# No internet connection - NetBT.sys file missing/corrupted? Need help!



## justin2311 (Oct 9, 2011)

Hi guys, I've recently run into an issue that I haven't been able to solve on my own (and Google). So I decided to sign up to ask help from the pro's.

I recently got a virus but eventually removed it (or so I hope) successfully. After rebooting my PC I noticed I wasn't able to connect to the internet. I have an excellent signal but the message reads "Acquiring network address" (clearly it isn't!). Anyhow, after spending countless hours on Google, I noticed that the DHCP service wasn't started, and could not be started. I would go to start and a message would read, "Error 1075: The dependency service does not exist or has been marked for deletion." Upon further research, I noticed that the NetBT file in the system's drivers folder wasn't to be found.

Also, I'm on Windows XP.

If anyone could help me with this problem I'd greatly appreciate it. 

Thank you!


----------



## Phantom010 (Mar 9, 2009)

Try extracting it from the Windows XP CD or from the ServicePackFiles\i386 folder.


----------



## justin2311 (Oct 9, 2011)

Hi thanks for such a quick reply!

I've read that I should do that, but I'm not entirely sure on how to go about doing so. I have found the i386 folder and the file. Just not sure what to do at that point.

Thanks again.


----------



## Phantom010 (Mar 9, 2009)

You can extract individual files from the cabinet files to replace missing or corrupted files. To extract information from a .cab file in Windows XP:

Click Start > Run > type *msconfig*.

Click OK.

Click *Expand File*.

In the *File to restore* box, type the name of the file that you want to restore.

In the *Restore from* box, type the path to the Windows XP .cab file from which you want to restore the file, or click *Browse From* to locate the Windows XP .cab file (you can find NetBT inside C:\WINDOWS\ServicePackFiles\i386)

In the *Save file in* box, type the path to which you want the new file extracted, or click *Browse To* to locate the folder that you want. (should be C:\WINDOWS\system32\drivers).

Click *Expand*.

In the *System Configuration Utility* dialog box, click *OK*. If you are prompted to restart the computer, click *Restart*.


----------



## justin2311 (Oct 9, 2011)

Hi, so I went to do exactly what you mentioned but I ran into a strange issue.

When browsing in the restore from box, I wasn't able to find NetBT in the C:\WINDOWS\ServicePackFiles\i386 folder. However, I found the file in C:\i386. Is that strange? Anyhow, I tried expanding it, rebooted, and DCHP still won't start and is still giving me the Error 1075.

I have access to an XP disc that came with my laptop, maybe that would be a better solution? If so, would you be able to tell me how to extract the file from the disc. Thank you again Phantom.


----------



## justin2311 (Oct 9, 2011)

Alright so I re-read what you wrote and tried it again. I initially didn't choose the right .cab file to restore from, but I did the second time around. So I clicked expand, rebooted, and still no fix.

Is there a second step after that? I looked in registry editor and NetBT is still not found.


----------



## Cookiegal (Aug 27, 2003)

There should should be another viable copy on the system. It's likely that restoring the file will not restore the connection as the registry gets messed up too but we'll deal with that after.

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*
Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:filefind
NetBT.sys
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## justin2311 (Oct 9, 2011)

Thanks for the reply Cookiegal, here are the results:

SystemLook 30.07.11 by jpshortstuff
Log created at 21:44 on 08/10/2011 by Justin
Administrator - Elevation successful

========== filefind ==========

Searching for "NetBT.sys"
C:\i386\netbt.sys --a--c- 162816 bytes [22:49 06/10/2006] [10:00 04/08/2004] 0C80E410CD2F47134407EE7DD19CC86B
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netbt.sys --a--c- 162816 bytes [03:20 23/02/2010] [19:21 13/04/2008] 74B2B2F5BEA5E9A3DC021D685551BD3D
C:\WINDOWS\system32\drivers\netbt.sys --a---- 162816 bytes [03:20 23/02/2010] [10:00 04/08/2004] 0C80E410CD2F47134407EE7DD19CC86B

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

OK so the file is there so you were successful in following Phantom's instructions to restore it.

I will need you to export two registry keys please. I'll be signing off for the night but I'll check back tomorrow.

Go to Start - Run and copy and paste the following:


```
regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services"
```
You won't see anything happen and it will only take a second. You will find the report it creates at C:\look.txt. This file will be quite large so please zip it before uploading it as an attachment.

Then do the same using the following command:


```
regedit /e C:\look2.txt "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services"
```
The second log will be at C:\look2.txt.


----------



## justin2311 (Oct 9, 2011)

Alright the first look.zip is attached in this reply. I'll attach the second in the post below.


----------



## justin2311 (Oct 9, 2011)

So the second zip file is attached to this reply.

Thanks again for everyone's help thus far!


----------



## Cookiegal (Aug 27, 2003)

OK, thanks. I'll examine them tomorrow. We'll probably have to rebuild the NetBt key.

What programs did you use on the virus just before losing your Internet?


----------



## justin2311 (Oct 9, 2011)

I used MBAM and HitmanPro.


----------



## Cookiegal (Aug 27, 2003)

I'm attaching a FixNetBTJustin.zip file to this post. Save it to your desktop (transfer it via a flash drive). Unzip it (extract the file) and then double-click on the FixNetBTJustin.reg file and allow it to merge into the registry. Then reboot the machine.

Then go to *Start *- *Run *- type in *services.msc* and check each of the following services to make sure they are started. If they are not then click on the button to start them.

Computer Browser
DHCP Client 
DNS Client
TCP/IP NetBIOS Helper
Network Connections
Network Location Awareness
Server
Workstation

If they all start successfully see if you have your Internet connection back.


----------



## justin2311 (Oct 9, 2011)

Hi Cookiegal. So I followed your instructions and here are the results.

After rebooting, I checked all of the services that you listed to make sure they are all started. There were two which weren't started (Computer Browser & Workstation). While attempting to start them, I get error messages for both.

Computer Browser - "Error 1068: The dependency service or group failed to start."
Workstation - Error code 2250 

Aside from those two, every other service is started.

The good news is, my I.P. address is no longer 0.0.0.0 and the message reads "Connected". However when I go to Firefox and try to visit a website, it continues to load but eventually I get a "Connection has timed out" error.

Please let me know what steps to take from here. I appreciate the help.


----------



## Cookiegal (Aug 27, 2003)

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*
Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:filefind
mup.sys
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## Cookiegal (Aug 27, 2003)

Also do this please:

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## justin2311 (Oct 9, 2011)

The log has been attached to this post.


----------



## justin2311 (Oct 9, 2011)

Cookiegal, there are quite a few in errors in both Application and System. Should I zip the Notepad file? Or just go ahead and paste them in my next reply?


----------



## Cookiegal (Aug 27, 2003)

If you could copy and paste them it would be easier. It may take more than one post.


----------



## Cookiegal (Aug 27, 2003)

justin2311 said:


> The log has been attached to this post.


I;ll copy and paste the report here:

SystemLook 30.07.11 by jpshortstuff
Log created at 14:36 on 09/10/2011 by Justin 
Administrator - Elevation successful

========== filefind ==========

Searching for "mup.sys"
C:\i386\mup.sys	--a--c- 107904 bytes	[22:49 06/10/2006]	[10:00 04/08/2004] 82035E0F41C2DD05AE41D27FE6CF7DE1
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\mup.sys	--a--c- 105344 bytes	[03:20 23/02/2010]	[19:17 13/04/2008] 2F625D11385B1A94360BFC70AAEFDEE1
C:\WINDOWS\system32\drivers\mup.sys	--a--c- 107904 bytes	[17:51 10/08/2004]	[10:00 04/08/2004] 82035E0F41C2DD05AE41D27FE6CF7DE1

-= EOF =-


----------



## justin2311 (Oct 9, 2011)

^ Whoops, sorry for not copying and pasting the log!

Alright so here is all of the errors found under "Application" in Event Viewer:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/9/2011
Time: 2:35:02 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/8/2011
Time: 9:05:45 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/8/2011
Time: 7:45:11 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/8/2011
Time: 6:55:04 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/8/2011
Time: 6:48:13 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/7/2011
Time: 10:41:17 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/7/2011
Time: 10:41:07 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/7/2011
Time: 10:23:10 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/7/2011
Time: 9:59:40 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: JavaQuickStarterService
Event Category: None
Event ID: 1
Date: 10/7/2011
Time: 9:43:54 PM
User: N/A
Computer: JUST
Description:
The description for Event ID ( 1 ) in Source ( JavaQuickStarterService ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Unable to create JQS API server: socket() failed (Socket error 10044)
.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/7/2011
Time: 3:56:10 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/6/2011
Time: 4:07:50 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 10/5/2011
Time: 8:50:40 PM
User: N/A
Computer: JUST
Description:
Hanging application iTunes.exe, version 7.6.2.9, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 69 54 75 6e 65 73 iTunes
0018: 2e 65 78 65 20 37 2e 36 .exe 7.6
0020: 2e 32 2e 39 20 69 6e 20 .2.9 in 
0028: 68 75 6e 67 61 70 70 20 hungapp 
0030: 30 2e 30 2e 30 2e 30 20 0.0.0.0 
0038: 61 74 20 6f 66 66 73 65 at offse
0040: 74 20 30 30 30 30 30 30 t 000000
0048: 30 30 00

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/5/2011
Time: 4:21:06 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/5/2011
Time: 4:20:53 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/4/2011
Time: 11:18:43 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/4/2011
Time: 12:24:37 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/4/2011
Time: 12:00:25 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 10/2/2011
Time: 9:15:05 PM
User: N/A
Computer: JUST
Description:
Hanging application Reason.exe, version 3.1.2.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 52 65 61 73 6f 6e Reason
0018: 2e 65 78 65 20 33 2e 31 .exe 3.1
0020: 2e 32 2e 30 20 69 6e 20 .2.0 in 
0028: 68 75 6e 67 61 70 70 20 hungapp 
0030: 30 2e 30 2e 30 2e 30 20 0.0.0.0 
0038: 61 74 20 6f 66 66 73 65 at offse
0040: 74 20 30 30 30 30 30 30 t 000000
0048: 30 30 00

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/2/2011
Time: 4:57:05 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/1/2011
Time: 11:32:45 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/1/2011
Time: 10:13:19 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/1/2011
Time: 10:11:53 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/30/2011
Time: 9:13:24 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/26/2011
Time: 9:32:09 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 9/26/2011
Time: 8:33:56 PM
User: N/A
Computer: JUST
Description:
Faulting application iexplore.exe, version 0.0.0.0, faulting module iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0028: 30 20 69 6e 20 69 65 78 0 in iex
0030: 70 6c 6f 72 65 2e 65 78 plore.ex
0038: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 30 38 set 0008
0050: 63 62 34 30 0d 0a cb40..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 9/26/2011
Time: 8:33:34 PM
User: N/A
Computer: JUST
Description:
Faulting application explorer.exe, version 0.0.0.0, faulting module , version 0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0028: 30 20 69 6e 20 20 30 2e 0 in 0.
0030: 30 2e 30 2e 30 20 61 74 0.0.0 at
0038: 20 6f 66 66 73 65 74 20 offset 
0040: 30 30 30 30 30 30 30 30 00000000
0048: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 9/26/2011
Time: 8:33:27 PM
User: N/A
Computer: JUST
Description:
Faulting application iexplore.exe, version 0.0.0.0, faulting module , version 0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 30 2e 30 2e 30 2e e 0.0.0.
0028: 30 20 69 6e 20 20 30 2e 0 in 0.
0030: 30 2e 30 2e 30 20 61 74 0.0.0 at
0038: 20 6f 66 66 73 65 74 20 offset 
0040: 30 30 30 30 30 30 30 30 00000000
0048: 0d 0a ..

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 3
Date: 9/25/2011
Time: 10:11:28 PM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list cab from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: This operation returned because the timeout period expired.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 9/25/2011
Time: 10:10:18 PM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 9/25/2011
Time: 10:10:16 PM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 9/25/2011
Time: 10:10:10 PM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/25/2011
Time: 10:01:51 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 5
Date: 9/24/2011
Time: 3:58:30 PM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/AD7E1C28B064EF8F6003402014C3D0E3370EB58A.crt> with error: This network connection does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 5
Date: 9/24/2011
Time: 3:58:30 PM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root certificate from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/AD7E1C28B064EF8F6003402014C3D0E3370EB58A.crt> with error: The connection with the server was terminated abnormally

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/23/2011
Time: 9:58:35 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/22/2011
Time: 11:07:50 PM
User: N/A
Computer: JUST
Description:
Hanging application Photoshop.exe, version 9.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 50 68 6f 74 6f 73 Photos
0018: 68 6f 70 2e 65 78 65 20 hop.exe 
0020: 39 2e 30 2e 30 2e 30 20 9.0.0.0 
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/22/2011
Time: 9:12:46 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/22/2011
Time: 12:10:28 AM
User: N/A
Computer: JUST
Description:
Hanging application Illustrator.exe, version 13.0.128.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 49 6c 6c 75 73 74 Illust
0018: 72 61 74 6f 72 2e 65 78 rator.ex
0020: 65 20 31 33 2e 30 2e 31 e 13.0.1
0028: 32 38 2e 30 20 69 6e 20 28.0 in 
0030: 68 75 6e 67 61 70 70 20 hungapp 
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0 
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00

Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 9/21/2011
Time: 11:30:03 AM
User: N/A
Computer: JUST
Description:
Fault bucket 452615105.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket: 
0008: 34 35 32 36 31 35 31 30 45261510
0010: 35 0d 0a 5..

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/21/2011
Time: 11:29:42 AM
User: N/A
Computer: JUST
Description:
Hanging application explorer.exe, version 6.0.2900.3156, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 65 78 70 6c 6f 72 explor
0018: 65 72 2e 65 78 65 20 36 er.exe 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 33 31 35 36 20 69 6e 20 3156 in 
0030: 68 75 6e 67 61 70 70 20 hungapp 
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0 
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/19/2011
Time: 5:52:16 PM
User: N/A
Computer: JUST
Description:
Hanging application firefox.exe, version 6.0.0.4240, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 66 69 72 65 66 6f firefo
0018: 78 2e 65 78 65 20 36 2e x.exe 6.
0020: 30 2e 30 2e 34 32 34 30 0.0.4240
0028: 20 69 6e 20 68 75 6e 67 in hung
0030: 61 70 70 20 30 2e 30 2e app 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 30 30 30 30 30 000000

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/17/2011
Time: 10:51:23 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/17/2011
Time: 8:51:53 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/16/2011
Time: 10:57:23 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/15/2011
Time: 6:13:43 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/14/2011
Time: 7:53:08 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/13/2011
Time: 9:37:25 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/13/2011
Time: 8:27:03 PM
User: N/A
Computer: JUST
Description:
Hanging application firefox.exe, version 6.0.0.4240, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 66 69 72 65 66 6f firefo
0018: 78 2e 65 78 65 20 36 2e x.exe 6.
0020: 30 2e 30 2e 34 32 34 30 0.0.4240
0028: 20 69 6e 20 68 75 6e 67 in hung
0030: 61 70 70 20 30 2e 30 2e app 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 30 30 30 30 30 000000

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/11/2011
Time: 9:38:37 PM
User: N/A
Computer: JUST
Description:
Hanging application Photoshop.exe, version 9.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 50 68 6f 74 6f 73 Photos
0018: 68 6f 70 2e 65 78 65 20 hop.exe 
0020: 39 2e 30 2e 30 2e 30 20 9.0.0.0 
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 9/11/2011
Time: 9:45:09 AM
User: N/A
Computer: JUST
Description:
Faulting application icm3232.exe, version 4.2.0.0, faulting module ntdll.dll, version 5.1.2600.3520, fault address 0x0003770f.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 63 6d ure icm
0018: 33 32 33 32 2e 65 78 65 3232.exe
0020: 20 34 2e 32 2e 30 2e 30 4.2.0.0
0028: 20 69 6e 20 6e 74 64 6c in ntdl
0030: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
0038: 31 2e 32 36 30 30 2e 33 1.2600.3
0040: 35 32 30 20 61 74 20 6f 520 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 33 37 37 30 66 03770f

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 9/9/2011
Time: 10:35:41 PM
User: N/A
Computer: JUST
Description:
Hanging application firefox.exe, version 6.0.0.4240, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 66 69 72 65 66 6f firefo
0018: 78 2e 65 78 65 20 36 2e x.exe 6.
0020: 30 2e 30 2e 34 32 34 30 0.0.4240
0028: 20 69 6e 20 68 75 6e 67 in hung
0030: 61 70 70 20 30 2e 30 2e app 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 30 30 30 30 30 000000

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 9/9/2011
Time: 4:50:27 PM
User: N/A
Computer: JUST
Description:
Faulting application icm3232.exe, version 4.2.0.0, faulting module ntdll.dll, version 5.1.2600.3520, fault address 0x0003770f.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 63 6d ure icm
0018: 33 32 33 32 2e 65 78 65 3232.exe
0020: 20 34 2e 32 2e 30 2e 30 4.2.0.0
0028: 20 69 6e 20 6e 74 64 6c in ntdl
0030: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
0038: 31 2e 32 36 30 30 2e 33 1.2600.3
0040: 35 32 30 20 61 74 20 6f 520 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 33 37 37 30 66 03770f

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/31/2011
Time: 8:05:58 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x000043df.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 34 33 64 66 43df

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 8/31/2011
Time: 12:41:52 AM
User: N/A
Computer: JUST
Description:
Faulting application tvp.exe, version 1.3.7.1208, faulting module tvp.exe, version 1.3.7.1208, fault address 0x000200c0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 74 76 70 ure tvp
0018: 2e 65 78 65 20 31 2e 33 .exe 1.3
0020: 2e 37 2e 31 32 30 38 20 .7.1208 
0028: 69 6e 20 74 76 70 2e 65 in tvp.e
0030: 78 65 20 31 2e 33 2e 37 xe 1.3.7
0038: 2e 31 32 30 38 20 61 74 .1208 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 32 30 30 63 30 000200c0
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 8/31/2011
Time: 12:41:23 AM
User: N/A
Computer: JUST
Description:
Faulting application tvp.exe, version 1.3.7.1208, faulting module tvp.exe, version 1.3.7.1208, fault address 0x000200c0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 74 76 70 ure tvp
0018: 2e 65 78 65 20 31 2e 33 .exe 1.3
0020: 2e 37 2e 31 32 30 38 20 .7.1208 
0028: 69 6e 20 74 76 70 2e 65 in tvp.e
0030: 78 65 20 31 2e 33 2e 37 xe 1.3.7
0038: 2e 31 32 30 38 20 61 74 .1208 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 32 30 30 63 30 000200c0
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/30/2011
Time: 7:33:11 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/28/2011
Time: 3:23:36 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/28/2011
Time: 10:49:12 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/27/2011
Time: 8:00:31 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/27/2011
Time: 8:03:47 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x000043df.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 34 33 64 66 43df

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/26/2011
Time: 9:05:46 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/25/2011
Time: 3:54:37 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/25/2011
Time: 8:45:41 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/24/2011
Time: 10:15:30 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/24/2011
Time: 7:48:04 PM
User: N/A
Computer: JUST
Description:
Hanging application Reason.exe, version 3.1.2.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 52 65 61 73 6f 6e Reason
0018: 2e 65 78 65 20 33 2e 31 .exe 3.1
0020: 2e 32 2e 30 20 69 6e 20 .2.0 in 
0028: 68 75 6e 67 61 70 70 20 hungapp 
0030: 30 2e 30 2e 30 2e 30 20 0.0.0.0 
0038: 61 74 20 6f 66 66 73 65 at offse
0040: 74 20 30 30 30 30 30 30 t 000000
0048: 30 30 00

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/23/2011
Time: 8:43:02 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/22/2011
Time: 10:39:23 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 8/21/2011
Time: 10:13:33 PM
User: N/A
Computer: JUST
Description:
Hanging application Photoshop.exe, version 9.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 50 68 6f 74 6f 73 Photos
0018: 68 6f 70 2e 65 78 65 20 hop.exe 
0020: 39 2e 30 2e 30 2e 30 20 9.0.0.0 
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/21/2011
Time: 9:40:22 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/21/2011
Time: 1:47:23 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/18/2011
Time: 8:47:25 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/17/2011
Time: 10:02:36 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/16/2011
Time: 9:35:09 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/14/2011
Time: 9:44:02 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/13/2011
Time: 10:19:05 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/12/2011
Time: 11:15:00 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 8/11/2011
Time: 11:31:12 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255


----------



## justin2311 (Oct 9, 2011)

And here are the recent (last 48 hours) errors found under "System":

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 10/9/2011
Time: 2:35:39 PM
User: N/A
Computer: JUST
Description:
The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:26:49 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:26:19 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:26:19 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:25:49 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:25:49 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:25:19 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:25:18 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:24:48 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:24:48 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:24:18 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:24:18 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:23:48 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:21:35 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:21:35 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:21:35 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:21:10 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:21:10 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:21:10 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:12:57 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:12:57 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:11:52 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:11:52 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:11:52 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:10:37 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category:  None
Event ID: 7024
Date: 10/9/2011
Time: 1:10:37 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:10:37 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:10:35 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:10:35 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:10:35 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:10:33 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:10:33 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:10:33 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:10:31 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:10:31 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:10:31 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:10:20 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:10:20 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:10:20 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:10:20 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:10:18 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:10:18 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:10:18 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:09:50 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:09:50 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:09:20 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/9/2011
Time: 1:09:20 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:08:50 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:07:47 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:07:47 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:53 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:53 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:53 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:47 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:47 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:47 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:42 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:41 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:41 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:38 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:38 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:38 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:36 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:36 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:36 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 1:06:32 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 1:06:32 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4314
Date: 10/9/2011
Time: 1:05:32 PM
User: N/A
Computer: JUST
Description:
Unable to read the driver's bindings to the transport from the registry.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 58 00 ......X.
0008: 00 00 00 00 da 10 00 c0 ....Ú..À
0010: 15 01 00 00 60 01 00 c0 ....`..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 1:06:17 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 12:59:12 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 12:59:12 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 12:59:12 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date:  10/9/2011
Time: 12:59:11 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 12:59:11 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 12:59:10 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 12:59:07 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 12:59:07 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/9/2011
Time: 12:59:07 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/9/2011
Time: 12:59:07 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 12:58:52 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 10:50:12 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 10:50:12 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 10:50:12 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 10:50:10 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 10:50:10 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 10:50:10 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 10:50:05 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 10:50:05 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 10:50:05 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 10:50:05 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 10:49:50 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 10:08:34 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:42:05 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:32:00 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:31:44 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 9:31:39 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:31:39 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 9:31:39 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 9:31:36 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:31:36 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 9:31:36 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 9:31:30 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:31:30 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:31:30 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:31:30 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 9:31:14 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 9:26:53 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:26:53 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 9:26:53 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 9:26:51 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:26:51 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 9:26:51 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 9:26:47 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:26:47 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:26:47 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 9:26:47 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 9:26:32 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:18:36 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:18:07 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:18:06 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:17:37 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:17:36 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:17:07 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:17:01 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:16:31 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:16:31 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category:  None
Event ID: 7003
Date: 10/8/2011
Time: 9:16:24 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:16:01 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:16:01 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:15:31 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:15:31 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:15:01 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/8/2011
Time: 9:15:01 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 9:14:31 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 8:07:47 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 8:07:47 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 8:07:47 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 8:07:40 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 8:07:40 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 8:07:40 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 8:07:40 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 8:07:30 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:49:19 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:46:05 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 10/8/2011
Time: 7:45:19 PM
User: N/A
Computer: JUST
Description:
The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:42:57 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:42:53 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 7:42:15 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 7:42:15 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 7:42:14 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 7:41:34 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 7:41:34 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 7:41:34 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 7:41:31 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 7:41:31 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 7:41:31 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 7:41:22 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 7:41:22 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:41:22 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:41:22 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 7:41:13 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:38:33 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:38:13 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:38:08 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:32:38 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:32:17 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:25:27 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:  Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 7:25:04 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:59:56 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:59:56 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 10/8/2011
Time: 6:55:09 PM
User: N/A
Computer: JUST
Description:
The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:54:20 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:54:20 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:54:20 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:54:18 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:54:18 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:54:18 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:54:10 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:54:10 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:54:10 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:54:10 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:53:54 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 10/8/2011
Time: 6:48:16 PM
User: N/A
Computer: JUST
Description:
The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:41:52 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:41:52 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:41:52 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:41:50 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time:  6:41:50 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:41:50 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:41:45 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:41:45 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:41:45 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:41:45 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:41:29 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:34:54 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:34:54 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:34:54 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:34:53 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:34:53 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:34:53 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:34:49 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:34:49 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:34:49 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:34:49 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:34:34 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Tcpip
Event Category: None
Event ID: 4198
Date: 10/8/2011
Time: 6:30:37 PM
User: N/A
Computer: JUST
Description:
The system detected an address conflict for IP address 192.168.1.5 with the system having network hardware address 00:0C:F1:8D:CD:E5. The local interface has been disabled.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 50 00 ......P.
0008: 00 00 00 00 66 10 00 c0 ....f..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:28:30 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category:  None
Event ID: 7001
Date: 10/8/2011
Time: 6:28:30 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:28:29 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:28:27 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:28:27 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:28:27 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:28:21 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:28:21 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:28:21 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:28:21 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:28:06 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:25:10 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:25:10 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:25:09 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:25:06 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:25:06 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:25:06 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/8/2011
Time: 6:25:01 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/8/2011
Time: 6:25:01 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:25:01 PM
User: N/A
Computer: JUST
Description:
The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 10/8/2011
Time: 6:25:01 PM
User: N/A
Computer: JUST
Description:
The DHCP Client service depends on the following nonexistent service: NetBT

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/8/2011
Time: 6:24:46 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À


----------



## Cookiegal (Aug 27, 2003)

Please use SystemLook to do another search using this script:


```
:filefind
rdbss.sys
```
Then post the log please.


----------



## justin2311 (Oct 9, 2011)

Here are the results:

SystemLook 30.07.11 by jpshortstuff
Log created at 15:34 on 09/10/2011 by Justin 
Administrator - Elevation successful

========== filefind ==========

Searching for "rdbss.sys"
C:\i386\rdbss.sys --a--c- 174592 bytes [22:49 06/10/2006] [01:13 28/10/2004] 809CA45CAA9072B3176AD44579D7F688
C:\i386\SP1\Windows\System32\Drivers\rdbss.sys --a--c- 170112 bytes [18:15 25/09/2006] [20:22 12/10/2004] 1FD256B6025449DCA3670574C0229D65
C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\rdbss.sys --a--c- 174592 bytes [18:37 25/09/2006] [01:14 28/10/2004] D0FEF8156D2D2FEC557C100956D76887
C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\rdbss.sys --a--c- 174592 bytes [10:22 05/05/2006] [10:22 05/05/2006] ED375CE745C42A14F10753F7022ECD6A
C:\WINDOWS\$NtUninstallKB914389$\rdbss.sys -----c- 174592 bytes [05:24 07/10/2006] [01:13 28/10/2004] 809CA45CAA9072B3176AD44579D7F688
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\rdbss.sys --a--c- 175744 bytes [03:21 23/02/2010] [19:28 13/04/2008] 7AD224AD1A1437FE28D89CF22B17780A
C:\WINDOWS\system32\dllcache\rdbss.sys -----c- 174592 bytes [09:47 05/05/2006] [09:47 05/05/2006] 03B965B1CA47F6EF60EB5E51CB50E0AF
C:\WINDOWS\system32\drivers\rdbss.sys --a---- 174592 bytes [17:51 10/08/2004] [09:47 05/05/2006] 03B965B1CA47F6EF60EB5E51CB50E0AF

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

Can you post the log from HitmanPro showing what it deleted please? It must have deleted something else that's needed.


----------



## justin2311 (Oct 9, 2011)

Hi, I can't seem to find the scan log (or any previous scan logs for that matter) from HitmanPro. I ran the scan Safe Mode, would that make a difference?


----------



## Cookiegal (Aug 27, 2003)

It shouldn't. Did you open the HitmanPro interface? There should be a tab or somewhere to click to see what it quarantined or deleted.

I have another search for you with SystemLook please:


```
:filefind:
mrxsmb.sys
```


----------



## justin2311 (Oct 9, 2011)

I found these files that were deleted in the HitmanPro interface under "History":

C:\WINDOWS\system32\vqiukcc.dll.bak
C:\WINDOWS\system32\syvwwugz.dll
C:\WINDOWS\system32\drivers\tlfjxgwz.sys
C:\WINDOWS\temp\19D.tmp
C:\WINDOWS\system32\bskcegq.bak

The SystemLook search is still running on my laptop as I type this. I will post the results in the post below. Thanks for being so patient!


----------



## justin2311 (Oct 9, 2011)

Alright here are the results:

SystemLook 30.07.11 by jpshortstuff
Log created at 16:34 on 09/10/2011 by Justin 
Administrator - Elevation successful

========== filefind ==========

Searching for "mrxsmb.sys"
C:\i386\mrxsmb.sys --a--c- 451584 bytes [22:49 06/10/2006] [04:26 19/01/2005] 5DDC9A1B2EB5A4BF010CE8C019A18C1F
C:\i386\SP1\Windows\System32\Drivers\mrxsmb.sys --a--c- 440064 bytes [18:15 25/09/2006] [08:51 19/01/2005] 7F09B37065B61DDBC6116F612E6183D1
C:\i386\SP2\Windows\System32\Drivers\mrxsmb.sys --a--c- 451584 bytes [18:15 25/09/2006] [08:51 19/01/2005] 7B195060FF456FA65954C72C5C1640FF
C:\WINDOWS\$hf_mig$\KB885250\SP2QFE\mrxsmb.sys --a--c- 451584 bytes [18:34 25/09/2006] [03:51 19/01/2005] 7B195060FF456FA65954C72C5C1640FF
C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\mrxsmb.sys --a--c- 448128 bytes [18:37 25/09/2006] [01:15 28/10/2004] A1BE3CB080DCC0A8270D21E3CA3B7005
C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\mrxsmb.sys --a--c- 454400 bytes [10:16 05/05/2006] [10:16 05/05/2006] 7412CE77C6FD823F8889B4DF420C680B
C:\WINDOWS\$hf_mig$\KB957097\SP2QFE\mrxsmb.sys --a--c- 455936 bytes [14:38 08/04/2009] [11:25 24/10/2008] D07DA410091143336DAE419A921AAE2B
C:\WINDOWS\$hf_mig$\KB957097\SP3GDR\mrxsmb.sys --a--c- 455296 bytes [14:38 08/04/2009] [11:21 24/10/2008] 60AE98742484E7AB80C3C1450E708148
C:\WINDOWS\$hf_mig$\KB957097\SP3QFE\mrxsmb.sys --a--c- 455936 bytes [14:38 08/04/2009] [11:41 24/10/2008] 7170AB42B51954DEF2781A4D1CCE65F4
C:\WINDOWS\$hf_mig$\KB978251\SP2QFE\mrxsmb.sys --a--c- 456832 bytes [19:14 10/02/2010] [13:37 04/12/2009] 31422F271B5F3E257339541E76569A00
C:\WINDOWS\$hf_mig$\KB978251\SP3GDR\mrxsmb.sys --a--c- 455424 bytes [19:14 10/02/2010] [18:22 04/12/2009] 421F7B922CEC5A5F340E7574A98F7B7C
C:\WINDOWS\$hf_mig$\KB978251\SP3QFE\mrxsmb.sys --a--c- 456832 bytes [19:14 10/02/2010] [17:25 04/12/2009] 602549D1E8A622E5746991F6C56B21CA
C:\WINDOWS\$hf_mig$\KB980232\SP2QFE\mrxsmb.sys --a--c- 457216 bytes [23:03 13/04/2010] [12:48 24/02/2010] 3500E756812E716351F2D341AE1D5623
C:\WINDOWS\$hf_mig$\KB980232\SP3GDR\mrxsmb.sys --a--c- 455680 bytes [23:03 13/04/2010] [13:11 24/02/2010] F3AEFB11ABC521122B67095044169E98
C:\WINDOWS\$hf_mig$\KB980232\SP3QFE\mrxsmb.sys --a--c- 457216 bytes [23:03 13/04/2010] [11:57 24/02/2010] D09B9F0B9960DD41E73127B7814C115F
C:\WINDOWS\$NtUninstallKB914389$\mrxsmb.sys -----c- 451584 bytes [05:24 07/10/2006] [04:26 19/01/2005] 5DDC9A1B2EB5A4BF010CE8C019A18C1F
C:\WINDOWS\$NtUninstallKB957097$\mrxsmb.sys -----c- 453120 bytes [14:14 09/04/2009] [09:41 05/05/2006] 025AF03CE51645C62F3B6907A7E2BE5E
C:\WINDOWS\$NtUninstallKB978251$\mrxsmb.sys -----c- 453632 bytes [14:51 11/02/2010] [11:10 24/10/2008] 6F2D483B97B395544E59749C47963C6A
C:\WINDOWS\$NtUninstallKB980232$\mrxsmb.sys -----c- 453760 bytes [12:44 14/04/2010] [14:41 04/12/2009] F9692BE777822AB3F1A91C34728786DA
C:\WINDOWS\Driver Cache\i386\mrxsmb.sys -----c- 454016 bytes [18:34 25/09/2006] [12:31 24/02/2010] FB6C89BB3CE282B08BDB1E3C179E1C39
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\mrxsmb.sys --a--c- 456576 bytes [03:18 23/02/2010] [19:17 13/04/2008] 68755F0FF16070178B54674FE5B847B0
C:\WINDOWS\system32\dllcache\mrxsmb.sys -----c- 454016 bytes [09:41 05/05/2006] [12:31 24/02/2010] FB6C89BB3CE282B08BDB1E3C179E1C39

-= EOF =-

I'm going to be leaving my house soon to watch a football game (Go Pats!) but I'll check back later to see what other steps need to be taken.

Thanks again!


----------



## Cookiegal (Aug 27, 2003)

That's fine. I have to make dinner. I'll be back later. I think (hope) we've found the problem.


----------



## Cookiegal (Aug 27, 2003)

Please go * here* to download *HijackThis*. You can transfer it via a flash drive.

To the right of the green arrow under *HijackThis downloads* click on the *Executable *button and download the *HijackThis.exe* file to your desktop.
Double-click the * HijackThis.exe* file on your desktop to launch the program. If you get a security warning asking if you want to run this software because the publisher couldn't be verified click on Run to allow it.
Click on the *Scan* button. The scan will not take long and when it's finished the resulting log will open automatically in Notepad.
Click on the *Save log* button and save the log file to your desktop. Copy and paste the contents of the log in your post.
*Please do not fix anything with HijackThis unless you are instructed to do so. Most of what appears in the log will be harmless and/or necessary.*

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.


----------



## justin2311 (Oct 9, 2011)

Cookiegal said:


> That's fine. I have to make dinner. I'll be back later. I think (hope) we've found the problem.


Good to hear! I'll try to post the log later on.


----------



## Cookiegal (Aug 27, 2003)

Sounds good. Enjoy the game.


----------



## Cookiegal (Aug 27, 2003)

We'll need another file search as well please:


```
:filefind
Rdbss.sys
```


----------



## justin2311 (Oct 9, 2011)

It was a good game!

Alright so here are the results of the HijackThis scan:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:37:44 PM, on 10/9/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: (no name) - {03CC49C7-F3A8-465F-9273-C9A76CE9A951} - C:\Documents and Settings\Justin Vinalon\Local Settings\Application Data\Systemx86_x64.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [bacstray] C:\Program Files\Broadcom\BACS\BacsTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup
O4 - HKCU\..\Run: [Malware Protection] C:\Documents and Settings\All Users\Application Data\defender.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MouseOnlinePolicy] rundll32.exe "C:\Documents and Settings\All Users\Application Data\MouseOnlinePolicy.dll",DllRegisterServer
O4 - HKCU\..\Run: [Xilisoft Update] rundll32 "C:\Documents and Settings\Justin Vinalon\Local Settings\Application Data\AOL\AOLUpdate\AOLupdt32.dll",DllRegisterServer
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Distributed Link Tracking Client (TrkWks32) - Unknown owner - C:\WINDOWS\system32\icm3232.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 7655 bytes


----------



## justin2311 (Oct 9, 2011)

Results for SystemLook search:

SystemLook 30.07.11 by jpshortstuff
Log created at 20:41 on 09/10/2011 by Justin
Administrator - Elevation successful

========== filefind ==========

Searching for "Rdbss.sys"
C:\i386\rdbss.sys --a--c- 174592 bytes [22:49 06/10/2006] [01:13 28/10/2004] 809CA45CAA9072B3176AD44579D7F688
C:\i386\SP1\Windows\System32\Drivers\rdbss.sys --a--c- 170112 bytes [18:15 25/09/2006] [20:22 12/10/2004] 1FD256B6025449DCA3670574C0229D65
C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\rdbss.sys --a--c- 174592 bytes [18:37 25/09/2006] [01:14 28/10/2004] D0FEF8156D2D2FEC557C100956D76887
C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\rdbss.sys --a--c- 174592 bytes [10:22 05/05/2006] [10:22 05/05/2006] ED375CE745C42A14F10753F7022ECD6A
C:\WINDOWS\$NtUninstallKB914389$\rdbss.sys -----c- 174592 bytes [05:24 07/10/2006] [01:13 28/10/2004] 809CA45CAA9072B3176AD44579D7F688
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\rdbss.sys --a--c- 175744 bytes [03:21 23/02/2010] [19:28 13/04/2008] 7AD224AD1A1437FE28D89CF22B17780A
C:\WINDOWS\system32\dllcache\rdbss.sys -----c- 174592 bytes [09:47 05/05/2006] [09:47 05/05/2006] 03B965B1CA47F6EF60EB5E51CB50E0AF
C:\WINDOWS\system32\drivers\rdbss.sys --a---- 174592 bytes [17:51 10/08/2004] [09:47 05/05/2006] 03B965B1CA47F6EF60EB5E51CB50E0AF

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

Navigate to this file (be sure to choose the one in this specific file path in the list of files found):

C:\WINDOWS\$hf_mig$\KB980232\SP3QFE\*mrxsmb.sys*

Right-click on the *mrxsmb.sys* file and select "copy".

Now navigate to the drivers folder (see the following path) and open the drivers folder:

C:\WINDOWS\system32\*drivers*

Right-click and select "paste" to place a copy of the file in the drivers folder.

Reboot and see if you have the Internet connection back please.


----------



## justin2311 (Oct 9, 2011)

I followed your instructions precisely. However, still no Internet unfortunately.


----------



## Cookiegal (Aug 27, 2003)

Sorry, I forgot to tell you to go back and start those two services that wouldn't start.

Computer Browser
Workstation

If they start see if you can connect.


----------



## justin2311 (Oct 9, 2011)

I went to go and try to start both services but they still refuse to start and are still giving me error messages when trying to do so.


----------



## Cookiegal (Aug 27, 2003)

Did you try to start Workstation first? if not try that one first and then if it starts try the other.


----------



## justin2311 (Oct 9, 2011)

Just tried starting Workstation first, still no dice.


----------



## Cookiegal (Aug 27, 2003)

Please post the newly created errors in Event Viewer under both Application and System.


----------



## justin2311 (Oct 9, 2011)

Here are the errors under "*Application*":

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/9/2011
Time: 8:37:36 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/9/2011
Time: 2:35:02 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

------------------------------------------------------------

Here are the most recent errors under "*System*":

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:08:29 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:08:29 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:07:22 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:07:22 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:50 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:50 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:50 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:48 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:48 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:48 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:47 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:47 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:47 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:46 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:45 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:45 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:42 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:42 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:42 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:41 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:41 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:40 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 10:06:36 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:06:36 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4314
Date: 10/9/2011
Time: 10:05:35 PM
User: N/A
Computer: JUST
Description:
Unable to read the driver's bindings to the transport from the registry.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 58 00 ......X.
0008: 00 00 00 00 da 10 00 c0 ....Ú..À
0010: 15 01 00 00 60 01 00 c0 ....`..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:06:21 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 10:04:14 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 10:04:14 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:57:52 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:57:52 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:57:33 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:57:33 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:57:33 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:57:27 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:57:27 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:57:27 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:57:21 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:57:21 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:57:21 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:57:11 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:57:11 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:55:05 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:55:05 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:54:54 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:54:54 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:54:54 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:49:03 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:49:03 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:42:53 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:42:53 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0  4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:42:44 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:42:44 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:42:43 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:35 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:35 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:33 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:33 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:41:33 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:32 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:32 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:41:32 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:30 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:30 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:41:30 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:25 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:25 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:41:25 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:22 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:22 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:41:22 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 9:41:17 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 9:41:17 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4314
Date: 10/9/2011
Time: 9:40:15 PM
User: N/A
Computer: JUST
Description:
Unable to read the driver's bindings to the transport from the registry.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 58 00 ......X.
0008: 00 00 00 00 da 10 00 c0 ....Ú..À
0010: 15 01 00 00 60 01 00 c0 ....`..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 9:41:02 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:43 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:43 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:43 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:41 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:41 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:41 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:41 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:41 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:40 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:38 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:38 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:38 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:34 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:34 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:34 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:27 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:27 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:26 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:46:26 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:46:26 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:46:26 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 10/9/2011
Time: 8:37:38 PM
User: N/A
Computer: JUST
Description:
The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:34:19 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:34:19 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 10/9/2011
Time: 8:34:19 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 10/9/2011
Time: 8:34:17 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/9/2011
Time: 8:34:17 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Please do another file search and post the results:


```
:filefind
rdr.sys
```


----------



## justin2311 (Oct 9, 2011)

Here are the results:

SystemLook 30.07.11 by jpshortstuff
Log created at 22:26 on 09/10/2011 by Justin
Administrator - Elevation successful

========== filefind ==========

Searching for "rdr.sys"
No files found.

