
06 e5 53 4d 00 00 00 00 ee 1a 8e 70 0c 00 00 00 ..SM.......p....
3e e8 55 b9 06 00 00 00 a4 39 71 42 14 00 00 00 >.U......9qB....
d0 10 cb 8f 00 00 00 00 b8 3a 07 00 99 21 04 00 .........:...!..
00 00 00 00 00 60 d1 63 1b 00 00 00 3d 4b 00 00 .....`.c....=K..
Windows has finished checking your disk.
Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

I'm attaching a FixLogMeIn.zip file to this post. Please save it to your desktop. Unzip it (extract the file) and click on the FixLogMeIn.reg file and allow it to merge into the registry.

Then reboot the machine and post a new HijackThis log please.


----------



## Danstang (Aug 4, 2011)

Followed instructions - but did not work - attached is a screenshot of the error


----------



## Cookiegal (Aug 27, 2003)

Please upload sreenshots as images and they will display in the post so I don't have to download the attachment to view it.

You didn't do it correctly. For some reason, you saved it to a Temp folder. It has to be saved to your deskpto and then run from there. Please try again.


----------



## Danstang (Aug 4, 2011)

It was saved to the desktop - I tried it again, this time _*unzipped to the desktop*_, ran it and got basically the same error message only it substituted Dan/Desktop instead of Temp.

Also, I am sorry but I don't know how to save a screen shot as an image...???


----------



## Cookiegal (Aug 27, 2003)

A screenshot is automatically an image. Once you hit the Prt Screen key then you open MS Paint which is in Start - All Programs - Accessories and then right-click the white space and select "Paste" and the image will be pasted there. Then click on File - Save As and save it in My Documents - My pictures and then upload it the same way you did the Word document.


----------



## Danstang (Aug 4, 2011)

OK - Thanks for the info - here is the screenshot of the error after trying to run the FixLogMeIn from the desktop -


----------



## Danstang (Aug 4, 2011)

Here is the upload of the screenshot for the error for FixLogMeIn...


----------



## Cookiegal (Aug 27, 2003)

Please try running the revised one that is attached.


----------



## Danstang (Aug 4, 2011)

This one worked - ran it and rebooted - Here is the new HiJackThis log;

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:04:05 AM, on 8/19/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1081\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1081\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 10503 bytes


----------



## Cookiegal (Aug 27, 2003)

Rescan with HijackThis, close all other browser windows, place a check mark beside the following entries and then click on "Fix Checked".

O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)

Reboot and post a new HijackThis log please.


----------



## Danstang (Aug 4, 2011)

Done as requested above - New HijackThis log below;

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:00:38 PM, on 8/19/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.com/ws/eBayISAPI.dll?MyEbay&gbh=1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1081\TmIEPlg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe -set Silent "1" SplashURL ""
O4 - HKLM\..\Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272556176392
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272584659703
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1081\TmIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Trend Micro Solution Platform (Amsp) - Trend Micro Inc. - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Rescue (c9ac5d2e-a940-48c9-ab70-e68c08553258) (LMIRescue_c9ac5d2e-a940-48c9-ab70-e68c08553258) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\LMIR0001.tmp\LMI_Rescue_srv.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 10535 bytes


