# AVG detects Win32/Heur Virus



## sk8clayton (May 29, 2011)

My AVG scan has detected the Win32/Heur Virus and moves it to the Virus Vault, but everytime I scan it appears again. I also believe this virus is causing my computer to freeze up randomly. Below is the HiJackThis log, DDS.txt file, and an attachment of the Attach.txt file.

hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:05:42 PM, on 6/18/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Electronic Arts\EADM\Core.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Microsoft Office\Office12\GROOVE.EXE
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files (x86)\AVG\AVG10\avgui.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ironto&s={searchTerms}&f=4
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: HyperCam Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\HyperCam Toolbar\tbcore3.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKCU\..\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Update] "C:\Users\Delaney\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files (x86)\Microsoft Office\Office12\GROOVE.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3375D107-FCDF-40EF-878C-FEBBE2F64527}: NameServer = 192.168.0.1
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: CinemaNow Service - CinemaNow, Inc. - C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Health Check Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Wireless Assistant Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: RtVOsdService Installer (RtVOsdService) - Realtek Semiconductor Corp. - C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 15355 bytes

DDS file:

.
DDS (Ver_11-05-19.01) - NTFSx86 
Internet Explorer: 9.0.8112.16421
Run by Delaney at 21:07:08 on 2011-06-18
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3835.1665 [GMT -7:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG10\avgchsva.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\atibtmon.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\AVG\AVG10\avgfws.exe
C:\Program Files (x86)\Electronic Arts\EADM\Core.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Microsoft Office\Office12\GROOVE.EXE
C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Program Files (x86)\AVG\AVG10\avgam.exe
C:\Program Files (x86)\AVG\AVG10\avgnsa.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Program Files (x86)\AVG\AVG10\avgui.exe
C:\PROGRA~2\AVG\AVG10\avgrsa.exe
C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Delaney\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\wbengine.exe
C:\Windows\System32\vds.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Delaney\Downloads\dds.scr
C:\Windows\SysWOW64\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://start.facemoods.com/?a=ironto&s={searchTerms}&f=4
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB: HyperCam Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - C:\Program Files (x86)\HyperCam Toolbar\tbcore3.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Google Update] "C:\Users\Delaney\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
StartupFolder: C:\Users\Delaney\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\GROOVE.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
TCP: {3375D107-FCDF-40EF-878C-FEBBE2F64527} = 192.168.0.1
TCP: B496D6265627C69765D20534D275962756C6563737 = 192.168.0.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB-X64: {338B4DFE-2E2C-4338-9E41-E176D497299E} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [HP Quick Launch] C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [RtkOSD] C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe