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

We'll have to continue this tomorrow as I'm signing off for the night.

In the meantime though, why did you never update to SP3? I see you're still on SP2 which is no longer supported.


----------



## justin2311 (Oct 9, 2011)

Alright, I'm actually going to be signing off as well. I'll be sure to check back sometime tomorrow afternoon.

As far as not updating to SP3, unfortunately I don't really have a valid excuse. I rarely use my laptop so it never really occurred to me (dumb, I know).


----------



## Cookiegal (Aug 27, 2003)

Do you have your installation CD?


----------



## justin2311 (Oct 9, 2011)

I believe so. I have a disc that came with the laptop that reads:

Operating System - Already Installed On Your Computer - Reinstallation CD Microsoft Windows XP Professional Including Service Pack 1a

Can I update to SP3 using that disc? Sorry, clearly I'm a complete noob!

If so, I will do the update once I can get my Internet back. Thanks again.


----------



## Cookiegal (Aug 27, 2003)

No you can't use that disk to install SP3 as it didn't exist when that disk was made. 

I'd like to see what MBAM deleted as you mentioned you used that and HitmanPro. Can you post the relevent log please so I can see what it removed?


----------



## justin2311 (Oct 9, 2011)

Shows how much I know! 

But alright, I'll post the MBAM scan log(s) when I get home later this afternoon. 

Also, I noticed the rdr.sys file is apparently missing. Is that going to be needed?

Thanks again for being so patient Cookiegal.


----------



## Cookiegal (Aug 27, 2003)

I'm not sure about that file yet. I don't know why you'd need it. I don't have it on mine. But one of the error messages seems to relate to it.

Is this XP Home or XP Pro?


----------



## justin2311 (Oct 9, 2011)

I'm on XP Home.


----------



## Phantom010 (Mar 9, 2009)

I'm on XP Pro and I don't have *rdr.sys* (NT Lan Manager Redirector File System Driver) either. However, I do have *nwrdr.sys*, the NetWare Redirector File System Driver, which seems similar. What do you think, *Cookiegal*?


----------



## Cookiegal (Aug 27, 2003)

From what I've seen the rdr.sys is from earlier systems like W2K. Justin, was this system upgraded to XP from W2K or another earlier operating system?

Thanks Phantom, it's worth doing a search for that file too Justin. Script:


```
:filefind
nwrdr.sys
```


----------



## justin2311 (Oct 9, 2011)

^ Phantom, thanks for chiming in. :up:

Here is the MBAM scan log that last removed anything:

Note: I only ran it for a minute because MBAM wouldn't scan any longer than that. Basically, if I let it run I would get the BSOD and have to reboot.  But that's another issue for a different day.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7879

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

10/5/2011 1:38:57 PM
mbam-log-2011-10-05 (13-38-57).txt

Scan type: Quick scan
Objects scanned: 1071
Time elapsed: 56 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
c:\WINDOWS\system32\j2iibf33pn5aq6w.exe (Backdoor.Bot) -> 632 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OwwwjUVVelBtz0c8234A (Backdoor.Bot) -> Value: OwwwjUVVelBtz0c8234A -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\j2iibf33pn5aq6w.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

------------------------------------------------------------

I also failed to mention that I used TDSSKiller to remove the viruses. However this was before I lost my Internet. I'll post the scan logs anyhow, maybe it will help find any other information:

10:20:31.0968 2860 TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
10:20:33.0609 2860 ============================================================
10:20:33.0609 2860 Current date / time: 2011/10/05 10:20:33.0609
10:20:33.0609 2860 SystemInfo:
10:20:33.0609 2860 
10:20:33.0609 2860 OS Version: 5.1.2600 ServicePack: 2.0
10:20:33.0609 2860 Product type: Workstation
10:20:33.0609 2860 ComputerName: JUST
10:20:33.0609 2860 UserName: Justin
10:20:33.0609 2860 Windows directory: C:\WINDOWS
10:20:33.0609 2860 System windows directory: C:\WINDOWS
10:20:33.0609 2860 Processor architecture: Intel x86
10:20:33.0609 2860 Number of processors: 1
10:20:33.0609 2860 Page size: 0x1000
10:20:33.0609 2860 Boot type: Normal boot
10:20:33.0609 2860 ============================================================
10:20:34.0578 2860 Initialize success
10:20:36.0640 2996 ============================================================
10:20:36.0640 2996 Scan started
10:20:36.0640 2996 Mode: Manual; 
10:20:36.0640 2996 ============================================================
10:20:38.0046 2996 a44ffdc2 (78bd13f84dfeb9bad405509ba132029c) C:\WINDOWS\3271380900:1538261565.exe
10:20:40.0281 2996 Suspicious file (Hidden): C:\WINDOWS\3271380900:1538261565.exe. md5: 78bd13f84dfeb9bad405509ba132029c
10:20:40.0281 2996 a44ffdc2 ( HiddenFile.Multi.Generic ) - warning
10:20:40.0281 2996 a44ffdc2 - detected HiddenFile.Multi.Generic (1)
10:20:40.0406 2996 Abiosdsk - ok
10:20:40.0453 2996 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
10:20:40.0453 2996 abp480n5 - ok
10:20:40.0515 2996 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:20:40.0515 2996 ACPI - ok
10:20:40.0562 2996 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
10:20:40.0562 2996 ACPIEC - ok
10:20:40.0609 2996 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
10:20:40.0609 2996 adpu160m - ok
10:20:40.0671 2996 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
10:20:40.0671 2996 aec - ok
10:20:40.0812 2996 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
10:20:40.0828 2996 AFD - ok
10:20:40.0859 2996 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
10:20:40.0859 2996 agp440 - ok
10:20:40.0890 2996 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
10:20:40.0906 2996 agpCPQ - ok
10:20:40.0937 2996 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
10:20:40.0937 2996 Aha154x - ok
10:20:40.0968 2996 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
10:20:40.0968 2996 aic78u2 - ok
10:20:41.0000 2996 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
10:20:41.0000 2996 aic78xx - ok
10:20:41.0046 2996 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
10:20:41.0046 2996 AliIde - ok
10:20:41.0078 2996 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
10:20:41.0078 2996 alim1541 - ok
10:20:41.0109 2996 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
10:20:41.0109 2996 amdagp - ok
10:20:41.0125 2996 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
10:20:41.0140 2996 amsint - ok
10:20:41.0187 2996 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
10:20:41.0187 2996 APPDRV - ok
10:20:41.0203 2996 appliandMP - ok
10:20:41.0265 2996 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
10:20:41.0281 2996 asc - ok
10:20:41.0312 2996 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
10:20:41.0312 2996 asc3350p - ok
10:20:41.0343 2996 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
10:20:41.0343 2996 asc3550 - ok
10:20:41.0406 2996 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:20:41.0406 2996 AsyncMac - ok
10:20:41.0437 2996 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:20:41.0437 2996 atapi - ok
10:20:41.0500 2996 Atdisk - ok
10:20:41.0531 2996 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:20:41.0546 2996 Atmarpc - ok
10:20:41.0578 2996 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:20:41.0578 2996 audstub - ok
10:20:41.0640 2996 BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
10:20:41.0656 2996 BCM43XX - ok
10:20:41.0671 2996 bcm4sbxp (c768c8a463d32c219ce291645a0621a4) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
10:20:41.0671 2996 bcm4sbxp - ok
10:20:41.0796 2996 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:20:41.0796 2996 Beep - ok
10:20:41.0812 2996 catchme - ok
10:20:41.0843 2996 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
10:20:41.0843 2996 cbidf - ok
10:20:41.0875 2996 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:20:41.0875 2996 cbidf2k - ok
10:20:41.0937 2996 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
10:20:41.0937 2996 cd20xrnt - ok
10:20:41.0953 2996 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:20:41.0953 2996 Cdaudio - ok
10:20:41.0984 2996 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
10:20:41.0984 2996 Cdfs - ok
10:20:42.0015 2996 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:20:42.0015 2996 Cdrom - ok
10:20:42.0046 2996 Changer - ok
10:20:42.0078 2996 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
10:20:42.0078 2996 CmBatt - ok
10:20:42.0109 2996 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
10:20:42.0109 2996 CmdIde - ok
10:20:42.0140 2996 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
10:20:42.0140 2996 Compbatt - ok
10:20:42.0187 2996 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
10:20:42.0187 2996 Cpqarray - ok
10:20:42.0234 2996 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
10:20:42.0234 2996 dac2w2k - ok
10:20:42.0265 2996 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
10:20:42.0265 2996 dac960nt - ok
10:20:42.0312 2996 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
10:20:42.0312 2996 Disk - ok
10:20:42.0390 2996 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
10:20:42.0406 2996 dmboot - ok
10:20:42.0453 2996 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
10:20:42.0453 2996 dmio - ok
10:20:42.0515 2996 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:20:42.0515 2996 dmload - ok
10:20:42.0578 2996 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
10:20:42.0578 2996 DMusic - ok
10:20:42.0609 2996 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
10:20:42.0609 2996 dpti2o - ok
10:20:42.0640 2996 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
10:20:42.0640 2996 drmkaud - ok
10:20:42.0703 2996 drvmcdb (e814854e6b246ccf498874839ab64d77) C:\WINDOWS\system32\drivers\drvmcdb.sys
10:20:42.0734 2996 drvmcdb - ok
10:20:42.0781 2996 drvnddm (ee83a4ebae70bc93cf14879d062f548b) C:\WINDOWS\system32\drivers\drvnddm.sys
10:20:42.0781 2996 drvnddm - ok
10:20:42.0890 2996 DSproct (2ac2372ffad9adc85672cc8e8ae14be9) C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys
10:20:42.0890 2996 DSproct - ok
10:20:42.0937 2996 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
10:20:42.0937 2996 E100B - ok
10:20:43.0000 2996 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
10:20:43.0000 2996 Fastfat - ok
10:20:43.0046 2996 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
10:20:43.0046 2996 Fdc - ok
10:20:43.0078 2996 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
10:20:43.0078 2996 Fips - ok
10:20:43.0109 2996 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
10:20:43.0109 2996 Flpydisk - ok
10:20:43.0156 2996 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
10:20:43.0171 2996 FltMgr - ok
10:20:43.0203 2996 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:20:43.0203 2996 Fs_Rec - ok
10:20:43.0234 2996 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:20:43.0250 2996 Ftdisk - ok
10:20:43.0281 2996 GEARAspiWDM (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
10:20:43.0281 2996 GEARAspiWDM - ok
10:20:43.0312 2996 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:20:43.0312 2996 Gpc - ok
10:20:43.0375 2996 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
10:20:43.0375 2996 HDAudBus - ok
10:20:43.0437 2996 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
10:20:43.0437 2996 HidUsb - ok
10:20:43.0578 2996 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
10:20:43.0578 2996 hpn - ok
10:20:43.0640 2996 HSFHWAZL (1c8caa80e91fb71864e9426f9eed048d) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
10:20:43.0640 2996 HSFHWAZL - ok
10:20:43.0765 2996 HSF_DPV (698204d9c2832e53633e53a30a53fc3d) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
10:20:43.0843 2996 HSF_DPV - ok
10:20:43.0906 2996 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
10:20:43.0906 2996 HTTP - ok
10:20:43.0968 2996 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
10:20:43.0968 2996 i2omgmt - ok
10:20:44.0015 2996 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
10:20:44.0015 2996 i2omp - ok
10:20:44.0078 2996 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:20:44.0078 2996 i8042prt - ok
10:20:44.0171 2996 ialm (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
10:20:44.0234 2996 ialm - ok
10:20:44.0312 2996 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:20:44.0312 2996 Imapi - ok
10:20:44.0375 2996 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
10:20:44.0375 2996 ini910u - ok
10:20:44.0406 2996 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:20:44.0406 2996 IntelIde - ok
10:20:44.0437 2996 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:20:44.0453 2996 intelppm - ok
10:20:44.0484 2996 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
10:20:44.0484 2996 Ip6Fw - ok
10:20:44.0515 2996 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:20:44.0515 2996 IpFilterDriver - ok
10:20:44.0531 2996 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:20:44.0546 2996 IpInIp - ok
10:20:44.0578 2996 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:20:44.0593 2996 IpNat - ok
10:20:44.0656 2996 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:20:44.0656 2996 IPSec - ok
10:20:44.0687 2996 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:20:44.0687 2996 IRENUM - ok
10:20:44.0750 2996 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:20:44.0750 2996 isapnp - ok
10:20:44.0796 2996 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:20:44.0796 2996 Kbdclass - ok
10:20:44.0843 2996 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
10:20:44.0843 2996 kbdhid - ok
10:20:44.0906 2996 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
10:20:44.0906 2996 kmixer - ok
10:20:44.0968 2996 KORGUMDS (cd2b7f4c57ff0d8422a3a7aa9995874a) C:\WINDOWS\system32\Drivers\KORGUMDS.SYS
10:20:44.0968 2996 KORGUMDS - ok
10:20:45.0015 2996 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
10:20:45.0015 2996 KSecDD - ok
10:20:45.0062 2996 Lavasoft Kernexplorer - ok
10:20:45.0078 2996 lbrtfdc - ok
10:20:45.0140 2996 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
10:20:45.0140 2996 mdmxsdk - ok
10:20:45.0171 2996 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:20:45.0171 2996 mnmdd - ok
10:20:45.0203 2996 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
10:20:45.0203 2996 Modem - ok
10:20:45.0250 2996 motmodem (5023875a94b0766d98a62a72bc4cb055) C:\WINDOWS\system32\DRIVERS\motmodem.sys
10:20:45.0250 2996 motmodem - ok
10:20:45.0296 2996 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:20:45.0296 2996 Mouclass - ok
10:20:45.0343 2996 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
10:20:45.0359 2996 mouhid - ok
10:20:45.0406 2996 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
10:20:45.0406 2996 MountMgr - ok
10:20:45.0453 2996 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
10:20:45.0453 2996 mraid35x - ok
10:20:45.0500 2996 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:20:45.0500 2996 MRxDAV - ok
10:20:45.0562 2996 MRxSmb (959e439bc926b45cbb1204c0a55ab9a4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:20:45.0578 2996 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\mrxsmb.sys. Real md5: 959e439bc926b45cbb1204c0a55ab9a4, Fake md5: fb6c89bb3ce282b08bdb1e3c179e1c39
10:20:45.0578 2996 MRxSmb ( ForgedFile.Multi.Generic ) - warning
10:20:45.0578 2996 MRxSmb - detected ForgedFile.Multi.Generic (1)
10:20:45.0609 2996 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
10:20:45.0625 2996 Msfs - ok
10:20:45.0671 2996 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:20:45.0671 2996 MSKSSRV - ok
10:20:45.0750 2996 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:20:45.0750 2996 MSPCLOCK - ok
10:20:45.0765 2996 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
10:20:45.0765 2996 MSPQM - ok
10:20:45.0796 2996 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:20:45.0796 2996 mssmbios - ok
10:20:45.0843 2996 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
10:20:45.0843 2996 Mup - ok
10:20:45.0890 2996 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
10:20:45.0890 2996 NDIS - ok
10:20:45.0906 2996 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:20:45.0921 2996 NdisTapi - ok
10:20:45.0953 2996 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:20:45.0953 2996 Ndisuio - ok
10:20:45.0984 2996 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:20:45.0984 2996 NdisWan - ok
10:20:46.0015 2996 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
10:20:46.0015 2996 NDProxy - ok
10:20:46.0031 2996 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:20:46.0031 2996 NetBIOS - ok
10:20:46.0093 2996 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:20:46.0093 2996 NetBT - ok
10:20:46.0156 2996 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
10:20:46.0156 2996 nm - ok
10:20:46.0187 2996 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
10:20:46.0187 2996 Npfs - ok
10:20:46.0265 2996 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
10:20:46.0281 2996 Ntfs - ok
10:20:46.0343 2996 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:20:46.0343 2996 Null - ok
10:20:46.0468 2996 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
10:20:46.0562 2996 nv - ok
10:20:46.0593 2996 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:20:46.0593 2996 NwlnkFlt - ok
10:20:46.0625 2996 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:20:46.0625 2996 NwlnkFwd - ok
10:20:46.0656 2996 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
10:20:46.0671 2996 NwlnkIpx - ok
10:20:46.0765 2996 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
10:20:46.0765 2996 NwlnkNb - ok
10:20:46.0796 2996 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
10:20:46.0796 2996 NwlnkSpx - ok
10:20:46.0843 2996 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
10:20:46.0843 2996 Parport - ok
10:20:46.0875 2996 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
10:20:46.0875 2996 PartMgr - ok
10:20:46.0921 2996 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
10:20:46.0921 2996 ParVdm - ok
10:20:46.0953 2996 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
10:20:46.0953 2996 PCI - ok
10:20:46.0984 2996 PCIDump - ok
10:20:47.0015 2996 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
10:20:47.0015 2996 PCIIde - ok
10:20:47.0062 2996 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
10:20:47.0062 2996 Pcmcia - ok
10:20:47.0078 2996 PDCOMP - ok
10:20:47.0125 2996 PDFRAME - ok
10:20:47.0140 2996 PDRELI - ok
10:20:47.0171 2996 PDRFRAME - ok
10:20:47.0203 2996 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
10:20:47.0203 2996 perc2 - ok
10:20:47.0265 2996 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
10:20:47.0265 2996 perc2hib - ok
10:20:47.0359 2996 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:20:47.0359 2996 PptpMiniport - ok
10:20:47.0390 2996 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
10:20:47.0406 2996 PSched - ok
10:20:47.0437 2996 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:20:47.0437 2996 Ptilink - ok
10:20:47.0484 2996 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
10:20:47.0484 2996 PxHelp20 - ok
10:20:47.0500 2996 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
10:20:47.0500 2996 ql1080 - ok
10:20:47.0546 2996 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
10:20:47.0546 2996 Ql10wnt - ok
10:20:47.0578 2996 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
10:20:47.0578 2996 ql12160 - ok
10:20:47.0609 2996 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
10:20:47.0625 2996 ql1240 - ok
10:20:47.0656 2996 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
10:20:47.0656 2996 ql1280 - ok
10:20:47.0687 2996 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:20:47.0703 2996 RasAcd - ok
10:20:47.0781 2996 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:20:47.0781 2996 Rasl2tp - ok
10:20:47.0812 2996 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:20:47.0828 2996 RasPppoe - ok
10:20:47.0859 2996 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:20:47.0859 2996 Raspti - ok
10:20:47.0906 2996 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:20:47.0906 2996 Rdbss - ok
10:20:47.0937 2996 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:20:47.0937 2996 RDPCDD - ok
10:20:47.0984 2996 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:20:47.0984 2996 rdpdr - ok
10:20:48.0046 2996 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
10:20:48.0062 2996 RDPWD - ok
10:20:48.0093 2996 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:20:48.0093 2996 redbook - ok
10:20:48.0140 2996 RimUsb - ok
10:20:48.0187 2996 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
10:20:48.0187 2996 RimVSerPort - ok
10:20:48.0234 2996 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
10:20:48.0234 2996 ROOTMODEM - ok
10:20:48.0296 2996 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:20:48.0296 2996 Secdrv - ok
10:20:48.0359 2996 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
10:20:48.0359 2996 serenum - ok
10:20:48.0390 2996 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
10:20:48.0390 2996 Serial - ok
10:20:48.0468 2996 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
10:20:48.0484 2996 Sfloppy - ok
10:20:48.0515 2996 Simbad - ok
10:20:48.0562 2996 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
10:20:48.0562 2996 sisagp - ok
10:20:48.0593 2996 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
10:20:48.0609 2996 Sparrow - ok
10:20:48.0640 2996 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
10:20:48.0640 2996 splitter - ok
10:20:48.0703 2996 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
10:20:48.0734 2996 sr - ok
10:20:48.0796 2996 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
10:20:48.0812 2996 Srv - ok
10:20:48.0859 2996 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys
10:20:48.0859 2996 sscdbhk5 - ok
10:20:48.0875 2996 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys
10:20:48.0875 2996 ssrtln - ok
10:20:48.0984 2996 STHDA (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINDOWS\system32\drivers\sthda.sys
10:20:49.0000 2996 STHDA - ok
10:20:49.0031 2996 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:20:49.0031 2996 swenum - ok
10:20:49.0062 2996 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
10:20:49.0062 2996 swmidi - ok
10:20:49.0093 2996 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
10:20:49.0093 2996 symc810 - ok
10:20:49.0125 2996 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
10:20:49.0140 2996 symc8xx - ok
10:20:49.0156 2996 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
10:20:49.0156 2996 sym_hi - ok
10:20:49.0187 2996 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
10:20:49.0187 2996 sym_u3 - ok
10:20:49.0265 2996 SynTP (6bef3acd6ee22eec55b68699e8aace09) C:\WINDOWS\system32\DRIVERS\SynTP.sys
10:20:49.0265 2996 SynTP - ok
10:20:49.0312 2996 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
10:20:49.0312 2996 sysaudio - ok
10:20:49.0375 2996 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:20:49.0390 2996 Tcpip - ok
10:20:49.0421 2996 Tcpip6 (be4007ab8c9b62e3688fc2f469b98190) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
10:20:49.0437 2996 Tcpip6 - ok
10:20:49.0453 2996 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:20:49.0453 2996 TDPIPE - ok
10:20:49.0500 2996 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
10:20:49.0500 2996 TDTCP - ok
10:20:49.0531 2996 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:20:49.0531 2996 TermDD - ok
10:20:49.0609 2996 tfsnboio (30698355067d07da5f9eb81132c9fdd6) C:\WINDOWS\system32\dla\tfsnboio.sys
10:20:49.0609 2996 tfsnboio - ok
10:20:49.0640 2996 tfsncofs (fb9d825bb4a2abdf24600f7505050e2b) C:\WINDOWS\system32\dla\tfsncofs.sys
10:20:49.0640 2996 tfsncofs - ok
10:20:49.0671 2996 tfsndrct (cafd8cca11aa1e8b6d2ea1ba8f70ec33) C:\WINDOWS\system32\dla\tfsndrct.sys
10:20:49.0671 2996 tfsndrct - ok
10:20:49.0781 2996 tfsndres (8db1e78fbf7c426d8ec3d8f1a33d6485) C:\WINDOWS\system32\dla\tfsndres.sys
10:20:49.0781 2996 tfsndres - ok
10:20:49.0812 2996 tfsnifs (b92f67a71cc8176f331b8aa8d9f555ad) C:\WINDOWS\system32\dla\tfsnifs.sys
10:20:49.0812 2996 tfsnifs - ok
10:20:49.0843 2996 tfsnopio (85985faa9a71e2358fcc2edefc2a3c5c) C:\WINDOWS\system32\dla\tfsnopio.sys
10:20:49.0843 2996 tfsnopio - ok
10:20:49.0859 2996 tfsnpool (bba22094f0f7c210567efdaf11f64495) C:\WINDOWS\system32\dla\tfsnpool.sys
10:20:49.0859 2996 tfsnpool - ok
10:20:49.0890 2996 tfsnudf (81340bef80b9811e98ce64611e67e3ff) C:\WINDOWS\system32\dla\tfsnudf.sys
10:20:49.0890 2996 tfsnudf - ok
10:20:49.0921 2996 tfsnudfa (c035fd116224ccc8325f384776b6a8bb) C:\WINDOWS\system32\dla\tfsnudfa.sys
10:20:49.0921 2996 tfsnudfa - ok
10:20:49.0953 2996 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
10:20:49.0953 2996 TosIde - ok
10:20:50.0015 2996 tunmp (87a0e9e18c10a9e454238e3330e2a26d) C:\WINDOWS\system32\DRIVERS\tunmp.sys
10:20:50.0015 2996 tunmp - ok
10:20:50.0062 2996 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
10:20:50.0062 2996 Udfs - ok
10:20:50.0109 2996 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
10:20:50.0109 2996 ultra - ok
10:20:50.0156 2996 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
10:20:50.0171 2996 Update - ok
10:20:50.0218 2996 USBAAPL (f340199e8cb097e1acd58a967c665919) C:\WINDOWS\system32\Drivers\usbaapl.sys
10:20:50.0406 2996 USBAAPL - ok
10:20:50.0562 2996 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
10:20:50.0562 2996 usbaudio - ok
10:20:50.0625 2996 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:20:50.0625 2996 usbccgp - ok
10:20:50.0687 2996 usbehci (708579b01fed227aadb393cb0c3b4a2c) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:20:50.0703 2996 usbehci - ok
10:20:50.0796 2996 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:20:50.0796 2996 usbhub - ok
10:20:50.0843 2996 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:20:50.0843 2996 usbprint - ok
10:20:50.0890 2996 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:20:50.0890 2996 usbscan - ok
10:20:50.0953 2996 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys
10:20:50.0953 2996 usbser - ok
10:20:51.0000 2996 usbsermpt (caad3467fbfae8a380f67e9c7150a85e) C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
10:20:51.0000 2996 usbsermpt - ok
10:20:51.0031 2996 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:20:51.0046 2996 USBSTOR - ok
10:20:51.0093 2996 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:20:51.0109 2996 usbuhci - ok
10:20:51.0125 2996 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
10:20:51.0125 2996 VgaSave - ok
10:20:51.0156 2996 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
10:20:51.0171 2996 viaagp - ok
10:20:51.0187 2996 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
10:20:51.0203 2996 ViaIde - ok
10:20:51.0234 2996 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
10:20:51.0234 2996 VolSnap - ok
10:20:51.0281 2996 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:20:51.0281 2996 Wanarp - ok
10:20:51.0328 2996 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
10:20:51.0328 2996 wanatw - ok
10:20:51.0390 2996 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
10:20:51.0390 2996 Wdf01000 - ok
10:20:51.0468 2996 WDICA - ok
10:20:51.0515 2996 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
10:20:51.0515 2996 wdmaud - ok
10:20:51.0609 2996 winachsf (74cf3f2e4e40c4a2e18d39d6300a5c24) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
10:20:51.0625 2996 winachsf - ok
10:20:51.0734 2996 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
10:20:51.0734 2996 WS2IFSL - ok
10:20:51.0812 2996 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
10:20:51.0812 2996 WudfPf - ok
10:20:51.0843 2996 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
10:20:51.0843 2996 WudfRd - ok
10:20:51.0921 2996 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
10:20:52.0093 2996 \Device\Harddisk0\DR0 - ok
10:20:52.0109 2996 Boot (0x1200) (16b46e90f13e34098c142ccc05745a8e) \Device\Harddisk0\DR0\Partition0
10:20:52.0109 2996 \Device\Harddisk0\DR0\Partition0 - ok
10:20:52.0109 2996 ============================================================
10:20:52.0109 2996 Scan finished
10:20:52.0109 2996 ============================================================
10:20:52.0125 2988 Detected object count: 2
10:20:52.0125 2988 Actual detected object count: 2
10:21:06.0250 2988 C:\WINDOWS\3271380900:1538261565.exe - copied to quarantine
10:21:06.0250 2988 a44ffdc2 ( HiddenFile.Multi.Generic ) - User select action: Quarantine 
10:21:06.0421 2988 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys - copied to quarantine
10:21:06.0421 2988 MRxSmb ( ForgedFile.Multi.Generic ) - User select action: Quarantine 
10:21:10.0625 3636 ============================================================
10:21:10.0640 3636 Scan started
10:21:10.0640 3636 Mode: Manual; 
10:21:10.0640 3636 ============================================================
10:21:11.0000 3636 a44ffdc2 (78bd13f84dfeb9bad405509ba132029c) C:\WINDOWS\3271380900:1538261565.exe
10:21:11.0000 3636 Suspicious file (Hidden): C:\WINDOWS\3271380900:1538261565.exe. md5: 78bd13f84dfeb9bad405509ba132029c
10:21:11.0000 3636 a44ffdc2 ( HiddenFile.Multi.Generic ) - warning
10:21:11.0000 3636 a44ffdc2 - detected HiddenFile.Multi.Generic (1)
10:21:11.0109 3636 Abiosdsk - ok
10:21:11.0156 3636 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
10:21:11.0156 3636 abp480n5 - ok
10:21:11.0218 3636 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:21:11.0218 3636 ACPI - ok
10:21:11.0296 3636 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
10:21:11.0296 3636 ACPIEC - ok
10:21:11.0328 3636 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
10:21:11.0328 3636 adpu160m - ok
10:21:11.0375 3636 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
10:21:11.0375 3636 aec - ok
10:21:11.0437 3636 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
10:21:11.0437 3636 AFD - ok
10:21:11.0484 3636 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
10:21:11.0484 3636 agp440 - ok
10:21:11.0515 3636 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
10:21:11.0515 3636 agpCPQ - ok
10:21:11.0546 3636 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
10:21:11.0546 3636 Aha154x - ok
10:21:11.0578 3636 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
10:21:11.0578 3636 aic78u2 - ok
10:21:11.0609 3636 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
10:21:11.0609 3636 aic78xx - ok
10:21:11.0656 3636 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
10:21:11.0656 3636 AliIde - ok
10:21:11.0671 3636 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
10:21:11.0687 3636 alim1541 - ok
10:21:11.0734 3636 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
10:21:11.0734 3636 amdagp - ok
10:21:11.0765 3636 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
10:21:11.0765 3636 amsint - ok
10:21:11.0812 3636 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
10:21:11.0812 3636 APPDRV - ok
10:21:11.0828 3636 appliandMP - ok
10:21:11.0859 3636 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
10:21:11.0859 3636 asc - ok
10:21:11.0906 3636 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
10:21:11.0906 3636 asc3350p - ok
10:21:11.0937 3636 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
10:21:11.0937 3636 asc3550 - ok
10:21:11.0968 3636 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:21:11.0968 3636 AsyncMac - ok
10:21:12.0015 3636 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:21:12.0015 3636 atapi - ok
10:21:12.0031 3636 Atdisk - ok
10:21:12.0062 3636 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:21:12.0062 3636 Atmarpc - ok
10:21:12.0093 3636 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:21:12.0093 3636 audstub - ok
10:21:12.0156 3636 BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
10:21:12.0156 3636 BCM43XX - ok
10:21:12.0187 3636 bcm4sbxp (c768c8a463d32c219ce291645a0621a4) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
10:21:12.0187 3636 bcm4sbxp - ok
10:21:12.0218 3636 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:21:12.0234 3636 Beep - ok
10:21:12.0250 3636 catchme - ok
10:21:12.0281 3636 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
10:21:12.0281 3636 cbidf - ok
10:21:12.0312 3636 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:21:12.0312 3636 cbidf2k - ok
10:21:12.0328 3636 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
10:21:12.0328 3636 cd20xrnt - ok
10:21:12.0359 3636 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:21:12.0359 3636 Cdaudio - ok
10:21:12.0390 3636 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
10:21:12.0390 3636 Cdfs - ok
10:21:12.0421 3636 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:21:12.0421 3636 Cdrom - ok
10:21:12.0437 3636 Changer - ok
10:21:12.0500 3636 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
10:21:12.0500 3636 CmBatt - ok
10:21:12.0515 3636 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
10:21:12.0515 3636 CmdIde - ok
10:21:12.0546 3636 Compbatt  (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
10:21:12.0546 3636 Compbatt - ok
10:21:12.0593 3636 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
10:21:12.0593 3636 Cpqarray - ok
10:21:12.0656 3636 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
10:21:12.0656 3636 dac2w2k - ok
10:21:12.0703 3636 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
10:21:12.0703 3636 dac960nt - ok
10:21:12.0734 3636 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
10:21:12.0734 3636 Disk - ok
10:21:12.0781 3636 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
10:21:12.0796 3636 dmboot - ok
10:21:12.0828 3636 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
10:21:12.0828 3636 dmio - ok
10:21:12.0843 3636 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:21:12.0843 3636 dmload - ok
10:21:12.0906 3636 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
10:21:12.0906 3636 DMusic - ok
10:21:12.0937 3636 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
10:21:12.0937 3636 dpti2o - ok
10:21:12.0968 3636 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
10:21:12.0968 3636 drmkaud - ok
10:21:13.0031 3636 drvmcdb (e814854e6b246ccf498874839ab64d77) C:\WINDOWS\system32\drivers\drvmcdb.sys
10:21:13.0031 3636 drvmcdb - ok
10:21:13.0062 3636 drvnddm (ee83a4ebae70bc93cf14879d062f548b) C:\WINDOWS\system32\drivers\drvnddm.sys
10:21:13.0062 3636 drvnddm - ok
10:21:13.0171 3636 DSproct (2ac2372ffad9adc85672cc8e8ae14be9) C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys
10:21:13.0171 3636 DSproct - ok
10:21:13.0203 3636 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
10:21:13.0218 3636 E100B - ok
10:21:13.0265 3636 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
10:21:13.0265 3636 Fastfat - ok
10:21:13.0312 3636 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
10:21:13.0312 3636 Fdc - ok
10:21:13.0343 3636 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
10:21:13.0343 3636 Fips - ok
10:21:13.0375 3636 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
10:21:13.0375 3636 Flpydisk - ok
10:21:13.0437 3636 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
10:21:13.0437 3636 FltMgr - ok
10:21:13.0468 3636 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:21:13.0484 3636 Fs_Rec - ok
10:21:13.0515 3636 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:21:13.0515 3636 Ftdisk - ok
10:21:13.0546 3636 GEARAspiWDM (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
10:21:13.0546 3636 GEARAspiWDM - ok
10:21:13.0578 3636 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:21:13.0578 3636 Gpc - ok
10:21:13.0625 3636 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
10:21:13.0625 3636 HDAudBus - ok
10:21:13.0687 3636 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
10:21:13.0687 3636  HidUsb - ok
10:21:13.0781 3636 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
10:21:13.0781 3636 hpn - ok
10:21:13.0843 3636 HSFHWAZL (1c8caa80e91fb71864e9426f9eed048d) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
10:21:13.0859 3636 HSFHWAZL - ok
10:21:13.0937 3636 HSF_DPV (698204d9c2832e53633e53a30a53fc3d) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
10:21:13.0953 3636 HSF_DPV - ok
10:21:14.0000 3636 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
10:21:14.0000 3636 HTTP - ok
10:21:14.0046 3636 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
10:21:14.0046 3636 i2omgmt - ok
10:21:14.0093 3636 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
10:21:14.0093 3636 i2omp - ok
10:21:14.0125 3636 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:21:14.0125 3636 i8042prt - ok
10:21:14.0218 3636 ialm (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
10:21:14.0234 3636 ialm - ok
10:21:14.0281 3636 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:21:14.0281 3636 Imapi - ok
10:21:14.0312 3636 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
10:21:14.0312 3636 ini910u - ok
10:21:14.0343 3636 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:21:14.0343 3636 IntelIde - ok
10:21:14.0375 3636 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:21:14.0375 3636 intelppm - ok
10:21:14.0390 3636 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
10:21:14.0390 3636 Ip6Fw - ok
10:21:14.0453 3636 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:21:14.0453 3636 IpFilterDriver - ok
10:21:14.0484 3636 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:21:14.0484 3636 IpInIp - ok
10:21:14.0531 3636 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:21:14.0531 3636 IpNat - ok
10:21:14.0578 3636 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:21:14.0578 3636 IPSec - ok
10:21:14.0593 3636 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:21:14.0593 3636 IRENUM - ok
10:21:14.0671 3636 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:21:14.0671 3636 isapnp - ok
10:21:14.0750 3636 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:21:14.0750 3636 Kbdclass - ok
10:21:14.0796 3636 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
10:21:14.0812 3636 kbdhid - ok
10:21:14.0859 3636 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
10:21:14.0859 3636 kmixer - ok
10:21:14.0921 3636 KORGUMDS (cd2b7f4c57ff0d8422a3a7aa9995874a) C:\WINDOWS\system32\Drivers\KORGUMDS.SYS
10:21:14.0921 3636 KORGUMDS - ok
10:21:14.0968 3636 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
10:21:14.0968 3636 KSecDD - ok
10:21:15.0000 3636 Lavasoft Kernexplorer - ok
10:21:15.0031 3636 lbrtfdc - ok
10:21:15.0093 3636 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
10:21:15.0093 3636 mdmxsdk - ok
10:21:15.0125 3636 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:21:15.0125 3636 mnmdd - ok
10:21:15.0140 3636 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
10:21:15.0140 3636 Modem - ok
10:21:15.0187 3636 motmodem (5023875a94b0766d98a62a72bc4cb055) C:\WINDOWS\system32\DRIVERS\motmodem.sys
10:21:15.0187 3636 motmodem - ok
10:21:15.0234 3636 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:21:15.0234 3636 Mouclass - ok
10:21:15.0281 3636 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
10:21:15.0296 3636 mouhid - ok
10:21:15.0328 3636 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
10:21:15.0328 3636 MountMgr - ok
10:21:15.0359 3636 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
10:21:15.0359 3636 mraid35x - ok
10:21:15.0421 3636 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:21:15.0421 3636 MRxDAV - ok
10:21:15.0484 3636 MRxSmb (959e439bc926b45cbb1204c0a55ab9a4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:21:15.0484 3636 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\mrxsmb.sys. Real md5: 959e439bc926b45cbb1204c0a55ab9a4, Fake md5: fb6c89bb3ce282b08bdb1e3c179e1c39
10:21:15.0484 3636 MRxSmb ( ForgedFile.Multi.Generic ) - warning
10:21:15.0484 3636 MRxSmb - detected ForgedFile.Multi.Generic (1)
10:21:15.0531 3636 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
10:21:15.0531 3636 Msfs - ok
10:21:15.0562 3636 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:21:15.0578 3636 MSKSSRV - ok
10:21:15.0593 3636 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:21:15.0593 3636 MSPCLOCK - ok
10:21:15.0609 3636 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
10:21:15.0609 3636 MSPQM - ok
10:21:15.0656 3636 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:21:15.0656 3636 mssmbios - ok
10:21:15.0718 3636 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
10:21:15.0718 3636 Mup - ok
10:21:15.0781 3636 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
10:21:15.0796 3636 NDIS - ok
10:21:15.0812 3636 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:21:15.0812 3636 NdisTapi - ok
10:21:15.0843 3636 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:21:15.0843 3636 Ndisuio - ok
10:21:15.0875 3636 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:21:15.0890 3636 NdisWan - ok
10:21:15.0906 3636 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
10:21:15.0921 3636 NDProxy - ok
10:21:15.0937 3636 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:21:15.0937 3636 NetBIOS - ok
10:21:15.0984 3636 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:21:15.0984 3636 NetBT - ok
10:21:16.0046 3636 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
10:21:16.0062 3636 nm - ok
10:21:16.0078 3636 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
10:21:16.0078 3636 Npfs - ok
10:21:16.0156 3636 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
10:21:16.0171 3636 Ntfs - ok
10:21:16.0203 3636 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:21:16.0203 3636 Null - ok
10:21:16.0328 3636 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
10:21:16.0343 3636 nv - ok
10:21:16.0375 3636 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:21:16.0375 3636 NwlnkFlt - ok
10:21:16.0406 3636 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:21:16.0406 3636 NwlnkFwd - ok
10:21:16.0468 3636 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
10:21:16.0468 3636 NwlnkIpx - ok
10:21:16.0500 3636 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
10:21:16.0500 3636 NwlnkNb - ok
10:21:16.0531 3636 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
10:21:16.0531 3636 NwlnkSpx - ok
10:21:16.0593 3636 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
10:21:16.0593 3636 Parport - ok
10:21:16.0640 3636 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
10:21:16.0640 3636 PartMgr - ok
10:21:16.0671 3636 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
10:21:16.0671 3636 ParVdm - ok
10:21:16.0781 3636 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
10:21:16.0781 3636 PCI - ok
10:21:16.0796 3636 PCIDump - ok
10:21:16.0828 3636 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
10:21:16.0828 3636 PCIIde - ok
10:21:16.0875 3636 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
10:21:16.0875 3636 Pcmcia - ok
10:21:16.0890 3636 PDCOMP - ok
10:21:16.0921 3636 PDFRAME - ok
10:21:16.0937 3636 PDRELI - ok
10:21:16.0953 3636 PDRFRAME - ok
10:21:17.0000 3636 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
10:21:17.0000 3636 perc2 - ok
10:21:17.0031 3636 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
10:21:17.0031 3636 perc2hib - ok
10:21:17.0093 3636 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:21:17.0093 3636 PptpMiniport - ok
10:21:17.0140 3636 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
10:21:17.0140 3636 PSched - ok
10:21:17.0171 3636 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:21:17.0171 3636 Ptilink - ok
10:21:17.0218 3636 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
10:21:17.0218 3636 PxHelp20 - ok
10:21:17.0250 3636 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
10:21:17.0250 3636 ql1080 - ok
10:21:17.0296 3636 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
10:21:17.0296 3636 Ql10wnt - ok
10:21:17.0328 3636 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
10:21:17.0328 3636 ql12160 - ok
10:21:17.0359 3636 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
10:21:17.0359 3636 ql1240 - ok
10:21:17.0406 3636 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
10:21:17.0406 3636 ql1280 - ok
10:21:17.0437 3636 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:21:17.0437 3636 RasAcd - ok
10:21:17.0468 3636 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:21:17.0468 3636 Rasl2tp - ok
10:21:17.0500 3636 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:21:17.0500 3636 RasPppoe - ok
10:21:17.0562 3636 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:21:17.0562 3636 Raspti - ok
10:21:17.0609 3636 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:21:17.0609 3636 Rdbss - ok
10:21:17.0625 3636 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:21:17.0640 3636 RDPCDD - ok
10:21:17.0671 3636 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:21:17.0687 3636 rdpdr - ok
10:21:17.0796 3636 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
10:21:17.0796 3636 RDPWD - ok
10:21:17.0843 3636 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:21:17.0843 3636 redbook - ok
10:21:17.0875 3636 RimUsb - ok
10:21:17.0921 3636 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
10:21:17.0937 3636 RimVSerPort - ok
10:21:17.0968 3636 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
10:21:17.0968 3636 ROOTMODEM - ok
10:21:18.0031 3636 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:21:18.0031 3636 Secdrv - ok
10:21:18.0078 3636 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
10:21:18.0078 3636 serenum - ok
10:21:18.0109 3636 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
10:21:18.0109 3636 Serial - ok
10:21:18.0156 3636 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
10:21:18.0156 3636 Sfloppy - ok
10:21:18.0187 3636 Simbad - ok
10:21:18.0218 3636 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
10:21:18.0218 3636 sisagp - ok
10:21:18.0265 3636 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
10:21:18.0265 3636 Sparrow - ok
10:21:18.0296 3636 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
10:21:18.0296 3636 splitter - ok
10:21:18.0343 3636 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
10:21:18.0343 3636 sr - ok
10:21:18.0406 3636 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
10:21:18.0406 3636 Srv - ok
10:21:18.0453 3636 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys
10:21:18.0453 3636 sscdbhk5 - ok
10:21:18.0484 3636 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys
10:21:18.0484 3636 ssrtln - ok
10:21:18.0578 3636 STHDA (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINDOWS\system32\drivers\sthda.sys
10:21:18.0593 3636 STHDA - ok
10:21:18.0625 3636 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:21:18.0625 3636 swenum - ok
10:21:18.0656 3636 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
10:21:18.0656 3636 swmidi - ok
10:21:18.0718 3636 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
10:21:18.0718 3636 symc810 - ok
10:21:18.0750 3636 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
10:21:18.0750 3636 symc8xx - ok
10:21:18.0765 3636 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
10:21:18.0765 3636 sym_hi - ok
10:21:18.0796 3636 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
10:21:18.0812 3636 sym_u3 - ok
10:21:18.0875 3636 SynTP (6bef3acd6ee22eec55b68699e8aace09) C:\WINDOWS\system32\DRIVERS\SynTP.sys
10:21:18.0875 3636 SynTP - ok
10:21:18.0906 3636 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
10:21:18.0906 3636 sysaudio - ok
10:21:18.0984 3636 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:21:18.0984 3636 Tcpip - ok
10:21:19.0031 3636 Tcpip6 (be4007ab8c9b62e3688fc2f469b98190) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
10:21:19.0031 3636 Tcpip6 - ok
10:21:19.0062 3636 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:21:19.0062 3636 TDPIPE - ok
10:21:19.0093 3636 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
10:21:19.0093 3636 TDTCP - ok
10:21:19.0140 3636 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:21:19.0140 3636 TermDD - ok
10:21:19.0218 3636 tfsnboio (30698355067d07da5f9eb81132c9fdd6) C:\WINDOWS\system32\dla\tfsnboio.sys
10:21:19.0218 3636 tfsnboio - ok
10:21:19.0250 3636 tfsncofs (fb9d825bb4a2abdf24600f7505050e2b) C:\WINDOWS\system32\dla\tfsncofs.sys
10:21:19.0250 3636 tfsncofs - ok
10:21:19.0281 3636 tfsndrct (cafd8cca11aa1e8b6d2ea1ba8f70ec33) C:\WINDOWS\system32\dla\tfsndrct.sys
10:21:19.0281 3636 tfsndrct - ok
10:21:19.0296 3636 tfsndres (8db1e78fbf7c426d8ec3d8f1a33d6485) C:\WINDOWS\system32\dla\tfsndres.sys
10:21:19.0296 3636 tfsndres - ok
10:21:19.0328 3636 tfsnifs (b92f67a71cc8176f331b8aa8d9f555ad) C:\WINDOWS\system32\dla\tfsnifs.sys
10:21:19.0328 3636 tfsnifs - ok
10:21:19.0359 3636 tfsnopio (85985faa9a71e2358fcc2edefc2a3c5c) C:\WINDOWS\system32\dla\tfsnopio.sys
10:21:19.0359 3636 tfsnopio - ok
10:21:19.0390 3636 tfsnpool (bba22094f0f7c210567efdaf11f64495) C:\WINDOWS\system32\dla\tfsnpool.sys
10:21:19.0390 3636 tfsnpool - ok
10:21:19.0437 3636 tfsnudf (81340bef80b9811e98ce64611e67e3ff) C:\WINDOWS\system32\dla\tfsnudf.sys
10:21:19.0437 3636 tfsnudf - ok
10:21:19.0468 3636 tfsnudfa (c035fd116224ccc8325f384776b6a8bb) C:\WINDOWS\system32\dla\tfsnudfa.sys
10:21:19.0468 3636 tfsnudfa - ok
10:21:19.0500 3636 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
10:21:19.0515 3636 TosIde - ok
10:21:19.0546 3636 tunmp (87a0e9e18c10a9e454238e3330e2a26d) C:\WINDOWS\system32\DRIVERS\tunmp.sys
10:21:19.0546 3636 tunmp - ok
10:21:19.0593 3636 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
10:21:19.0593 3636 Udfs - ok
10:21:19.0656 3636 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
10:21:19.0671 3636 ultra - ok
10:21:19.0828 3636 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
10:21:19.0828 3636 Update - ok
10:21:19.0890 3636 USBAAPL (f340199e8cb097e1acd58a967c665919) C:\WINDOWS\system32\Drivers\usbaapl.sys
10:21:19.0890 3636 USBAAPL - ok
10:21:19.0937 3636 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
10:21:19.0937 3636 usbaudio - ok
10:21:20.0015 3636 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:21:20.0015 3636 usbccgp - ok
10:21:20.0078 3636 usbehci (708579b01fed227aadb393cb0c3b4a2c) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:21:20.0078 3636 usbehci - ok
10:21:20.0125 3636 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:21:20.0125 3636 usbhub - ok
10:21:20.0156 3636 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:21:20.0156 3636 usbprint - ok
10:21:20.0203 3636 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:21:20.0203 3636 usbscan - ok
10:21:20.0265 3636 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys
10:21:20.0265 3636 usbser - ok
10:21:20.0312 3636 usbsermpt (caad3467fbfae8a380f67e9c7150a85e) C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
10:21:20.0312 3636 usbsermpt - ok
10:21:20.0359 3636 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:21:20.0359 3636 USBSTOR - ok
10:21:20.0390 3636 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:21:20.0390 3636 usbuhci - ok
10:21:20.0406 3636 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
10:21:20.0421 3636 VgaSave - ok
10:21:20.0453 3636 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
10:21:20.0468 3636 viaagp - ok
10:21:20.0484 3636 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
10:21:20.0484 3636 ViaIde - ok
10:21:20.0531 3636 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
10:21:20.0531 3636 VolSnap - ok
10:21:20.0578 3636 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:21:20.0578 3636 Wanarp - ok
10:21:20.0609 3636 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
10:21:20.0609 3636 wanatw - ok
10:21:20.0718 3636 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
10:21:20.0734 3636 Wdf01000 - ok
10:21:20.0796 3636 WDICA - ok
10:21:20.0843 3636 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
10:21:20.0843 3636 wdmaud - ok
10:21:21.0062 3636 winachsf (74cf3f2e4e40c4a2e18d39d6300a5c24) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
10:21:21.0062 3636 winachsf - ok
10:21:21.0281 3636 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
10:21:21.0296 3636 WS2IFSL - ok
10:21:21.0593 3636 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
10:21:21.0593 3636 WudfPf - ok
10:21:21.0828 3636 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
10:21:21.0828 3636 WudfRd - ok
10:21:21.0875 3636 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
10:21:22.0093 3636 \Device\Harddisk0\DR0 - ok
10:21:22.0093 3636 Boot (0x1200) (16b46e90f13e34098c142ccc05745a8e) \Device\Harddisk0\DR0\Partition0
10:21:22.0109 3636 \Device\Harddisk0\DR0\Partition0 - ok
10:21:22.0109 3636 ============================================================
10:21:22.0109 3636 Scan finished
10:21:22.0109 3636 ============================================================
10:21:22.0125 3292 Detected object count: 2
10:21:22.0125 3292 Actual detected object count: 2
10:21:29.0578 3292 C:\WINDOWS\3271380900:1538261565.exe - copied to quarantine
10:21:29.0578 3292 a44ffdc2 ( HiddenFile.Multi.Generic ) - User select action: Quarantine 
10:21:29.0796 3292 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys - copied to quarantine
10:21:29.0796 3292 MRxSmb ( ForgedFile.Multi.Generic ) - User select action: Quarantine 
10:21:32.0609 2856 Deinitialize success