----------



## Danstang (Aug 4, 2011)

Symptoms continue to appear. As I was typing this post, they appeared yet again and I had to close the IE explorer - so I am typing this in notepad and hope to be able to save to send to you. I have a few screen shots I have attached of what I see when it starts. 
It always seems to start with opening the start menu, then usually, but not always it will go to user accounts where you can change the photo for logging in, from there it'sa crap shoot - usually but not alwayts starts with a program that I am running or have run recentlysuch as Microsoft Excel, Windowsa Media Player, ULead photo explorer, MS Flight Sim X, etc - 
Sometimes, if I kill the internet, it will stop BUT NOT ALWAYS. If I do kill the internet connection, it will ALWAYS prevent me from closing any open windows and I will need to do a hard re-start. BUT I can usually open new programs such as task manager or paint or just about anything else - once they are open however, they will not close, they will just "grayout" at the top of the window. I can switch freely between them, but thats it.
There appear to be certain times when this happens more frequently - usually between 6 and 8am EDT, 2-3pm EDT and later on in the evening, after 9 or 10 pm EDT. Also, it does not usually happen on Sundays. 
Trend Micro also now usually starts almost right up when the machine is booted after a normal shutdown (not re-start) but takes the normal amount of time if I do a restart.
Also, I continue to receive an Adobe Reader updater message every 3-4 days - but after looking at the details,it lookslike the last realupdate for the rerader was in June - back around when this whole thing started. I always say yes to the update.
OK - So it just did it AGAIN at 11:40 PM -11:45 PM with the internet off on the cablebox. 
Near my wits end with this.


----------



## Cookiegal (Aug 27, 2003)

Go to *Start * *Run *- type *msconfig*  click OK and click on the *startup tab*. Uncheck everything there except for your anti-virus program. Then reboot and let me know if the problem persists please.


----------



## Danstang (Aug 4, 2011)

OK - I have followed your instructions - unchecked evrything but what I believe to be my A/V - see screenshot named Screenshot Startup Items 8-20.GIF - after rebooting, the machine adds one more, see screenshot named Screenshot Startup Items 8-20 after reboot.GIF

We'll have to wait and see if the symptoms appear as they tend not to do so nearly as much on the weekends, especially on Sundays. 

Also, I ran a complete gmer scan this morning. Had to walk away during it as it took quite a bit of time. I have the log if you would like to see - but when I cam back and after closing it out and saving the log, Outlook would not start and IE froze up. Hard restart and then started outlook in safe mode - it's working OK now though. 

Thanks for your help - I have searched google extensively for this type of issue and basically come back with it's time to reformat and start over - which is not an option due to the inability to use USB's to back up. Maybe a pro could, but I am far from a pro - though after this I think I could cure alot of other peopole's issues..lol


----------



## Cookiegal (Aug 27, 2003)

Do you have a shortcut on your desktop to the Start Menu folder?

Is it possible you have Keyboard hotkeys as shortcuts to that folder or the other programs that are opening up?


----------



## Danstang (Aug 4, 2011)

To my knowledge, the only shortcut I have to the start up is the one provided by windows. If I have any hotkeys I am unaware of them. 

While I did not personally experience the symptoms today, my wife did while working in MS Excel. Same type of thing, opened start menu, closed out any IE windows etc.


----------



## Cookiegal (Aug 27, 2003)

Please post the GMER log.


----------



## Danstang (Aug 4, 2011)

OK - Today I did not experience any issues until I went on my flight simprogram, MSFSX. Then same thing, Start menu, user ID etc.. 
plus it also brought up a window to a shortcut for windows media player :

"C:\Program Files Windows Media Player\wmplayer.exe"/prefetch:1

I was able to wait it out and get it to stop and closed out the windows it opened and continue in MSFSX, but then a bit later, it brought up Start menu and then this time the right mouse key was useless - it was if it was being held down - had to do a hard re-start.

How would determine if I had any hot keys that are causing this? I doubt that is the issue, but will look at anything. What is your honest option about resolving this? Do you think I should start a topic in the hardware forum to see if I can get the USB's working correctly while this issue continues so I can back up and have it re-formatted?