mRun-x64: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
mRun-x64: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]
R1 Avgfwfd;AVG network filter service;C:\Windows\system32\DRIVERS\avgfwd6a.sys --> C:\Windows\system32\DRIVERS\avgfwd6a.sys [?]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-3-30 98208]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG10\avgfws.exe [2011-3-9 2708024]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-4-18 7398752]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [2011-2-8 269520]
R2 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [2010-2-26 127984]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-1-27 102968]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-2-4 92216]
R2 RtVOsdService;RtVOsdService Installer;C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-6-24 315392]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-4-11 136176]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-6-17 1025352]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-4-11 136176]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-06-19 02:13:06	--------	d-----w-	C:\Users\Delaney\AppData\Local\{959E6DB1-DB32-40A9-9804-9752F2828168}
2011-06-18 22:32:31	--------	d-----w-	C:\Users\Delaney\AppData\Local\{099ECC23-9FCB-427B-BB58-D73359C130EB}
2011-06-18 19:26:53	--------	d-----w-	C:\Users\Delaney\AppData\Local\{FA7EB374-CDD9-4D48-9368-73F37C2EE961}
2011-06-17 23:42:26	--------	d-----w-	C:\_OTS
2011-06-17 21:58:08	--------	d-----w-	C:\Users\Delaney\AppData\Local\{651AAB4B-BABA-4236-8732-B871F530C852}
2011-06-17 21:50:38	--------	d-----w-	C:\Users\Delaney\AppData\Local\{C130E785-85BB-446C-9C30-D66487FAC360}
2011-06-17 21:41:13	--------	d-----w-	C:\ProgramData\AVG Security Toolbar
2011-06-17 21:40:59	--------	d-----w-	C:\Windows\SysWow64\drivers\AVG
2011-06-17 21:37:17	--------	d-----w-	C:\Users\Delaney\AppData\Local\{AC312FBB-550A-4341-BF2C-1C00EC81C33B}
2011-06-17 20:49:29	--------	d-----w-	C:\Users\Delaney\AppData\Local\{E7A009C9-273D-4297-9F95-082F88B9B8F1}
2011-06-17 20:32:37	--------	d-----w-	C:\Users\Delaney\AppData\Local\{9BDD5EFB-3514-488E-886F-772E946E438B}
2011-06-17 06:21:54	499200	----a-w-	C:\Windows\System32\drivers\afd.sys
2011-06-17 06:21:54	1923968	----a-w-	C:\Windows\System32\drivers\tcpip.sys
2011-06-17 06:21:34	158208	----a-w-	C:\Windows\System32\drivers\mrxsmb.sys
2011-06-17 06:21:34	128000	----a-w-	C:\Windows\System32\drivers\mrxsmb20.sys
2011-06-17 06:21:33	289280	----a-w-	C:\Windows\System32\drivers\mrxsmb10.sys
2011-06-17 06:21:16	3135488	----a-w-	C:\Windows\System32\win32k.sys
2011-06-17 06:21:00	467456	----a-w-	C:\Windows\System32\drivers\srv.sys
2011-06-17 06:21:00	410112	----a-w-	C:\Windows\System32\drivers\srv2.sys
2011-06-17 06:21:00	168448	----a-w-	C:\Windows\System32\drivers\srvnet.sys
2011-06-17 06:20:40	861696	----a-w-	C:\Windows\System32\oleaut32.dll
2011-06-17 06:20:40	571904	----a-w-	C:\Windows\SysWow64\oleaut32.dll
2011-06-16 23:26:32	976896	----a-w-	C:\Windows\System32\inetcomm.dll
2011-06-16 23:26:32	741376	----a-w-	C:\Windows\SysWow64\inetcomm.dll
2011-06-16 22:57:25	--------	d-----w-	C:\Users\Delaney\AppData\Local\{E7695D6A-E5AE-43DB-A74F-99F647ACE926}
2011-06-16 04:10:39	--------	d-----w-	C:\Users\Delaney\AppData\Local\{E5BBFA45-19CE-4B03-ACA9-1DD65ACD2A81}
2011-06-16 03:47:44	--------	d-----w-	C:\Users\Delaney\AppData\Local\{DADBC8D1-31C4-48BD-8FA9-5438268CFC7C}
2011-06-15 20:53:26	--------	d-----w-	C:\Users\Delaney\AppData\Local\{88E9EC12-7A1C-4D3D-B25E-5BFF273F942D}
2011-06-15 08:06:08	--------	d-----w-	C:\Users\Delaney\AppData\Local\{0B3B7581-D6BD-4105-A734-5BE6D9243F3F}
2011-06-14 20:04:49	--------	d-----w-	C:\Users\Delaney\AppData\Local\{8698F432-C66C-49A8-B095-7DFFB4AE8C66}