10:37:47.0562 2676 TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
10:37:49.0234 2676 ============================================================
10:37:49.0234 2676 Current date / time: 2011/10/05 10:37:49.0234
10:37:49.0234 2676 SystemInfo:
10:37:49.0234 2676 
10:37:49.0234 2676 OS Version: 5.1.2600 ServicePack: 2.0
10:37:49.0234 2676 Product type: Workstation
10:37:49.0234 2676 ComputerName: JUST
10:37:49.0234 2676 UserName: Justin
10:37:49.0234 2676 Windows directory: C:\WINDOWS
10:37:49.0234 2676 System windows directory: C:\WINDOWS
10:37:49.0234 2676 Processor architecture: Intel x86
10:37:49.0234 2676 Number of processors: 1
10:37:49.0234 2676 Page size: 0x1000
10:37:49.0234 2676 Boot type: Normal boot
10:37:49.0234 2676 ============================================================
10:37:50.0812 2676 Initialize success
10:38:02.0187 3048 ============================================================
10:38:02.0187 3048 Scan started
10:38:02.0187 3048 Mode: Manual; 
10:38:02.0187 3048 ============================================================
10:38:02.0375 3048 a44ffdc2 (78bd13f84dfeb9bad405509ba132029c) C:\WINDOWS\3271380900:1538261565.exe
10:38:04.0437 3048 Suspicious file (Hidden): C:\WINDOWS\3271380900:1538261565.exe. md5: 78bd13f84dfeb9bad405509ba132029c
10:38:04.0437 3048 a44ffdc2 ( HiddenFile.Multi.Generic ) - warning
10:38:04.0437 3048 a44ffdc2 - detected HiddenFile.Multi.Generic (1)
10:38:04.0593 3048 Abiosdsk - ok
10:38:04.0640 3048 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
10:38:04.0640 3048 abp480n5 - ok
10:38:04.0703 3048 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:38:04.0703 3048 ACPI - ok
10:38:04.0765 3048 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
10:38:04.0765 3048 ACPIEC - ok
10:38:04.0812 3048 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
10:38:04.0859 3048 adpu160m - ok
10:38:04.0937 3048 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
10:38:04.0953 3048 aec - ok
10:38:05.0000 3048 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
10:38:05.0000 3048 AFD - ok
10:38:05.0078 3048 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
10:38:05.0078 3048 agp440 - ok
10:38:05.0093 3048 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
10:38:05.0093 3048 agpCPQ - ok
10:38:05.0125 3048 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
10:38:05.0140 3048 Aha154x - ok
10:38:05.0156 3048 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
10:38:05.0156 3048 aic78u2 - ok
10:38:05.0187 3048 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
10:38:05.0187 3048 aic78xx - ok
10:38:05.0234 3048 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
10:38:05.0234 3048 AliIde - ok
10:38:05.0265 3048 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
10:38:05.0265 3048 alim1541 - ok
10:38:05.0296 3048 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
10:38:05.0296 3048 amdagp - ok
10:38:05.0328 3048 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
10:38:05.0328 3048 amsint - ok
10:38:05.0375 3048 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
10:38:05.0375 3048 APPDRV - ok
10:38:05.0390 3048 appliandMP - ok
10:38:05.0468 3048 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
10:38:05.0468 3048 asc - ok
10:38:05.0484 3048 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
10:38:05.0484 3048 asc3350p - ok
10:38:05.0515 3048 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
10:38:05.0515 3048 asc3550 - ok
10:38:05.0562 3048 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:38:05.0562 3048 AsyncMac - ok
10:38:05.0609 3048 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:38:05.0609 3048 atapi - ok
10:38:05.0656 3048 Atdisk - ok
10:38:05.0687 3048 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:38:05.0687 3048 Atmarpc - ok
10:38:05.0718 3048 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:38:05.0718 3048 audstub - ok
10:38:05.0781 3048 BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
10:38:05.0796 3048 BCM43XX - ok
10:38:05.0828 3048 bcm4sbxp (c768c8a463d32c219ce291645a0621a4) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
10:38:05.0828 3048 bcm4sbxp - ok
10:38:05.0875 3048 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:38:05.0875 3048 Beep - ok
10:38:05.0906 3048 catchme - ok
10:38:05.0953 3048 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
10:38:05.0953 3048 cbidf - ok
10:38:05.0968 3048 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:38:05.0968 3048 cbidf2k - ok
10:38:06.0000 3048 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
10:38:06.0000 3048 cd20xrnt - ok
10:38:06.0031 3048 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:38:06.0031 3048 Cdaudio - ok
10:38:06.0046 3048 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
10:38:06.0062 3048 Cdfs - ok
10:38:06.0078 3048 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:38:06.0078 3048 Cdrom - ok
10:38:06.0109 3048 Changer - ok
10:38:06.0171 3048 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
10:38:06.0171 3048 CmBatt - ok
10:38:06.0203 3048 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
10:38:06.0203 3048 CmdIde - ok
10:38:06.0234 3048 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
10:38:06.0234 3048 Compbatt - ok
10:38:06.0281 3048 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
10:38:06.0281 3048 Cpqarray - ok
10:38:06.0328 3048 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
10:38:06.0343 3048 dac2w2k - ok
10:38:06.0375 3048 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
10:38:06.0390 3048 dac960nt - ok
10:38:06.0437 3048 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
10:38:06.0437 3048 Disk - ok
10:38:06.0500 3048 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
10:38:06.0500 3048 dmboot - ok
10:38:06.0546 3048 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
10:38:06.0546 3048 dmio - ok
10:38:06.0578 3048 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:38:06.0578 3048 dmload - ok
10:38:06.0640 3048 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
10:38:06.0640 3048 DMusic - ok
10:38:06.0671 3048 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
10:38:06.0671 3048 dpti2o - ok
10:38:06.0718 3048 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
10:38:06.0718 3048 drmkaud - ok
10:38:06.0765 3048 drvmcdb (e814854e6b246ccf498874839ab64d77) C:\WINDOWS\system32\drivers\drvmcdb.sys
10:38:06.0765 3048 drvmcdb - ok
10:38:06.0796 3048 drvnddm (ee83a4ebae70bc93cf14879d062f548b) C:\WINDOWS\system32\drivers\drvnddm.sys
10:38:06.0796 3048 drvnddm - ok
10:38:06.0937 3048 DSproct (2ac2372ffad9adc85672cc8e8ae14be9) C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys
10:38:06.0937 3048 DSproct - ok
10:38:07.0109 3048 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
10:38:07.0109 3048 E100B - ok
10:38:07.0187 3048 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
10:38:07.0187 3048 Fastfat - ok
10:38:07.0250 3048 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
10:38:07.0250 3048 Fdc - ok
10:38:07.0312 3048 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
10:38:07.0312 3048 Fips - ok
10:38:07.0375 3048 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
10:38:07.0375 3048 Flpydisk - ok
10:38:07.0437 3048 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
10:38:07.0437 3048 FltMgr - ok
10:38:07.0468 3048 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:38:07.0468 3048 Fs_Rec - ok
10:38:07.0500 3048 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:38:07.0515 3048 Ftdisk - ok
10:38:07.0546 3048 GEARAspiWDM (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
10:38:07.0546 3048 GEARAspiWDM - ok
10:38:07.0578 3048 Gpc  (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:38:07.0578 3048 Gpc - ok
10:38:07.0625 3048 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
10:38:07.0625 3048 HDAudBus - ok
10:38:07.0671 3048 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
10:38:07.0687 3048 HidUsb - ok
10:38:07.0703 3048 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
10:38:07.0703 3048 hpn - ok
10:38:07.0781 3048 HSFHWAZL (1c8caa80e91fb71864e9426f9eed048d) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
10:38:07.0781 3048 HSFHWAZL - ok
10:38:07.0906 3048 HSF_DPV (698204d9c2832e53633e53a30a53fc3d) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
10:38:07.0968 3048 HSF_DPV - ok
10:38:08.0031 3048 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
10:38:08.0031 3048 HTTP - ok
10:38:08.0062 3048 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
10:38:08.0062 3048 i2omgmt - ok
10:38:08.0093 3048 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
10:38:08.0093 3048 i2omp - ok
10:38:08.0156 3048 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:38:08.0156 3048 i8042prt - ok
10:38:08.0281 3048 ialm (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
10:38:08.0343 3048 ialm - ok
10:38:08.0375 3048 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:38:08.0375 3048 Imapi - ok
10:38:08.0406 3048 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
10:38:08.0406 3048 ini910u - ok
10:38:08.0437 3048 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:38:08.0437 3048 IntelIde - ok
10:38:08.0484 3048 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:38:08.0484 3048 intelppm - ok
10:38:08.0531 3048 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
10:38:08.0531 3048 Ip6Fw - ok
10:38:08.0546 3048 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:38:08.0562 3048 IpFilterDriver - ok
10:38:08.0578 3048 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:38:08.0578 3048 IpInIp - ok
10:38:08.0656 3048 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:38:08.0656 3048 IpNat - ok
10:38:08.0703 3048 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:38:08.0703 3048 IPSec - ok
10:38:08.0734 3048 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:38:08.0734 3048 IRENUM - ok
10:38:08.0765 3048 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:38:08.0765 3048 isapnp - ok
10:38:08.0812 3048 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:38:08.0812 3048 Kbdclass - ok
10:38:08.0921 3048 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
10:38:08.0921 3048 kbdhid - ok
10:38:08.0984 3048 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
10:38:08.0984 3048 kmixer - ok
10:38:09.0031 3048 KORGUMDS (cd2b7f4c57ff0d8422a3a7aa9995874a) C:\WINDOWS\system32\Drivers\KORGUMDS.SYS
10:38:09.0031 3048 KORGUMDS - ok
10:38:09.0078 3048 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
10:38:09.0093 3048 KSecDD - ok
10:38:09.0140 3048 Lavasoft Kernexplorer - ok
10:38:09.0156 3048 lbrtfdc - ok
10:38:09.0218 3048 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
10:38:09.0218 3048 mdmxsdk - ok
10:38:09.0250 3048 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:38:09.0250 3048 mnmdd - ok
10:38:09.0281 3048 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
10:38:09.0281 3048 Modem - ok
10:38:09.0328 3048 motmodem (5023875a94b0766d98a62a72bc4cb055) C:\WINDOWS\system32\DRIVERS\motmodem.sys
10:38:09.0328 3048 motmodem - ok
10:38:09.0375 3048 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:38:09.0375 3048 Mouclass - ok
10:38:09.0421 3048 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
10:38:09.0437 3048 mouhid - ok
10:38:09.0468 3048 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
10:38:09.0468 3048 MountMgr - ok
10:38:09.0500 3048 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
10:38:09.0500 3048 mraid35x - ok
10:38:09.0562 3048 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:38:09.0562 3048 MRxDAV - ok
10:38:09.0640 3048 MRxSmb (959e439bc926b45cbb1204c0a55ab9a4) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:38:09.0640 3048 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\mrxsmb.sys. Real md5: 959e439bc926b45cbb1204c0a55ab9a4, Fake md5: fb6c89bb3ce282b08bdb1e3c179e1c39
10:38:09.0640 3048 MRxSmb ( ForgedFile.Multi.Generic ) - warning
10:38:09.0640 3048 MRxSmb - detected ForgedFile.Multi.Generic (1)
10:38:09.0812 3048 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
10:38:09.0812 3048 Msfs - ok
10:38:09.0921 3048 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:38:09.0921 3048 MSKSSRV - ok
10:38:09.0953 3048 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:38:09.0953 3048 MSPCLOCK - ok
10:38:09.0968 3048 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
10:38:09.0968 3048 MSPQM - ok
10:38:10.0000 3048 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:38:10.0000 3048 mssmbios - ok
10:38:10.0046 3048 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
10:38:10.0046 3048 Mup - ok
10:38:10.0078 3048 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
10:38:10.0093 3048 NDIS - ok
10:38:10.0125 3048 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:38:10.0125 3048 NdisTapi - ok
10:38:10.0187 3048 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:38:10.0187 3048 Ndisuio - ok
10:38:10.0218 3048 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:38:10.0218 3048 NdisWan - ok
10:38:10.0250 3048 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
10:38:10.0250 3048 NDProxy - ok
10:38:10.0281 3048 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:38:10.0281 3048 NetBIOS - ok
10:38:10.0328 3048 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:38:10.0343 3048 NetBT - ok
10:38:10.0406 3048 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
10:38:10.0406 3048 nm - ok
10:38:10.0437 3048 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
10:38:10.0437 3048 Npfs - ok
10:38:10.0515 3048 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
10:38:10.0531 3048 Ntfs - ok
10:38:10.0593 3048 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:38:10.0593 3048 Null - ok
10:38:10.0703 3048 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
10:38:10.0796 3048 nv - ok
10:38:10.0828 3048 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:38:10.0843 3048 NwlnkFlt - ok
10:38:10.0906 3048 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:38:10.0921 3048 NwlnkFwd - ok
10:38:10.0953 3048 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
10:38:10.0953 3048 NwlnkIpx - ok
10:38:10.0984 3048 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
10:38:10.0984 3048 NwlnkNb - ok
10:38:11.0015 3048 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
10:38:11.0015 3048 NwlnkSpx - ok
10:38:11.0078 3048 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
10:38:11.0078 3048 Parport - ok
10:38:11.0125 3048 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
10:38:11.0125 3048 PartMgr - ok
10:38:11.0156 3048 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
10:38:11.0156 3048 ParVdm - ok
10:38:11.0187 3048 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
10:38:11.0187 3048 PCI - ok
10:38:11.0218 3048 PCIDump - ok
10:38:11.0281 3048 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
10:38:11.0281 3048 PCIIde - ok
10:38:11.0328 3048 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
10:38:11.0328 3048 Pcmcia - ok
10:38:11.0343 3048 PDCOMP - ok
10:38:11.0390 3048 PDFRAME - ok
10:38:11.0406 3048 PDRELI - ok
10:38:11.0421 3048 PDRFRAME - ok
10:38:11.0468 3048 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
10:38:11.0468 3048 perc2 - ok
10:38:11.0531 3048 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
10:38:11.0531 3048 perc2hib - ok
10:38:11.0593 3048 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:38:11.0593 3048 PptpMiniport - ok
10:38:11.0625 3048 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
10:38:11.0640 3048 PSched - ok
10:38:11.0671 3048 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:38:11.0671 3048 Ptilink - ok
10:38:11.0718 3048 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
10:38:11.0718 3048 PxHelp20 - ok
10:38:11.0750 3048 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
10:38:11.0750 3048 ql1080 - ok
10:38:11.0781 3048 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
10:38:11.0781 3048 Ql10wnt - ok
10:38:11.0812 3048 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
10:38:11.0812 3048 ql12160 - ok
10:38:11.0906 3048 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
10:38:11.0906 3048 ql1240 - ok
10:38:11.0937 3048 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
10:38:11.0937 3048 ql1280 - ok
10:38:11.0968 3048 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:38:11.0984 3048 RasAcd - ok
10:38:12.0015 3048 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:38:12.0015 3048 Rasl2tp - ok
10:38:12.0046 3048 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:38:12.0046 3048 RasPppoe - ok
10:38:12.0078 3048 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:38:12.0078 3048 Raspti - ok
10:38:12.0140 3048 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:38:12.0140 3048 Rdbss - ok
10:38:12.0187 3048 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:38:12.0203 3048 RDPCDD - ok
10:38:12.0234 3048 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:38:12.0250 3048 rdpdr - ok
10:38:12.0312 3048 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
10:38:12.0312 3048 RDPWD - ok
10:38:12.0359 3048 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:38:12.0359 3048 redbook - ok
10:38:12.0406 3048 RimUsb - ok
10:38:12.0453 3048 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
10:38:12.0453 3048 RimVSerPort - ok
10:38:12.0484 3048 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
10:38:12.0484 3048 ROOTMODEM - ok
10:38:12.0546 3048 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:38:12.0562 3048 Secdrv - ok
10:38:12.0593 3048 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
10:38:12.0593 3048 serenum - ok
10:38:12.0625 3048 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
10:38:12.0625 3048 Serial - ok
10:38:12.0703 3048 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
10:38:12.0703 3048 Sfloppy - ok
10:38:12.0718 3048 Simbad - ok
10:38:12.0750 3048 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
10:38:12.0765 3048 sisagp - ok
10:38:12.0796 3048 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
10:38:12.0796 3048 Sparrow - ok
10:38:12.0843 3048 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
10:38:12.0843 3048 splitter - ok
10:38:12.0890 3048 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
10:38:12.0890 3048 sr - ok
10:38:12.0953 3048 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
10:38:12.0968 3048 Srv - ok
10:38:13.0000 3048 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys
10:38:13.0015 3048 sscdbhk5 - ok
10:38:13.0031 3048 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys
10:38:13.0031 3048 ssrtln - ok
10:38:13.0140 3048 STHDA (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINDOWS\system32\drivers\sthda.sys
10:38:13.0156 3048 STHDA - ok
10:38:13.0203 3048 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:38:13.0203 3048 swenum - ok
10:38:13.0234 3048 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
10:38:13.0234 3048 swmidi - ok
10:38:13.0265 3048 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
10:38:13.0281 3048 symc810 - ok
10:38:13.0312 3048 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
10:38:13.0312 3048 symc8xx - ok
10:38:13.0328 3048 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
10:38:13.0328 3048 sym_hi - ok
10:38:13.0359 3048 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
10:38:13.0375 3048 sym_u3 - ok
10:38:13.0437 3048 SynTP (6bef3acd6ee22eec55b68699e8aace09) C:\WINDOWS\system32\DRIVERS\SynTP.sys
10:38:13.0437 3048 SynTP - ok
10:38:13.0484 3048 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
10:38:13.0484 3048 sysaudio - ok
10:38:13.0562 3048 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:38:13.0562 3048 Tcpip - ok
10:38:13.0593 3048 Tcpip6 (be4007ab8c9b62e3688fc2f469b98190) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
10:38:13.0609 3048 Tcpip6 - ok
10:38:13.0625 3048 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:38:13.0625 3048 TDPIPE - ok
10:38:13.0656 3048 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
10:38:13.0656 3048 TDTCP - ok
10:38:13.0703 3048 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:38:13.0703 3048 TermDD - ok
10:38:13.0781 3048 tfsnboio (30698355067d07da5f9eb81132c9fdd6) C:\WINDOWS\system32\dla\tfsnboio.sys
10:38:13.0781 3048 tfsnboio - ok
10:38:13.0796 3048 tfsncofs (fb9d825bb4a2abdf24600f7505050e2b) C:\WINDOWS\system32\dla\tfsncofs.sys
10:38:13.0796 3048 tfsncofs - ok
10:38:13.0828 3048 tfsndrct (cafd8cca11aa1e8b6d2ea1ba8f70ec33) C:\WINDOWS\system32\dla\tfsndrct.sys
10:38:13.0828 3048 tfsndrct - ok
10:38:13.0906 3048 tfsndres (8db1e78fbf7c426d8ec3d8f1a33d6485) C:\WINDOWS\system32\dla\tfsndres.sys
10:38:13.0906 3048 tfsndres - ok
10:38:13.0937 3048 tfsnifs (b92f67a71cc8176f331b8aa8d9f555ad) C:\WINDOWS\system32\dla\tfsnifs.sys
10:38:13.0937 3048 tfsnifs - ok
10:38:13.0968 3048 tfsnopio (85985faa9a71e2358fcc2edefc2a3c5c) C:\WINDOWS\system32\dla\tfsnopio.sys
10:38:13.0968 3048 tfsnopio - ok
10:38:13.0984 3048 tfsnpool (bba22094f0f7c210567efdaf11f64495) C:\WINDOWS\system32\dla\tfsnpool.sys
10:38:13.0984 3048 tfsnpool - ok
10:38:14.0015 3048 tfsnudf (81340bef80b9811e98ce64611e67e3ff) C:\WINDOWS\system32\dla\tfsnudf.sys
10:38:14.0015 3048 tfsnudf - ok
10:38:14.0046 3048 tfsnudfa (c035fd116224ccc8325f384776b6a8bb) C:\WINDOWS\system32\dla\tfsnudfa.sys
10:38:14.0046 3048 tfsnudfa - ok
10:38:14.0078 3048 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
10:38:14.0078 3048 TosIde - ok
10:38:14.0171 3048 tunmp (87a0e9e18c10a9e454238e3330e2a26d) C:\WINDOWS\system32\DRIVERS\tunmp.sys
10:38:14.0171 3048 tunmp - ok
10:38:14.0218 3048 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
10:38:14.0218 3048 Udfs - ok
10:38:14.0265 3048 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
10:38:14.0265 3048 ultra - ok
10:38:14.0312 3048 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
10:38:14.0328 3048 Update - ok
10:38:14.0390 3048 USBAAPL (f340199e8cb097e1acd58a967c665919) C:\WINDOWS\system32\Drivers\usbaapl.sys
10:38:14.0390 3048 USBAAPL - ok
10:38:14.0437 3048 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
10:38:14.0453 3048 usbaudio - ok
10:38:14.0515 3048 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:38:14.0515 3048 usbccgp - ok
10:38:14.0531 3048 usbehci (708579b01fed227aadb393cb0c3b4a2c) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:38:14.0531 3048 usbehci - ok
10:38:14.0562 3048 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:38:14.0562 3048 usbhub - ok
10:38:14.0609 3048 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:38:14.0609 3048 usbprint - ok
10:38:14.0656 3048 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:38:14.0656 3048 usbscan - ok
10:38:14.0718 3048 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys
10:38:14.0718 3048 usbser - ok
10:38:14.0765 3048 usbsermpt (caad3467fbfae8a380f67e9c7150a85e) C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
10:38:14.0765 3048 usbsermpt - ok
10:38:14.0812 3048 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:38:14.0812 3048 USBSTOR - ok
10:38:14.0906 3048 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:38:14.0906 3048 usbuhci - ok
10:38:14.0921 3048 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
10:38:14.0921 3048 VgaSave - ok
10:38:14.0968 3048 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
10:38:14.0968 3048 viaagp - ok
10:38:15.0000 3048 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
10:38:15.0000 3048 ViaIde - ok
10:38:15.0031 3048 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
10:38:15.0046 3048 VolSnap - ok
10:38:15.0078 3048 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:38:15.0078 3048 Wanarp - ok
10:38:15.0125 3048 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
10:38:15.0125 3048 wanatw - ok
10:38:15.0187 3048 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
10:38:15.0203 3048 Wdf01000 - ok
10:38:15.0234 3048 WDICA - ok
10:38:15.0281 3048 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
10:38:15.0281 3048 wdmaud - ok
10:38:15.0375 3048 winachsf (74cf3f2e4e40c4a2e18d39d6300a5c24) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
10:38:15.0390 3048 winachsf - ok
10:38:15.0484 3048 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
10:38:15.0484 3048 WS2IFSL - ok
10:38:15.0546 3048 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
10:38:15.0546 3048 WudfPf - ok
10:38:15.0593 3048 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
10:38:15.0593 3048 WudfRd - ok
10:38:15.0656 3048 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
10:38:15.0921 3048 \Device\Harddisk0\DR0 - ok
10:38:15.0937 3048 MBR (0x1B8) (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk1\DR4
10:38:15.0937 3048 \Device\Harddisk1\DR4 - ok
10:38:15.0953 3048 Boot (0x1200) (16b46e90f13e34098c142ccc05745a8e) \Device\Harddisk0\DR0\Partition0
10:38:15.0953 3048 \Device\Harddisk0\DR0\Partition0 - ok
10:38:15.0953 3048 Boot (0x1200) (670a1c3f0a855d85892650b6be274289) \Device\Harddisk1\DR4\Partition0
10:38:15.0953 3048 \Device\Harddisk1\DR4\Partition0 - ok
10:38:15.0968 3048 ============================================================
10:38:15.0968 3048 Scan finished
10:38:15.0968 3048 ============================================================
10:38:15.0984 3036 Detected object count: 2
10:38:15.0984 3036 Actual detected object count: 2
10:38:59.0515 3036 HKLM\SYSTEM\ControlSet001\services\a44ffdc2 - will be deleted on reboot
10:38:59.0562 3036 HKLM\SYSTEM\ControlSet004\services\a44ffdc2 - will be deleted on reboot
10:38:59.0562 3036 C:\WINDOWS\3271380900:1538261565.exe - will be deleted on reboot
10:38:59.0562 3036 a44ffdc2 ( HiddenFile.Multi.Generic ) - User select action: Delete 
10:38:59.0562 3036 HKLM\SYSTEM\ControlSet001\services\MRxSmb - will be deleted on reboot
10:38:59.0593 3036 HKLM\SYSTEM\ControlSet002\services\MRxSmb - will be deleted on reboot
10:38:59.0609 3036 HKLM\SYSTEM\ControlSet004\services\MRxSmb - will be deleted on reboot
10:38:59.0625 3036 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys - will be deleted on reboot
10:38:59.0625 3036 MRxSmb ( ForgedFile.Multi.Generic ) - User select action: Delete 
10:39:03.0265 2656 Deinitialize success