Here is the GMER scan log I ran on 8/20;

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-20 16:57:59
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\00000066 WDC_WD2500JS-58NCB1 rev.10.02E02
Running: eq11pwk0.exe; Driver: C:\DOCUME~1\Dan\LOCALS~1\Temp\fwtdapow.sys

---- System - GMER 1.0.15 ----
SSDT 89942780 ZwCreateKey
SSDT 89878500 ZwCreateMutant
SSDT 89941580 ZwCreateProcess
SSDT 89941880 ZwCreateProcessEx
SSDT 898788C0 ZwCreateSymbolicLinkObject
SSDT 89878020 ZwCreateThread
SSDT 89942D80 ZwDeleteKey
SSDT 89943680 ZwDeleteValueKey
SSDT 89878AA0 ZwDuplicateObject
SSDT 89878200 ZwLoadDriver
SSDT 89941B80 ZwOpenProcess
SSDT 89943C60 ZwOpenSection
SSDT 89941E80 ZwOpenThread
SSDT 89943080 ZwRenameKey
SSDT 89943380 ZwRestoreKey
SSDT 898786E0 ZwSetSystemInformation
SSDT 89942A80 ZwSetValueKey
SSDT 89942180 ZwTerminateProcess
SSDT 89942480 ZwTerminateThread
SSDT 89943E40 ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB71CF3A0, 0x59FFE5, 0xE8000020]
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip NVTcp.sys (NVIDIA Networking Protocol Driver./NVIDIA Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp NVTcp.sys (NVIDIA Networking Protocol Driver./NVIDIA Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----


----------



## Danstang (Aug 4, 2011)

PS - Cookie - I just realized that Combofix is still showing as an icon on the desktop - could this be the culprit for not being able to use the USBs for plus and play without the found new hardware wizard? Also I have not tried to to run any CD's etc lately, but doesn't combofix need to be gone for me to do so?


----------



## Cookiegal (Aug 27, 2003)

Danstang said:


> PS - Cookie - I just realized that Combofix is still showing as an icon on the desktop - could this be the culprit for not being able to use the USBs for plus and play without the found new hardware wizard? Also I have not tried to to run any CD's etc lately, but doesn't combofix need to be gone for me to do so?


No. It just means that a CD or USB drive will not start up automatically, you have to click on it to start it. It's much safer so nothing gets executed automatically.

There has been so much posted in this thread that I don't remember hearing about a problem with plug and play. Can you elaborate on that please?

Also, please right-click the icon on your desktop for Windows Media Player and select "Properties" then let me know what it says in the Shortcut Key box.


----------



## Danstang (Aug 4, 2011)

Let's take the easier one 1st - windows media player shows "nothing" in the shortcut box.

As for the USB's - I originally started posting in the hardware thread (I think) and you suggested I start here.

Quite some time ago, my HP Photosmart Plus #B209A started acting up - I went round for round with HP to get it to work wirelessly and on the home network. Eventually, they had me make a reg edit which corrected the issue for printing but as I later discovered, disabled several of the printers other features.

What I did not realize at the time is that is also somehow disabled any plug and play devices that were not currently installed or hooked up.

From that point on, I have not been able to run so much as a plug and play usb mouse. The Install New Hardware Wizard always pops up asking for drivers etc - which it should not need. Even when I run the CD for any plug and play that I have a CD for, it will not work. I am scared to death to touch this as if any solution does not work, I fear I will be left without a printer, without my camera card reader, etc. Then if the only solution is to re-install windows, I would have no way to back anything else up) It won't even let me install a thumb drive. USUALLY when I have tried in the past to run a plug and play, I at least get power on the device the first time I try - then the wizard starts....

Do you feel this is any way related to the current issue of loosing control?

So far today, I or my wife using the same log in (we only have one on this system so far as I know) have not had any issues at all.

The only other thing I can think to mention here is that I had downloaded a music album some time ago to put onto my son's Video MP3 player. I paid for the download ,so I do not believe it was a P2P etc., but I do not remember where I downloaded it from.

Here is the thing. When clicking on the desktop icon in the lower right hand corner for Windows Media Player, it now always takes me to that album (the only one) in my Library of music in Windows Media Player - the shortcut is the one I posted last night:

"C:\Program Files Windows Media Player\wmplayer.exe"/prefetch:1

So I did a little more digging wanting to know why it always brought up that album instead of just the regular Windows Media Player file - I searched my machine under C -Programs - Windows Media and found the regular windows media player folder, but also found a folder for Windows Media Connect 2. I googled Windows Media Connect 2 and found this:

http://en.wikipedia.org/wiki/Windows_Media_Connect

This seems to read to me that I am inadvertently sharing this info - and if someone requests it, somehow they are directing my system to it - hence the pop ups etc

So - your thoughts? Are we dealing with 2 separate issues or are they connected? I can't be the only one out there with these issues - can I?