2011-06-13 21:52:29	--------	d-----w-	C:\Users\Delaney\AppData\Local\{EFA3551A-4835-4658-8272-A7F5703B2862}
2011-06-13 18:15:43	--------	d-----w-	C:\Users\Delaney\AppData\Local\{FFACE3E0-14E7-4FD7-97BD-D7AA79745F2D}
2011-06-13 06:14:36	--------	d-----w-	C:\Users\Delaney\AppData\Local\{CA6A1543-8C2E-4FED-8BD6-3B0A30221FA2}
2011-06-12 21:50:32	--------	d-----w-	C:\Users\Delaney\AppData\Local\{C388929F-231D-4957-84A0-9CC1592E4265}
2011-06-12 06:28:41	--------	d-----w-	C:\Users\Delaney\AppData\Local\{2113F531-F655-4A2E-987D-FA3F07A1923A}
2011-06-11 22:01:58	--------	d-----w-	C:\Program Files\iPod
2011-06-11 22:01:57	--------	d-----w-	C:\Program Files\iTunes
2011-06-11 22:01:57	--------	d-----w-	C:\Program Files (x86)\iTunes
2011-06-11 18:24:16	--------	d-----w-	C:\Users\Delaney\AppData\Local\{C3FD225E-3881-4039-B763-61586AFDC57B}
2011-06-11 02:30:52	--------	d-----w-	C:\Users\Delaney\AppData\Local\{DDBE03F5-5F11-45A8-B1BC-08F7154B2A64}
2011-06-09 23:00:49	--------	d-----w-	C:\Users\Delaney\AppData\Local\{992E79AE-46E8-4409-A54C-CD85B451CCBE}
2011-06-09 02:32:25	--------	d-----w-	C:\Users\Delaney\AppData\Local\{CB83F8A9-CB9B-4625-AC4A-511D014DC82E}
2011-06-08 04:50:26	--------	d-----w-	C:\Users\Delaney\AppData\Local\{3CBD91B0-F8AA-46D2-983C-0C693C370B39}
2011-06-08 00:34:30	--------	d-----w-	C:\Users\Delaney\AppData\Local\{D29C3A21-24F1-4996-8EFD-A81598E67BA1}
2011-06-06 22:03:58	--------	d-----w-	C:\Users\Delaney\AppData\Local\{BA7BD62F-7A8C-4CFE-A32B-A43D209727E8}
2011-06-05 20:22:30	--------	d-----w-	C:\Users\Delaney\AppData\Local\WMTools Downloaded Files
2011-06-05 20:06:37	--------	d-----w-	C:\Users\Delaney\AppData\Local\{C1AAC3AA-5DA4-4F9B-AC6E-A3FCCBEB529B}
2011-06-05 08:05:19	--------	d-----w-	C:\Users\Delaney\AppData\Local\{F6BCFC76-65B5-4993-8333-BE6FA2DAF992}
2011-06-05 03:34:47	--------	d-----w-	C:\Program Files (x86)\Movie Maker 2.6
2011-06-04 20:03:19	--------	d-----w-	C:\Users\Delaney\AppData\Local\{C51830E3-568D-495E-9787-B752552E084D}
2011-06-04 00:40:40	--------	d-----w-	C:\Users\Delaney\AppData\Roaming\PFStaticIP
2011-06-04 00:39:48	--------	d-----w-	C:\Program Files (x86)\PFStaticIP
2011-06-04 00:16:32	--------	d-----w-	C:\Users\Delaney\AppData\Local\{9A3FB40C-EC4F-4460-B0F3-A016A612878E}
2011-06-02 23:15:31	404640	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-02 22:46:35	--------	d-----w-	C:\Users\Delaney\AppData\Local\{5617245E-B494-4511-85BF-9F58A0F83640}
2011-06-02 01:14:43	--------	d-----w-	C:\Users\Delaney\AppData\Local\{29EB45E1-ACCE-43A2-8258-122B457F63DA}
2011-05-31 23:54:46	--------	d-----w-	C:\Program Files (x86)\ESET
2011-05-31 23:04:50	--------	d-----w-	C:\Users\Delaney\AppData\Local\{4DD2E3C3-018C-48F0-8011-295A1D75EB35}
2011-05-30 23:40:12	--------	d-----w-	C:\Users\Delaney\AppData\Roaming\Malwarebytes
2011-05-30 23:39:57	38224	----a-w-	C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-30 23:39:56	--------	d-----w-	C:\ProgramData\Malwarebytes
2011-05-30 23:39:53	24152	----a-w-	C:\Windows\System32\drivers\mbam.sys
2011-05-30 23:39:53	--------	d-----w-	C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-05-30 21:34:11	--------	d-----w-	C:\Users\Delaney\AppData\Local\{10513C5D-0018-48A6-A086-C9B09DFC467C}
2011-05-30 05:47:15	--------	d-----w-	C:\Users\Delaney\AppData\Local\{ECAF9AA6-56B1-4070-84F5-505AAD1D39EA}
2011-05-29 17:44:34	--------	d-----w-	C:\Users\Delaney\AppData\Local\{3F9F4CCB-0972-40C3-A90F-236ACA0DA6AE}
2011-05-29 05:37:25	--------	d-----w-	C:\Users\Delaney\AppData\Local\{ED922517-DC77-4919-BAA3-CC0D6B39BD35}
2011-05-29 00:39:10	--------	d-----w-	C:\Users\Delaney\AppData\Local\{C05B9FF3-1CD9-4300-9018-A5B1F058A59D}