21:02:28.0093 2460 TDSS rootkit removing tool 2.6.4.0 Oct 3 2011 17:37:01
21:02:28.0203 2460 ============================================================
21:02:28.0203 2460 Current date / time: 2011/10/07 21:02:28.0203
21:02:28.0203 2460 SystemInfo:
21:02:28.0203 2460 
21:02:28.0203 2460 OS Version: 5.1.2600 ServicePack: 2.0
21:02:28.0203 2460 Product type: Workstation
21:02:28.0203 2460 ComputerName: JUST
21:02:28.0203 2460 UserName: Justin
21:02:28.0203 2460 Windows directory: C:\WINDOWS
21:02:28.0203 2460 System windows directory: C:\WINDOWS
21:02:28.0203 2460 Processor architecture: Intel x86
21:02:28.0203 2460 Number of processors: 1
21:02:28.0203 2460 Page size: 0x1000
21:02:28.0203 2460 Boot type: Normal boot
21:02:28.0203 2460 ============================================================
21:02:30.0000 2460 Initialize success
21:02:31.0078 2592 ============================================================
21:02:31.0078 2592 Scan started
21:02:31.0078 2592 Mode: Manual; 
21:02:31.0078 2592 ============================================================
21:02:32.0015 2592 a44ffdc2 (78bd13f84dfeb9bad405509ba132029c) C:\WINDOWS\3271380900:1538261565.exe
21:02:34.0312 2592 Suspicious file (Hidden): C:\WINDOWS\3271380900:1538261565.exe. md5: 78bd13f84dfeb9bad405509ba132029c
21:02:34.0312 2592 a44ffdc2 ( HiddenFile.Multi.Generic ) - warning
21:02:34.0312 2592 a44ffdc2 - detected HiddenFile.Multi.Generic (1)
21:02:34.0468 2592 Abiosdsk - ok
21:02:34.0578 2592 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
21:02:34.0656 2592 abp480n5 - ok
21:02:34.0843 2592 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:02:34.0859 2592 ACPI - ok
21:02:35.0265 2592 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:02:35.0265 2592 ACPIEC - ok
21:02:35.0312 2592 adpu160m  (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
21:02:35.0312 2592 adpu160m - ok
21:02:35.0375 2592 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
21:02:35.0375 2592 aec - ok
21:02:35.0437 2592 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
21:02:35.0437 2592 AFD - ok
21:02:35.0468 2592 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
21:02:35.0484 2592 agp440 - ok
21:02:35.0515 2592 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
21:02:35.0515 2592 agpCPQ - ok
21:02:35.0593 2592 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
21:02:35.0593 2592 Aha154x - ok
21:02:35.0625 2592 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
21:02:35.0625 2592 aic78u2 - ok
21:02:35.0671 2592 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
21:02:35.0671 2592 aic78xx - ok
21:02:35.0718 2592 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
21:02:35.0718 2592 AliIde - ok
21:02:35.0750 2592 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
21:02:35.0750 2592 alim1541 - ok
21:02:35.0765 2592 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
21:02:35.0781 2592 amdagp - ok
21:02:35.0796 2592 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
21:02:35.0796 2592 amsint - ok
21:02:35.0859 2592 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
21:02:35.0859 2592 APPDRV - ok
21:02:35.0875 2592 appliandMP - ok
21:02:35.0937 2592 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
21:02:35.0937 2592 asc - ok
21:02:35.0968 2592 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
21:02:35.0968 2592 asc3350p - ok
21:02:35.0984 2592 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
21:02:36.0000 2592 asc3550 - ok
21:02:36.0046 2592 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:02:36.0046 2592 AsyncMac - ok
21:02:36.0093 2592 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:02:36.0109 2592 atapi - ok
21:02:36.0140 2592 Atdisk - ok
21:02:36.0187 2592 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:02:36.0187 2592 Atmarpc - ok
21:02:36.0203 2592 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:02:36.0203 2592 audstub - ok
21:02:36.0281 2592 BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
21:02:36.0281 2592 BCM43XX - ok
21:02:36.0312 2592 bcm4sbxp (c768c8a463d32c219ce291645a0621a4) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
21:02:36.0312 2592 bcm4sbxp - ok
21:02:36.0343 2592 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:02:36.0343 2592 Beep - ok
21:02:36.0390 2592 catchme - ok
21:02:36.0437 2592 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
21:02:36.0437 2592 cbidf - ok
21:02:36.0484 2592 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:02:36.0484 2592 cbidf2k - ok
21:02:36.0531 2592 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
21:02:36.0531 2592 cd20xrnt - ok
21:02:36.0546 2592 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:02:36.0546 2592 Cdaudio - ok
21:02:36.0578 2592 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
21:02:36.0578 2592 Cdfs - ok
21:02:36.0609 2592 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:02:36.0609 2592 Cdrom - ok
21:02:36.0625 2592 Changer - ok
21:02:36.0671 2592 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:02:36.0671 2592 CmBatt - ok
21:02:36.0703 2592 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
21:02:36.0703 2592 CmdIde - ok
21:02:36.0734 2592 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:02:36.0750 2592 Compbatt - ok
21:02:36.0781 2592 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
21:02:36.0781 2592 Cpqarray - ok
21:02:36.0828 2592 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
21:02:36.0828 2592 dac2w2k - ok
21:02:36.0875 2592 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
21:02:36.0875 2592 dac960nt - ok
21:02:36.0937 2592 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
21:02:36.0937 2592 Disk - ok
21:02:37.0000 2592 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
21:02:37.0015 2592 dmboot - ok
21:02:37.0062 2592 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
21:02:37.0062 2592 dmio - ok
21:02:37.0093 2592 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:02:37.0093 2592 dmload - ok
21:02:37.0156 2592 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
21:02:37.0156 2592 DMusic - ok
21:02:37.0187 2592 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
21:02:37.0187 2592 dpti2o - ok
21:02:37.0218 2592 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
21:02:37.0234 2592 drmkaud - ok
21:02:37.0265 2592 drvmcdb (e814854e6b246ccf498874839ab64d77) C:\WINDOWS\system32\drivers\drvmcdb.sys
21:02:37.0265 2592 drvmcdb - ok
21:02:37.0296 2592 drvnddm (ee83a4ebae70bc93cf14879d062f548b) C:\WINDOWS\system32\drivers\drvnddm.sys
21:02:37.0312 2592 drvnddm - ok
21:02:37.0453 2592 DSproct (2ac2372ffad9adc85672cc8e8ae14be9) C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys
21:02:37.0453 2592 DSproct - ok
21:02:37.0781 2592 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
21:02:37.0796 2592 E100B - ok
21:02:37.0875 2592 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
21:02:37.0875 2592 Fastfat - ok
21:02:37.0921 2592 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
21:02:37.0921 2592 Fdc - ok
21:02:37.0953 2592 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
21:02:37.0953 2592 Fips - ok
21:02:37.0984 2592 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:02:38.0000 2592 Flpydisk - ok
21:02:38.0046 2592 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
21:02:38.0046 2592 FltMgr - ok
21:02:38.0078 2592 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:02:38.0078 2592 Fs_Rec - ok
21:02:38.0109 2592 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:02:38.0109 2592 Ftdisk - ok
21:02:38.0156 2592 GEARAspiWDM (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
21:02:38.0171 2592 GEARAspiWDM - ok
21:02:38.0203 2592 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:02:38.0203 2592 Gpc - ok
21:02:38.0250 2592 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:02:38.0250 2592 HDAudBus - ok
21:02:38.0296 2592 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:02:38.0296 2592 HidUsb - ok
21:02:38.0359 2592 hitmanpro35 (72472b9ce5d02e443cff49a40355455d) C:\WINDOWS\system32\drivers\hitmanpro35.sys
21:02:38.0359 2592 hitmanpro35 - ok
21:02:38.0406 2592 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
21:02:38.0406 2592 hpn - ok
21:02:38.0468 2592 HSFHWAZL (1c8caa80e91fb71864e9426f9eed048d) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
21:02:38.0484 2592 HSFHWAZL - ok
21:02:38.0578 2592 HSF_DPV (698204d9c2832e53633e53a30a53fc3d) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
21:02:38.0734 2592 HSF_DPV - ok
21:02:38.0796 2592 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
21:02:38.0796 2592 HTTP - ok
21:02:38.0843 2592 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
21:02:38.0843 2592 i2omgmt - ok
21:02:38.0890 2592 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
21:02:38.0890 2592 i2omp - ok
21:02:38.0953 2592 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:02:38.0953 2592 i8042prt - ok
21:02:39.0046 2592 ialm (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
21:02:39.0109 2592 ialm - ok
21:02:39.0156 2592 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:02:39.0156 2592 Imapi - ok
21:02:39.0187 2592 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
21:02:39.0187 2592 ini910u - ok
21:02:39.0234 2592 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
21:02:39.0234 2592 IntelIde - ok
21:02:39.0250 2592 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:02:39.0265 2592 intelppm - ok
21:02:39.0296 2592 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
21:02:39.0296 2592 Ip6Fw - ok
21:02:39.0328 2592 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:02:39.0343 2592 IpFilterDriver - ok
21:02:39.0359 2592 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:02:39.0359 2592 IpInIp - ok
21:02:39.0406 2592 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:02:39.0406 2592 IpNat - ok
21:02:39.0453 2592 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:02:39.0453 2592 IPSec - ok
21:02:39.0500 2592 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:02:39.0500 2592 IRENUM - ok
21:02:39.0531 2592 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:02:39.0531 2592 isapnp - ok
21:02:39.0562 2592 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:02:39.0562 2592 Kbdclass - ok
21:02:39.0625 2592 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:02:39.0625 2592 kbdhid - ok
21:02:39.0718 2592 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
21:02:39.0734 2592 kmixer - ok
21:02:39.0765 2592 KORGUMDS (cd2b7f4c57ff0d8422a3a7aa9995874a) C:\WINDOWS\system32\Drivers\KORGUMDS.SYS
21:02:39.0765 2592 KORGUMDS - ok
21:02:39.0828 2592 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
21:02:39.0828 2592 KSecDD - ok
21:02:39.0890 2592 Lavasoft Kernexplorer - ok
21:02:39.0906 2592 lbrtfdc - ok
21:02:39.0968 2592 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
21:02:39.0968 2592 mdmxsdk - ok
21:02:40.0000 2592 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:02:40.0000 2592 mnmdd - ok
21:02:40.0031 2592 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
21:02:40.0031 2592 Modem - ok
21:02:40.0078 2592 motmodem (5023875a94b0766d98a62a72bc4cb055) C:\WINDOWS\system32\DRIVERS\motmodem.sys
21:02:40.0078 2592 motmodem - ok
21:02:40.0125 2592 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:02:40.0125 2592 Mouclass - ok
21:02:40.0171 2592 mouhid  (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:02:40.0171 2592 mouhid - ok
21:02:40.0203 2592 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
21:02:40.0203 2592 MountMgr - ok
21:02:40.0234 2592 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
21:02:40.0234 2592 mraid35x - ok
21:02:40.0296 2592 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:02:40.0296 2592 MRxDAV - ok
21:02:40.0375 2592 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
21:02:40.0375 2592 Msfs - ok
21:02:40.0421 2592 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:02:40.0421 2592 MSKSSRV - ok
21:02:40.0453 2592 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:02:40.0453 2592 MSPCLOCK - ok
21:02:40.0468 2592 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
21:02:40.0468 2592 MSPQM - ok
21:02:40.0500 2592 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:02:40.0500 2592 mssmbios - ok
21:02:40.0546 2592 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
21:02:40.0546 2592 Mup - ok
21:02:40.0593 2592 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
21:02:40.0593 2592 NDIS - ok
21:02:40.0609 2592 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:02:40.0625 2592 NdisTapi - ok
21:02:40.0687 2592 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:02:40.0687 2592 Ndisuio - ok
21:02:40.0718 2592 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:02:40.0734 2592 NdisWan - ok
21:02:40.0750 2592 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
21:02:40.0765 2592 NDProxy - ok
21:02:40.0781 2592 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:02:40.0781 2592 NetBIOS - ok
21:02:40.0875 2592 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
21:02:40.0875 2592 nm - ok
21:02:40.0906 2592 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
21:02:40.0906 2592 Npfs - ok
21:02:40.0984 2592 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
21:02:41.0000 2592 Ntfs - ok
21:02:41.0031 2592 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:02:41.0031 2592 Null - ok
21:02:41.0156 2592 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
21:02:41.0250 2592 nv - ok
21:02:41.0281 2592 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:02:41.0281 2592 NwlnkFlt - ok
21:02:41.0312 2592 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:02:41.0312 2592 NwlnkFwd - ok
21:02:41.0359 2592 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
21:02:41.0359 2592 NwlnkIpx - ok
21:02:41.0406 2592 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
21:02:41.0406 2592 NwlnkNb - ok
21:02:41.0437 2592 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
21:02:41.0437 2592 NwlnkSpx - ok
21:02:41.0500 2592 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
21:02:41.0500 2592 Parport - ok
21:02:41.0546 2592 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
21:02:41.0546 2592 PartMgr - ok
21:02:41.0578 2592 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:02:41.0578 2592 ParVdm - ok
21:02:41.0609 2592 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
21:02:41.0625 2592 PCI - ok
21:02:41.0687 2592 PCIDump - ok
21:02:41.0718 2592 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:02:41.0718 2592 PCIIde - ok
21:02:41.0765 2592 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:02:41.0765 2592 Pcmcia - ok
21:02:41.0781 2592 PDCOMP - ok
21:02:41.0828 2592 PDFRAME - ok
21:02:41.0843 2592 PDRELI - ok
21:02:41.0859 2592 PDRFRAME - ok
21:02:41.0906 2592 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
21:02:41.0906 2592 perc2 - ok
21:02:41.0968 2592 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
21:02:41.0968 2592 perc2hib - ok
21:02:42.0031 2592 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:02:42.0031 2592 PptpMiniport - ok
21:02:42.0062 2592 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
21:02:42.0078 2592 PSched - ok
21:02:42.0109 2592 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:02:42.0109 2592 Ptilink - ok
21:02:42.0156 2592 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:02:42.0156 2592 PxHelp20 - ok
21:02:42.0187 2592 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
21:02:42.0187 2592 ql1080 - ok
21:02:42.0218 2592 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
21:02:42.0218 2592 Ql10wnt - ok
21:02:42.0250 2592 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
21:02:42.0250 2592 ql12160 - ok
21:02:42.0281 2592 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
21:02:42.0281 2592 ql1240 - ok
21:02:42.0328 2592 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
21:02:42.0328 2592 ql1280 - ok
21:02:42.0390 2592 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:02:42.0390 2592 RasAcd - ok
21:02:42.0421 2592 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:02:42.0421 2592 Rasl2tp - ok
21:02:42.0453 2592 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:02:42.0453 2592 RasPppoe - ok
21:02:42.0484 2592 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:02:42.0484 2592 Raspti - ok
21:02:42.0531 2592 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:02:42.0546 2592 Rdbss - ok
21:02:42.0578 2592 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:02:42.0578 2592 RDPCDD - ok
21:02:42.0625 2592 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:02:42.0625 2592 rdpdr - ok
21:02:42.0718 2592 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
21:02:42.0718 2592 RDPWD - ok
21:02:42.0765 2592 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:02:42.0765 2592 redbook - ok
21:02:42.0812 2592 RimUsb - ok
21:02:42.0875 2592 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
21:02:42.0875 2592 RimVSerPort - ok
21:02:42.0906 2592 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
21:02:42.0906 2592 ROOTMODEM - ok
21:02:42.0984 2592 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:02:42.0984 2592 Secdrv - ok
21:02:43.0031 2592 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
21:02:43.0031 2592 serenum - ok
21:02:43.0062 2592 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
21:02:43.0062 2592 Serial - ok
21:02:43.0140 2592 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:02:43.0140 2592 Sfloppy - ok
21:02:43.0156 2592 Simbad - ok
21:02:43.0187 2592 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
21:02:43.0203 2592 sisagp - ok
21:02:43.0218 2592 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
21:02:43.0234 2592 Sparrow - ok
21:02:43.0265 2592 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
21:02:43.0265 2592 splitter - ok
21:02:43.0296 2592 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
21:02:43.0296 2592 sr - ok
21:02:43.0359 2592 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
21:02:43.0375 2592 Srv - ok
21:02:43.0421 2592 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys
21:02:43.0421 2592 sscdbhk5 - ok
21:02:43.0484 2592 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys
21:02:43.0484 2592 ssrtln - ok
21:02:43.0593 2592 STHDA (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINDOWS\system32\drivers\sthda.sys
21:02:43.0609 2592 STHDA - ok
21:02:43.0671 2592 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:02:43.0687 2592 swenum - ok
21:02:43.0734 2592 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
21:02:43.0750 2592 swmidi - ok
21:02:43.0781 2592 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
21:02:43.0781 2592 symc810 - ok
21:02:43.0812 2592 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
21:02:43.0812 2592 symc8xx - ok
21:02:43.0843 2592 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
21:02:43.0843 2592 sym_hi - ok
21:02:43.0875 2592 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
21:02:43.0875 2592 sym_u3 - ok
21:02:43.0937 2592 SynTP (6bef3acd6ee22eec55b68699e8aace09) C:\WINDOWS\system32\DRIVERS\SynTP.sys
21:02:43.0937 2592 SynTP - ok
21:02:43.0984 2592 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
21:02:43.0984 2592 sysaudio - ok
21:02:44.0046 2592 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:02:44.0062 2592 Tcpip - ok
21:02:44.0109 2592 Tcpip6 (be4007ab8c9b62e3688fc2f469b98190) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
21:02:44.0125 2592 Tcpip6 - ok
21:02:44.0156 2592 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:02:44.0156 2592 TDPIPE - ok
21:02:44.0187 2592 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
21:02:44.0187 2592 TDTCP - ok
21:02:44.0218 2592 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:02:44.0218 2592 TermDD - ok
21:02:44.0281 2592 tfsnboio (30698355067d07da5f9eb81132c9fdd6) C:\WINDOWS\system32\dla\tfsnboio.sys
21:02:44.0281 2592 tfsnboio - ok
21:02:44.0312 2592 tfsncofs (fb9d825bb4a2abdf24600f7505050e2b) C:\WINDOWS\system32\dla\tfsncofs.sys
21:02:44.0312 2592 tfsncofs - ok
21:02:44.0343 2592 tfsndrct (cafd8cca11aa1e8b6d2ea1ba8f70ec33) C:\WINDOWS\system32\dla\tfsndrct.sys
21:02:44.0343 2592 tfsndrct - ok
21:02:44.0359 2592 tfsndres (8db1e78fbf7c426d8ec3d8f1a33d6485) C:\WINDOWS\system32\dla\tfsndres.sys
21:02:44.0375 2592 tfsndres - ok
21:02:44.0406 2592 tfsnifs (b92f67a71cc8176f331b8aa8d9f555ad) C:\WINDOWS\system32\dla\tfsnifs.sys
21:02:44.0406 2592 tfsnifs - ok
21:02:44.0437 2592 tfsnopio (85985faa9a71e2358fcc2edefc2a3c5c) C:\WINDOWS\system32\dla\tfsnopio.sys
21:02:44.0453 2592 tfsnopio - ok
21:02:44.0468 2592 tfsnpool (bba22094f0f7c210567efdaf11f64495) C:\WINDOWS\system32\dla\tfsnpool.sys
21:02:44.0468 2592 tfsnpool - ok
21:02:44.0500 2592 tfsnudf (81340bef80b9811e98ce64611e67e3ff) C:\WINDOWS\system32\dla\tfsnudf.sys
21:02:44.0500 2592 tfsnudf - ok
21:02:44.0515 2592 tfsnudfa (c035fd116224ccc8325f384776b6a8bb) C:\WINDOWS\system32\dla\tfsnudfa.sys
21:02:44.0515 2592 tfsnudfa - ok
21:02:44.0796 2592 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
21:02:44.0796 2592 TosIde - ok
21:02:44.0875 2592 tunmp (87a0e9e18c10a9e454238e3330e2a26d) C:\WINDOWS\system32\DRIVERS\tunmp.sys
21:02:44.0875 2592 tunmp - ok
21:02:44.0906 2592 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
21:02:44.0921 2592 Udfs - ok
21:02:44.0953 2592 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
21:02:44.0968 2592 ultra - ok
21:02:45.0015 2592 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
21:02:45.0031 2592 Update - ok
21:02:45.0093 2592 USBAAPL (f340199e8cb097e1acd58a967c665919) C:\WINDOWS\system32\Drivers\usbaapl.sys
21:02:45.0093 2592 USBAAPL - ok
21:02:45.0140 2592 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
21:02:45.0156 2592 usbaudio - ok
21:02:45.0203 2592 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:02:45.0218 2592 usbccgp - ok
21:02:45.0234 2592 usbehci (708579b01fed227aadb393cb0c3b4a2c) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:02:45.0234 2592 usbehci - ok
21:02:45.0281 2592 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:02:45.0281 2592 usbhub - ok
21:02:45.0328 2592 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:02:45.0328 2592 usbprint - ok
21:02:45.0359 2592 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:02:45.0375 2592 usbscan - ok
21:02:45.0421 2592 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys
21:02:45.0437 2592 usbser - ok
21:02:45.0468 2592 usbsermpt (caad3467fbfae8a380f67e9c7150a85e) C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
21:02:45.0468 2592 usbsermpt - ok
21:02:45.0515 2592 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:02:45.0515 2592 USBSTOR - ok
21:02:45.0531 2592 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:02:45.0546 2592 usbuhci - ok
21:02:45.0562 2592 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
21:02:45.0562 2592 VgaSave - ok
21:02:45.0609 2592 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
21:02:45.0609 2592 viaagp - ok
21:02:45.0703 2592 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
21:02:45.0703 2592 ViaIde - ok
21:02:45.0750 2592 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
21:02:45.0750 2592 VolSnap - ok
21:02:45.0796 2592 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:02:45.0796 2592 Wanarp - ok
21:02:45.0828 2592 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
21:02:45.0843 2592 wanatw - ok
21:02:45.0906 2592 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
21:02:45.0921 2592 Wdf01000 - ok
21:02:45.0937 2592 WDICA - ok
21:02:45.0984 2592 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
21:02:45.0984 2592 wdmaud - ok
21:02:46.0078 2592 winachsf (74cf3f2e4e40c4a2e18d39d6300a5c24) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
21:02:46.0125 2592 winachsf - ok
21:02:46.0281 2592 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:02:46.0281 2592 WS2IFSL - ok
21:02:46.0359 2592 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:02:46.0359 2592 WudfPf - ok
21:02:46.0406 2592 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:02:46.0406 2592 WudfRd - ok
21:02:46.0484 2592 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
21:02:46.0718 2592 \Device\Harddisk0\DR0 - ok
21:02:46.0734 2592 Boot (0x1200) (16b46e90f13e34098c142ccc05745a8e) \Device\Harddisk0\DR0\Partition0
21:02:46.0734 2592 \Device\Harddisk0\DR0\Partition0 - ok
21:02:46.0734 2592 ============================================================
21:02:46.0734 2592 Scan finished
21:02:46.0734 2592 ============================================================
21:02:46.0765 2584 Detected object count: 1
21:02:46.0765 2584 Actual detected object count: 1
21:02:56.0203 2584 HKLM\SYSTEM\ControlSet001\services\a44ffdc2 - will be deleted on reboot
21:02:56.0250 2584 HKLM\SYSTEM\ControlSet004\services\a44ffdc2 - will be deleted on reboot
21:02:56.0265 2584 C:\WINDOWS\3271380900:1538261565.exe - will be deleted on reboot
21:02:56.0265 2584 a44ffdc2 ( HiddenFile.Multi.Generic ) - User select action: Delete 
21:02:59.0265 2448 Deinitialize success


----------



## justin2311 (Oct 9, 2011)

Cookiegal said:


> From what I've seen the rdr.sys is from earlier systems like W2K. Justin, was this system upgraded to XP from W2K or another earlier operating system?


I don't believe so. I bought the laptop new a few years ago and XP was already installed on it. I haven't changed anything.

Here are the results for the latest SystemLook search that you had me do:

SystemLook 30.07.11 by jpshortstuff
Log created at 14:57 on 10/10/2011 by Justin
Administrator - Elevation successful

========== filefind ==========

Searching for "nwrdr.sys"
C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwrdr.sys --a--c- 163456 bytes [10:39 13/10/2006] [10:39 13/10/2006] BBBC2E555BB5E4ADBAEB1447F11C68C9

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

Right-click on this file:

C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwrdr.sys

and then drop it in this folder (like you did before). Let me know if you would like me to repeat the instructions.

C:\WINDOWS\system32\*drivers*

Reboot and then try to start the Workstation service first and if that one starts then try to start the Computer Browser service. If they both start, see if you can connect.


----------



## justin2311 (Oct 9, 2011)

I followed your instructions precisely. After rebooting, I am still unable to start Workstation successfully.


----------



## Cookiegal (Aug 27, 2003)

You get the same error message?

Let's make sure those files were actually dropped. Please search with the following scripts:

*:filefind
mrxsmb.sys*
*
:filefind
nwrdr.sys*


----------



## Cookiegal (Aug 27, 2003)

It's possible the infection still has a lock on something as well. If we're not successful we can turn our focus to that. It will just be more difficult as you will have to transfer programs via flash drive.


----------



## justin2311 (Oct 9, 2011)

I'm willing to try whatever as long as you and anyone else doesn't lose hope for me 

One other thing that I noticed, every time I go to reboot, there would be an "End Program - rundll32.exe" error message that would pop up. It would show three times and I'd have to hit "End Now" each time. But after that, Windows would reboot normally. I'm not sure if that is a virus or just some other issue, but perhaps it's playing a role in the loss of my Internet?

I'll post the SystemLook results in a second.


----------



## Cookiegal (Aug 27, 2003)

Not losing hope.....................yet.


----------



## justin2311 (Oct 9, 2011)

SystemLook 30.07.11 by jpshortstuff
Log created at 16:01 on 10/10/2011 by Justin 
Administrator - Elevation successful

========== filefind ==========

Searching for "mrxsmb.sys"
C:\i386\mrxsmb.sys --a--c- 451584 bytes [22:49 06/10/2006] [04:26 19/01/2005] 5DDC9A1B2EB5A4BF010CE8C019A18C1F
C:\i386\SP1\Windows\System32\Drivers\mrxsmb.sys --a--c- 440064 bytes [18:15 25/09/2006] [08:51 19/01/2005] 7F09B37065B61DDBC6116F612E6183D1
C:\i386\SP2\Windows\System32\Drivers\mrxsmb.sys --a--c- 451584 bytes [18:15 25/09/2006] [08:51 19/01/2005] 7B195060FF456FA65954C72C5C1640FF
C:\WINDOWS\$hf_mig$\KB885250\SP2QFE\mrxsmb.sys --a--c- 451584 bytes [18:34 25/09/2006] [03:51 19/01/2005] 7B195060FF456FA65954C72C5C1640FF
C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\mrxsmb.sys --a--c- 448128 bytes [18:37 25/09/2006] [01:15 28/10/2004] A1BE3CB080DCC0A8270D21E3CA3B7005
C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\mrxsmb.sys --a--c- 454400 bytes [10:16 05/05/2006] [10:16 05/05/2006] 7412CE77C6FD823F8889B4DF420C680B
C:\WINDOWS\$hf_mig$\KB957097\SP2QFE\mrxsmb.sys --a--c- 455936 bytes [14:38 08/04/2009] [11:25 24/10/2008] D07DA410091143336DAE419A921AAE2B
C:\WINDOWS\$hf_mig$\KB957097\SP3GDR\mrxsmb.sys --a--c- 455296 bytes [14:38 08/04/2009] [11:21 24/10/2008] 60AE98742484E7AB80C3C1450E708148
C:\WINDOWS\$hf_mig$\KB957097\SP3QFE\mrxsmb.sys --a--c- 455936 bytes [14:38 08/04/2009] [11:41 24/10/2008] 7170AB42B51954DEF2781A4D1CCE65F4
C:\WINDOWS\$hf_mig$\KB978251\SP2QFE\mrxsmb.sys --a--c- 456832 bytes [19:14 10/02/2010] [13:37 04/12/2009] 31422F271B5F3E257339541E76569A00
C:\WINDOWS\$hf_mig$\KB978251\SP3GDR\mrxsmb.sys --a--c- 455424 bytes [19:14 10/02/2010] [18:22 04/12/2009] 421F7B922CEC5A5F340E7574A98F7B7C
C:\WINDOWS\$hf_mig$\KB978251\SP3QFE\mrxsmb.sys --a--c- 456832 bytes [19:14 10/02/2010] [17:25 04/12/2009] 602549D1E8A622E5746991F6C56B21CA
C:\WINDOWS\$hf_mig$\KB980232\SP2QFE\mrxsmb.sys --a--c- 457216 bytes [23:03 13/04/2010] [12:48 24/02/2010] 3500E756812E716351F2D341AE1D5623
C:\WINDOWS\$hf_mig$\KB980232\SP3GDR\mrxsmb.sys --a--c- 455680 bytes [23:03 13/04/2010] [13:11 24/02/2010] F3AEFB11ABC521122B67095044169E98
C:\WINDOWS\$hf_mig$\KB980232\SP3QFE\mrxsmb.sys --a--c- 457216 bytes [23:03 13/04/2010] [11:57 24/02/2010] D09B9F0B9960DD41E73127B7814C115F
C:\WINDOWS\$NtUninstallKB914389$\mrxsmb.sys -----c- 451584 bytes [05:24 07/10/2006] [04:26 19/01/2005] 5DDC9A1B2EB5A4BF010CE8C019A18C1F
C:\WINDOWS\$NtUninstallKB957097$\mrxsmb.sys -----c- 453120 bytes [14:14 09/04/2009] [09:41 05/05/2006] 025AF03CE51645C62F3B6907A7E2BE5E
C:\WINDOWS\$NtUninstallKB978251$\mrxsmb.sys -----c- 453632 bytes [14:51 11/02/2010] [11:10 24/10/2008] 6F2D483B97B395544E59749C47963C6A
C:\WINDOWS\$NtUninstallKB980232$\mrxsmb.sys -----c- 453760 bytes [12:44 14/04/2010] [14:41 04/12/2009] F9692BE777822AB3F1A91C34728786DA
C:\WINDOWS\Driver Cache\i386\mrxsmb.sys -----c- 454016 bytes [18:34 25/09/2006] [12:31 24/02/2010] FB6C89BB3CE282B08BDB1E3C179E1C39
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\mrxsmb.sys --a--c- 456576 bytes [03:18 23/02/2010] [19:17 13/04/2008] 68755F0FF16070178B54674FE5B847B0
C:\WINDOWS\system32\dllcache\mrxsmb.sys --a---- 457216 bytes [01:38 10/10/2011] [11:57 24/02/2010] D09B9F0B9960DD41E73127B7814C115F
C:\WINDOWS\system32\drivers\mrxsmb.sys --a---- 457216 bytes [01:38 10/10/2011] [11:57 24/02/2010] D09B9F0B9960DD41E73127B7814C115F

-= EOF =-

SystemLook 30.07.11 by jpshortstuff
Log created at 15:58 on 10/10/2011 by Justin
Administrator - Elevation successful

========== filefind ==========

Searching for "nwrdr.sys"
C:\WINDOWS\$hf_mig$\KB923980\SP2QFE\nwrdr.sys --a--c- 163456 bytes [10:39 13/10/2006] [10:39 13/10/2006] BBBC2E555BB5E4ADBAEB1447F11C68C9
C:\WINDOWS\system32\drivers\nwrdr.sys --a---- 163456 bytes [19:37 10/10/2011] [10:39 13/10/2006] BBBC2E555BB5E4ADBAEB1447F11C68C9

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

Download the tools needed to a flash drive or other removable media, and transfer them to the infected computer.

***************************************************

Download ComboFix from one of these locations:

*Link 1*
*Link 2*

--------------------------------------------------------------------

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to *Step 1*, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

* Note: If you have SP3, use the SP2 package.*

---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------

*Disable your AntiVirus and AntiSpyware applications*, usually via a right click on the System Tray icon. They may otherwise interfere with our tools











Drag the setup package onto ComboFix.exe and drop it.

Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.










At the next prompt, click 'Yes' to run the full ComboFix scan.

When the tool is finished, it will produce a report for you.
Please post the *C:\ComboFix.txt* in your next reply.


----------



## justin2311 (Oct 9, 2011)

Alright so I'm in the process of running ComboFix. About 5 minutes in, an error message pops up, "Rootkit detected - ZeroAccess!". The message read that the rootkit inserted itself in the tcp/ip stack and that I may not have Internet access. If I don't it says to re-run ComboFix. As of right now, Windows rebooted automatically and ComboFix is continuing to run.


----------



## Cookiegal (Aug 27, 2003)

Sounds good.


----------



## justin2311 (Oct 9, 2011)

OK, here are the results:

ComboFix 11-10-07.02 - Justin 10/10/2011 17:06:48.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.293 [GMT -4:00]
Running from: c:\documents and settings\Justin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Justin\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\chrome.manifest
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\chrome\xulcache.jar
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\defaults\preferences\xulcache.js
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\install.rdf
c:\documents and settings\All Users\Application Data\MouseOnlinePolicy.dll
c:\documents and settings\Justin\Application Data\DNyA0uvS2bm5EZhAV Guard Online.ico
c:\documents and settings\Justin\Application Data\euvD2onF4m5W7E8AV Guard Online.ico
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\chrome.manifest
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\chrome\xulcache.jar
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\defaults\preferences\xulcache.js
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{09bb6878-f10f-4e2f-b777-93cad80e96cc}\install.rdf
c:\documents and settings\Justin\Application Data\s99ggTXqjYCeIBzAV Guard Online.ico
c:\documents and settings\Justin\Application Data\vONtxA0uv2b3m5QAV Guard Online.ico
c:\documents and settings\Justin\Application Data\WTXwjUVelBc13n4AV Guard Online.ico
c:\documents and settings\Justin\Application Data\zyxA0uvS2b3m5Q6AV Guard Online.ico
c:\documents and settings\Justin\Local Settings\Application Data\AOL\AOLUpdate\AOLupdt32.dll
c:\documents and settings\Justin\Local Settings\Application Data\Systemx86_x64.dll
c:\documents and settings\Justin\simztyuczy.tmp
c:\windows\$NtUninstallKB42610$
c:\windows\$NtUninstallKB42610$\1279850560
c:\windows\$NtUninstallKB42610$\2756705730\@
c:\windows\$NtUninstallKB42610$\2756705730\bckfg.tmp
c:\windows\$NtUninstallKB42610$\2756705730\cfg.ini
c:\windows\$NtUninstallKB42610$\2756705730\Desktop.ini
c:\windows\$NtUninstallKB42610$\2756705730\kwrd.dll
c:\windows\$NtUninstallKB42610$\2756705730\L\odetmngk
c:\windows\$NtUninstallKB42610$\2756705730\lsflt7.ver
c:\windows\$NtUninstallKB42610$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB42610$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB42610$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB42610$\2756705730\U\[email protected]
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 19:37 . 2006-10-13 10:39 163456 ----a-w- c:\windows\system32\drivers\nwrdr.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-10-08 22:38 . 2011-10-08 22:38 -------- dc----w- C:\ERDNT
2011-10-07 23:30 . 2011-08-31 21:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-06 00:41 . 2011-10-06 00:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-05 17:36 . 2011-10-05 17:36 -------- d-----w- c:\documents and settings\Justin\Application Data\vONtxA0uv2b3m5Q
2011-10-05 17:36 . 2011-10-05 17:36 -------- d-----w- c:\documents and settings\Justin\Application Data\P5sWJ7fELgZjCkV
2011-10-05 16:10 . 2011-10-05 16:10 -------- d-----w- c:\documents and settings\Justin\Application Data\WTXwjUVelBc13n4
2011-10-05 16:10 . 2011-10-05 16:10 -------- d-----w- c:\documents and settings\Justin\Application Data\H2ibF3pnGaJdKfZ
2011-10-05 14:41 . 2011-10-05 14:41 -------- d-----w- c:\documents and settings\Justin\Application Data\zyxA0uvS2b3m5Q6
2011-10-05 14:41 . 2011-10-05 14:41 -------- d-----w- c:\documents and settings\Justin\Application Data\naH6sWJ7f9jeIrO
2011-10-05 14:34 . 2011-10-05 14:34 -------- d-----w- c:\documents and settings\Justin\Application Data\DNyA0uvS2bm5EZh
2011-10-05 14:34 . 2011-10-05 14:34 -------- d-----w- c:\documents and settings\Justin\Application Data\AH6sWJ7fE9TqYeV
2011-10-05 14:30 . 2011-10-08 02:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-05 14:19 . 2011-10-05 14:19 -------- d-----w- c:\documents and settings\Justin\Application Data\YL9hTXqjUeIrPyA
2011-10-05 14:19 . 2011-10-05 14:19 -------- d-----w- c:\documents and settings\Justin\Application Data\euvD2onF4m5W7E8
2011-10-05 14:11 . 2011-10-05 14:11 -------- d-----w- c:\documents and settings\Justin\Application Data\W44mmHK7f
2011-10-05 14:11 . 2011-10-05 14:11 -------- d-----w- c:\documents and settings\Justin\Application Data\s99ggTXqjYCeIBz
2011-10-05 14:10 . 2011-10-05 14:10 -------- d-----w- c:\documents and settings\Justin\Application Data\kIIVVrlONtxAuc
2011-10-02 18:00 . 2011-10-02 18:00 -------- d-----w- c:\program files\Hitman Pro
2011-09-28 02:27 . 2011-09-28 02:27 1409 ----a-w- c:\windows\QTFont.for
2011-09-26 23:08 . 2011-09-26 23:14 -------- dc----w- C:\TDSSKiller_Quarantine
2011-09-16 15:05 . 2011-09-16 15:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2011-09-16 15:05 . 2011-09-16 15:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-07 23:40 . 2010-08-27 21:51 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-09-21 00:08 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-10 21:25 . 2011-10-10 21:25 16384 c:\windows\temp\Perflib_Perfdata_28c.dat
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe -startup" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 8:48 PM 24652]
S2 TrkWks32;Distributed Link Tracking Client ;c:\windows\system32\icm3232.exe --> c:\windows\system32\icm3232.exe [?]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [8/27/2010 5:51 PM 23624]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 2:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
znyjfrbd
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: manageyourloans.com\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 64061
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-Malware Protection - c:\documents and settings\All Users\Application Data\defender.exe
HKCU-Run-MouseOnlinePolicy - c:\documents and settings\All Users\Application Data\MouseOnlinePolicy.dll
HKCU-Run-Xilisoft Update - c:\documents and settings\Justin\Local Settings\Application Data\AOL\AOLUpdate\AOLupdt32.dll
HKLM-Run-ISUSScheduler - c:\program files\Common Files\InstallShield\UpdateService\issch.exe
HKLM-Run-bacstray - c:\program files\Broadcom\BACS\BacsTray.exe
HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10e.exe
SafeBoot-00130605.sys
SafeBoot-06648696.sys
SafeBoot-95056162.sys
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 17:25
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_USERS\S-1-5-21-118781078-28829433-61137247-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{12653D3B-7986-50D6-4312-A8DC8AA537AD}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oalpkelhkcjpaoiapeaoofikfpeinb"=hex:6a,61,67,64,62,64,67,6d,66,69,70,6d,61,6a,
61,6b,67,68,6c,6b,00,4b
"nabaaijlbmlmfpjijhgfphjockli"=hex:6a,61,67,64,62,64,67,6d,66,69,70,6d,61,6a,
61,6b,67,68,6c,6b,00,4b
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð|ÿÿÿÿ.|ùA~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00TøH\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 \03\00\03\00\00°v\03\00\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00\03\00ô\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00z\03\00z\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00|\03\00|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00}\03\00}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00\03\00\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02\03\00\12\03\00(\03\008\03\00H\03\00T\03\00d\03\00r\03\00\03\00\03\00\03\00x\03\00f\03\00T\03\00D\03\00.\03\00\16\03\00\04\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00\02\00\00\00\00\00\00¾\03\00\00\00\00\00\00\00\14\00\00@\00\00J\00\00v\00\00t\00\003\00\00«\00\00g\00\00 \00\00?\00\00F\00\00§\00\00P\00\00Ó\00\00\08\00\00\00\00y\00\001\00\00}\00\00 \00\00Ã\00\00\11\00\00\"\00\00\00\00Ò\00\00\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00TøH\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1960)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\stsystra.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2011-10-10 17:32:46 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-10 21:32
.
Pre-Run: 281,477,120 bytes free
Post-Run: 290,160,640 bytes free
.
- - End Of File - - 26D7EDBD9050D5A4D65C648718BE3ADD


----------



## Cookiegal (Aug 27, 2003)

Please use SystemLook once again but with this script and post the results.


```
:regfind
DC3BF90CC0D3D2F398A9A6D1762F70F3
```


----------



## justin2311 (Oct 9, 2011)

Here are the results (it's super long, so I'll post the second half below):

SystemLook 30.07.11 by jpshortstuff
Log created at 18:08 on 10/10/2011 by Justin
Administrator - Elevation successful