----------



## Cookiegal (Aug 27, 2003)

We haven't found any malware so at this point I'm out of ideas. If you like, I can merge this thread back to your original one or you can revive that one and refer back to this one to show you've been checked for malware.


----------



## Danstang (Aug 4, 2011)

Hi Cookie,

Thanks for all of your help. 

The system went berserk again this morning, then quieted down this afternoon and then started up with its old tricks again this afternoon. 

At one point during a hard re-start, it came tome that I should look at switching users to see if there are any others listed (there shouldn't be) so I went into start - control panel - administrative tools - Computer management (local) and then shared folders, then shares - there is a folder there called old hard drive from a previous issue where I had to take the machine in to a local shop (before I discovered this site) because it would not start up. They re-formatted the hard drive and were able to save data from the "old hard drive" (no hardware was changed). In any case, there is a shortcut on my desktop for this folder and low and behold, it was marked for sharing n the network. The Old Hard Drive folder contained many shortcuts to the programs that have been popping up. I have unchecked the share box, and so far, so good....but it's early yet. 

Can you please keep this open for a day or so and let's see if that was the issue with what I believed to be a Malware problem? If that fixes it, great - if not then I'll let you know where I want to go from there. 

If it does fix it, that tells me there is a hole somewhere in the network that someone was getting in to access that folder. Does that sound about right?


----------



## Danstang (Aug 4, 2011)

OK - Spoke too soon - a a test I moved the wired OLD ps2 or whatever it's called wired HP mouse around fast on the desktop and in outlook etc - same symptoms - but was able to clsoe themn out this time - no hard restart needed. Bad mouse port? Who knows - I guess let's start with going back to the original forum please - can you do that or should I start a thread?


----------



## Cookiegal (Aug 27, 2003)

What is the name of the folder containing those shortcuts on your desktop?


----------



## Danstang (Aug 4, 2011)

the name of the folder on the desktop is Old Hard Drive. I deleted many of the files in the folders inside this folder out of caution, but the symptoms were very present again today.


----------



## Cookiegal (Aug 27, 2003)

I've been discussing this with my fellow moderators and there is a possibility that this is related to the mouse/keyboard. Are you using a wireless mouse/keyboard setup? Is it possible there's another previous mouse still connected?


----------



## Danstang (Aug 4, 2011)

I wish it was that easy... There used to be a wireless mouse / keybord hooked up to the system durig the issues I was (and am currently) having witht the USB's .l I know that I did inadvertantly delete the wireless mouse / keyboard and then had to go to a PS2 mouse and a old keyboard thru the old round ports - BUT - this issue did not start until at least a year after the fact. 

I have also tried to install an older microsoft intellimouse with no success - hardware wizzard comes up - wants drivers which I had already installed etc.. - so I deleted the software / drivers for it cause it would not work

Last night, I unplugged the power, the mouse, the router and the cable modem - I unplugged the PS2 mouse and re-plugged it in - then brought everything back up - everythng worked great last night - no symptoms. Then today I tried unsucessfully to install the intellimouse via USB - it did not work, so I uninstalled and went about my business... The 

As of tonight, the PC is unusable - the pop up programs are constant - both with or without internet connection - I am using my laptop to post. 

The only things connected to the PC are an HP Printer (wireles - see previous posts about this), a Logitech joystick via usb, the mouse and the keyboard through the old round connections. The PC will also allow me to connect and will read the data on my dynex reader for digital photos from a sony memory stick.