========== regfind ==========

Searching for "DC3BF90CC0D3D2F398A9A6D1762F70F3"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\DC3BF90CC0D3D2F398A9A6D1762F70F3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\DC3BF90CC0D3D2F398A9A6D1762F70F3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41E8829053EAFEA48BE8329D517B1FED]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\41E8829053EAFEA48BE8329D517B1FED]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\005DA4A7028CD9242A0E6D9FDB7D9A5D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01299744BBA6DE9458835371DD0AC065]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\2052\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01FEA275F78D82846A7D4318B9BE83A6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.h"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\023380DFFF5185C4780C1ECC3476D46C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\corperfmonsymbols.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0297059B4B28D494496583876A268BB9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02AD9EA5965A12647B8D89862BBD2453]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\033C0DDB82D5A884CABB7D26F1A0E07B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_hightrust.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\03AF68C1D84BD7640BE516276548A9BF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\SBSDisabled\Install"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0439A4F405F532D38B79D68715340965]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\052B2721AB0A9C844AD5476125C9D8EA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05490A803DC2D7A468ABBF088D6ED906]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0599A4AAFFE0F6749B9FF74C30911645]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild\Microsoft.Build.Commontypes.xsd"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05F7A0D985874684D9655A48345722E9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0620EFFB3A8CAC53AA072CBD677AF5AC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB979909\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\069CFB3FE70A3BA499A10F54ECC2E7C6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06CD78EE4A756B33CB9AE199BAE6E226]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06DBC900CA946154081BAE7B81842928]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08829354A784ABF37A574A84A0E8DE8A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB976569\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B1BC897995F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.89_x-ww_0de46bd0\downlevel_payload.8.0.50727.89\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B1BC897995F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.89_x-ww_0de46bd0\downlevel_manifest.8.0.50727.89\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B9B2448A46C80D0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3044_x-ww_b80ea88c\downlevel_payload.8.0.50727.3044\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08B9B2448A46C80D0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3044_x-ww_b80ea88c\downlevel_manifest.8.0.50727.3044\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\095F7F869DD8F404FA150AD8E6E6D6ED]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0999D6A3ABFC4CB469FB56DBAA81D8D0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallMembership.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0A089D8236DF30736B7417F5C561327E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0A08F651FDF3F05489962F3B9EEF6DF4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0A12C140D55193843A472FE9A1CE9BBA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B45C4469A60319438BABFD39A21FBBE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\DevDiv\NetFx\Servicing\2.0\SP"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B825EE5547D74D48A43C8ECFFF10301]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_minimaltrust.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0BF42EF5B93931349B900D4868CD121C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C12EC0DF34F49E4C89F4093871ED9FE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D7FFDCF2464D3E35B057CB07A34E0D2]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E1699F2D57101944895B3B654B43248]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E629C78B89BF9243ABE87B384B44259]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FA2F82E473392449988E210F96B6C01]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FD39E36E3C004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.99_x-ww_51e92916\downlevel_manifest.8.0.50727.99\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1080D1DF4015DBB448F7EF577EC688C9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\netfxsbs12.hkf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\10C44CD6B78B6944083D4BC442615C2A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.xsd"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\112546189F4870E4EB2B7931E9FC297E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_mscordbi.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11EF26775CD2AD14AB913217EEC170E5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11FA6B1348418C83689B7EA400C6E999]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB951113\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\123F98E9676DF8C39A43D7EEBA44E12F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP2\KB976765v2\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13435AE2CFC3F5F4A8BD64A61023E0CE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\138A1F407D2E05E328D3EA78C7EFC8F6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\145F99F326DAE9335A95D0F64DB1A51E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1499D820A8754B63A87FD17F07856448]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\15292945F02779D4DA24129A4699B21E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.rsp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1542AEC87C5AB624197ACEDC5D5E546F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1033.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16C13AAD1128C6D429EA790EFC81CF57]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\177F1B749721A1E4DA4EAB392A126FBC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\178D146DA28EA9D4F8A35C0ECCA1BF4E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\17E397F905034DC428B9D0351F3FBC36]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1036\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A90D176A9A949190CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.193_x-ww_ac24e7bf\downlevel_manifest.8.0.50727.193\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC06A3EEBA4F7835BF935747F71D7DB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B023BD2221492644B15B18C7833D733]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B820321C08C24E38B6EFB0BF4D0226E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C61BC8955C5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.93_x-ww_0de56c09\downlevel_payload.8.0.50727.93\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C61BC8955C5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.93_x-ww_0de56c09\downlevel_manifest.8.0.50727.93\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DA0CB1D19FFB803693CF72828F2B2CD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DEA00C998AE1B010BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.101_x-ww_6818287f\downlevel_payload.8.0.50727.101\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DEA00C998AE1B010CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.101_x-ww_6818287f\downlevel_manifest.8.0.50727.101\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E10E6A108030EC48AA3B3DBC7563F4F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F2F650B065CF6937A1B33A5AC3E3151]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB952346\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA71CAD4B9E54A328DDA955687BD7D7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB948646\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\201E9B369BC06D94DA7574E9B2A17E73]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\208A90ECAFAA3A649B3537AE1D949906]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1025\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20C5E559D19CC5D4C9489BF33851AD45]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\setUpAuthentication.aspx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20DE37EB11038E54CBD641576809DF5A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1025.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2122F3CFFEFBB8E3D865324B10087424]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2171BC8913C5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.94_x-ww_0de56c0a\downlevel_payload.8.0.50727.94\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2171BC8913C5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.94_x-ww_0de56c0a\downlevel_manifest.8.0.50727.94\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\21CDED0DC8955BE4EA659F1B24B81BE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\239AD22110C31D24B88048A5B56E8A41]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\239C1145387564A42BB3710640B8099B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\249A62CBF89AF4E4D988988CC238D035]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\257B19FB0ED6ADF45A60A302704BC07E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2601E703EBBC41D3084DB62F831F125C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB957542\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2617C58F2146BFD4490170AFBB7E9519]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallCommon.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\28446FA9E5E80284D927B64B76F59064]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\28C0B4F7EA1390C4D8EC4F010A394F83]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_2052.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2ACB6998F5A7346408A43494A013CCEB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B8779BAB69F0AF4585456DC86AD82A7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_diasymreader.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B95AD6440506E232ACED7E815F3EAB7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB952883\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BF6AB9CC1C32014993A3C1D6DA9C3C3]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\goAmerica.browser"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2CD29DA2CA7C7CF3A9817C8251D7A14F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB958129\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2DCA0B68F5D96204B86DF22ABCD9FE27]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2DD1B81FA064EC44FB3F224A446394AC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E467E30F82A0474489E21706646A607]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\31706A3D2D544B73296BD434ECFCDEAC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB949272\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3178D6A16119EA44AB06C40F8E1C5DB8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\317F2148ABCA22536A953DE45BBAFEF8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\KB947148\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\323CCB994C1355640B7D54820A94181C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\324264BA762283D4C850EED39EDE1594]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\32D4B63024AE37643B0C0ECBE3014FAD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\SmtpSettings.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\33A81FD774B8C5B37BAEC6E36541DA70]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\346B46203E02A9448B66FC2C08190F78]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\365ED9A27E356273E99EF6FD0A9327E4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3671BC89D0C5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.95_x-ww_0de56c0b\downlevel_payload.8.0.50727.95\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3671BC89D0C5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.95_x-ww_0de56c0b\downlevel_manifest.8.0.50727.95\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36F60B85431154B439F7D1053D25A4B4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_3082.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36F85DD890EE3EE4D9E6999AB47719AB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_dataperfcounters_shared12_neutral.h"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\37042673CC0FA4241A723BDF8D30AAF8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\38E68AF724657164B93AFD2E3680E031]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\WebAdminPage.cs"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\38FA3B4E5B5957A4AA58FD9A61848947]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3950F5B610ACF774883593D88A24C5B1]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\39A3115D03F535D4998DD9E45C1F3155]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbscmp20_perfcounter.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A4E59B3C64E4D644998C933F272EB13]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\addUser.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BA059AA891C4164286CAF6C68C5BA55]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CLR.mof"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BE6A37130464D115AF3000972A8B18B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\system32\mscoree.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C1E68EBB87A0B44091152B82DEA824F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallPersistSqlState.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CABF17600B919190CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.100_x-ww_ac1be585\downlevel_manifest.8.0.50727.100\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E3B2E26F92E3143DAF5D232CFB2F768]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP2\KB974417\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FB6F4CDCDC91AD4E9819EAF519319B0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="01:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2001"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FC6F24507CE90D43A333CA0A9CA4D79]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FDA1DC4D696D244C952B472A8D58AAF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4073BE8F8D3F7AE359349AB6BED5C9FB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\KB946503\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40F82A38174F36C3182163088321BCBF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP2\KB958481\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\432CCCDE3E44CFF4C9423D702179A8BD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallPersistSqlState.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\445198175868143409F9C48DAF2453F3]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\457CDCFF4106E414A97D5E2BF7BEAC5A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46248D9C7258F464BBBD077DEFC66670]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\467A81C4CAC87214EA39E4BC65E5322D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_VsaVb7rt.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47186AC25943BAD47AC8EBF041C9DAB4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.h"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4849670B6DFB21241B1DC6B3E05F6ECF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\486B573DF5AA5B44D955F83C1F0527EC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet.mof"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49390AD49942E4337BB8CAF1A354E0C0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB947748\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49F0A4CD1DDEB6333AB6545EC3590925]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A797A8E53F6A184BBBAE642DC53B8BF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_lowtrust.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B71BC899EB5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.96_x-ww_0de56c0c\downlevel_payload.8.0.50727.96\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B71BC899EB5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.96_x-ww_0de56c0c\downlevel_manifest.8.0.50727.96\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BC3AEA81B1566231832AE84BDBA334F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB431780\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BCF7EFCE4F0C79339BE4C4D99D5F8B3]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EBB202F98A9ADB4D82A2F4DCBF41FF9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_mscorsec.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F76A244A49AD80D0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3051_x-ww_b80fa8c8\downlevel_payload.8.0.50727.3051\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F76A244A49AD80D0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3051_x-ww_b80fa8c8\downlevel_manifest.8.0.50727.3051\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5081BC895CB5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.97_x-ww_0de56c0d\downlevel_payload.8.0.50727.97\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5081BC895CB5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.97_x-ww_0de56c0d\downlevel_manifest.8.0.50727.97\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50B0AAB78F41BF443AEA4D90B28E342E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\515C51DD12BD4A2418F98C5486518A03]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_lowtrust.config.default"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51894F619FB8FCA4E96D80561CA0E266]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5263359B32F40A83982E14B312485CF4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52F8CBA75DDF60F4898FF869ADD697C8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\541645477B2DB204BB78A6A97F60653C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\543AE646A11394D44A5E13C877191226]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_GlobalResources\AppConfigCommon.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5503168D8A0DBBD34BAFF2701ED44437]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5523B62149D62F04988C9BF4CDBD2515]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\564271BD63EF16F4589379E5410134F4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57F3B6EF97411944EB8F7A269B571A4F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57F56B719CB15D115AA4000972A8B18B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\system32\netfxperf.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\58853A6326943E04A83060E18462DBF7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5896C8F1485723F45A3A204B8591C56C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\58C05813D865E43478B9E8CB1ACF3913]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5918A2442829D80D0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3052_x-ww_b80fa8c9\downlevel_payload.8.0.50727.3052\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5918A2442829D80D0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3052_x-ww_b80fa8c9\downlevel_manifest.8.0.50727.3052\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59388176ACE999190CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.238_x-ww_ac9cf5cb\downlevel_manifest.8.0.50727.238\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59A694D1D9360574AAC2360B3BD1521F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEHost.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59B644DB6A74D874F93D7598D851E50E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5A8BEF2378211B64B81D35E715652487]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.Tasks"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5B0D3A45CD58C1C47BB0B093B2DA258C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C274ABCBDE0CA043ACCF857113361D5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C69D73498BD45E32B20D0B887238D29]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB949777\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C81A6C9851D98245B01678F70F0B969]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5CBD17ED70804704D9260059093352F9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5CD557F58ACB2984A970D255D858B79F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\3082\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D281E0D13072C345BEB10E45F588FB0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E1C351F14F2E203A8A2D79AC89121D5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB948233\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E85ADF333360294E9A65BF3D8562F61]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5F712AE492F7A5B3EB08A674517952AD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5FE81B9AFAA01424F861E5AC15A20655]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild\Microsoft.Build.Core.xsd"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\600EF8FB22C705331B2CA2CBCAB55747]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB952324\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\606646307741BBF44B7988D79C70DF99]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_DataOracleClientPerfCounters_shared12_neutral.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\60F9190E18717F14FB9A63F9935F5478]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61075ADA1E592CC4E84D3ECEDE2B9F2E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\617999BBB675290428525E1964B2E22B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Security.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62116324C9F86F74396BE51A4095AD75]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62A79A60FA1136F438E2F4263C7A1D63]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\63100ED8B282393309AF72AD5931F071]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB950230\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\63B9A244ABB7D80D0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\downlevel_payload.8.0.50727.3053\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\63B9A244ABB7D80D0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\downlevel_manifest.8.0.50727.3053\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\63E97BB9ECE015D49B0B4F103C3B43A8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallProfile.SQL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\64CA7B214545D974BA907F2A6157FCE3]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_wminet_utils.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\655222F2D9492FF41B8F58FA36007FFE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6581BC891AB5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.98_x-ww_0de56c0e\downlevel_payload.8.0.50727.98\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6581BC891AB5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.98_x-ww_0de56c0e\downlevel_manifest.8.0.50727.98\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\658CCE38247DAE53BB0B804488C6800F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB957543\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6680A270397A88A4E8436220F841A14A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_NetworkingPerfCounters.h"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\672A69C0C2B8CAC4D81547152B72097B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\67521166DA92CE2488D24AF6BA0818B8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_minimaltrust.config.default"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\676FFAF504B0B7642A5F223298207BBC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6810675C36286834EB2CF4365EA211A1]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\690C824F5274E4A43B44F8158C7897DA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\690D3EEAE226C584396960829563BB2A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69B89D107E68E7E44A375D232870FEE2]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_mediumtrust.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6A9D4D9CA2208A549A80BA440FDD2662]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\ProviderList.ascx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B2C2DCA2582D7A3CB3EF9F557D47A16]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB952137\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B364D5C0D8C7284FB7386C0F7753664]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B5FA08A29348E14D9CD8CA910083041]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.cfg"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B677DE869C16194C8A0E9769C8A186F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C93A7230ADA0A8498C584256F4335D5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dv_aspnetmmc.chm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CF9B3C6DB3782E43A00C57D4584AE18]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\createPermission.aspx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6D9BA43C933938138B630D9C645B025A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DAFDFB976BE4B010BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.104_x-ww_68182882\downlevel_payload.8.0.50727.104\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DAFDFB976BE4B010CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.104_x-ww_68182882\downlevel_manifest.8.0.50727.104\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E2B897BB67DF033BA8E5485A5B384D7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F6FC71DD96180B33B771FD606B11869]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F949E36CB3004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_51e427d4\downlevel_manifest\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FD7F92B9C1BD63429C05BA1B1DAD04B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.h"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\705D36F5E70BD633F9A640EB3EDB29BB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\70B24390FF2CA9043BF140D14520CECC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\721B6F1EE48B76F4D98245DCEA43B6B2]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7301F639EE6B4FE3A849F83169C92B5A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\73A79C73C68925E4B80577C6780FBEC6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscoree.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\742B43E1CC54DC53C9AB59CB6541EAF8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB946457\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75BF95A774332A03A93BA9B2C8BCC7E8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7664BBB65283F7D41850A89C6DC60954]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76C12BF73A9F8874B891CF8D2F11C292]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\78101FFB7CC925A4FB892FE36A7B53F5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RedistList\FrameworkList.xml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7939623FF05FB2E39A4733F0D4DC2019]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7951D2F6337CE7C38A1F3F8AD82987CF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\795F42273AF532B37A354E0FAB06B487]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A0DCDED98788304DB93CC7B4D95E24D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A603937386B69A43B8C89878B209F34]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1040.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A65AAB79D0876C42B384DC4EEDA79B8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A7E7B9FEE50CC83D852B05022AE19C5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A81BC89D7B5F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.99_x-ww_0de56c0f\downlevel_payload.8.0.50727.99\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A81BC89D7B5F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.99_x-ww_0de56c0f\downlevel_manifest.8.0.50727.99\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7ABB69D3D8493EC4DBB4B0824DDBB86F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallSqlStateTemplate.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B73A2AB7B3564C41918B35D8753CD16]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B7BED582C0B9964BA31995513C851D2]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B8C976FC56DCF63EAA1344D1EB0FBBA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB200003\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C2A0A3B9FBBAE44E98BB05E598D1306]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1031.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C61C7AA4A753464699170CD325DDB78]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7D63A01D58BF8F23C8B5640D6B6A1D4C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""


----------



## justin2311 (Oct 9, 2011)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7D7A7CB0A381C274EBF14AA0E026C647]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7ED64F09705969746B8EA407420D6A19]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7F1BBA53C57121041B28762241C8F009]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\system32\mscories.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7F1E234D2DE8FF83E8713B8433FCDF63]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FBD2B77A566C2341B4BDA8D7244ED51]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\Program Files\Internet Explorer\MUI\0409\mscorier.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FC1B20FDA3D7494083A2F5F0DEAA1D3]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80A21CD73248B5445AB2D2D76108CF97]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80F8A534CE34C37479A36408DF607B90]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1033\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\812E9E3AAEA7E9F4F9FE0EA401209BDF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\815DE197FE1BE664CB88CB6D3CA9C629]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8228FB02160E5B34BAB48FA6AD307DD0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_regsql.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82DE7549CF3F8CCB0DF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82E0E82B94515114DBF7BD17CF4485E4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.resx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82EF3F24DD621EA3BAC85739B708986C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB953990\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8320CD3BF0907D6448ED7F063CD20DF0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\shfusion.chm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\838E3080B57E2B84FB79A258D45BF9B8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1028\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\854EEFB99D9E3B010BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.193_x-ww_68212ab8\downlevel_payload.8.0.50727.193\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\854EEFB99D9E3B010CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.193_x-ww_68212ab8\downlevel_manifest.8.0.50727.193\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\858FC6C9AB0E85C32AFC4BC10D560DD8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB950986\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88333FEDA8D26D14D9715C27987A3328]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\894532D9ED6F2CB38A8B3656D033589C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\89DC518537DCBCD419348152453A30A6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8A8B873D542EB163C8A6614C3AA9194B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8AC5D97BF2F092B4CA057493F6D5D4EF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallPersonalization.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8AE8903FE0B848E389FAB6AC0064E480]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8AEE712325301504086A8461A27ED2E0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B3A11359A8234A39A16D3D004B5157B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B706AAC0E412034FB93ACEB30974855]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorld.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8BC8B629739569143AD4CB34DC63B315]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C60D176EDB949190CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.103_x-ww_ac1be588\downlevel_manifest.8.0.50727.103\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CA4A2DD729380043B0800BB8E938117]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CB76533B876674348E9C80F789D7023]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB953300\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DE80ABDB2B68EB3CB3B7F399471410C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB954832\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E5EDB9E123BEB7408C93E7FB702BAC7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallSqlState.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9055DA7481CC1024CB23A6109FD8FC9B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9056426A07FB13D4DA07AB2FE084DA3F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\system32\MUI\0409\mscorees.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9065E6995EA9FD847AABA181B2BDA9AC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9073EDD5C0D0B0A44987D268343E83B0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\91450D38A87AA7F498CB617CA4776BBF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_perf.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922F87AED0360A938AF7D8A4D6641DFD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\932672F26892EA63F886C005BB922375]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB947317\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9336DF229AF5490448E44649A6080758]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_Networkingperfcounters.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\938214A2DB1671941BD2D6088EF32454]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\943C7687AF89C04478C3C47D87502DF6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\SharedReg12.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95E27F295A263A23F9A63AB6458DD9CC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB980773\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9709587234A3DB546B8C6EADC717C0FE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_system.configuration.install.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9748750627E03734EB12265C01AB2FCA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\985D382ADF2219D48931F5A092913ECE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallSqlState.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98B3FDECF94E069469CA1F828958169E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\system32\dfshim.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98C3960E44786613B8B2A595CB2BFA45]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB958481\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CF18FF2CD608F44977D71604FEF79C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98DA9D49BE150E438A90A543CC9B8F24]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98E01315D6865DE4CAD1186BB214E3E4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_system.data.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A182A23A24B76C3F86D0F94B405D88C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B7383F4255251B47B141698DF32CFF7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1028.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BD74E6BB973B5C3E984F0CDB9BA551D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB946573\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BDB01AE798B8AC34AA63D9E6BEA391C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB948233v2\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BF275CEFA2EEE63ABD266573D65BD68]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB974417\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C03B1CC0E326EF46ABE74E179737958]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardAddUser.ascx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C049E3685A004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.89_x-ww_51e828d7\downlevel_manifest.8.0.50727.89\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C0C94F09651D6150CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3044_x-ww_fc126593\downlevel_manifest.8.0.50727.3044\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D760B9276B49273AAF4B0F40C7C59BB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB957541\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E45CBE8BF565E946B8C24C395434D6A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9EB790044E4EC774ABFCBC3B70E29587]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9EF943A95045E7034BC07A5D282061AE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F361191ABAB5FE3EADCBB7E6B9C4F9A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F7241905182FC03EAC2B51366E3FE16]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\KB946927\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9FAA6C1E97C539636AA5D524BD545A23]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A05ED0C976063184AA91C1264A3D2856]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1042\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0624B030A2B64139BA5C9F425E35C6C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A082AC7BA846AF744BDCB8968E8B1FFE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\DWDCW20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A09602F190844F535AFC164049506B14]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\KB946644\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0C39E3661D004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.93_x-ww_51e92910\downlevel_manifest.8.0.50727.93\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0DD4167D961D3643B9AA8BE5C6CD778]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0E32C3DE6352DC36A9B8C41D5AA7217]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB946922\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A14DE176A4B929190CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.101_x-ww_ac1be586\downlevel_manifest.8.0.50727.101\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A17363101EBBA1446A39488547A5C4A4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A1D95B7904F4EC342BD7FF5CBAB8DB18]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_mediumtrust.config.default"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A67CC970EE6C44E3B8C725F16ACC2410]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6B18150721804A459BBA0C579D7E890]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A74D878DF41D4D115A64000972A8B18B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A75910C9F3AE0B010BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.100_x-ww_6818287e\downlevel_payload.8.0.50727.100\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A75910C9F3AE0B010CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.100_x-ww_6818287e\downlevel_manifest.8.0.50727.100\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A76ADE1BF2FAA9E45ABEBD53EC0FACAB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbscmp20_mscorwks.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A78D7101962472C428E3956A55CFA4E9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A84671C32545C354B9005535A56CEC46]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A969F8B5C88E42F4282BE4F39B15033D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A9F36C58FD9E25F3C8FA4467F9A8E5EB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA36E041625DC753594CE54F8774DC9D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB976765v2\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA8530DD20848564CB31D334227972E6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Version"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA9E310B563370A40AA003D14D2E352B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1042.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADAC4DD2CDF3B714CACACE152BA44118]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\navigationBar.ascx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADD5884B60E795641A4DD0FBF64C5053]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AEA691E5EBAC39242A9C588106E3E103]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AEEFF02917CB44B4CBF848EAA9593B91]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF1927F299F8418438DD943AE44FC821]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF224C8139D31933E9CB20BFF5E27882]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF8147A63F209AE4EA86BC364A95584A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fusion.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFE3B1357657D8A46888E3A5FE6BCD22]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B00F15351AEA8A249A5708E4549F2579]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B1504ED6D501E9739BC2CDBE5934422D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B26396E0A34663B45AE0551E88B803E7]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B2FC05CE46035D115AA4000972A8B18B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B3223BC631F1FB342B06FF191663FFBB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B3D5E9FCC79A54B4A925A66E2253FD39]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web_hightrust.config.default"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B45C4A025C5DC8249B1566359F33F4EE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1041\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4A9A2CFE5E69194AA9072FBB54ED41C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4CC9364870C9F730829B173EDCE51BF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5C39E362FC004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.94_x-ww_51e92911\downlevel_manifest.8.0.50727.94\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B659BB04DB55F6E46A04FF52B22E03C2]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6A6D2E5A8A6A733887E2DD94FBCD11A]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6B9EA59941A1994085A4B13C65771C8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1040\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B7159D85A1668774DBE147B76AB0541C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B84D7D73BF037A133B1A05EA55F50A1B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B8DB2B2C25F8CBF3FA091A18B05CD913]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B9132632BCD7548489C993FCBED5FAB5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\1033\Install"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B9487585E3D7D724C81860BFA24896F6]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B9EA275E95070743FBAE1EE1C121F16F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB956860\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA769F780233D1A4E9F819C0998643CB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BB865B2C522005A32873F998C175A868]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBC26C640B4023146A486AF3B7F567BA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC251EF6488EA3546AEB4CC8EBE395A5]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCCB576F7E1C20B4FA54A6015F42A767]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDC9E05CDA7F6174D946F0050DCDC6E8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF9D650B8D34F8F3A8DD295DB68D8939]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\KB948815\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C132C4005C5F0454985BB4B9D15163EF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C1EA736DA29E2FC4991F275B0BD56569]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ieexec.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C23EDB24E0937954C95CB9E4319765F0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2680B99149838C4C9D18121E6CDFFCD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2815AF91CDFFA135B784FB8C04255C1]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C340D74E96424E64F90FC29C080B809F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C35597A54C58D2248861553C918E2EB9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C459398E4AE33963095433FE5B5321ED]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4E38F654A27D383B82E93E65EC216D4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4E5AFB990EE8B010BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.238_x-ww_689938c4\downlevel_payload.8.0.50727.238\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4E5AFB990EE8B010CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.238_x-ww_689938c4\downlevel_manifest.8.0.50727.238\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4F9BC89822E58E4BAE436B1C526D934]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C5A638D0F8F11CB36B17EC37C1094059]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C63F65D2FE90A114990BACBEB8003725]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_iehost.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C64D5F23DDAEB514789B5ACDA6E964ED]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C66B147156362163986835D646BD5F6B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C66EBF42FCCBF633480D7EC1485FF27B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C8EC0D9DA431D98469E7AD5CA44E77DA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_mscorrc.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA347F47BB8536C439E6A705CFF8B9DA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAC39E36ECC004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.95_x-ww_51e92912\downlevel_manifest.8.0.50727.95\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CBE9F498C24DD614CAEB2E7DD183CD92]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\UninstallRoles.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE73E67DA9373954B960458877659584]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFBA49EA2C808994CAEB8EF260970D04]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D02ADAD4D4B9A8A4CA831EE6CA0F7C22]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1041.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D0570601D8678B1329C36418871C2FFE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D138BE1A38811103F8431477FDC79EA9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D18336C48ACD7563DBAEFA5CDB0120F4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D21CA0A776C826449B95D555B4E9096E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3CD060B1EE638D4ABA554426FA0CD36]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3D884F0B0A5E6150CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3051_x-ww_fc1365cf\downlevel_manifest.8.0.50727.3051\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D5706A62D23ED603DAC828055B4124E4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB960043\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6461317C3DC4F04799BDCE9E42626FE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\DevDiv\NetFx\Servicing\2.0\1033\Install"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D74D878DF41D4D115A64000972A8B18B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D78E6A7A10526564AADBD3B7442F12DB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D7A0BF8185EC26331A8EC3130E32F9F1]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D7F754BB5E38D2939AB866C82FB7273C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8DB7E1D625D032378232130171D6403]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9273A93A11FD504AB870B18A1C99EBA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9286B25CE1B1274AA952626052DD341]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9A2C4DF65A3B3B3B9BF9FACFCE33503]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA0C2808EA12B343CA80B418F30294E4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB952677\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\downlevel_payload\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA42BC89BF25F5BD0CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\downlevel_manifest\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA5CF29E79B3ADD4AA69FB3869BF9530]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonSymbols.h"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE0547C0491EAA445930C124B4B953F4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\XPThemes.manifest"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE6C937091FFCD540AD60552A02B40F8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\security.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEA068A89E443DA46815043777A9229F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Install"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DECC471E0F85EF13DB09D151F7E1582F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP2\KB980773\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF2F3CC136B8AF48A741F0FC4AEBAF0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.ini"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF0CDFBE53E9C6D458944D6560F6F029]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\system32\mscorier.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DFC39E36AAC004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.96_x-ww_51e92913\downlevel_manifest.8.0.50727.96\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1D62698277EA424F9D5A75C0DA0C6FD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E2C81D76A654C6C3180EE7C6B5F0FF11]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB946102\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E47E2D1DC66F58A45A48D4E0F5FEDF60]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4D39E3668C004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.97_x-ww_51e92914\downlevel_manifest.8.0.50727.97\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4FDFE31B19040A4EBCD5CFBF0DD8DD9]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E54EEB510DA80414BA2D470B4D01A557]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\Program Files\Common Files\Microsoft Shared\DW\1031\DWINTL20.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E6993D4A60461A647AA6FF265D47C883]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E75ED00F4BADEC832900B5C82DA736AD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 2.0 Service Pack 2\SP1\KB949226\ThisVersionInstalled"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E764C6ECA1D557743B1083A13120F828]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E769D53279F26D115A15000972A8B18B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E76BAA285AC18FA46AE9534811740B41]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="C:\WINDOWS\INF\AER_1036.ADM"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E7F87833AF04B1A4F9DB553FAFE36242]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallSqlStateTemplate.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8753EE94804E984FBD629572F39F6A8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallWebEventSqlProvider.sql"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E93A153EFE0B39543B9C07D8D24CE2E0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA02B38C70316AA48872448FB86389D0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB0213FE01E86B64387DB24392902D79]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB47D3ADF94F0803FBAFEDF25A5EAAE0]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBFDD3D5488BC5634A42A72C5C8F8771]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB971111\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC127D7305C4641368C20906FF6B78D3]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED6A84F03434E6150CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3052_x-ww_fc1365d0\downlevel_manifest.8.0.50727.3052\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EDB5E939C254DF143AE02D89890E0C1E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EE18FEA0F184AF135873686FC466EEDC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF6FF88EF8BB8E049827F95B997A2F1B]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF94F86DD9B097743BB2F153C77912CE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe.config"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFACCEA5A0A73DD4FBB521ED9C3E1BAC]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0290D2785788FE44A516E4E3423FA94]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F102C17682C959190CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.104_x-ww_ac1be589\downlevel_manifest.8.0.50727.104\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1E914D2B5BE6633E93195AFD7BC0687]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F22C54511AC784240B744517FE77DBBF]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F23B9AB8D52003D4BACFEE0AD9999C4C]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2AD200544E3F124C8FFC703BDAE490D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F48904FC82458C845B281E287CF34720]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F51FD8AC04A11CE3DBEFE600322500E4]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5430BA37F123D94FA99EAEB20A39B15]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfdll.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F70C84F0B7C2E6150CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_fc1365d1\downlevel_manifest.8.0.50727.3053\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F71EEFB9D1BE3B010BF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.103_x-ww_68182881\downlevel_payload.8.0.50727.103\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F71EEFB9D1BE3B010CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.103_x-ww_68182881\downlevel_manifest.8.0.50727.103\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F738DEF0A3529FF4381DB952A551E2DB]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F73D96EBE8464C443AEE1E29616A3108]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscortim.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7D9ABC563C0DFD35B84503B6178A04E]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F9D39E3626C004C50CF18C3B9B1A1EE8]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Installations\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.98_x-ww_51e92915\downlevel_manifest.8.0.50727.98\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB17EC9F7D369C6498D391283586A940]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC1CDEBAC43AAB53B9093413A792491D]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="02:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}.KB976576\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD01C6A9B00EFA749A5683F6D47045BD]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c:\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE84DF2C0B604064586D62696C46C5AE]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.jscript.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF27405C02051B745B9246BEF3F6D96F]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFE468A1177C48D41890244606F90EBA]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="c?\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\闰粀��键粀闹繁]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"="DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8 @A"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\DC3BF90CC0D3D2F398A9A6D1762F70F3]

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

In Internet Explorer go to *Tools *- *Internet Options* - *Connections Ta*b - *Lan Settings* and uncheck "Use a proxy server for your LAN" and check "Automatically detect settings".

In Firefox go to *Tools *- *Options*... -> *Advanced Tab* -> *Network Tab* -> "*Settings*" under Connection and click on "No proxy".

Open Notepad and copy and paste the text in the code box below into it:


```
Driver::
TrkWks32
znyjfrbd

NetSvc::
znyjfrbd

Folder::
c:\documents and settings\Justin\Application Data\vONtxA0uv2b3m5Q
c:\documents and settings\Justin\Application Data\P5sWJ7fELgZjCkV
c:\documents and settings\Justin\Application Data\WTXwjUVelBc13n4
c:\documents and settings\Justin\Application Data\H2ibF3pnGaJdKfZ
c:\documents and settings\Justin\Application Data\zyxA0uvS2b3m5Q6
c:\documents and settings\Justin\Application Data\naH6sWJ7f9jeIrO
c:\documents and settings\Justin\Application Data\DNyA0uvS2bm5EZh
c:\documents and settings\Justin\Application Data\AH6sWJ7fE9TqYeV
c:\documents and settings\Justin\Application Data\YL9hTXqjUeIrPyA
c:\documents and settings\Justin\Application Data\euvD2onF4m5W7E8
c:\documents and settings\Justin\Application Data\W44mmHK7f
c:\documents and settings\Justin\Application Data\s99ggTXqjYCeIBz
c:\documents and settings\Justin\Application Data\kIIVVrlONtxAuc

Firefox::
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: network.proxy.http_port - 64061

RegNull::
[HKEY_USERS\S-1-5-21-118781078-28829433-61137247-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{12653D3B-7986-50D6-4312-A8DC8AA537AD}*]

RegLockDel::
[HKEY_USERS\S-1-5-21-118781078-28829433-61137247-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{12653D3B-7986-50D6-4312-A8DC8AA537AD}*]
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

*Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.*


----------



## justin2311 (Oct 9, 2011)

The scan is running, I will post back with the results once it is finished.


----------



## justin2311 (Oct 9, 2011)

*ComboFix scan log:*

ComboFix 11-10-07.02 - Justin 10/10/2011 19:41:16.9.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.226 [GMT -4:00]
Running from: c:\documents and settings\Justin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Justin\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Justin\Application Data\AH6sWJ7fE9TqYeV
c:\documents and settings\Justin\Application Data\DNyA0uvS2bm5EZh
c:\documents and settings\Justin\Application Data\euvD2onF4m5W7E8
c:\documents and settings\Justin\Application Data\H2ibF3pnGaJdKfZ
c:\documents and settings\Justin\Application Data\kIIVVrlONtxAuc
c:\documents and settings\Justin\Application Data\naH6sWJ7f9jeIrO
c:\documents and settings\Justin\Application Data\P5sWJ7fELgZjCkV
c:\documents and settings\Justin\Application Data\s99ggTXqjYCeIBz
c:\documents and settings\Justin\Application Data\vONtxA0uv2b3m5Q
c:\documents and settings\Justin\Application Data\W44mmHK7f
c:\documents and settings\Justin\Application Data\WTXwjUVelBc13n4
c:\documents and settings\Justin\Application Data\YL9hTXqjUeIrPyA
c:\documents and settings\Justin\Application Data\zyxA0uvS2b3m5Q6
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 19:37 . 2006-10-13 10:39 163456 ----a-w- c:\windows\system32\drivers\nwrdr.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-10-08 22:38 . 2011-10-08 22:38 -------- dc----w- C:\ERDNT
2011-10-07 23:30 . 2011-08-31 21:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-06 00:41 . 2011-10-06 00:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-05 14:30 . 2011-10-08 02:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-02 18:00 . 2011-10-02 18:00 -------- d-----w- c:\program files\Hitman Pro
2011-09-26 23:08 . 2011-09-26 23:14 -------- dc----w- C:\TDSSKiller_Quarantine
2011-09-16 15:05 . 2011-09-16 15:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2011-09-16 15:05 . 2011-09-16 15:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-07 23:40 . 2010-08-27 21:51 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-09-21 00:08 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.

```
<pre>
c:\program files\Broadcom\BACS\BacsTray .exe
</pre>
```
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-10 23:27 . 2011-10-10 23:27 16384 c:\windows\temp\Perflib_Perfdata_29c.dat
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe -startup" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 8:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [8/27/2010 5:51 PM 23624]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 2:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: manageyourloans.com\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 19:55
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð|ÿÿÿÿ.|ùA~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00TøH\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 \03\00\03\00\00°v\03\00\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00\03\00ô\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00z\03\00z\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00|\03\00|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00}\03\00}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00\03\00\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02\03\00\12\03\00(\03\008\03\00H\03\00T\03\00d\03\00r\03\00\03\00\03\00\03\00x\03\00f\03\00T\03\00D\03\00.\03\00\16\03\00\04\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00\02\00\00\00\00\00\00¾\03\00\00\00\00\00\00\00\14\00\00@\00\00J\00\00v\00\00t\00\003\00\00«\00\00g\00\00 \00\00?\00\00F\00\00§\00\00P\00\00Ó\00\00\08\00\00\00\00y\00\001\00\00}\00\00 \00\00Ã\00\00\11\00\00\"\00\00\00\00Ò\00\00\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00TøH\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2616)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-10-10 19:59:05
ComboFix-quarantined-files.txt 2011-10-10 23:59
ComboFix2.txt 2011-10-10 21:32
.
Pre-Run: 258,453,504 bytes free
Post-Run: 256,602,112 bytes free
.
- - End Of File - - 08959212147FE73E5C22A302C5833219

----------------------------------------------------------------
*
HijackThis scan log:*

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:00:34 PM, on 10/10/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6202 bytes


----------



## justin2311 (Oct 9, 2011)

Alright so some good news. The "End Program - rundll32.exe" error that I mentioned previously has been taken care of. Windows reboots perfectly normal now. 

I'm logging off for the night, but I'll check the thread again sometime tomorrow morning. Hopefully we can finally have this issue solved (fingers crossed).


----------



## Cookiegal (Aug 27, 2003)

Open Notepad and copy and paste the text in the code box below into it:


```
RenV::
c:\program files\Broadcom\BACS\BacsTray .exe
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

*Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.*

Then please do this:

Go to *Start *- *Run *- type in cmd and click OK to open a command prompt:

Type the following command (be sure to include the space between the g and the /:

*Ipconfig /all*

Hit Enter.

Right-click in the top part of command window and choose Select All, then hit Enter.
Paste the results in a message here please.


----------



## justin2311 (Oct 9, 2011)

Good morning!

Alright ComboFix just finished scanning, here are the results:

ComboFix 11-10-07.02 - Justin 10/11/2011 8:43.10.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.254 [GMT -4:00]
Running from: c:\documents and settings\Justin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Justin\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\d3d9caps.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-09-11 to 2011-10-11 )))))))))))))))))))))))))))))))
.
.
2011-10-11 00:43 . 2011-10-11 00:43 1409 ----a-w- c:\windows\QTFont.for
2011-10-10 19:37 . 2006-10-13 10:39 163456 ----a-w- c:\windows\system32\drivers\nwrdr.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-10-08 22:38 . 2011-10-08 22:38 -------- dc----w- C:\ERDNT
2011-10-07 23:30 . 2011-08-31 21:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-06 00:41 . 2011-10-06 00:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-05 14:30 . 2011-10-08 02:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-02 18:00 . 2011-10-02 18:00 -------- d-----w- c:\program files\Hitman Pro
2011-09-26 23:08 . 2011-09-26 23:14 -------- dc----w- C:\TDSSKiller_Quarantine
2011-09-16 15:05 . 2011-09-16 15:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2011-09-16 15:05 . 2011-09-16 15:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-07 23:40 . 2010-08-27 21:51 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-09-21 00:08 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-11 12:23 . 2011-10-11 12:23 16384 c:\windows\temp\Perflib_Perfdata_6c.dat
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe -startup" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 8:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [8/27/2010 5:51 PM 23624]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 2:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: manageyourloans.com\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-11 08:58
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð|ÿÿÿÿ.|ùA~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00TøH\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 \03\00\03\00\00°v\03\00\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00\03\00ô\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00z\03\00z\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00|\03\00|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00}\03\00}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00\03\00\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02\03\00\12\03\00(\03\008\03\00H\03\00T\03\00d\03\00r\03\00\03\00\03\00\03\00x\03\00f\03\00T\03\00D\03\00.\03\00\16\03\00\04\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00\02\00\00\00\00\00\00¾\03\00\00\00\00\00\00\00\14\00\00@\00\00J\00\00v\00\00t\00\003\00\00«\00\00g\00\00 \00\00?\00\00F\00\00§\00\00P\00\00Ó\00\00\08\00\00\00\00y\00\001\00\00}\00\00 \00\00Ã\00\00\11\00\00\"\00\00\00\00Ò\00\00\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00TøH\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
Completion time: 2011-10-11 09:01:50
ComboFix-quarantined-files.txt 2011-10-11 13:01
ComboFix2.txt 2011-10-10 23:59
ComboFix3.txt 2011-10-10 21:32
.
Pre-Run: 252,973,056 bytes free
Post-Run: 251,219,968 bytes free
.
- - End Of File - - 8DC736CCE9CF8D2E6B79F3A2F3D3B8AF


----------



## justin2311 (Oct 9, 2011)

*HijackThis log:*

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:03:09 AM, on 10/11/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6202 bytes

---------------------------------------------------------------------------

*Command Prompt:*

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Justin>Ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : JUST
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : home

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Cont
roller
Physical Address. . . . . . . . . : 00-15-C5-6F-42-CC

Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . : home
Description . . . . . . . . . . . : Dell Wireless 1370 WLAN Mini-PCI Car
d
Physical Address. . . . . . . . . : 00-16-CF-55-A1-F5
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.50
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : Tuesday, October 11, 2011 8:23:38 AM

Lease Expires . . . . . . . . . . : Wednesday, October 12, 2011 8:23:38
AM

C:\Documents and Settings\Justin>


----------



## Cookiegal (Aug 27, 2003)

Go to *Start *- *Run *- type in cmd and click OK.

At the command prompt type in:

*netsh winsock reset catalog*

Press enter.

then type in:

*netsh int ip reset resetlog.txt*

Press enter.

Then reboot the machine and see if you can start those services please.


----------



## justin2311 (Oct 9, 2011)

Alright, so I just did both commands and then rebooted.

Then I opened up services.msc and tried to start Workstation, still no luck.

BUT, out of curiosity I opened Firefox to see if it would work, and it did! I have my Internet back, in fact I'm typing this out on my laptop!  

Thank you so much Cookiegal and Phantom, you guys are awesome. 

And just out of curiosity, does the Workstation and Computer Browser services still need to be started?


----------



## justin2311 (Oct 9, 2011)

OK, Internet seems to be working fine. Although I just noticed one issue, I think I may have the Google redirect virus (which is strange because I assumed the multiple ComboFix scans would have taken care of that?) Anyhow, I checked to make sure that "No Proxy" was selected in Firefox, and it is. Any other ideas? 

Thanks again!


----------



## Phantom010 (Mar 9, 2009)

justin2311 said:


> And just out of curiosity, does the Workstation and Computer Browser services still need to be started?


Yes, by default, those services are *Started* and *Automatic*.


----------



## justin2311 (Oct 9, 2011)

Alright so in that case, I don't believe my problem is entirely solved. Could having those two services not start, somehow tie in to why I'm getting redirected Google searches?


----------



## Cookiegal (Aug 27, 2003)

Are you still getting redirected?


----------



## Cookiegal (Aug 27, 2003)

Sorry, I didn't read back far enough.

Please download GMER from: http://gmer.net/index.php

Click on the "Download EXE" button and save the randomly named .exe file to your desktop.

*Note: You must uninstall any CD Emulation programs that you have before running GMER as they can cause conflicts and give false results.*

Double click the GMER .exe file on your desktop to run the tool and it will automatically do a quick scan.

If the tool warns of rootkit activity and asks if you want to run a full scan, click on No and make sure the following are *unchecked *on the right-hand side:

IAT/EAT
Any drive letter other than the primary system drive (which is generally C).

Click the *Scan *button and when the scan is finished, click *Save* and save the log in Notepad with the name ark.txt to your desktop.

*Note: It's important that all other windows be closed and that you don't touch the mouse or do anything with the computer during the scan as it may cause it to freeze. You should disable your screen saver as if it comes on it may cause the program to freeze.*

Open the ark.txt file and copy and paste the contents of the log here please.


----------



## justin2311 (Oct 9, 2011)

^ OK, I'll do that once I get home later today. I'll post the results in my next reply.

Quick question, would iTunes be considered a CD Emulation program?

And another thing that I noticed when I shut down the laptop last night, it seems as though the "End Program - rundll32.exe" error popups are back! Not sure if this is a virus or if it's another file that's missing/corrupt that could be causing this?


----------



## Cookiegal (Aug 27, 2003)

No. iTunes is not an emulator. I don't believe I saw any event of an emulator on your system.

I'm sure the error is related to the malware.

In addition to GMER please also do the following:

Please download DDS by sUBs to your desktop from one of the following locations:

http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

Double-click the DDS.scr to run the tool.

When DDS has finished scanning, it will open two logs named as follows:

DDS.txt
Attach.txt

Save them both to your desktop. Copy and paste the contents of the DDS.txt and Attach.txt files in your reply please.


----------



## justin2311 (Oct 9, 2011)

Alright sounds good. I'll post the results when I get home sometime later today.


----------



## Cookiegal (Aug 27, 2003)

:up:


----------



## justin2311 (Oct 9, 2011)

Alright the GMER scan has been running for about an hour and a half and is still in progress. How long does this scan typically take?


----------



## Cookiegal (Aug 27, 2003)

It can take a while. It depends on a lot of factors. The important thing is not to interrupt it or it may freeze.


----------



## justin2311 (Oct 9, 2011)

Sorry it took so long, here are the GMER scan results:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-12 23:53:11
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST9408114A rev.8.03
Running: n2esplgf.exe; Driver: C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\pxtdypow.sys

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!HttpQueryInfoA 63017353 5 Bytes JMP 00BAE8E8 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!HttpAddRequestHeadersA 63018275 5 Bytes JMP 00BABD38 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!HttpOpenRequestA 630187BC 5 Bytes JMP 00BAAEA8 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!InternetConnectA 63019446 5 Bytes JMP 00BAA760 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!InternetReadFile 6301AC9D 5 Bytes JMP 00BAD310 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!HttpSendRequestW 6301F73E 5 Bytes JMP 00BACBC8 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!InternetCloseHandle 63020A61 5 Bytes JMP 00BADA58 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!InternetOpenA 6302B2D5 5 Bytes JMP 00BAA018 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!HttpSendRequestA 6302E822 5 Bytes JMP 00BAC480 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!InternetReadFileExA 630337B6 5 Bytes JMP 00BAB5F0 
.text C:\WINDOWS\system32\rundll32.exe[1776] WININET.dll!InternetErrorDlg 63099B81 5 Bytes JMP 00BAE1A0

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)

Device \FileSystem\Fastfat \Fat A79D6C8A
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- EOF - GMER 1.0.15 ----


----------



## justin2311 (Oct 9, 2011)

And here are the DDS results:

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Run by Justin at 9:56:36 on 2011-10-13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.100 [GMT -4:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: {044b637c-1fe0-43e5-8958-c83ffaa2a9cb} - c:\documents and settings\justin\local settings\application data\Shellx86_x64.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - 
uRun: [Broadcom Update] rundll32 "c:\documents and settings\justin\local settings\application data\adobe\adobeupdate\Adobeupdt32.dll",DllRegisterServer
uRun: [MicrosoftBackupManager] rundll32.exe "c:\documents and settings\all users\application data\MicrosoftBackupManager.dll",DllRegisterServer
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask .exe" -atboottime
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm .exe" -startup
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
Trusted Zone: manageyourloans.com\www
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1302616533671
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{7AAB67EE-AD9E-4B10-A341-96D20AD9DD90} : DhcpNameServer = 192.168.1.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxdev.dll
SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - No File
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\justin\application data\mozilla\firefox\profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
============= SERVICES / DRIVERS ===============
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-10-27 24652]
S3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys --> c:\windows\system32\drivers\appliand.sys [?]
S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [2010-8-27 23624]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [2008-10-29 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\lavasoft\ad-aware\kernexplorer.sys --> c:\program files\lavasoft\ad-aware\KernExplorer.sys [?]
.
=============== Created Last 30 ================
.
2011-10-12 00:32:34 0 ---ha-w- c:\documents and settings\justin\simztyuczy.tmp
2011-10-12 00:23:04 1409 ----a-w- c:\windows\QTFont.for
2011-10-12 00:22:27 100352 ----a-w- c:\documents and settings\all users\application data\MicrosoftBackupManager.dll
2011-10-12 00:22:21 266752 ----a-w- c:\documents and settings\justin\local settings\application data\Shellx86_x64.dll
2011-10-10 20:52:59 98816 ----a-w- c:\windows\sed.exe
2011-10-10 20:52:59 518144 ----a-w- c:\windows\SWREG.exe
2011-10-10 20:52:59 256000 ----a-w- c:\windows\PEV.exe
2011-10-10 20:52:59 208896 ----a-w- c:\windows\MBR.exe
2011-10-10 19:37:46 163456 ----a-w- c:\windows\system32\drivers\nwrdr.sys
2011-10-10 01:38:36 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 01:38:36 457216 ----a-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-10-08 22:38:31 -------- dc----w- C:\ERDNT
2011-10-07 23:30:36 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-06 00:41:53 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-05 14:30:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-02 18:00:17 -------- d-----w- c:\program files\Hitman Pro
2011-09-26 23:08:57 -------- dc----w- C:\TDSSKiller_Quarantine
.
==================== Find3M ====================
.
2011-10-07 23:40:04 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-10-02 18:23:19 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
.
============= FINISH: 9:58:26.21 ===============


----------



## justin2311 (Oct 9, 2011)

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 10/5/2006 9:54:18 PM
System Uptime: 10/13/2011 9:51:07 AM (0 hours ago)
.
Motherboard: Dell Inc. | | 0RJ272
Processor: Intel(R) Celeron(R) M processor 1.60GHz | Microprocessor | 1209/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 33 GiB total, 0.167 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP77: 10/9/2011 2:29:21 PM - System Checkpoint
RP78: 10/10/2011 5:55:55 PM - System Checkpoint
RP79: 10/11/2011 8:57:07 PM - System Checkpoint
.
==== Installed Programs ======================
.
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge 1.0
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Common File Installer
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Center 1.0
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS2
Adobe Reader 7.0.8
Adobe Setup
Adobe Shockwave Player
Adobe Stock Photos 1.0
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
AIM 7
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Connectivity Services
AOL Uninstaller (Choose which Products to Remove)
AOLIcon
Apple Mobile Device Support
Apple Software Update
Avanquest update
Broadcom Management Programs
BuddyList Ops 1.0.0.1
Conexant HDA D110 MDC V.92 Modem
Critical Update for Windows Media Player 11 (KB959772)
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Support 3.2
Dell System Restore
Dell Wireless WLAN Card
Digital Content Portal
Digital Line Detect
Documentation & Support Launcher
Download Updater (AOL LLC)
DreamStation DXi2
E.M. Total Video Player 1.31
ELIcon
Games, Music, & Photos Launcher
High Definition Audio Driver Package - KB835221
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB908673)
Hotfix for Windows XP (KB909095)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Graphics Media Accelerator Driver for Mobile
Internet Service Offers Launcher
iTunes
Java Auto Updater
Java(TM) 6 Update 21
Learn2 Player (Uninstall Only)
Malwarebytes' Anti-Malware version 1.51.2.1300
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Calculator Plus
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Encarta Encyclopedia Standard 2006
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
Microsoft Streets & Trips 2006
Microsoft Tool Web Packageiruse.exe
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ Run Time Lib Setup
Microsoft Word 2002
Microsoft Works
Microsoft Works Suite 2006 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
Modem Helper
Mozilla Firefox 6.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 6 Service Pack 2 (KB973686)
NetWaiting
PDF Settings
PowerDVD 5.5
QuickSet
QuickTime
Reason
ReCycle 2.0
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Sonic DLA
Sonic Foundry Sound Forge 6.0
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Synaptics Pointing Device Driver
TextMaker Viewer
Total Video Converter 3.71 100812
TreeSize Free V2.5
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URL Assistant
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885855
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
WinZip
Works Upgrade
Zune Desktop Theme
.
==== Event Viewer Messages From Past Week ========
.
10/9/2011 4:27:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/9/2011 4:26:48 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
10/9/2011 4:12:24 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: APPDRV Fips intelppm
10/9/2011 12:59:07 PM, error: Service Control Manager [7003] - The TCP/IP NetBIOS Helper service depends on the following nonexistent service: NetBT
10/9/2011 12:59:07 PM, error: Service Control Manager [7003] - The DHCP Client service depends on the following nonexistent service: NetBT
10/9/2011 1:26:19 PM, error: Service Control Manager [7024] - The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).
10/13/2011 9:52:44 AM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The system cannot find the file specified.
10/11/2011 10:27:36 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
10/10/2011 5:05:37 PM, error: Workstation [5727] - Could not load RDR device driver.
10/10/2011 5:05:33 PM, error: Service Control Manager [7024] - The Workstation service terminated with service-specific error 2250 (0x8CA).
10/10/2011 5:05:33 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The service has returned a service-specific error code.
10/10/2011 5:05:24 PM, error: NetBT [4314] - Unable to read the driver's bindings to the transport from the registry.
10/10/2011 4:59:12 PM, error: Service Control Manager [7034] - The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 3:52:02 PM, error: Service Control Manager [7034] - The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).
10/10/2011 10:27:29 PM, error: Service Control Manager [7001] - The Remote Procedure Call (RPC) Locator service depends on the Workstation service which failed to start because of the following error: The service has returned a service-specific error code.
10/10/2011 10:26:36 PM, error: Service Control Manager [7001] - The Messenger service depends on the Workstation service which failed to start because of the following error: The service has returned a service-specific error code.
10/10/2011 10:25:23 PM, error: Service Control Manager [7001] - The Net Logon service depends on the Workstation service which failed to start because of the following error: The service has returned a service-specific error code.
.
==== End Of File ===========================


----------



## Cookiegal (Aug 27, 2003)

Drag the version of ComboFix that you currently have to the recycle bin and grab the latest version, disable security programs and runa new scan then post the log please.

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.


----------



## justin2311 (Oct 9, 2011)

Sorry I haven't been active with the updates. I've been busy with work lately and in fact I'm going to be pretty busy this weekend as well. I will do my best to update when I get a chance. Probably sometime Sunday? Have a nice weekend!


----------



## Cookiegal (Aug 27, 2003)

That's fine. Thanks for letting me know.


----------



## justin2311 (Oct 9, 2011)

OK, sorry for the delay!

Here are the ComboFix results:

ComboFix 11-10-17.02 - Justin 10/17/2011 18:36:29.11.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.225 [GMT -4:00]
Running from: c:\documents and settings\Justin\Desktop\puppy.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\chrome.manifest
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\chrome\xulcache.jar
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\defaults\preferences\xulcache.js
c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ftq1215i.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\install.rdf
c:\documents and settings\All Users\Application Data\MicrosoftBackupManager.dll
c:\documents and settings\Justin\Application Data\ldr.ini
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\chrome.manifest
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\chrome\xulcache.jar
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\defaults\preferences\xulcache.js
c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\extensions\{ec146686-8f7a-4ea1-885e-0e34fd013543}\install.rdf
c:\documents and settings\Justin\Local Settings\Application Data\Adobe\AdobeUpdate\Adobeupdt32.dll
c:\documents and settings\Justin\Local Settings\Application Data\Shellx86_x64.dll
c:\documents and settings\Justin\simztyuczy.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-09-17 to 2011-10-17 )))))))))))))))))))))))))))))))
.
.
2011-10-12 00:23 . 2011-10-12 00:23 1409 ----a-w- c:\windows\QTFont.for
2011-10-10 19:37 . 2006-10-13 10:39 163456 ----a-w- c:\windows\system32\drivers\nwrdr.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-10-10 01:38 . 2010-02-24 11:57 457216 ----a-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-10-08 22:38 . 2011-10-08 22:38 -------- dc----w- C:\ERDNT
2011-10-07 23:30 . 2011-08-31 21:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-06 00:41 . 2011-10-06 00:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-05 14:30 . 2011-10-08 02:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-02 18:00 . 2011-10-02 18:00 -------- d-----w- c:\program files\Hitman Pro
2011-09-26 23:08 . 2011-09-26 23:14 -------- dc----w- C:\TDSSKiller_Quarantine
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-07 23:40 . 2010-08-27 21:51 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-09-21 00:08 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-17 22:29 . 2011-10-17 22:29 16384 c:\windows\temp\Perflib_Perfdata_604.dat
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe -startup" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 8:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [8/27/2010 5:51 PM 23624]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 2:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: manageyourloans.com\www
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Broadcom Update - c:\documents and settings\Justin\Local Settings\Application Data\Adobe\AdobeUpdate\Adobeupdt32.dll
HKCU-Run-MicrosoftBackupManager - c:\documents and settings\All Users\Application Data\MicrosoftBackupManager.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-17 18:51
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð|ÿÿÿÿ.|ùA~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00TøH\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 \03\00\03\00\00°v\03\00\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00\03\00ô\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00z\03\00z\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00|\03\00|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00}\03\00}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00\03\00\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02\03\00\12\03\00(\03\008\03\00H\03\00T\03\00d\03\00r\03\00\03\00\03\00\03\00x\03\00f\03\00T\03\00D\03\00.\03\00\16\03\00\04\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00\02\00\00\00\00\00\00¾\03\00\00\00\00\00\00\00\14\00\00@\00\00J\00\00v\00\00t\00\003\00\00«\00\00g\00\00 \00\00?\00\00F\00\00§\00\00P\00\00Ó\00\00\08\00\00\00\00y\00\001\00\00}\00\00 \00\00Ã\00\00\11\00\00\"\00\00\00\00Ò\00\00\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00TøH\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
Completion time: 2011-10-17 18:56:09
ComboFix-quarantined-files.txt 2011-10-17 22:55
ComboFix2.txt 2011-10-11 13:01
ComboFix3.txt 2011-10-10 23:59
ComboFix4.txt 2011-10-10 21:32
.
Pre-Run: 113,455,104 bytes free
Post-Run: 168,161,280 bytes free
.
- - End Of File - - F8E148DEB461D6999054E540C7DDEAB8

Please let me know what others steps need to be taken. Thanks again!


----------



## Cookiegal (Aug 27, 2003)

Is this something that you put in the trusted sites zone intentionally?

Trusted Zone: manageyourloans.com\www


----------



## justin2311 (Oct 9, 2011)

I sometimes pay my loans while using this laptop, so yes, I added that website to the trusted sites zone. If you recommend that I remove it then I will, and I'll continue to just use my PC to make payments.


----------



## Cookiegal (Aug 27, 2003)

I'm not a fan of having sites in the trusted zone as that allows the site to bypass most security measures on your computer. There shouldn't be any reason why you can't use the site without having it in the trusted zone. Were you having trouble accessing it?


----------



## justin2311 (Oct 9, 2011)

Yes, I believe I was prompted to add it to the trusted zone at some point. This was a while ago so I'm not entirely sure how it happened. But I took your advice and just removed it.

Also, I've been on Google doing test searches, and everything seems fine. Are there any additional steps needed to assure that the redirect virus has been removed completely?


----------



## Cookiegal (Aug 27, 2003)

Please run the following on-line scanner. Note that you must use Internet Explorer to perform the scan.

Note: If you're running a 64-bit system you have to choose the 32-bit option in IE. To do that, go to the Start Menu and right-click the Internet Explorer (32-bit) icon and then select 'Run as administrator' from the right-click menu.

http://www.eset.com/online-scanner

Accept the Terms of Use and then press the Start button

Allow the ActiveX control to be installed.

Put a check by Remove found threats and then run the scan.

When the scan is finished, you will see the results in a window.

A log.txt file is created here: C:\Program Files\EsetOnlineScanner\log.txt.

Open the log file with Notepad and copy and paste the contents here please.


----------



## Cookiegal (Aug 27, 2003)

Also, there's an odd-looking registry key with a bunch of gibberish showing in the ComboFix log that I'd like to get checked out so please do the following.

First, copy the following command:

*SWREG SAVE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData" myHive.zip*

Then go to *Start *- *Run *- type in *cmd *and click OK to open a command prompt.

Then right-click in the command prompt window and the command that you copied will be pasted there. Then hit Enter. It will only take less than a minute and you should see a message saying something to the effect that the operation completed successfully.

It will have created a zipped file called "myHive.zip" which will be found in the same directory that was showing in the command prompt. For instance, if the command prompt was at C:> then the file will be found at C:\myHive.zip. If the command prompt was at c:\documents and settings\Justin> then it will be found at c:\documents and settings\Justin\myHive.zip.

Please upload the myHive.zip file here as an attachment.


----------



## justin2311 (Oct 9, 2011)

The myhive.zip was created but I'm having a hard time uploading it. It says "Upload failed.", any ideas?


----------



## Cookiegal (Aug 27, 2003)

Is it possibly too large? If so there should have been a message at the top of the upload box. It can't be larger that 500 KB.


----------



## justin2311 (Oct 9, 2011)

Alright, I recently lost my Internet connection again so I haven't been able to update this thread. Basically what happened was that I managed to get another virus, so I ran HitmanPro again. After it detected/deleted some files (see below), I lost my Internet. I retraced some of the steps previously mentioned in this thread. And apparently the ZeroAccess rootkit planted itself in the TCP/IP stack again. 

HitmanPro scan results show that it deleted these files:

vqiukcc.dll.bak
syvwwugz.dll
tlfjxgwz.sys
19D.tmp
bskcegq.bak

I also want to say that the 'IPsec.sys' was corrupted. After the HitmanPro scan, it asked me to insert my Windows XP CD (do not have). When the scan was complete, I rebooted the computer and couldn't connect to the Internet whatsoever. I checked and the file is still there in the drivers folder, but I'm assuming it's corrupted?

Any help is appreciated. Thanks.


----------



## Cookiegal (Aug 27, 2003)

Go to *Start *- *Run *and copy and paste the following:

*regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services"*

You won't see anything happen and it will only take a second. You will find the report it creates at C:\look.txt. Please zip it up and then upload it here as an attachment.


----------



## justin2311 (Oct 9, 2011)

OK here it is.​


----------



## Cookiegal (Aug 27, 2003)

Please remove Combofix by dragging it to the Recycle Bin then grab the latest version and post a new log.

Please visit *Combofix Guide & Instructions * for instructions for downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.


----------



## justin2311 (Oct 9, 2011)

Here's the Combofix log:

ComboFix 11-11-13.03 - Justin 11/13/2011 15:41:07.16.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.247 [GMT -5:00]
Running from: c:\documents and settings\Justin\Desktop\puppy.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-10-13 to 2011-11-13 )))))))))))))))))))))))))))))))
.
.
2011-11-11 02:19 . 2011-11-11 02:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-11 02:18 . 2011-11-11 02:18 -------- dc----w- C:\puppy
2011-11-10 14:28 . 2004-08-04 07:00 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys
2011-11-09 20:57 . 2011-11-11 02:06 -------- d-sh--w- c:\documents and settings\Justin\Local Settings\Application Data\a44ffdc2
2011-11-02 22:31 . 2011-11-02 22:31 1409 ----a-w- c:\windows\QTFont.for
2011-10-20 01:15 . 2011-10-20 01:16 -------- d-----w- c:\documents and settings\Justin\Application Data\GetRightToGo
2011-10-20 01:13 . 2011-10-25 00:36 -------- d-----w- c:\program files\MIDIOX
2011-10-19 14:26 . 2011-10-19 14:26 -------- d-----w- c:\program files\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-21 14:22 . 2011-10-06 00:41 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-08-31 21:00 . 2011-10-07 23:30 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-02 23:22 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-13 16:18 . 2011-11-13 16:18 16384 c:\windows\temp\Perflib_Perfdata_7ac.dat
- 2004-08-10 17:51 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2006-10-06 22:54 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2004-08-10 17:51 . 2011-11-11 02:16 79818 c:\windows\system32\perfc009.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 79818 c:\windows\system32\perfc009.dat
+ 2007-09-23 22:18 . 2007-09-23 22:18 39936 c:\windows\system32\myokent.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-11-11 02:05 . 2011-11-11 02:21 409200 c:\windows\system32\Restore\rstrlog.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 460864 c:\windows\system32\perfh009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 460864 c:\windows\system32\perfh009.dat
+ 2011-10-21 14:22 . 2011-10-21 14:22 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
- 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
+ 2011-10-10 19:37 . 2006-10-13 10:39 163456 c:\windows\system32\drivers\nwrdr.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\drivers\mrxsmb.sys
- 2006-04-20 11:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\dllcache\mrxsmb.sys
+ 2011-10-20 01:25 . 2011-10-20 01:25 154624 c:\windows\Installer\6b9768.msi
+ 2009-07-18 03:21 . 2011-10-21 14:22 8522400 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe -startup" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi2"=myokent.dll
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 7:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 1:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-13 15:55
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð|ÿÿÿÿ.|ùA~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00TøH\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 \03\00\03\00\00°v\03\00\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00\03\00ô\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00z\03\00z\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00|\03\00|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00}\03\00}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00\03\00\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02\03\00\12\03\00(\03\008\03\00H\03\00T\03\00d\03\00r\03\00\03\00\03\00\03\00x\03\00f\03\00T\03\00D\03\00.\03\00\16\03\00\04\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00\02\00\00\00\00\00\00¾\03\00\00\00\00\00\00\00\14\00\00@\00\00J\00\00v\00\00t\00\003\00\00«\00\00g\00\00 \00\00?\00\00F\00\00§\00\00P\00\00Ó\00\00\08\00\00\00\00y\00\001\00\00}\00\00 \00\00Ã\00\00\11\00\00\"\00\00\00\00Ò\00\00\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00TøH\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\myokent.dll
c:\windows\System32\BCMLogon.dll
c:\windows\system32\igfxdev.dll
.
- - - - - - - > 'lsass.exe'(632)
c:\windows\system32\myokent.dll
.
- - - - - - - > 'explorer.exe'(1860)
c:\windows\system32\myokent.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-11-13 15:59:30
ComboFix-quarantined-files.txt 2011-11-13 20:59
ComboFix2.txt 2011-11-11 02:46
ComboFix3.txt 2011-11-10 15:32
ComboFix4.txt 2011-11-10 15:02
ComboFix5.txt 2011-11-11 03:27
.
Pre-Run: 287,137,792 bytes free
Post-Run: 285,945,856 bytes free
.
- - End Of File - - A4AE0017502F804019DF91BA60F3E4DB


----------



## Cookiegal (Aug 27, 2003)

Open Notepad and copy and paste the text in the code box below into it:


```
Folder::
c:\documents and settings\Justin\Local Settings\Application Data\a44ffdc2

Firefox::
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2801948&SearchSource=3&q={searchTerms}
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

*Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.*

***Note** *


----------



## Cookiegal (Aug 27, 2003)

Also, please see post 106 and upload the requested zipped file.


----------



## justin2311 (Oct 9, 2011)

Here are the Combofix results:

ComboFix 11-11-13.03 - Justin 11/13/2011 19:40:08.17.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.240 [GMT -5:00]
Running from: c:\documents and settings\Justin\Desktop\puppy.exe
Command switches used :: c:\documents and settings\Justin\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Justin\Local Settings\Application Data\a44ffdc2
c:\documents and settings\Justin\Local Settings\Application Data\a44ffdc2\@
c:\documents and settings\Justin\Local Settings\Application Data\a44ffdc2\loader.tlb
.
.
((((((((((((((((((((((((( Files Created from 2011-10-14 to 2011-11-14 )))))))))))))))))))))))))))))))
.
.
2011-11-11 02:19 . 2011-11-11 02:19 --------  d-----w- c:\windows\system32\wbem\Repository
2011-11-11 02:18 . 2011-11-11 02:18 -------- dc----w- C:\puppy
2011-11-10 14:28 . 2004-08-04 07:00 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys
2011-10-20 01:15 . 2011-10-20 01:16 -------- d-----w- c:\documents and settings\Justin\Application Data\GetRightToGo
2011-10-20 01:13 . 2011-10-25 00:36 -------- d-----w- c:\program files\MIDIOX
2011-10-19 14:26 . 2011-10-19 14:26 -------- d-----w- c:\program files\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-21 14:22 . 2011-10-06 00:41 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-08-31 21:00 . 2011-10-07 23:30 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-02 23:22 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-13 23:34 . 2011-11-13 23:34 16384 c:\windows\temp\Perflib_Perfdata_76c.dat
- 2004-08-10 17:51 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2006-10-06 22:54 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2004-08-10 17:51 . 2011-11-11 02:16 79818 c:\windows\system32\perfc009.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 79818 c:\windows\system32\perfc009.dat
+ 2007-09-23 22:18 . 2007-09-23 22:18 39936 c:\windows\system32\myokent.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-11-11 02:05 . 2011-11-11 02:21 409200 c:\windows\system32\Restore\rstrlog.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 460864 c:\windows\system32\perfh009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 460864 c:\windows\system32\perfh009.dat
+ 2011-10-21 14:22 . 2011-10-21 14:22 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
- 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
+ 2011-10-10 19:37 . 2006-10-13 10:39 163456 c:\windows\system32\drivers\nwrdr.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\drivers\mrxsmb.sys
- 2006-04-20 11:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\dllcache\mrxsmb.sys
+ 2011-10-20 01:25 . 2011-10-20 01:25 154624 c:\windows\Installer\6b9768.msi
+ 2009-07-18 03:21 . 2011-10-21 14:22 8522400 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe -startup" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi2"=myokent.dll
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 7:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 1:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-13 19:54
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð|ÿÿÿÿ.|ùA~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00TøH\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 \03\00\03\00\00°v\03\00\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00\03\00ô\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00z\03\00z\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00|\03\00|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00}\03\00}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00\03\00\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02\03\00\12\03\00(\03\008\03\00H\03\00T\03\00d\03\00r\03\00\03\00\03\00\03\00x\03\00f\03\00T\03\00D\03\00.\03\00\16\03\00\04\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00\02\00\00\00\00\00\00¾\03\00\00\00\00\00\00\00\14\00\00@\00\00J\00\00v\00\00t\00\003\00\00«\00\00g\00\00 \00\00?\00\00F\00\00§\00\00P\00\00Ó\00\00\08\00\00\00\00y\00\001\00\00}\00\00 \00\00Ã\00\00\11\00\00\"\00\00\00\00Ò\00\00\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00TøH\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\myokent.dll
.
- - - - - - - > 'lsass.exe'(632)
c:\windows\system32\myokent.dll
.
Completion time: 2011-11-13 19:58:33
ComboFix-quarantined-files.txt 2011-11-14 00:58
ComboFix2.txt 2011-11-13 21:02
ComboFix3.txt 2011-11-11 02:46
ComboFix4.txt 2011-11-10 15:32
ComboFix5.txt 2011-11-14 00:38
.
Pre-Run: 282,796,032 bytes free
Post-Run: 281,096,192 bytes free
.
- - End Of File - - BD59B67EF55D033498CAF936B4AC3097


----------



## justin2311 (Oct 9, 2011)

As far as the myhive.zip file is concerned, it is 3.94 MB. Any other suggestions as far as uploading? 

I just realized that I needed to do another HijackThis scan, I'll post the log shortly.


----------



## justin2311 (Oct 9, 2011)

HJT log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:12:28 PM, on 11/13/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe" -startup
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6392 bytes


----------



## Cookiegal (Aug 27, 2003)

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*
Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:filefind
netbt.sys
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## justin2311 (Oct 9, 2011)

Will post the results sometime tomorrow. Thanks.


----------



## justin2311 (Oct 9, 2011)

SystemLook results:

SystemLook 30.07.11 by jpshortstuff
Log created at 23:50 on 13/11/2011 by Justin
Administrator - Elevation successful

========== filefind ==========

Searching for "netbt.sys"

C:\i386\netbt.sys --a--c- 162816 bytes [22:49 06/10/2006] [10:00 04/08/2004]0C80E410CD2F47134407EE7DD19CC86B
C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netbt.sys --a--c- 162816 bytes [03:20 23/02/2010] [19:21 13/04/2008] 74B2B2F5BEA5E9A3DC021D685551BD3D
C:\WINDOWS\system32\drivers\netbt.sys --a---- 162816 bytes [03:20 23/02/2010] [10:00 04/08/2004] 0C80E410CD2F47134407EE7DD19CC86B

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

justin2311 said:


> As far as the myhive.zip file is concerned, it is 3.94 MB. Any other suggestions as far as uploading?


Yes, please do the following where a bigger upload is allowed:

Please go *Here* and enter the URL to this thread beside *Link to topic where this file was requested:*

Then click on *Browse* and locate the following file on your computer:

myHive.zip

Select the file and click OK. Then click on *Send File*.


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## justin2311 (Oct 9, 2011)

OTS.txt file attached below.

Also, the myhive.zip file has been submitted.


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new HijackThis log please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "{BA52B914-B692-46c4-B683-905236F6F655}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "ISUSPM Startup" -> ["C:\Program Files\Common Files\InstallShield\UpdateService\isuspm  .exe" -startup]
YN -> "QuickTime Task" -> ["C:\Program Files\QuickTime\qttask  .exe" -atboottime]
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
YN -> "C:\WINDOWS\system32\icm3232.exe" -> [C:\WINDOWS\system32\icm3232.exe:*:Enabled:Windows Update Service]
[Files/Folders - Created Within 30 Days]
NY ->  7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY ->  2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
[Files/Folders - Modified Within 30 Days]
NY ->  1fdcfdfe -> C:\Documents and Settings\Justin\Application Data\1fdcfdfe
NY ->  ff010201 -> C:\Documents and Settings\Justin\Application Data\ff010201
NY ->  e8a48a04 -> C:\Documents and Settings\Justin\Application Data\e8a48a04
NY ->  97a4f2fe -> C:\Documents and Settings\Justin\Application Data\97a4f2fe
NY ->  7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY ->  2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
[Files - No Company Name]
NY ->  97a4f2fe -> C:\Documents and Settings\Justin\Application Data\97a4f2fe
NY ->  e8a48a04 -> C:\Documents and Settings\Justin\Application Data\e8a48a04
NY ->  ff010201 -> C:\Documents and Settings\Justin\Application Data\ff010201
NY ->  1fdcfdfe -> C:\Documents and Settings\Justin\Application Data\1fdcfdfe
NY ->  056i0w4uvrt4847882h2 -> C:\Documents and Settings\All Users\Application Data\056i0w4uvrt4847882h2
NY ->  6v8s8h7ffcdl033kr64e764v488tsv0n520ba567 -> C:\Documents and Settings\Justin\Local Settings\Application Data\6v8s8h7ffcdl033kr64e764v488tsv0n520ba567
NY ->  6v8s8h7ffcdl033kr64e764v488tsv0n520ba567 -> C:\Documents and Settings\All Users\Application Data\6v8s8h7ffcdl033kr64e764v488tsv0n520ba567
NY ->  lbp6r35x3f07xf1a5 -> C:\Documents and Settings\Justin\Local Settings\Application Data\lbp6r35x3f07xf1a5
NY ->  lbp6r35x3f07xf1a5 -> C:\Documents and Settings\All Users\Application Data\lbp6r35x3f07xf1a5
NY ->  ~17751860r -> C:\Documents and Settings\All Users\Application Data\~17751860r
NY ->  ~17751860 -> C:\Documents and Settings\All Users\Application Data\~17751860
NY ->  17751860 -> C:\Documents and Settings\All Users\Application Data\17751860
NY ->  ~18472756r -> C:\Documents and Settings\All Users\Application Data\~18472756r
NY ->  ~18472756 -> C:\Documents and Settings\All Users\Application Data\~18472756
NY ->  18472756 -> C:\Documents and Settings\All Users\Application Data\18472756
NY ->  84215.sys -> C:\WINDOWS\System32\drivers\84215.sys
NY ->  lsrslt.ini -> C:\WINDOWS\lsrslt.ini
NY ->  Nsezapele.bin -> C:\WINDOWS\Nsezapele.bin
NY ->  Rhuvocu.dat -> C:\WINDOWS\Rhuvocu.dat
NY ->  jcl665ep0rnlp562hps -> C:\Documents and Settings\All Users\Application Data\jcl665ep0rnlp562hps
NY ->  jcl665ep0rnlp562hps -> C:\Documents and Settings\Justin\Local Settings\Application Data\jcl665ep0rnlp562hps
[Empty Temp Folders]
[EmptyFlash]
[EmptyJava]
[Start Explorer]
[Reboot]
```


----------



## justin2311 (Oct 9, 2011)

*OTS Fix results:*

All Processes Killed
[Registry - Safe List]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{BA52B914-B692-46c4-B683-905236F6F655} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA52B914-B692-46c4-B683-905236F6F655}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ISUSPM Startup deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\icm3232.exe deleted successfully.
[Files/Folders - Created Within 30 Days]
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET190.tmp deleted successfully.
C:\WINDOWS\System32\SET19C.tmp deleted successfully.
C:\WINDOWS\System32\SET1A5.tmp deleted successfully.
C:\WINDOWS\System32\SET1A7.tmp deleted successfully.
C:\WINDOWS\System32\SET1A9.tmp deleted successfully.
C:\WINDOWS\System32\SET1AA.tmp deleted successfully.
C:\WINDOWS\system.tmp deleted successfully.
C:\WINDOWS\win.tmp deleted successfully.
[Files/Folders - Modified Within 30 Days]
C:\Documents and Settings\Justin\Application Data\1fdcfdfe moved successfully.
C:\Documents and Settings\Justin\Application Data\ff010201 moved successfully.
C:\Documents and Settings\Justin\Application Data\e8a48a04 moved successfully.
C:\Documents and Settings\Justin\Application Data\97a4f2fe moved successfully.
[Files - No Company Name]
File C:\Documents and Settings\Justin\Application Data\97a4f2fe not found!
File C:\Documents and Settings\Justin\Application Data\e8a48a04 not found!
File C:\Documents and Settings\Justin\Application Data\ff010201 not found!
File C:\Documents and Settings\Justin\Application Data\1fdcfdfe not found!
C:\Documents and Settings\All Users\Application Data\056i0w4uvrt4847882h2 moved successfully.
C:\Documents and Settings\Justin\Local Settings\Application Data\6v8s8h7ffcdl033kr64e764v488tsv0n520ba567 moved successfully.
C:\Documents and Settings\All Users\Application Data\6v8s8h7ffcdl033kr64e764v488tsv0n520ba567 moved successfully.
C:\Documents and Settings\Justin\Local Settings\Application Data\lbp6r35x3f07xf1a5 moved successfully.
C:\Documents and Settings\All Users\Application Data\lbp6r35x3f07xf1a5 moved successfully.
C:\Documents and Settings\All Users\Application Data\~17751860r moved successfully.
C:\Documents and Settings\All Users\Application Data\~17751860 moved successfully.
C:\Documents and Settings\All Users\Application Data\17751860 moved successfully.
C:\Documents and Settings\All Users\Application Data\~18472756r moved successfully.
C:\Documents and Settings\All Users\Application Data\~18472756 moved successfully.
C:\Documents and Settings\All Users\Application Data\18472756 moved successfully.
C:\WINDOWS\System32\drivers\84215.sys moved successfully.
C:\WINDOWS\lsrslt.ini moved successfully.
C:\WINDOWS\Nsezapele.bin moved successfully.
C:\WINDOWS\Rhuvocu.dat moved successfully.
C:\Documents and Settings\All Users\Application Data\jcl665ep0rnlp562hps moved successfully.
C:\Documents and Settings\Justin\Local Settings\Application Data\jcl665ep0rnlp562hps moved successfully.
[Empty Temp Folders]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 31975095 bytes
->Flash cache emptied: 1320 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Justin

User: Justin 
->Temp folder emptied: 17920 bytes
->Temporary Internet Files folder emptied: 327974 bytes
->Java cache emptied: 4236453 bytes
->FireFox cache emptied: 43311969 bytes
->Apple Safari cache emptied: 5729280 bytes
->Flash cache emptied: 1164903 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 8061062 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 6217 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 65 bytes
->Flash cache emptied: 31488 bytes

User: Owner
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 2078037 bytes
RecycleBin emptied: 671915 bytes

Total Files Cleaned = 93.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: Justin

User: Justin
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Owner

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: Administrator

User: All Users

User: Default User

User: Justin

User: Justin
->Java cache emptied: 0 bytes

User: LocalService
->Java cache emptied: 0 bytes

User: NetworkService
->Java cache emptied: 0 bytes

User: Owner

Total Java Files Cleaned = 0.00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.46.0 fix logfile created on 11142011_191022

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

*HJT Log:*

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:17:07 PM, on 11/14/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6211 bytes


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## justin2311 (Oct 9, 2011)

*Application Errors:*

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/14/2011
Time: 6:33:03 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/13/2011
Time: 10:11:56 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/13/2011
Time: 1:43:56 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date:  11/11/2011
Time: 9:31:40 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x0000573e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 37 33 65 573e

Event Type: Error
Event Source: JavaQuickStarterService
Event Category: None
Event ID: 1
Date: 11/10/2011
Time: 9:11:35 PM
User: N/A
Computer: JUST
Description:
The description for Event ID ( 1 ) in Source ( JavaQuickStarterService ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Unable to create JQS API server: bind() failed (Socket error 10050)
.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/10/2011
Time: 7:14:07 PM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x000043df.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 34 33 64 66 43df

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/10/2011
Time: 10:47:43 AM
User: N/A
Computer: JUST
Description:
Faulting application NICCONFIGSVC.exe, version 7.0.7.0, faulting module NICCONFIGSVC.exe, version 7.0.7.0, fault address 0x00005255.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4e 49 43 ure NIC
0018: 43 4f 4e 46 49 47 53 56 CONFIGSV
0020: 43 2e 65 78 65 20 37 2e C.exe 7.
0028: 30 2e 37 2e 30 20 69 6e 0.7.0 in
0030: 20 4e 49 43 43 4f 4e 46 NICCONF
0038: 49 47 53 56 43 2e 65 78 IGSVC.ex
0040: 65 20 37 2e 30 2e 37 2e e 7.0.7.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 35 32 35 35 5255

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 11/10/2011
Time: 8:30:57 AM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 11/10/2011
Time: 8:30:57 AM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 11/10/2011
Time: 8:30:57 AM
User: N/A
Computer: JUST
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

*System Errors:*

Event Type: Error
Event Source: Windows Update Agent
Event Category: Software Sync 
Event ID: 16
Date: 11/15/2011
Time: 7:30:37 PM
User: N/A
Computer: JUST
Description:
Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 57 69 6e 33 32 48 52 65 Win32HRe
0008: 73 75 6c 74 3d 30 78 30 sult=0x0
0010: 30 30 30 30 30 30 30 20 0000000 
0018: 55 70 64 61 74 65 49 44 UpdateID
0020: 3d 7b 30 30 30 30 30 30 ={000000
0028: 30 30 2d 30 30 30 30 2d 00-0000-
0030: 30 30 30 30 2d 30 30 30 0000-000
0038: 30 2d 30 30 30 30 30 30 0-000000
0040: 30 30 30 30 30 30 7d 20 000000} 
0048: 52 65 76 69 73 69 6f 6e Revision
0050: 4e 75 6d 62 65 72 3d 30 Number=0
0058: 20 00 .

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/15/2011
Time: 7:29:58 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/15/2011
Time: 7:29:58 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/15/2011
Time: 7:29:58 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/15/2011
Time: 7:29:56 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/15/2011
Time: 7:29:56 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/15/2011
Time: 7:29:56 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/15/2011
Time: 7:29:22 PM
User: N/A
Computer: JUST
Description:
The Messenger service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/15/2011
Time: 7:29:22 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/15/2011
Time: 7:29:22 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7022
Date: 11/15/2011
Time: 7:29:22 PM
User: N/A
Computer: JUST
Description:
The Dell Wireless WLAN Tray Service service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/15/2011
Time: 7:29:12 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 8:10:18 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/14/2011
Time: 8:10:18 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/14/2011
Time: 8:10:18 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 8:10:09 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/14/2011
Time: 8:10:09 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:26:05 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:25:35 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:25:35 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:25:05 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:24:30 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:23:31 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:22:26 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:22:26 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:21:56 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:21:26 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:20:22 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:19:52 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 7:18:51 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:18:21 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/14/2011
Time: 7:13:57 PM
User: N/A
Computer: JUST
Description:
The Messenger service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 7:13:57 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7022
Date: 11/14/2011
Time: 7:13:57 PM
User: N/A
Computer: JUST
Description:
The Dell Wireless WLAN Tray Service service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/14/2011
Time: 7:13:47 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/14/2011
Time: 7:10:25 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 11/14/2011
Time: 7:10:24 PM
User: N/A
Computer: JUST
Description:
The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/14/2011
Time: 4:40:43 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/14/2011
Time: 4:40:13 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Workstation
Event Category: None
Event ID: 5727
Date: 11/14/2011
Time: 4:28:36 PM
User: N/A
Computer: JUST
Description:
Could not load RDR device driver.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 11/13/2011
Time: 10:12:03 PM
User: N/A
Computer: JUST
Description:
The NICCONFIGSVC service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 11/13/2011
Time: 7:39:33 PM
User: N/A
Computer: JUST
Description:
The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/13/2011
Time: 7:38:11 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/13/2011
Time: 7:38:11 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/13/2011
Time: 6:47:15 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 11/13/2011
Time: 6:39:00 PM
User: NT AUTHORITY\SYSTEM
Computer: JUST
Description:
The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/13/2011
Time: 6:38:30 PM
User: N/A
Computer: JUST
Description:
The Background Intelligent Transfer Service service terminated with service-specific error 2147942405 (0x80070005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Go to the Run box on the Start Menu and type in:
*
sfc /scannow*

This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

You may be prompted to insert the XP installation CD.


----------



## justin2311 (Oct 9, 2011)

I just ran it and it appeared to scan but it didn't prompt me to insert the XP installation CD (probably a good thing because I don't have one). 

Once it finished scanning, the window closed out on its own and nothing else happened.


----------



## Cookiegal (Aug 27, 2003)

Please open HijackThis.
Click on *Open Misc Tools Section*
Make sure that both boxes beside "Generate StartupList Log" are checked:

*List all minor sections(Full)*
*List Empty Sections(Complete)*
Click *Generate StartupList Log*.
Click *Yes* at the prompt.
It will open a text file. Please copy the entire contents of that page and paste it here.