Here is one more thing I came accross tonight - When the PC started going nuts, I retarted it in networking safe mode - from there, is shows 2 users - one for me and one for an administrator who's "photo" I do not recognize. I tried rebooting into "regular" safe mode and the same thing shows up. There ar4e several files that show up when I click on that unknown administrator account that are the same as the pop up programs. BUT - When I start the PC in regular mode, there is NO administrator account that shows up...???

I have about had it - I can't use it for now and which is going to cost me dearly!


----------



## Danstang (Aug 4, 2011)

Computer usable this morning - still showing symptoms, but not nearly as bad as last night. As for the 2 user accounts, one is my regular login - the other is apparently for me to log in as administator, both have similar names - but I do not recall creating a seperate admin account. There's no reason to.


----------



## Cookiegal (Aug 27, 2003)

Danstang said:


> Here is one more thing I came accross tonight - When the PC started going nuts, I retarted it in networking safe mode - from there, is shows 2 users - one for me and one for an administrator who's "photo" I do not recognize. I tried rebooting into "regular" safe mode and the same thing shows up. There ar4e several files that show up when I click on that unknown administrator account that are the same as the pop up programs. BUT - When I start the PC in regular mode, there is NO administrator account that shows up...???


This is normal as the true Administrator account is only visible in safe mode. The "photo" is probably a generic one created by Windows.

Please do this:

Go to Start - Run - type in *devmgmt.msc* and click OK to open the Device Manager. Are there any yellow alerts beside any of the devices listed there?

Also, click on the + beside Mice and Other Pointing Devices and let me know what it says there below. Then double-click on what is says below and then on the Driver tab and then click on Driver Details and let me know the names of the files mentioned there please.


----------



## Danstang (Aug 4, 2011)

Hi Cookie - So I did all of hat and I'll give you 3 guesses what happened whe I was ready to submit the post with the info...

That was the last straw - I could no longer afford to try and trouble shoot this myself with your assistance - It has simply cost me too much in time and treasure.

I took the PC into my local guys - the believe at first glance that it is either a mouse issue or an itrusion at the router level. We'll see.

To answer your question for future use - there were 2 errors under unknown devices - at leat one of which was connected to NVidea in some fashion (I believe the monitor) The otjer was uknown, but I believe it was also dealing with the Monitor. I had tried to delete these several times - buit they always came back.

The pointers section only shoed the PS2 mouse - drivers were from 2001 I think.

I'll let you know if I get any specific info on the cause of the problem from the shop. I have taken machines there before and they ahve always been very professional and helpful, quick, inexpensive etc... here is their URL; http://techinasec.net/

Thanks again for trying for me - let me know if you want me to post on the results.


----------



## Cookiegal (Aug 27, 2003)

I didn't see any signs of a DNS hijack or intrusion (no redirects or addition of a proxy and no changes in DNS settings). I'm convinced it's related to the keyboard and/or mouse or the drivers. It could even be something like the Ctrl key getting stuck at times or being too sensitive and getting pressed unintentionally. If you hit Crtl and O at the same that's the "Open" command and it will open the last folder that was opened. I was able to replicate opening the Start Menu folder that way.

Please do post back the solution as it could be helpful to others who may experience the same problem.


----------



## Danstang (Aug 4, 2011)

Hi Cookie,

Well, It took my local guys a week and a hundred bucks, but they fixed it. The pop ups were from trhe OLD OLD OLD PS2 mouse - just went bad on me - not being able to use the USB's was their main challenge (plug and play asking for drivers for anything plugged in). They believe that at some point I had a virus which was ripped out, but took some system files with it (thanks Trend Micro). They also mentioned they have seen 3 machines in the past 2 weeks that were infected while trend was running...

Good news is I am up and running and they were able to save all of my files - I just have top put them back where they belong now...

Hope this helps - and thanks for trying. You'll be first on my list for any PC probs. 

Thanks Again!

Dan:up:


----------



## Danstang (Aug 4, 2011)

PS The only way to solve the USB issue was to re-install windows.


----------



## Cookiegal (Aug 27, 2003)

Thanks for reporting back. :up:


----------