----------



## justin2311 (Oct 9, 2011)

OK here are the results:

StartupList report, 11/16/2011, 1:17:14 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Justin\Desktop\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Justin\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

igfxtray = C:\WINDOWS\system32\igfxtray.exe
igfxhkcmd = C:\WINDOWS\system32\hkcmd.exe
igfxpers = C:\WINDOWS\system32\igfxpers.exe
Broadcom Wireless Manager UI = C:\WINDOWS\system32\WLTRAY.exe
SigmatelSysTrayApp = stsystra.exe
dla = C:\WINDOWS\system32\dla\tfswctrl.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\ComFile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

[{8b15971b-5355-4c82-8c07-7e181ea07608}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=*Registry value not found*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\BAE\BAE.dll - {CA6319C0-31B7-401E-A518-A07C3DB8F777}
(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

--------------------------------------------------

Enumerating Task Scheduler jobs:

AppleSoftwareUpdate.job

--------------------------------------------------

Enumerating Download Program Files:

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671

[OnlineScanner Control]
InProcServer32 = C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX
CODEBASE = http://download.eset.com/special/eos/OnlineScanner.cab

[{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
CODEBASE = http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\nwprovau.dll
NameSpace #2: C:\WINDOWS\System32\mswsock.dll
NameSpace #3: C:\WINDOWS\System32\winrnr.dll
NameSpace #4: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\mswsock.dll
Protocol #5: C:\WINDOWS\system32\mswsock.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\mswsock.dll
Protocol #18: C:\WINDOWS\system32\mswsock.dll
Protocol #19: C:\WINDOWS\system32\mswsock.dll
Protocol #20: C:\WINDOWS\system32\mswsock.dll
Protocol #21: C:\WINDOWS\system32\mswsock.dll
Protocol #22: C:\WINDOWS\system32\mswsock.dll
Protocol #23: C:\WINDOWS\system32\mswsock.dll
Protocol #24: C:\WINDOWS\system32\mswsock.dll
Protocol #25: C:\WINDOWS\system32\mswsock.dll
Protocol #26: C:\WINDOWS\system32\mswsock.dll
Protocol #27: C:\WINDOWS\system32\mswsock.dll
Protocol #28: C:\WINDOWS\system32\rsvpsp.dll
Protocol #29: C:\WINDOWS\system32\rsvpsp.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

IPv6 Helper Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
abp480n5: \SystemRoot\system32\DRIVERS\ABP480N5.SYS (disabled)
Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Adobe LM Service: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
adpu160m: \SystemRoot\system32\DRIVERS\adpu160m.sys (disabled)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: \SystemRoot\system32\DRIVERS\agp440.sys (disabled)
Compaq AGP Bus Filter: \SystemRoot\system32\DRIVERS\agpCPQ.sys (disabled)
Aha154x: \SystemRoot\system32\DRIVERS\aha154x.sys (disabled)
aic78u2: \SystemRoot\system32\DRIVERS\aic78u2.sys (disabled)
aic78xx: \SystemRoot\system32\DRIVERS\aic78xx.sys (disabled)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
AliIde: \SystemRoot\system32\DRIVERS\aliide.sys (disabled)
ALI AGP Bus Filter: \SystemRoot\system32\DRIVERS\alim1541.sys (disabled)
AMD AGP Bus Filter Driver: \SystemRoot\system32\DRIVERS\amdagp.sys (disabled)
amsint: \SystemRoot\system32\DRIVERS\amsint.sys (disabled)
AOL Connectivity Service: C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe (autostart)
APPDRV: \SystemRoot\SYSTEM32\DRIVERS\APPDRV.SYS (system)
Apple Mobile Device: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" (autostart)
appliandMP: system32\DRIVERS\appliand.sys (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
asc: \SystemRoot\system32\DRIVERS\asc.sys (disabled)
asc3350p: \SystemRoot\system32\DRIVERS\asc3350p.sys (disabled)
asc3550: \SystemRoot\system32\DRIVERS\asc3550.sys (disabled)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
Dell Wireless WLAN Card Driver: system32\DRIVERS\bcmwl5.sys (manual start)
Broadcom 440x 10/100 Integrated Controller XP Driver: system32\DRIVERS\bcm4sbxp.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (disabled)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
catchme: \??\C:\puppy26727p\catchme.sys (manual start)
cbidf: \SystemRoot\system32\DRIVERS\cbidf2k.sys (disabled)
cd20xrnt: \SystemRoot\system32\DRIVERS\cd20xrnt.sys (disabled)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start)
.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
Microsoft ACPI Control Method Battery Driver: system32\DRIVERS\CmBatt.sys (manual start)
CmdIde: \SystemRoot\system32\DRIVERS\cmdide.sys (disabled)
Microsoft Composite Battery Driver: system32\DRIVERS\compbatt.sys (system)
COM+ System Application: %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cpqarray: \SystemRoot\system32\DRIVERS\cpqarray.sys (disabled)
CryptSvc: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
dac2w2k: \SystemRoot\system32\DRIVERS\dac2w2k.sys (disabled)
dac960nt: \SystemRoot\system32\DRIVERS\dac960nt.sys (disabled)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
dpti2o: \SystemRoot\system32\DRIVERS\dpti2o.sys (disabled)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
drvmcdb: system32\drivers\drvmcdb.sys (system)
drvnddm: system32\drivers\drvnddm.sys (autostart)
DSproct: \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys (manual start)
Intel(R) PRO Adapter Driver: system32\DRIVERS\e100b325.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Fax: %systemroot%\system32\fxssvc.exe (disabled)
Floppy Disk Controller Driver: system32\DRIVERS\fdc.sys (manual start)
FLEXnet Licensing Service: "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" (manual start)
Floppy Disk Driver: system32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\DRIVERS\fltMgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
GEAR CDRom Filter: SYSTEM32\DRIVERS\GEARAspiWDM.sys (manual start)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
hpn: \SystemRoot\system32\DRIVERS\hpn.sys (disabled)
HSFHWAZL: system32\DRIVERS\HSFHWAZL.sys (manual start)
HSF_DPV: system32\DRIVERS\HSF_DPV.sys (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i2omp: \SystemRoot\system32\DRIVERS\i2omp.sys (disabled)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
ialm: system32\DRIVERS\ialmnt5.sys (manual start)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
Windows CardSpace: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: %systemroot%\system32\imapi.exe (manual start)
ini910u: \SystemRoot\system32\DRIVERS\ini910u.sys (disabled)
IntelIde: system32\DRIVERS\intelide.sys (system)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Java Quick Starter: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" (autostart)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
KORG USB-MIDI Driver for Windows: System32\Drivers\KORGUMDS.SYS (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Lavasoft helper driver: \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys (manual start)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
mdmxsdk: system32\DRIVERS\mdmxsdk.sys (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Motorola USB CDC ACM Driver: system32\DRIVERS\motmodem.sys (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
mraid35x: \SystemRoot\system32\DRIVERS\mraid35x.sys (disabled)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: %systemroot%\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
MSSQL$SONY_MEDIAMGR: C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR (manual start)
MSSQLServerADHelper: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (manual start)
NICCONFIGSVC: C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe (autostart)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Network Monitor Driver: system32\DRIVERS\NMnt.sys (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
NWLink IPX/SPX/NetBIOS Compatible Transport Protocol: system32\DRIVERS\nwlnkipx.sys (autostart)
NWLink NetBIOS: system32\DRIVERS\nwlnknb.sys (autostart)
NWLink SPX/SPXII Protocol: system32\DRIVERS\nwlnkspx.sys (autostart)
SAP Agent: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Parallel port driver: system32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
perc2: \SystemRoot\system32\DRIVERS\perc2.sys (disabled)
perc2hib: \SystemRoot\system32\DRIVERS\perc2hib.sys (disabled)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\Drivers\PxHelp20.sys (system)
ql1080: \SystemRoot\system32\DRIVERS\ql1080.sys (disabled)
Ql10wnt: \SystemRoot\system32\DRIVERS\ql10wnt.sys (disabled)
ql12160: \SystemRoot\system32\DRIVERS\ql12160.sys (disabled)
ql1240: \SystemRoot\system32\DRIVERS\ql1240.sys (disabled)
ql1280: \SystemRoot\system32\DRIVERS\ql1280.sys (disabled)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: system32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
BlackBerry Smartphone: System32\Drivers\RimUsb.sys (manual start)
RIM Virtual Serial Port v2: system32\DRIVERS\RimSerial.sys (manual start)
Microsoft Legacy Modem Driver: System32\Drivers\RootMdm.sys (manual start)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost.exe -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)
Serial port driver: system32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SIS AGP Bus Filter: \SystemRoot\system32\DRIVERS\sisagp.sys (disabled)
Sparrow: \SystemRoot\system32\DRIVERS\sparrow.sys (disabled)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
SQLAgent$SONY_MEDIAMGR: C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR (manual start)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
sscdbhk5: system32\drivers\sscdbhk5.sys (system)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
ssrtln: system32\drivers\ssrtln.sys (system)
SigmaTel High Definition Audio CODEC: system32\drivers\sthda.sys (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{A445BD1E-49EE-4607-B370-5CCA447377C4} (manual start)
symc810: \SystemRoot\system32\DRIVERS\symc810.sys (disabled)
symc8xx: \SystemRoot\system32\DRIVERS\symc8xx.sys (disabled)
sym_hi: \SystemRoot\system32\DRIVERS\sym_hi.sys (disabled)
sym_u3: \SystemRoot\system32\DRIVERS\sym_u3.sys (disabled)
Synaptics TouchPad Driver: system32\DRIVERS\SynTP.sys (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Microsoft IPv6 Protocol Driver: system32\DRIVERS\tcpip6.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k DComLaunch (manual start)
tfsnboio: system32\dla\tfsnboio.sys (autostart)
tfsncofs: system32\dla\tfsncofs.sys (autostart)
tfsndrct: system32\dla\tfsndrct.sys (autostart)
tfsndres: system32\dla\tfsndres.sys (autostart)
tfsnifs: system32\dla\tfsnifs.sys (autostart)
tfsnopio: system32\dla\tfsnopio.sys (autostart)
tfsnpool: system32\dla\tfsnpool.sys (autostart)
tfsnudf: system32\dla\tfsnudf.sys (autostart)
tfsnudfa: system32\dla\tfsnudfa.sys (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TosIde: \SystemRoot\system32\DRIVERS\toside.sys (disabled)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microsoft Tun Miniport Adapter Driver: system32\DRIVERS\tunmp.sys (manual start)
ultra: \SystemRoot\system32\DRIVERS\ultra.sys (disabled)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Apple Mobile USB Driver: System32\Drivers\usbaapl.sys (manual start)
USB Audio Driver (WDM): system32\drivers\usbaudio.sys (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
Motorola A1000 USB Modem Driver: system32\DRIVERS\usbser.sys (manual start)
Motorola USB Modem Driver for MPT: system32\DRIVERS\usbsermpt.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
VIA AGP Bus Filter: \SystemRoot\system32\DRIVERS\viaagp.sys (disabled)
ViaIde: \SystemRoot\system32\DRIVERS\viaide.sys (disabled)
Viewpoint Manager Service: "C:\Program Files\Viewpoint\Common\ViewpointService.exe" (autostart)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
WAN Miniport (ATW): system32\DRIVERS\wanatw4.sys (manual start)
Wdf01000: system32\DRIVERS\Wdf01000.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
winachsf: system32\DRIVERS\HSF_CNXT.sys (manual start)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Dell Wireless WLAN Tray Service: %SystemRoot%\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)
Windows Socket 2.0 Non-IFS Service Provider Support Environment: \SystemRoot\System32\drivers\ws2ifsl.sys (disabled)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

0aMCPClient: *Registry key not found*
PostBootReminder: C:\WINDOWS\system32\shell32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

End of report, 39,346 bytes
Report generated in 0.484 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *services.msc* and click OK and check the NICCONFIGSVC service and let me know if it's Started or Stopped please.

Also, please do this:

Go to *Start *- *Run *- type in cmd and click OK to open a command prompt:

Type the following command (be sure to include the space between the g and the /:

*Ipconfig /all*

Hit Enter.

Right click in the command window and choose Select All, then hit Enter.
Paste the results in a message here.


----------



## justin2311 (Oct 9, 2011)

The NICCONFIGSVC service is Stopped and the Startup Type is Automatic.

Here are the ipconfig /all results:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Justin>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : JUST
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physical Address. . . . . . . . . : 00-15-C5-6F-42-CC

Ethernet adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Dell Wireless 1370 WLAN Mini-PCI Card
Physical Address. . . . . . . . . : 00-16-CF-55-A1-F5

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : FF-FF-FF-FF-FF-FF-FF-FF
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : fe80::ffff:ffff:fffd%6
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Documents and Settings\Justin>


----------



## Cookiegal (Aug 27, 2003)

Since things may have changed, please do this again.

Go to *Start *- *Run *and copy and paste the following:

*regedit /e C:\lookservices.txt "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services"*

You won't see anything happen and it will only take a second. You will find the report it creates at C:\lookservices.txt. Please zip it up and then upload the zipped file as an attachment.

Then please report the startup status (Stopped or Started) and the startup type (Automatic, Manual, Disabled) for each of the following:

Computer Browser 
DHCP Client 
DNS Client 
IPSEC Services
Network Connections 
Network Location Awareness (NLA)
Server 
TCP/IP NetBIOS Helper services
Workstation


----------



## justin2311 (Oct 9, 2011)

lookservices.zip attached.

Status of services:

Computer Browser - Stopped - Automatic 
DHCP Client - Started - Automatic
DNS Client - Started - Automatic 
IPSEC Services - Started - Automatic 
Network Connections - Started - Automatic 
Network Location Awareness (NLA) - Started - Automatic 
Server - Started - Automatic 
TCP/IP NetBIOS Helper services - Started - Automatic 
Workstation - Stopped - Automatic


----------



## Cookiegal (Aug 27, 2003)

Let's try the same fix we used previously. It has one additional command to delete the key before rebuilding it so please be sure to use this one and not the previous one. I'm uploading NetBTJustin.zip to this post. Unzip it and double-click on the NetBTJustin.reg file and allow it to merge into the registry.

After doing that, start the Workstation service first and then the Computer Browser Service and reboot the machine.

See if yoiu can connect to the Internet. If not check the services again and see if you can start them and then if successful, see if you can connect.


----------



## justin2311 (Oct 9, 2011)

The file merged successfully into the registry but still no luck starting the Workstation or Computer Browser services. I tried starting Workstation first, but I got an error message. I get an error message trying to start Computer Browser as well. Also, still no Internet.


----------



## Cookiegal (Aug 27, 2003)

Go to *Start *- *Run *- type in *cmd *and click OK.

At the command prompt type in:

*netsh winsock reset catalog*

Press enter.

then type in:

*netsh int ip reset resetlog.txt*

Press enter.

Then reboot the machine and see if you can start those services please.

Did you try with Firefox as well?

Have you uploaded that UserHive file yet that was too large to upload here?


----------



## justin2311 (Oct 9, 2011)

Alright so I ran those two commands and rebooted. After rebooting, I went to go start those two services but they still wouldn't start. What's strange though is that I now have an Internet connection (Workstation and Computer Browser still not Started). 

Also, yes I uploaded the myhive.zip file a few posts back. If you need me to submit it again, let me know. Thanks.


----------



## Cookiegal (Aug 27, 2003)

That's good. I believe that was the case before that those services wouldn't start.

Please drag ComboFix to the recycle bin, grab the latest version, run a new scan and post that log.

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.


----------



## justin2311 (Oct 9, 2011)

Is it recommended that those two services start? I'll run the scan now and post the results once finished.


----------



## Cookiegal (Aug 27, 2003)

You should be able to start them so something is preventing it. We'll see if we can get to the bottom of it though.


----------



## justin2311 (Oct 9, 2011)

Sounds good. Here are the Combofix results:

ComboFix 11-11-16.02 - Justin 11/16/2011 19:02:27.18.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.229 [GMT -5:00]
Running from: c:\documents and settings\Justin\Desktop\puppy.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-10-17 to 2011-11-17 )))))))))))))))))))))))))))))))
.
.
2011-11-15 00:10 . 2011-11-15 00:10 -------- dc----w- C:\_OTS
2011-11-11 02:19 . 2011-11-11 02:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-11 02:18 . 2011-11-11 02:18 -------- dc----w- C:\puppy
2011-11-10 14:28 . 2004-08-04 07:00 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys
2011-10-20 01:15 . 2011-10-20 01:16 -------- d-----w- c:\documents and settings\Justin\Application Data\GetRightToGo
2011-10-20 01:13 . 2011-10-25 00:36 -------- d-----w- c:\program files\MIDIOX
2011-10-19 14:26 . 2011-10-19 14:26 -------- d-----w- c:\program files\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-21 14:22 . 2011-10-06 00:41 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-08-31 21:00 . 2011-10-07 23:30 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-02 23:22 . 2011-05-22 00:18 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-16 23:43 . 2011-11-16 23:43 16384 c:\windows\temp\Perflib_Perfdata_788.dat
- 2004-08-10 17:51 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2006-10-06 22:54 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2004-08-10 17:51 . 2011-11-11 02:16 79818 c:\windows\system32\perfc009.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 79818 c:\windows\system32\perfc009.dat
+ 2007-09-23 22:18 . 2007-09-23 22:18 39936 c:\windows\system32\myokent.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-11-11 02:05 . 2011-11-11 02:21 409200 c:\windows\system32\Restore\rstrlog.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 460864 c:\windows\system32\perfh009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 460864 c:\windows\system32\perfh009.dat
+ 2011-10-21 14:22 . 2011-10-21 14:22 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
- 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
+ 2011-10-10 19:37 . 2006-10-13 10:39 163456 c:\windows\system32\drivers\nwrdr.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2010-02-23 03:20 . 2004-08-04 10:00 162816 c:\windows\system32\drivers\netbt.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\drivers\mrxsmb.sys
- 2006-04-20 11:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\dllcache\mrxsmb.sys
+ 2011-10-20 01:25 . 2011-10-20 01:25 154624 c:\windows\Installer\6b9768.msi
+ 2009-07-18 03:21 . 2011-10-21 14:22 8522400 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi2"=myokent.dll
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 7:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 1:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-16 19:16
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•A~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08€MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00›w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00Tø‰H\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00‹Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 ‚\03\00‡\03\00\00°v\03\00Œ\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00"\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00-\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à€\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00Œ\03\00ô€\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00ˆz\03\00žz\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00"{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00‚|\03\00'|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00Š}\03\00š}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00-~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00‚\03\00"\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02€\03\00\12€\03\00(€\03\008€\03\00H€\03\00T€\03\00d€\03\00r€\03\00„€\03\00-€\03\00†‚\03\00x‚\03\00f‚\03\00T‚\03\00D‚\03\00.‚\03\00\16‚\03\00\04‚\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00€\02\00\00€\00\00\00\00¾€\03\00\00\00\00\00ž\00\00€\14\00\00€@\00\00€J\00\00€v\00\00€t\00\00€3\00\00€«\00\00€g\00\00€ \00\00€?\00\00€F\00\00€§\00\00€P\00\00€Ó\00\00€\08\00\00€Ÿ\00\00€y\00\00€1\00\00€}\00\00€ \00\00€Ã\00\00€\11\00\00€\"\00\00€'\00\00€Ò\00\00€\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00…Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10Ÿ\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00Tø‰H\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05"\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\myokent.dll
.
- - - - - - - > 'lsass.exe'(632)
c:\windows\system32\myokent.dll
.
- - - - - - - > 'explorer.exe'(3372)
c:\windows\system32\myokent.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-11-16 19:21:13
ComboFix-quarantined-files.txt 2011-11-17 00:20
ComboFix2.txt 2011-11-14 00:58
ComboFix3.txt 2011-11-13 21:02
ComboFix4.txt 2011-11-11 02:46
ComboFix5.txt 2011-11-17 00:00
.
Pre-Run: 380,993,536 bytes free
Post-Run: 380,497,920 bytes free
.
- - End Of File - - 443A82FCC04260FDC66F4BC151534A69


----------



## justin2311 (Oct 9, 2011)

Small update: 

I did a quick search on Google to test it out, and I got redirected. Closed out the window, rebooted into Safe mode and ran a quick scan in MBAM. It found a few infections, so I had them removed and rebooted the computer. Did another quick search on Google and so far so good. But I noticed that the computer was real slow and sluggish. Took a look at the running processes in Task Manager and there a task "ping.exe" that's taking up like 200K memory usage! So I ran another MBAM scan in Safe mode, it deleted the infection(s) again, and everything seems fine until a few minutes and the ping.exe reappears. Also, "svchost.exe" is running on multiple occasions.


----------



## Cookiegal (Aug 27, 2003)

Please post the MBAM logs.


----------



## Cookiegal (Aug 27, 2003)

Also, please do this:

Please download GMER from: http://gmer.net/index.php

Click on the "Download EXE" button and save the randomly named .exe file to your desktop.

*Note: You must uninstall any CD Emulation programs that you have before running GMER as they can cause conflicts and give false results.*

Double click the GMER .exe file on your desktop to run the tool and it will automatically do a quick scan.

If the tool warns of rootkit activity and asks if you want to run a full scan, click on No and make sure the following are *unchecked *on the right-hand side:

IAT/EAT
Any drive letter other than the primary system drive (which is generally C).

Click the *Scan *button and when the scan is finished, click *Save* and save the log in Notepad with the name ark.txt to your desktop.

*Note: It's important that all other windows be closed and that you don't touch the mouse or do anything with the computer during the scan as it may cause it to freeze. You should disable your screen saver as if it comes on it may cause the program to freeze.*

Open the ark.txt file and copy and paste the contents of the log here please.


----------



## justin2311 (Oct 9, 2011)

MBAM Log: (I don't know why it says "No action taken." Because I remember once it finished scanning, a dialogue box popped up saying "All infections removed successfully".)

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8178

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18702

11/16/2011 7:57:05 PM
mbam-log-2011-11-16 (19-56-47).txt

Scan type: Quick scan
Objects scanned: 181554
Time elapsed: 5 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WqjjYYCekIVrONx8234A (Malware.Packer) -> Value: WqjjYYCekIVrONx8234A -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gPP00ycSSibD3n (Malware.Packer) -> Value: gPP00ycSSibD3n -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38A.exe (Malware.Packer) -> Value: 38A.exe -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\av security 2012v121.exe (Malware.Packer) -> No action taken.
c:\documents and settings\justin\application data\dwme.exe (Malware.Packer) -> No action taken.
c:\program files\LP\0156\38A.exe (Malware.Packer) -> No action taken.
c:\documents and settings\justin\local settings\temp\dwme.exe (Malware.Packer) -> No action taken.
c:\documents and settings\justin\local settings\temp\wpbt0.dll (Trojan.Exploit.Drop) -> No action taken.
c:\documents and settings\justin\local settings\temporary internet files\Content.IE5\16RO4CEV\info[1].exe (Trojan.Exploit.Drop) -> No action taken.
c:\documents and settings\justin\local settings\temporary internet files\Content.IE5\GN8YHLO2\file[1].exe (Malware.Packer) -> No action taken.
c:\documents and settings\justin\local settings\temporary internet files\Content.IE5\HCJBFTI7\file[1].exe (Trojan.Exploit.Drop) -> No action taken.
c:\documents and settings\justin\application data\ldr.ini (Malware.Trace) -> No action taken.
c:\documents and settings\justin\Desktop\av security 2012.lnk (Rogue.AVSecurity2012) -> No action taken.


----------



## justin2311 (Oct 9, 2011)

Also, I'll run a GMER scan later tonight when I get chance. Thanks.


----------



## Cookiegal (Aug 27, 2003)

Also do this please.

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## Cookiegal (Aug 27, 2003)

Please go to the following link and run TDSSKiller:

http://support.kaspersky.com/viruses/solutions?qid=208280684

Allow it cure anything if prompted.

Please post the log back here.


----------



## justin2311 (Oct 9, 2011)

GMER has been scanning for about an hour now. Will post results once finished.


----------



## justin2311 (Oct 9, 2011)

GMER scan log:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-17 23:59:42
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST9408114A rev.8.03
Running: chbztcyf.exe; Driver: C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\pxtdypow.sys

---- Kernel code sections - GMER 1.0.15 ----

.text netbt.sys A9913000 8 Bytes CALL A9913483 \SystemRoot\system32\DRIVERS\netbt.sys (MBT Transport driver/Microsoft Corporation)
.text netbt.sys A9913009 49 Bytes [00, 40, 8B, 4D, 1C, 8B, 55, ...]
.text netbt.sys A991303B 33 Bytes [15, 70, D2, 92, A9, E9, 2F, ...]
.text netbt.sys A991305D 12 Bytes [6A, 00, FF, 75, 08, 89, 7D, ...]
.text netbt.sys A991306A 97 Bytes [84, C0, 0F, 84, 27, D2, 00, ...]
.text ... 
? C:\WINDOWS\system32\DRIVERS\netbt.sys suspicious PE modification

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[1288] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00FC000A 
.text C:\WINDOWS\System32\svchost.exe[1288] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00FD000A 
.text C:\WINDOWS\System32\svchost.exe[1288] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00E7000C 
.text C:\WINDOWS\System32\ping.exe[1800] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B3000A 
.text C:\WINDOWS\System32\ping.exe[1800] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00B4000A 
.text C:\WINDOWS\System32\ping.exe[1800] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 009E000A 
.text C:\WINDOWS\System32\ping.exe[1800] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 009F000A 
.text C:\WINDOWS\System32\ping.exe[1800] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 009D000C 
.text C:\WINDOWS\System32\ping.exe[1800] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 00B7000A 
.text C:\WINDOWS\System32\ping.exe[1800] USER32.dll!WindowFromPoint  7E41BD8E 5 Bytes JMP 00B8000A 
.text C:\WINDOWS\System32\ping.exe[1800] USER32.dll!GetForegroundWindow 7E41BE4B 5 Bytes JMP 00B9000A 
.text C:\WINDOWS\System32\ping.exe[1800] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00B6000A

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)

Device \FileSystem\Fastfat \Fat A8458C8A
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- Modules - GMER 1.0.15 ----

Module (noname) (*** hidden *** ) A995B000-A997C000 (135168 bytes)

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\NetworkService\Cookies\[email protected][3].txt 0 bytes
File C:\Documents and Settings\NetworkService\Cookies\[email protected][3].txt 210 bytes
File C:\Documents and Settings\NetworkService\Cookies\[email protected][3].txt 114 bytes
File C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt 3666 bytes
File C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt 0 bytes
File  C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\imp[10] 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\aj[7] 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\AdServerServlet[8].htm 1663 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\p-01-0VIaSjnOLg[1].gif 35 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\ci[1].png 1525 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\3426[1].gif 62 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\02H64UPH\creative_add_on[1].js 2384 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2QTBX6YN\alt_cta_728x90Less15[1].swf 42875 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2QTBX6YN\srad[1].js 13748 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IV5IL7SU\lucky_magazine[1].jpg 2685 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IV5IL7SU\vepc[1].swf 49387 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IV5IL7SU\navcancl[1] 2713 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IV5IL7SU\gradient_asset_item2[1].png 7174 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IV5IL7SU\ttj[6] 806 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\bullet[1] 3169 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\ErrorPageTemplate[1] 2168 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\iframe[1]  43 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\video32162806001_thumb[1].jpg 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\video42853714001_thumb[1].jpg 4055 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\video524216817001_thumb[1].jpg 0 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\video68458487001_thumb[1].jpg 2988 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\swfLoader_flash_300x600_586adaadb75cb36605134f2841e691ea[1].swf 6023 bytes
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PY6PGGJ3\bCAODPUEX.gif 43 bytes


----------



## justin2311 (Oct 9, 2011)

TDSSKiller log:

00:17:57.0781 3780 TDSS rootkit removing tool 2.6.19.0 Nov 16 2011 12:18:50
00:17:58.0156 3780 ============================================================
00:17:58.0156 3780 Current date / time: 2011/11/18 00:17:58.0156
00:17:58.0156 3780 SystemInfo:
00:17:58.0156 3780 
00:17:58.0156 3780 OS Version: 5.1.2600 ServicePack: 2.0
00:17:58.0156 3780 Product type: Workstation
00:17:58.0156 3780 ComputerName: JUST
00:17:58.0156 3780 UserName: Justin
00:17:58.0156 3780 Windows directory: C:\WINDOWS
00:17:58.0156 3780 System windows directory: C:\WINDOWS
00:17:58.0156 3780 Processor architecture: Intel x86
00:17:58.0156 3780 Number of processors: 1
00:17:58.0156 3780 Page size: 0x1000
00:17:58.0156 3780 Boot type: Normal boot
00:17:58.0156 3780 ============================================================
00:18:00.0500 3780 Initialize success
00:18:03.0312 3980 ============================================================
00:18:03.0312 3980 Scan started
00:18:03.0312 3980 Mode: Manual; 
00:18:03.0312 3980 ============================================================
00:18:05.0859 3980 Abiosdsk - ok
00:18:05.0937 3980 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
00:18:05.0937 3980 abp480n5 - ok
00:18:06.0000 3980 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
00:18:06.0000 3980 ACPI - ok
00:18:06.0046 3980 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
00:18:06.0046 3980 ACPIEC - ok
00:18:06.0125 3980 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
00:18:06.0125 3980 adpu160m - ok
00:18:06.0218 3980 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
00:18:06.0218 3980 aec - ok
00:18:06.0453 3980 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
00:18:06.0468 3980 AFD - ok
00:18:06.0500 3980 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
00:18:06.0500 3980 agp440 - ok
00:18:06.0531 3980 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
00:18:06.0546 3980 agpCPQ - ok
00:18:06.0578 3980 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
00:18:06.0578 3980 Aha154x - ok
00:18:06.0640 3980 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
00:18:06.0640 3980 aic78u2 - ok
00:18:06.0687 3980 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
00:18:06.0687 3980 aic78xx - ok
00:18:06.0734 3980 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
00:18:06.0734 3980 AliIde - ok
00:18:06.0765 3980 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
00:18:06.0781 3980 alim1541 - ok
00:18:06.0812 3980 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
00:18:06.0812 3980 amdagp - ok
00:18:06.0859 3980 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
00:18:06.0875 3980 amsint - ok
00:18:06.0937 3980 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
00:18:06.0953 3980 APPDRV - ok
00:18:06.0968 3980 appliandMP - ok
00:18:07.0015 3980 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
00:18:07.0015 3980 asc - ok
00:18:07.0046 3980 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
00:18:07.0046 3980 asc3350p - ok
00:18:07.0078 3980 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
00:18:07.0078 3980 asc3550 - ok
00:18:07.0187 3980 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
00:18:07.0187 3980 AsyncMac - ok
00:18:07.0218 3980 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
00:18:07.0234 3980 atapi - ok
00:18:07.0281 3980 Atdisk - ok
00:18:07.0406 3980 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
00:18:07.0421 3980 Atmarpc - ok
00:18:07.0484 3980 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
00:18:07.0500 3980 audstub - ok
00:18:07.0562 3980 BCM43XX (30d20fc98bcfd52e1da778cf19b223d4) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
00:18:07.0578 3980 BCM43XX - ok
00:18:07.0656 3980 bcm4sbxp (c768c8a463d32c219ce291645a0621a4) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
00:18:07.0656 3980 bcm4sbxp - ok
00:18:07.0703 3980 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
00:18:07.0703 3980 Beep - ok
00:18:07.0781 3980 catchme - ok
00:18:07.0812 3980 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
00:18:07.0828 3980 cbidf - ok
00:18:08.0109 3980 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
00:18:08.0109 3980 cbidf2k - ok
00:18:08.0218 3980 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
00:18:08.0218 3980 cd20xrnt - ok
00:18:08.0281 3980 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
00:18:08.0281 3980 Cdaudio - ok
00:18:08.0390 3980 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
00:18:08.0390 3980 Cdfs - ok
00:18:08.0437 3980 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
00:18:08.0437 3980 Cdrom - ok
00:18:08.0453 3980 Changer - ok
00:18:08.0500 3980 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
00:18:08.0515 3980 CmBatt - ok
00:18:08.0546 3980 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
00:18:08.0546 3980 CmdIde - ok
00:18:08.0578 3980 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
00:18:08.0593 3980 Compbatt - ok
00:18:08.0625 3980 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
00:18:08.0640 3980 Cpqarray - ok
00:18:08.0687 3980 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
00:18:08.0687 3980 dac2w2k - ok
00:18:08.0734 3980 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
00:18:08.0750 3980 dac960nt - ok
00:18:08.0781 3980 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
00:18:08.0796 3980 Disk - ok
00:18:08.0859 3980 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
00:18:08.0890 3980 dmboot - ok
00:18:09.0046 3980 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
00:18:09.0046 3980 dmio - ok
00:18:09.0109 3980 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
00:18:09.0109 3980 dmload - ok
00:18:09.0171 3980 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
00:18:09.0187 3980 DMusic - ok
00:18:09.0218 3980 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
00:18:09.0218 3980 dpti2o - ok
00:18:09.0265 3980 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
00:18:09.0265 3980 drmkaud - ok
00:18:09.0328 3980 drvmcdb (e814854e6b246ccf498874839ab64d77) C:\WINDOWS\system32\drivers\drvmcdb.sys
00:18:09.0328 3980 drvmcdb - ok
00:18:09.0375 3980 drvnddm (ee83a4ebae70bc93cf14879d062f548b) C:\WINDOWS\system32\drivers\drvnddm.sys
00:18:09.0375 3980 drvnddm - ok
00:18:09.0500 3980 DSproct (2ac2372ffad9adc85672cc8e8ae14be9) C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys
00:18:09.0500 3980 DSproct - ok
00:18:09.0625 3980 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
00:18:09.0625 3980 E100B - ok
00:18:09.0765 3980 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
00:18:09.0765 3980 Fastfat - ok
00:18:09.0843 3980 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
00:18:09.0843 3980 Fdc - ok
00:18:09.0921 3980 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
00:18:09.0921 3980 Fips - ok
00:18:09.0984 3980 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
00:18:10.0000 3980 Flpydisk - ok
00:18:10.0062 3980 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
00:18:10.0062 3980 FltMgr - ok
00:18:10.0125 3980 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
00:18:10.0125 3980 Fs_Rec - ok
00:18:10.0250 3980 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
00:18:10.0250 3980 Ftdisk - ok
00:18:10.0343 3980 GEARAspiWDM (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
00:18:10.0343 3980 GEARAspiWDM - ok
00:18:10.0406 3980 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
00:18:10.0406 3980 Gpc - ok
00:18:10.0453 3980 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
00:18:10.0453 3980 HDAudBus - ok
00:18:10.0546 3980 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
00:18:10.0546 3980 HidUsb - ok
00:18:10.0640 3980 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
00:18:10.0640 3980 hpn - ok
00:18:10.0718 3980 HSFHWAZL (1c8caa80e91fb71864e9426f9eed048d) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
00:18:10.0718 3980 HSFHWAZL - ok
00:18:10.0843 3980 HSF_DPV (698204d9c2832e53633e53a30a53fc3d) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
00:18:10.0906 3980 HSF_DPV - ok
00:18:11.0000 3980 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
00:18:11.0015 3980 HTTP - ok
00:18:11.0078 3980 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
00:18:11.0078 3980 i2omgmt - ok
00:18:11.0109 3980 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
00:18:11.0109 3980 i2omp - ok
00:18:11.0203 3980 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
00:18:11.0203 3980 i8042prt - ok
00:18:11.0328 3980 ialm (5a8e05f1d5c36abd58cffa111eb325ea) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
00:18:11.0406 3980 ialm - ok
00:18:11.0500 3980 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
00:18:11.0500 3980 Imapi - ok
00:18:11.0546 3980 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
00:18:11.0546 3980 ini910u - ok
00:18:11.0593 3980 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
00:18:11.0593 3980 IntelIde - ok
00:18:11.0625 3980 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
00:18:11.0625 3980 intelppm - ok
00:18:11.0656 3980 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
00:18:11.0656 3980 Ip6Fw - ok
00:18:11.0703 3980 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
00:18:11.0703 3980 IpFilterDriver - ok
00:18:11.0734 3980 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
00:18:11.0734 3980 IpInIp - ok
00:18:11.0828 3980 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
00:18:11.0828 3980 IpNat - ok
00:18:11.0906 3980 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
00:18:11.0906 3980 IPSec - ok
00:18:11.0968 3980 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
00:18:11.0984 3980 IRENUM - ok
00:18:12.0046 3980 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
00:18:12.0046 3980 isapnp - ok
00:18:12.0093 3980 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
00:18:12.0093 3980 Kbdclass - ok
00:18:12.0187 3980 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
00:18:12.0203 3980 kbdhid - ok
00:18:12.0250 3980 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
00:18:12.0265 3980 kmixer - ok
00:18:12.0312 3980 KORGUMDS (cd2b7f4c57ff0d8422a3a7aa9995874a) C:\WINDOWS\system32\Drivers\KORGUMDS.SYS
00:18:12.0312 3980 KORGUMDS - ok
00:18:12.0375 3980 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
00:18:12.0375 3980 KSecDD - ok
00:18:12.0453 3980 Lavasoft Kernexplorer - ok
00:18:12.0546 3980 lbrtfdc - ok
00:18:12.0625 3980 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
00:18:12.0625 3980 mdmxsdk - ok
00:18:12.0671 3980 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
00:18:12.0671 3980 mnmdd - ok
00:18:12.0703 3980 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
00:18:12.0703 3980 Modem - ok
00:18:12.0750 3980 motmodem (5023875a94b0766d98a62a72bc4cb055) C:\WINDOWS\system32\DRIVERS\motmodem.sys
00:18:12.0750 3980 motmodem - ok
00:18:12.0828 3980 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
00:18:12.0828 3980 Mouclass - ok
00:18:12.0875 3980 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
00:18:12.0875 3980 mouhid - ok
00:18:12.0906 3980 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
00:18:12.0906 3980 MountMgr - ok
00:18:12.0953 3980 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
00:18:12.0953 3980 mraid35x - ok
00:18:13.0015 3980 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
00:18:13.0031 3980 MRxDAV - ok
00:18:13.0078 3980 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
00:18:13.0093 3980 Msfs - ok
00:18:13.0140 3980 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
00:18:13.0171 3980 MSKSSRV - ok
00:18:13.0203 3980 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
00:18:13.0203 3980 MSPCLOCK - ok
00:18:13.0234 3980 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
00:18:13.0234 3980 MSPQM - ok
00:18:13.0281 3980 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
00:18:13.0281 3980 mssmbios - ok
00:18:13.0328 3980 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
00:18:13.0343 3980 Mup - ok
00:18:13.0406 3980 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
00:18:13.0406 3980 NDIS - ok
00:18:13.0453 3980 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
00:18:13.0453 3980 NdisTapi - ok
00:18:13.0484 3980 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
00:18:13.0484 3980 Ndisuio - ok
00:18:13.0515 3980 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
00:18:13.0531 3980 NdisWan - ok
00:18:13.0546 3980 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
00:18:13.0562 3980 NDProxy - ok
00:18:13.0593 3980 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
00:18:13.0593 3980 NetBIOS - ok
00:18:13.0671 3980 NetBT (8abbc2f4ee9ccddcf737bdd8fc53f44f) C:\WINDOWS\system32\DRIVERS\netbt.sys
00:18:13.0703 3980 NetBT ( Rootkit.Win32.ZAccess.k ) - infected
00:18:13.0703 3980 NetBT - detected Rootkit.Win32.ZAccess.k (0)
00:18:13.0796 3980 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
00:18:13.0796 3980 nm - ok
00:18:13.0843 3980 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
00:18:13.0843 3980 Npfs - ok
00:18:13.0953 3980 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
00:18:13.0968 3980 Ntfs - ok
00:18:14.0015 3980 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
00:18:14.0031 3980 Null - ok
00:18:14.0156 3980 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
00:18:14.0250 3980 nv - ok
00:18:14.0312 3980 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
00:18:14.0312 3980 NwlnkFlt - ok
00:18:14.0343 3980 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
00:18:14.0343 3980 NwlnkFwd - ok
00:18:14.0406 3980 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
00:18:14.0406 3980 NwlnkIpx - ok
00:18:14.0484 3980 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
00:18:14.0484 3980 NwlnkNb - ok
00:18:14.0546 3980 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
00:18:14.0546 3980 NwlnkSpx - ok
00:18:14.0671 3980 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
00:18:14.0671 3980 Parport - ok
00:18:14.0734 3980 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
00:18:14.0734 3980 PartMgr - ok
00:18:14.0765 3980 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
00:18:14.0781 3980 ParVdm - ok
00:18:14.0796 3980 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
00:18:14.0796 3980 PCI - ok
00:18:14.0843 3980 PCIDump - ok
00:18:14.0890 3980 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
00:18:14.0890 3980 PCIIde - ok
00:18:14.0937 3980 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
00:18:14.0937 3980 Pcmcia - ok
00:18:14.0968 3980 PDCOMP - ok
00:18:15.0000 3980 PDFRAME - ok
00:18:15.0015 3980 PDRELI - ok
00:18:15.0031 3980 PDRFRAME - ok
00:18:15.0078 3980 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
00:18:15.0093 3980 perc2 - ok
00:18:15.0125 3980 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
00:18:15.0125 3980 perc2hib - ok
00:18:15.0234 3980 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
00:18:15.0234 3980 PptpMiniport - ok
00:18:15.0296 3980 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
00:18:15.0296 3980 PSched - ok
00:18:15.0328 3980 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
00:18:15.0328 3980 Ptilink - ok
00:18:15.0390 3980 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
00:18:15.0390 3980 PxHelp20 - ok
00:18:15.0453 3980 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
00:18:15.0453 3980 ql1080 - ok
00:18:15.0484 3980 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
00:18:15.0484 3980 Ql10wnt - ok
00:18:15.0546 3980 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
00:18:15.0546 3980 ql12160 - ok
00:18:15.0578 3980 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
00:18:15.0578 3980 ql1240 - ok
00:18:15.0718 3980 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
00:18:15.0734 3980 ql1280 - ok
00:18:15.0796 3980 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
00:18:15.0796 3980 RasAcd - ok
00:18:15.0828 3980 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
00:18:15.0828 3980 Rasl2tp - ok
00:18:15.0890 3980 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
00:18:15.0890 3980 RasPppoe - ok
00:18:15.0953 3980 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
00:18:15.0953 3980 Raspti - ok
00:18:16.0015 3980 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
00:18:16.0015 3980 Rdbss - ok
00:18:16.0046 3980 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
00:18:16.0046 3980 RDPCDD - ok
00:18:16.0109 3980 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
00:18:16.0125 3980 rdpdr - ok
00:18:16.0203 3980 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
00:18:16.0203 3980 RDPWD - ok
00:18:16.0281 3980 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
00:18:16.0281 3980 redbook - ok
00:18:16.0312 3980 RimUsb - ok
00:18:16.0406 3980 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
00:18:16.0406 3980 RimVSerPort - ok
00:18:16.0453 3980 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
00:18:16.0453 3980 ROOTMODEM - ok
00:18:16.0687 3980 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
00:18:16.0703 3980 Secdrv - ok
00:18:16.0781 3980 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
00:18:16.0781 3980 serenum - ok
00:18:16.0859 3980 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
00:18:16.0859 3980 Serial - ok
00:18:16.0921 3980 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
00:18:16.0921 3980 Sfloppy - ok
00:18:16.0968 3980 Simbad - ok
00:18:17.0015 3980 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
00:18:17.0015 3980 sisagp - ok
00:18:17.0078 3980 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
00:18:17.0078 3980 Sparrow - ok
00:18:17.0125 3980 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
00:18:17.0125 3980 splitter - ok
00:18:17.0250 3980 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
00:18:17.0250 3980 sr - ok
00:18:17.0328 3980 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
00:18:17.0328 3980 Srv - ok
00:18:17.0375 3980 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys
00:18:17.0375 3980 sscdbhk5 - ok
00:18:17.0421 3980 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys
00:18:17.0421 3980 ssrtln - ok
00:18:17.0515 3980 STHDA (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINDOWS\system32\drivers\sthda.sys
00:18:17.0656 3980 STHDA - ok
00:18:17.0703 3980 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
00:18:17.0703 3980 swenum - ok
00:18:17.0781 3980 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
00:18:17.0781 3980 swmidi - ok
00:18:17.0812 3980 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
00:18:17.0812 3980 symc810 - ok
00:18:17.0921 3980 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
00:18:17.0921 3980 symc8xx - ok
00:18:17.0953 3980 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
00:18:17.0953 3980 sym_hi - ok
00:18:17.0984 3980 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
00:18:17.0984 3980 sym_u3 - ok
00:18:18.0062 3980 SynTP (6bef3acd6ee22eec55b68699e8aace09) C:\WINDOWS\system32\DRIVERS\SynTP.sys
00:18:18.0078 3980 SynTP - ok
00:18:18.0156 3980 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
00:18:18.0156 3980 sysaudio - ok
00:18:18.0312 3980 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
00:18:18.0328 3980 Tcpip - ok
00:18:18.0421 3980 Tcpip6 (be4007ab8c9b62e3688fc2f469b98190) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
00:18:18.0421 3980 Tcpip6 - ok
00:18:18.0484 3980 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
00:18:18.0484 3980 TDPIPE - ok
00:18:18.0515 3980 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
00:18:18.0515 3980 TDTCP - ok
00:18:18.0578 3980 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
00:18:18.0578 3980 TermDD - ok
00:18:18.0640 3980 tfsnboio (30698355067d07da5f9eb81132c9fdd6) C:\WINDOWS\system32\dla\tfsnboio.sys
00:18:18.0656 3980 tfsnboio - ok
00:18:18.0718 3980 tfsncofs (fb9d825bb4a2abdf24600f7505050e2b) C:\WINDOWS\system32\dla\tfsncofs.sys
00:18:18.0718 3980 tfsncofs - ok
00:18:18.0750 3980 tfsndrct (cafd8cca11aa1e8b6d2ea1ba8f70ec33) C:\WINDOWS\system32\dla\tfsndrct.sys
00:18:18.0750 3980 tfsndrct - ok
00:18:18.0781 3980 tfsndres (8db1e78fbf7c426d8ec3d8f1a33d6485) C:\WINDOWS\system32\dla\tfsndres.sys
00:18:18.0781 3980 tfsndres - ok
00:18:18.0812 3980 tfsnifs (b92f67a71cc8176f331b8aa8d9f555ad) C:\WINDOWS\system32\dla\tfsnifs.sys
00:18:18.0828 3980 tfsnifs - ok
00:18:18.0859 3980 tfsnopio (85985faa9a71e2358fcc2edefc2a3c5c) C:\WINDOWS\system32\dla\tfsnopio.sys
00:18:18.0859 3980 tfsnopio - ok
00:18:18.0890 3980 tfsnpool (bba22094f0f7c210567efdaf11f64495) C:\WINDOWS\system32\dla\tfsnpool.sys
00:18:18.0890 3980 tfsnpool - ok
00:18:18.0937 3980 tfsnudf (81340bef80b9811e98ce64611e67e3ff) C:\WINDOWS\system32\dla\tfsnudf.sys
00:18:18.0937 3980 tfsnudf - ok
00:18:18.0953 3980 tfsnudfa (c035fd116224ccc8325f384776b6a8bb) C:\WINDOWS\system32\dla\tfsnudfa.sys
00:18:18.0968 3980 tfsnudfa - ok
00:18:19.0031 3980 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
00:18:19.0031 3980 TosIde - ok
00:18:19.0078 3980 tunmp (87a0e9e18c10a9e454238e3330e2a26d) C:\WINDOWS\system32\DRIVERS\tunmp.sys
00:18:19.0078 3980 tunmp - ok
00:18:19.0156 3980 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
00:18:19.0171 3980 Udfs - ok
00:18:19.0234 3980 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
00:18:19.0234 3980 ultra - ok
00:18:19.0296 3980 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
00:18:19.0312 3980 Update - ok
00:18:19.0500 3980 USBAAPL (f340199e8cb097e1acd58a967c665919) C:\WINDOWS\system32\Drivers\usbaapl.sys
00:18:19.0500 3980 USBAAPL - ok
00:18:19.0546 3980 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
00:18:19.0546 3980 usbaudio - ok
00:18:19.0609 3980 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
00:18:19.0609 3980 usbccgp - ok
00:18:19.0687 3980 usbehci (708579b01fed227aadb393cb0c3b4a2c) C:\WINDOWS\system32\DRIVERS\usbehci.sys
00:18:19.0687 3980 usbehci - ok
00:18:19.0718 3980 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
00:18:19.0718 3980 usbhub - ok
00:18:19.0765 3980 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
00:18:19.0765 3980 usbprint - ok
00:18:19.0812 3980 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
00:18:19.0812 3980 usbscan - ok
00:18:19.0890 3980 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys
00:18:19.0890 3980 usbser - ok
00:18:19.0937 3980 usbsermpt (caad3467fbfae8a380f67e9c7150a85e) C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
00:18:19.0937 3980 usbsermpt - ok
00:18:19.0984 3980 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
00:18:19.0984 3980 USBSTOR - ok
00:18:20.0046 3980 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
00:18:20.0046 3980 usbuhci - ok
00:18:20.0078 3980 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
00:18:20.0078 3980 VgaSave - ok
00:18:20.0140 3980 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
00:18:20.0156 3980 viaagp - ok
00:18:20.0203 3980 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
00:18:20.0203 3980 ViaIde - ok
00:18:20.0234 3980 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
00:18:20.0250 3980 VolSnap - ok
00:18:20.0328 3980 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
00:18:20.0343 3980 Wanarp - ok
00:18:20.0375 3980 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
00:18:20.0375 3980 wanatw - ok
00:18:20.0453 3980 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
00:18:20.0468 3980 Wdf01000 - ok
00:18:20.0500 3980 WDICA - ok
00:18:20.0546 3980 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
00:18:20.0546 3980 wdmaud - ok
00:18:20.0656 3980 winachsf (74cf3f2e4e40c4a2e18d39d6300a5c24) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
00:18:20.0687 3980 winachsf - ok
00:18:20.0968 3980 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
00:18:20.0984 3980 WS2IFSL - ok
00:18:21.0031 3980 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
00:18:21.0031 3980 WudfPf - ok
00:18:21.0078 3980 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
00:18:21.0078 3980 WudfRd - ok
00:18:21.0171 3980 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
00:18:21.0453 3980 \Device\Harddisk0\DR0 - ok
00:18:21.0468 3980 Boot (0x1200) (16b46e90f13e34098c142ccc05745a8e) \Device\Harddisk0\DR0\Partition0
00:18:21.0468 3980 \Device\Harddisk0\DR0\Partition0 - ok
00:18:21.0468 3980 ============================================================
00:18:21.0468 3980 Scan finished
00:18:21.0468 3980 ============================================================
00:18:21.0500 2704 Detected object count: 1
00:18:21.0500 2704 Actual detected object count: 1
00:18:29.0593 2704 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\netbt.sys) error 1813
00:18:35.0656 2704 Backup copy not found, trying to cure infected file..
00:18:35.0875 2704 Cure success, using it..
00:18:36.0000 2704 C:\WINDOWS\system32\DRIVERS\netbt.sys - will be cured on reboot
00:18:38.0250 2704 NetBT ( Rootkit.Win32.ZAccess.k ) - User select action: Cure 
00:18:43.0468 3044 Deinitialize success


----------



## Cookiegal (Aug 27, 2003)

Both GMER and TDSSKiller indicate there was still a problem with the netbt.sys file which TDSSKiller appears to have taken care of but to be sure I need you to run GMER again and post the new log please.


----------



## justin2311 (Oct 9, 2011)

I'll try to do another GMER scan sometime later today. Also, not sure why but I couldn't get OTS to scan. I'd hit Run scan and it would just freeze up.


----------



## Cookiegal (Aug 27, 2003)

Do you have the recovery console installed?


----------



## justin2311 (Oct 9, 2011)

Yeah it's installed. Here's the GMER log:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-18 18:29:16
Windows 5.1.2600 Service Pack 2 
Running: chbztcyf.exe; Driver: C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\pxtdypow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)

Device \FileSystem\Fastfat \Fat A89B1C8A
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- EOF - GMER 1.0.15 ----


----------



## Cookiegal (Aug 27, 2003)

That's good. Are you able to get OTS to run a scan now? If so, please do that and upload the log as an attachment.


----------



## justin2311 (Oct 9, 2011)

Yeah, just ran the OTS scan. The log is attached below.


----------



## Cookiegal (Aug 27, 2003)

Do you know what this is?

C:\WINDOWS\System32\.crusader


----------



## justin2311 (Oct 9, 2011)

No idea, can't be anything good though lol. Should I delete it?


----------



## Cookiegal (Aug 27, 2003)

And these?

C:\Program Files\4FD01
C:\Program Files\LP


----------



## justin2311 (Oct 9, 2011)

Not familiar with those either.


----------



## Cookiegal (Aug 27, 2003)

justin2311 said:


> No idea, can't be anything good though lol. Should I delete it?


I'll include it in the file along with the other two I asked about.


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new HijackThis log please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> Reg Error: Key error. [Yahoo! Toolbar]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value error.]
YN -> CmdMapping\\"{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}" [HKLM] -> [Reg Error: Key error.]
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" [HKLM] -> Reg Error: Key error. [0aMCPClient]
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
YN -> "C:\Program Files\America Online 9.0\waol.exe" -> [C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL]
YN -> "C:\Program Files\Common Files\AOL\1160348457\ee\AOLServiceHost.exe" -> [C:\Program Files\Common Files\AOL\1160348457\ee\AOLServiceHost.exe:*:Enabled:AOL Services]
[Files/Folders - Created Within 30 Days]
NY ->  4FD01 -> C:\Program Files\4FD01
NY ->  LP -> C:\Program Files\LP
NY ->  6854F -> C:\Documents and Settings\Justin\Application Data\6854F
NY ->  AV Security 2012 -> C:\Documents and Settings\Justin\Start Menu\Programs\AV Security 2012
NY ->  UwwwjUUVelItz0y -> C:\Documents and Settings\Justin\Application Data\UwwwjUUVelItz0y
NY ->  fddWWK8fRZ -> C:\Documents and Settings\Justin\Application Data\fddWWK8fRZ
NY ->  xjjUUVelIBtz0c1 -> C:\Documents and Settings\Justin\Application Data\xjjUUVelIBtz0c1
NY ->  JkkUUVrlOBtx -> C:\Documents and Settings\Justin\Application Data\JkkUUVrlOBtx
[Files/Folders - Modified Within 30 Days]
NY ->  .crusader -> C:\WINDOWS\System32\.crusader
NY ->  3 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp
[Files - No Company Name]
NY ->  y2C7YAOo7.dat -> C:\Documents and Settings\All Users\Application Data\y2C7YAOo7.dat
[Empty Temp Folders]
[EmptyFlash]
[EmptyJava]
[Start Explorer]
[Reboot]
```


----------



## Cookiegal (Aug 27, 2003)

Please go to *VirusTotal* and upload the following file for scanning.

Click *Browse*
Copy and paste the contents of the following code box into the text box next to *File name:* then click *Open* 

```
C:\WINDOWS\System32\qwiahrma.dat
```

Click *Send File*
If confronted with two options, choose *Reanalyse file now*
Wait for the scan to finish and then copy and paste the URL from your browser address bar in your next reply please.


----------



## justin2311 (Oct 9, 2011)

*OTS:*

All Processes Killed
[Registry - Safe List]
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\0aMCPClient deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\America Online 9.0\waol.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Common Files\AOL\1160348457\ee\AOLServiceHost.exe deleted successfully.
[Files/Folders - Created Within 30 Days]
C:\Program Files\4FD01 folder moved successfully.
C:\Program Files\LP\0156 folder moved successfully.
C:\Program Files\LP folder moved successfully.
C:\Documents and Settings\Justin\Application Data\6854F folder moved successfully.
C:\Documents and Settings\Justin\Start Menu\Programs\AV Security 2012 folder moved successfully.
C:\Documents and Settings\Justin\Application Data\UwwwjUUVelItz0y folder moved successfully.
C:\Documents and Settings\Justin\Application Data\fddWWK8fRZ folder moved successfully.
C:\Documents and Settings\Justin\Application Data\xjjUUVelIBtz0c1 folder moved successfully.
C:\Documents and Settings\Justin\Application Data\JkkUUVrlOBtx folder moved successfully.
[Files/Folders - Modified Within 30 Days]
C:\WINDOWS\System32\.crusader moved successfully.
C:\WINDOWS\Temp\fla1.tmp deleted successfully.
C:\WINDOWS\Temp\fla3A.tmp deleted successfully.
C:\WINDOWS\Temp\jar_cache1084383491696936949.tmp deleted successfully.
[Files - No Company Name]
C:\Documents and Settings\All Users\Application Data\y2C7YAOo7.dat moved successfully.
[Empty Temp Folders]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Justin

User: Justin
->Temp folder emptied: 164269 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 38491 bytes
->FireFox cache emptied: 42438494 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 470 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 95674582 bytes
->Java cache emptied: 10708 bytes
->Flash cache emptied: 14500 bytes

User: Owner
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 724 bytes

Total Files Cleaned = 132.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: Justin

User: Justin
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Owner

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: Administrator

User: All Users

User: Default User

User: Justin

User: Justin
->Java cache emptied: 0 bytes

User: LocalService
->Java cache emptied: 0 bytes

User: NetworkService
->Java cache emptied: 0 bytes

User: Owner

Total Java Files Cleaned = 0.00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.46.0 fix logfile created on 11182011_201507

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

*HJT:*

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:24:20 PM, on 11/18/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Justin\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6321 bytes


----------



## justin2311 (Oct 9, 2011)

VirusTotal results: http://www.virustotal.com/file-scan...e2dda1befd039dfc8603949b675a8377e3-1321665651


----------



## Cookiegal (Aug 27, 2003)

The virus total only shows it's still in the queue so it didn't give a result.

Please run a new scan with ComboFix and post the log.


----------



## justin2311 (Oct 9, 2011)

Alright I'll run another ComboFix scan when I get chance later today.

Also, I noticed that there's two files that are taking up a whole bunch of space (roughly 500mb each). The files are hiberfil.sys and pagefile.sys. Could I just delete these or are they needed?


----------



## Cookiegal (Aug 27, 2003)

Those files are legitimate and should not be deleted.


----------



## justin2311 (Oct 9, 2011)

ComboFix log:

ComboFix 11-11-19.04 - Justin 11/19/2011 18:03:12.19.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.295 [GMT -5:00]
Running from: c:\documents and settings\Justin\Desktop\puppy.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB22925$
c:\windows\$NtUninstallKB22925$\1100862144
c:\windows\$NtUninstallKB22925$\2756705730\@
c:\windows\$NtUninstallKB22925$\2756705730\bckfg.tmp
c:\windows\$NtUninstallKB22925$\2756705730\cfg.ini
c:\windows\$NtUninstallKB22925$\2756705730\Desktop.ini
c:\windows\$NtUninstallKB22925$\2756705730\keywords
c:\windows\$NtUninstallKB22925$\2756705730\kwrd.dll
c:\windows\$NtUninstallKB22925$\2756705730\L\odetmngk
c:\windows\$NtUninstallKB22925$\2756705730\lsflt7.ver
c:\windows\$NtUninstallKB22925$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB22925$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB22925$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB22925$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB22925$\2756705730\U\[email protected]
c:\windows\$NtUninstallKB22925$\2756705730\U\[email protected]
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_COMSYSAPP
-------\Service_COMSysApp
.
.
((((((((((((((((((((((((( Files Created from 2011-10-19 to 2011-11-19 )))))))))))))))))))))))))))))))
.
.
2011-11-19 01:57 . 2011-11-19 01:57 1409 ----a-w- c:\windows\QTFont.for
2011-11-17 01:04 . 2011-11-05 06:53 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-11-15 00:10 . 2011-11-15 00:10 -------- dc----w- C:\_OTS
2011-11-11 02:19 . 2011-11-11 02:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-11 02:18 . 2011-11-11 02:18 -------- dc----w- C:\puppy
2011-11-10 14:28 . 2004-08-04 07:00 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-18 05:20 . 2010-02-23 03:20 162816 ----a-w- c:\windows\system32\drivers\netbt.sys
2011-10-21 14:22 . 2011-10-06 00:41 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-08-31 21:00 . 2011-10-07 23:30 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-05 06:53 . 2011-11-17 01:04 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-19 23:22 . 2011-11-19 23:22 16384 c:\windows\temp\Perflib_Perfdata_398.dat
- 2004-08-10 17:51 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2006-10-06 22:54 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
- 2004-08-10 17:51 . 2011-05-20 04:29 79818 c:\windows\system32\perfc009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 79818 c:\windows\system32\perfc009.dat
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-11-11 02:05 . 2011-11-11 02:21 409200 c:\windows\system32\Restore\rstrlog.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 460864 c:\windows\system32\perfh009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 460864 c:\windows\system32\perfh009.dat
+ 2011-10-21 14:22 . 2011-10-21 14:22 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
- 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
+ 2011-10-10 19:37 . 2006-10-13 10:39 163456 c:\windows\system32\drivers\nwrdr.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\drivers\mrxsmb.sys
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
- 2006-04-20 11:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\dllcache\mrxsmb.sys
+ 2009-07-18 03:21 . 2011-10-21 14:22 8522400 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 7:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 1:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-84484682.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-19 18:22
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•A~*]
"DC3BF90CC0D3D2F398A9A6D1762F70F3"=multi:"DD_CA_ConfigureNativeImageCommit_X86.3643236F_FC70_11D3_A536_0090278A1BB8\[email protected]\06\00\00\00À\00î\08€MZ\00\03\00\00\00\04\00\00\00ÿÿ\00\00¸\00\00\00\00\00\00\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00ø\00\00\00\0e\1fº\0e\00´\09Í!¸\01LÍ!This program cannot be run in DOS mode.\0d\0d\0a$\00\00\00\00\00\00\00›w{ïß\16\15¼ß\16\15¼ß\16\15¼øÐx¼Þ\16\15¼øÐ{¼Þ\16\15¼\1c\19H¼Ò\16\15¼ß\16\14¼|\16\15¼oÓh¼Â\16\15¼oÓx¼v\16\15¼oÓ{¼ã\16\15¼øÐo¼Þ\16\15¼øÐg¼Ñ\16\15¼øÐi¼Þ\16\15¼øÐm¼Þ\16\15¼Richß\16\15¼\00\00\00\00\00\00\00\00PE\00\00L\01\04\00Tø‰H\00\00\00\00\00\00\00\00à\00\02!\0b\01\08\00\00x\03\00\00r\05\00\00\00\00\00‹Ë\01\00\00\10\00\00\00\03\00\00\00\00\10\00\10\00\00\00\02\00\00\05\00\00\00\08\00\00\00\04\00\00\00\00\00\00\00\000\09\00\00\04\00\00ÙW\09\00\02\00\00\00\00\00\10\00\00\10\00\00\00\00\10\00\00\10\00\00\00\00\00\00\10\00\00\00 ‚\03\00‡\03\00\00°v\03\00Œ\00\00\00\00Ð\03\00\\'\05\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\09\00"\1f\00\00°\12\00\00\1c\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00¸\04\01\[email protected]\00\00\00\00\00\00\00\00\00\00\00\00\10\00\00p\02\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00.text\00\00\00'v\03\00\00\10\00\00\00x\03\00\00\04\00\00\00\00\00\00\00\00\00\00\00\00\00\00 \00\00`.data\00\00\00X=\00\00\00\03\00\00\1a\00\00\00|\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00À.rsrc\00\00\00\000\05\00\00Ð\03\00\00(\05\00\00-\03\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\[email protected]\00\00R.\00\00\00\00\09\00\000\00\00\00¾\08\00\00\00\00\00\00\00\00\00\00\00\00\[email protected]\00\00B\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00à€\03\00\04\03\00\12\03\00(\03\00:\03\00T\03\00d\03\00v\03\00Œ\03\00ô€\03\00\00\00\00\00Vz\03\00jz\03\00zz\03\00ˆz\03\00žz\03\00®z\03\00¾z\03\00Ôz\03\00èz\03\00\00{\03\00\16{\03\00({\03\004{\03\00D{\03\00P{\03\00b{\03\00|{\03\00"{\03\00®{\03\00¾{\03\00Ð{\03\00Ü{\03\00ð{\03\00þ{\03\00\0c|\03\00\18|\03\00&|\03\000|\03\00H|\03\00X|\03\00p|\03\00‚|\03\00'|\03\00 |\03\00²|\03\00Ê|\03\00à|\03\00ú|\03\00\12}\03\00,}\03\00F}\03\00T}\03\00b}\03\00p}\03\00Š}\03\00š}\03\00°}\03\00Ä}\03\00Ø}\03\00ô}\03\00\12~\03\00&~\03\002~\03\00<~\03\00Jz\03\00Z~\03\00f~\03\00~~\03\00-~\03\00ª~\03\00Â~\03\00Ø~\03\00è~\03\00ø~\03\00\06\03\00\12\03\00.\03\00>\03\00L\03\00^\03\00p\03\00‚\03\00"\03\00¤\03\00¶\03\00Ä\03\00Þ\03\00î\03\00\02€\03\00\12€\03\00(€\03\008€\03\00H€\03\00T€\03\00d€\03\00r€\03\00„€\03\00-€\03\00†‚\03\00x‚\03\00f‚\03\00T‚\03\00D‚\03\00.‚\03\00\16‚\03\00\04‚\03\00ò\03\00æ\03\004z\03\00(z\03\00\14z\03\00\06z\03\00ôy\03\00äy\03\00Òy\03\00Ây\03\00ºy\03\00H~\03\00¬y\03\00\00\00\00\00\06\00\00€\02\00\00€\00\00\00\00¾€\03\00\00\00\00\00ž\00\00€\14\00\00€@\00\00€J\00\00€v\00\00€t\00\00€3\00\00€«\00\00€g\00\00€ \00\00€?\00\00€F\00\00€§\00\00€P\00\00€Ó\00\00€\08\00\00€Ÿ\00\00€y\00\00€1\00\00€}\00\00€ \00\00€Ã\00\00€\11\00\00€\"\00\00€'\00\00€Ò\00\00€\00\00\00\00ª\03\00¼\03\00\00\00\00\00\00\00\00\00¯X\03\10\00\00\00\00\00\00\00\00…Ó\01\10Ô\0c\02\10î\1c\02\10¾Y\02\10¼£\02\10\00\00\00\00\00\00\00\00PÂ\02\10Ÿ\1d\02\10\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00Tø‰H\00\00\00\00\02\00\00\00$\00\00\00\00\05\01\00\00ù\00\00$\05\01\10Ö\08\01\10ûÌ\01\10¤\05\01\10üd\01\10îd\01\10ð\05\01\10Ae\01\10îd\01\[email protected]\06\01\10N|\01\10îd\01\10string too long\00invalid string position\00\00\00\00\00\06\01\10\08Í\01\10ûÌ\01\10Unknown exception\00\00\00¤\06\01\10Ñ\01\10.\00/\00\\\00\00\00?\00*\00\00\00\00\00csmà\01\00\00\00\00\00\00\00\00\00\00\00\03\00\00\00 \05"\19\00\00\00\00\00\00\00\00CorExitProcess\00\00.mixcrt\00EncodePointer\00\00\00KERNEL32.DLL\00\00\00\00DecodePointer\00\00\00FlsFree\00FlsSetValue\00FlsGetValue\00FlsAlloc\00\00\00\00Pª\03\10¨ª\03\10\00\00\00\00\01\02\03\04\05\06\07\08\09\0a\0b\0c\0d\0e\0f\10\11\12\13\14\15\16\17\18\19\1a\1b\1c\1d\1e\1f !\"#$%&'()*+,-./0123456789:;<=>[email protected][\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\00c\00c\00s\00=\00\00\00\00\00U\00T\00F\00-\008\00\00\00U\00T\00F\00-\001\006\00L\00E\00\00\00\00\00U\00N\00\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3368)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\stsystra.exe
.
**************************************************************************
.
Completion time: 2011-11-19 18:26:59 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-19 23:26
ComboFix2.txt 2011-11-17 00:21
ComboFix3.txt 2011-11-14 00:58
ComboFix4.txt 2011-11-13 21:02
ComboFix5.txt 2011-11-19 22:54
.
Pre-Run: 533,590,016 bytes free
Post-Run: 525,168,640 bytes free
.
- - End Of File - - FF2966FDAEF0FF8FEA1B9395C29AD25C


----------



## Cookiegal (Aug 27, 2003)

I had mentioned those corrupt registry entries to the developer of ComboFix as I'd never seen them before and he graciously provided a fix for you. So I'm attaching the FixHive.zip file to this post. Save it to your desktop and unzip it to extract the FixHive.exe file it contains then just double click the FixHive.exe file to run it. When it completes it should say "Done!".

Then reboot the machine and run ComboFix again please and post that log.


----------



## justin2311 (Oct 9, 2011)

Thank you, I appreciate it!

Here's the ComboFix log:

ComboFix 11-11-19.04 - Justin 11/19/2011 21:32:58.20.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.360 [GMT -5:00]
Running from: c:\documents and settings\Justin\Desktop\puppy.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_COMSysApp
.
.
((((((((((((((((((((((((( Files Created from 2011-10-20 to 2011-11-20 )))))))))))))))))))))))))))))))
.
.
2011-11-19 01:57 . 2011-11-19 01:57 1409 ----a-w- c:\windows\QTFont.for
2011-11-17 01:04 . 2011-11-05 06:53 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-11-15 00:10 . 2011-11-15 00:10 -------- dc----w- C:\_OTS
2011-11-11 02:19 . 2011-11-11 02:19 -------- d-----w- c:\windows\system32\wbem\Repository
2011-11-11 02:18 . 2011-11-11 02:18 -------- dc----w- C:\puppy
2011-11-10 14:28 . 2004-08-04 07:00 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-18 05:20 . 2010-02-23 03:20 162816 ----a-w- c:\windows\system32\drivers\netbt.sys
2011-10-21 14:22 . 2011-10-06 00:41 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-09 02:04 . 2011-10-09 02:04 111898 -c--a-w- C:\look.zip
2011-10-02 18:23 . 2004-08-10 17:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2011-08-31 21:00 . 2011-10-07 23:30 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-05 06:53 . 2011-11-17 01:04 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-09-27_01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-20 02:51 . 2011-11-20 02:51 16384 c:\windows\temp\Perflib_Perfdata_7e0.dat
- 2004-08-10 17:51 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
+ 2006-10-06 22:54 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
- 2004-08-10 17:51 . 2011-05-20 04:29 79818 c:\windows\system32\perfc009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 79818 c:\windows\system32\perfc009.dat
+ 2011-10-06 00:42 . 2011-10-06 00:42 81920 c:\windows\Installer\{E24A0015-C73F-4B57-B8DF-5EB84D2E9685}\ARPPRODUCTICON.exe
+ 2011-11-11 02:05 . 2011-11-11 02:21 409200 c:\windows\system32\Restore\rstrlog.dat
- 2004-08-10 17:51 . 2011-05-20 04:29 460864 c:\windows\system32\perfh009.dat
+ 2004-08-10 17:51 . 2011-11-11 02:16 460864 c:\windows\system32\perfh009.dat
+ 2011-10-21 14:22 . 2011-10-21 14:22 247968 c:\windows\system32\Macromed\Flash\FlashUtil11c_Plugin.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 243360 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe
+ 2011-10-06 00:41 . 2011-10-06 00:41 328864 c:\windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.dll
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
- 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\drivers\tcpip.sys
+ 2011-10-10 19:37 . 2006-10-13 10:39 163456 c:\windows\system32\drivers\nwrdr.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\drivers\mrxsmb.sys
+ 2004-08-10 17:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
- 2006-04-20 11:51 . 2008-06-20 10:45 360320 c:\windows\system32\dllcache\tcpip.sys
+ 2011-10-10 01:38 . 2010-02-24 11:57 457216 c:\windows\system32\dllcache\mrxsmb.sys
+ 2009-07-18 03:21 . 2011-10-21 14:22 8522400 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2011-10-06 00:42 . 2011-10-06 00:42 1093632 c:\windows\Installer\72f6bd.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Justin^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Justin\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-06-29 17:13 1032192 -c--a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-07-17 02:29 389120 -c--a-w- c:\program files\Dell Support\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-02-23 21:19 53248 -c----w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-03-30 14:36 267048 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-09-10 07:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Adobe\\Adobe Photoshop CS2\\Photoshop.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDPHCP Server
.
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/27/2007 7:48 PM 24652]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys --> c:\windows\system32\DRIVERS\appliand.sys [?]
S3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\drivers\KORGUMDS.SYS [10/29/2008 1:11 AM 21720]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\3bu3lu8j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-19 21:52
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ef,b7,ef,35,45,6a,59,4b,93,e4,69,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3576)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\stsystra.exe
.
**************************************************************************
.
Completion time: 2011-11-19 21:56:40 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-20 02:56
ComboFix2.txt 2011-11-19 23:27
ComboFix3.txt 2011-11-17 00:21
ComboFix4.txt 2011-11-14 00:58
ComboFix5.txt 2011-11-20 02:31
.
Pre-Run: 507,035,648 bytes free
Post-Run: 496,615,424 bytes free
.
- - End Of File - - F3D6E14B85CDFBC26A309F777BB1C1BE


----------



## Cookiegal (Aug 27, 2003)

Please navigate to this file and upload it here as an attachment:

C:\QooBox\ComboFix-quarantined-files.txt


----------



## justin2311 (Oct 9, 2011)

Attached.


----------



## Cookiegal (Aug 27, 2003)

ComboFix inadvertently removed a valid service so we're going to restore it from the registry backups it creates.

Please navigate to this file:

C:\Qoobox\Quarantine\Registry_backups\Service_COMSysApp.reg.dat

and remove the .dat file extension so the file now looks like this:

C:\Qoobox\Quarantine\Registry_backups\Service_COMSysApp.reg

Then double-click the Service_COMSysApp.reg file and allow it to merge into the registry.

Also, please do the exact same procedure for this file:

C:\Qoobox\Quarantine\Registry_backups\Legacy_COMSYSAPP.reg.dat

Let me know if that completes successfully please.


----------



## justin2311 (Oct 9, 2011)

How exactly do I remove the .dat extension?


----------



## Cookiegal (Aug 27, 2003)

Right-click the file and select "Rename" and then just backspace over the .dat part (be sure to remove the dot before dat (remove dat dot )


----------



## justin2311 (Oct 9, 2011)

Ah gotcha, thanks lol. When I go to rename it, the ".dat" isn't even there, it's just "Service_COMSysApp.reg". But looking at the file's properties it's labeled as a DAT file.


----------



## Cookiegal (Aug 27, 2003)

You probably don't have file extensions showing.

Go to Control Panel - Folder Options - click on the View tab and under Advanced Settings, uncheck Hide extensions for known file types then click OK. You should then see .dat at the end.


----------



## justin2311 (Oct 9, 2011)

Cool that worked. So C:\Qoobox\Quarantine\Registry_backups\Service_COMSysApp.reg merged into the registry successfully. But I get an error trying to merge C:\Qoobox\Quarantine\Registry_backups\Legacy_COMSYSAPP.reg.


----------



## Cookiegal (Aug 27, 2003)

What is the error message that you get?


----------



## justin2311 (Oct 9, 2011)

Cannot import C:\Qoobox\Quarantine\Registry_backups\Legacy_COMSYSAPP.reg: Error accessing the registry. 

I didn't reboot the computer after merging the first file. Is a reboot required?


----------



## Cookiegal (Aug 27, 2003)

It shouldn't be required to reboot.

Let's use SystemLook to check those keys. I believe you already have it but I'll post the full instructions in case you need to download it again.

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*
Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:reg
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COMSYSAPP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## justin2311 (Oct 9, 2011)

SystemLook 30.07.11 by jpshortstuff
Log created at 19:11 on 20/11/2011 by Justin
Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COMSYSAPP]
(Unable to open key - key not found)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp]
"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
"Start"= 0x0000000003 (3)
"Type"= 0x0000000010 (16)

-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

I'd like to see an export on this key so please do the following:

Go to *Start *- *Run *and copy and paste the following:

*regedit /e C:\lookCOM.txt "KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp"*

You won't see anything happen and it will only take a second. You will find the report it creates at C:\lookCOM.txt. Please open it in Notepad and then copy and paste the report here.

I believe there is a permissions issue on the other key. Do you know your way around the registry at all?


----------



## justin2311 (Oct 9, 2011)

Alright I copy and pasted regedit /e C:\lookCOM.txt "KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp" into the run box but I don't think it created a .txt file, can't find it. 

No sorry don't really know anything about working with the registry.


----------



## Cookiegal (Aug 27, 2003)

I'm sorry that's because of my sloppy copy and paste. The command should be:

regedit /e C:\lookCOM.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp"


----------



## justin2311 (Oct 9, 2011)

No worries.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp]
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,\
00,6c,00,6c,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2f,00,\
50,00,72,00,6f,00,63,00,65,00,73,00,73,00,69,00,64,00,3a,00,7b,00,30,00,32,\
00,44,00,34,00,42,00,33,00,46,00,31,00,2d,00,46,00,44,00,38,00,38,00,2d,00,\
31,00,31,00,44,00,31,00,2d,00,39,00,36,00,30,00,44,00,2d,00,30,00,30,00,38,\
00,30,00,35,00,46,00,43,00,37,00,39,00,32,00,33,00,35,00,7d,00,00,00
"Start"=dword:00000003
"Type"=dword:00000010


----------



## Cookiegal (Aug 27, 2003)

Can you please export this one too?

Go to *Start *- *Run *and copy and paste the following:

*regedit /e C:\lookRoot.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root"*

You won't see anything happen and it will only take a second. You will find the report it creates at C:\lookRoot.txt. Please open it in Notepad and then copy and paste the report here.


----------



## justin2311 (Oct 9, 2011)

There's so much text I can't even post it lol. Should I upload as an attachment?


----------



## Cookiegal (Aug 27, 2003)

Yes please.


----------



## justin2311 (Oct 9, 2011)

Attached.


----------



## Cookiegal (Aug 27, 2003)

I need you to perform a task in the registry.

Go to *Start *- *Run *- type in *regedit *and click OK to open the registry editor.

Next, navigate to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root

To do that, expand each of the branches in the left-hand pane by clicking on the + that you see to the left, as follows:

+HKEY_LOCAL_MACHINE
+SYSTEM
+CurrentControlSet
+Enum

Under Enum, right click on the Root key and select "permissions". Then under "Group or user names" highlight "Everyone". Under "Permissions for Everyone" put a check mark beside "Full control" under the Allow column. Then click "Apply" and OK.

Then click on "File" and "Exit" to close the registry editor.

Now reboot the machine and try to merge the C:\Qoobox\Quarantine\Registry_backups\Legacy_COMSYSAPP.reg file again.


----------



## justin2311 (Oct 9, 2011)

So that worked. The C:\Qoobox\Quarantine\Registry_backups\Legacy_COMSYSAPP.reg file successfully merged into the registry.


----------



## Cookiegal (Aug 27, 2003)

That's good. How are things with the system now?


----------



## Cookiegal (Aug 27, 2003)

Also, I'd like to export the restored key to see how it looks now.

Go to Start - Run and copy and paste the following:

regedit /e C:\lookLegacy.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COMSYSAPP"

You won't see anything happen and it will only take a second. You will find the report it creates at C:\lookLegacy.txt. Please open it in Notepad and then copy and paste the report here.


----------



## justin2311 (Oct 9, 2011)

Everything seems pretty solid thus far. Thanks for your help, I appreciate it!

One thing I've noticed though when rebooting the computer, after I log in, it would show the desktop for like a good minute before everything else appears (taskbar, icons, etc). Doesn't seem normal to me, but aside from that everything runs good.


----------



## Cookiegal (Aug 27, 2003)

I made another post just before you posted this in case you didn't notice it. Please export that key.

Please post a new HijackThis log as well.


----------



## Cookiegal (Aug 27, 2003)

I'm signing off for the night so will continue this tomorrow.


----------



## justin2311 (Oct 9, 2011)

I couldn't get regedit /e C:\lookLegacy.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COMSYSAPP " to work at first, but then I noticed there was a space in between LEGACY_COMSYSAPP and " so I removed it and that got it to work.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COMSYSAPP]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_COMSYSAPP\0000]
"Service"="COMSysApp"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="COM+ System Application"


----------



## Cookiegal (Aug 27, 2003)

OK, thanks. 

The first key is still not correct so I'm attaching a FixComSysApp.zip file to this post. Please save it to your desktop then unzip it and double-click the FixComSysApp.reg file and allow it merge into the registry.

Then please post a new HijackThis log and let me know how things are with the system.


----------



## justin2311 (Oct 9, 2011)

The file merged successfully. HJT log below:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:07:59 AM, on 11/22/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Justin
\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4060925
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1302616533671
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6106 bytes

Everything seems fine it's just that boot up issue where the desktop would hang for a minute before everything else loads up.


----------



## Cookiegal (Aug 27, 2003)

I just want to check something as a precaution.

Go to *Start *- *Run *- type in type *diskmgmt.msc* and click OK to open Disk Management.

Drag the right side of the window all the way to the right so you can see all of the columns and then take a screenshot and post it here please.


----------



## justin2311 (Oct 9, 2011)

Sorry for the delay.

Everything is running pretty solid minus the start up issue. Not only that but those two services still can't be started.


----------



## Cookiegal (Aug 27, 2003)

Please try to start those services again as I would like to see if an error message is generated when it fails.

After doing that, check the Event Viewer and post errors that just occurred (in the same time frame) under both Application and System please.


----------



## justin2311 (Oct 9, 2011)

Still won't start. Here are the errors:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 11/27/2011
Time: 1:46:16 PM
User: N/A
Computer: JUST
Description:
The Workstation service terminated with service-specific error 2250 (0x8CA).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 11/27/2011
Time: 1:46:16 PM
User: N/A
Computer: JUST
Description:
The Computer Browser service depends on the Workstation service which failed to start because of the following error: 
The service has returned a service-specific error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Is this computer networked with any others at home or elsewhere? Do you share files with other computers?


----------



## justin2311 (Oct 9, 2011)

Not that I know of? I have a wireless router that this laptop is connected to. I have a desktop that is also connected to the router. No files are shared with the desktop PC.


----------



## Cookiegal (Aug 27, 2003)

Please go to the Control Panel - Network Connections - then right-click on your LAN connection and select Properties and look under the General Tab. Is there a check mark in the box beside "Client for Microsoft Networks" and "File and Printer Sharing for Microsoft Networks"?


----------



## justin2311 (Oct 9, 2011)

Actually yes those are both checked.


----------



## Cookiegal (Aug 27, 2003)

I would suggest trying to upgrade to Service Pack 3 now. This may fix some of the errors as there may be files that are corrupt or not the correct version.

Before doing so be sure to back up anything important to an external hard drive as a precaution to be sure you don't lose anything.

Here are some instructions from Microsoft for how to prepare and install Service Pack 3.

http://technet.microsoft.com/en-us/library/cc507836.aspx

Let me know how that goes.


----------