2011-05-28 20:06:43	--------	d-----w-	C:\Users\Delaney\AppData\Local\{9AFC25C1-886C-43C3-8E2C-C0562BC287A8}
2011-05-28 02:31:56	--------	d-----w-	C:\Windows\SysWow64\spool
2011-05-28 01:16:41	--------	d-----w-	C:\Users\Delaney\AppData\Local\Sony
2011-05-28 01:15:25	--------	d-----w-	C:\Program Files (x86)\Sony
2011-05-27 23:10:54	--------	d-----w-	C:\Users\Delaney\AppData\Local\{45D9F687-51BC-4F76-A142-18E3745C7BBB}
2011-05-26 23:23:03	--------	d-----w-	C:\Users\Delaney\AppData\Local\{71ADE3D0-1796-49AB-8EA6-60BBA483B47A}
2011-05-26 23:12:07	--------	d-----w-	C:\Users\Delaney\AppData\Local\{EC40FACC-BB06-4DD4-B945-1583C5C96162}
2011-05-25 23:10:56	27520	----a-w-	C:\Windows\System32\drivers\Diskdump.sys
2011-05-25 23:02:53	--------	d-----w-	C:\Users\Delaney\AppData\Local\{6F4DFD89-8711-431F-AFBE-A684802FE084}
2011-05-23 22:26:45	--------	d-----w-	C:\Users\Delaney\AppData\Local\{41ACE94D-423B-485C-A128-CC6EBE418029}
2011-05-23 02:27:19	--------	d-----w-	C:\Users\Delaney\AppData\Local\{F8ADCD1F-0701-4F99-A4AB-C2A805194AAE}
2011-05-22 20:21:52	--------	d-----w-	C:\Users\Delaney\AppData\Local\{2A7CBA2D-4B35-4CD4-B5D9-92B752FB6463}
2011-05-22 07:28:07	--------	d-----w-	C:\Users\Delaney\AppData\Local\{3083481F-79EB-4AE5-9542-1F98F05B4520}
2011-05-21 19:26:09	--------	d-----w-	C:\Users\Delaney\AppData\Local\{4573FAC3-9CFE-4947-8877-C54AE6DE8D7D}
2011-05-21 06:07:38	--------	d-----w-	C:\Windows\System32\SPReview
2011-05-21 06:05:42	--------	d-----w-	C:\Windows\System32\EventProviders
2011-05-21 05:57:42	48976	----a-w-	C:\Windows\System32\netfxperf.dll
2011-05-21 05:57:42	1942856	----a-w-	C:\Windows\System32\dfshim.dll
2011-05-21 05:57:04	1130824	----a-w-	C:\Windows\SysWow64\dfshim.dll
2011-05-21 05:54:59	244736	----a-w-	C:\Windows\System32\sqmapi.dll
2011-05-21 05:53:59	504320	----a-w-	C:\Windows\System32\biocpl.dll
2011-05-21 05:52:59	76800	----a-w-	C:\Windows\System32\drivers\hidclass.sys
2011-05-21 05:51:59	663040	----a-w-	C:\Windows\SysWow64\rpcrt4.dll
2011-05-21 05:50:48	3072	----a-w-	C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
2011-05-21 05:50:48	2560	----a-w-	C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
2011-05-21 05:50:44	6144	----a-w-	C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
2011-05-21 05:50:44	4608	----a-w-	C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
2011-05-21 05:50:24	209920	----a-w-	C:\Windows\SysWow64\PkgMgr.exe
2011-05-21 05:50:24	189952	----a-w-	C:\Windows\SysWow64\wdscore.dll
2011-05-21 05:49:59	323072	----a-w-	C:\Windows\SysWow64\drvstore.dll
2011-05-21 05:49:59	257024	----a-w-	C:\Windows\SysWow64\dpx.dll
2011-05-21 05:49:54	606208	----a-w-	C:\Windows\SysWow64\wbem\fastprox.dll
2011-05-21 05:49:54	363008	----a-w-	C:\Windows\SysWow64\wbemcomn.dll
2011-05-21 05:45:17	529408	----a-w-	C:\Windows\System32\wbemcomn.dll
2011-05-21 05:45:17	524288	----a-w-	C:\Windows\System32\wmicmiplugin.dll
2011-05-21 05:45:17	1225216	----a-w-	C:\Windows\System32\wbem\wbemcore.dll
2011-05-21 05:44:54	933376	----a-w-	C:\Windows\System32\SmiEngine.dll
2011-05-21 05:44:44	199168	----a-w-	C:\Windows\System32\PkgMgr.exe
2011-05-21 05:43:11	422912	----a-w-	C:\Windows\System32\drvstore.dll
2011-05-21 05:43:10	399872	----a-w-	C:\Windows\System32\dpx.dll
2011-05-21 05:33:45	321024	----a-w-	C:\Windows\System32\d3d10_1core.dll
2011-05-21 05:33:45	219136	----a-w-	C:\Windows\SysWow64\d3d10_1core.dll
2011-05-21 05:33:45	197120	----a-w-	C:\Windows\System32\d3d10_1.dll
2011-05-21 05:33:45	161792	----a-w-	C:\Windows\SysWow64\d3d10_1.dll
2011-05-20 23:52:28	--------	d-----w-	C:\Users\Delaney\AppData\Local\{F6DF6AAB-FD1F-44EE-9712-2AD88BCED803}
2011-05-20 04:54:59	766976	----a-w-	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
.
==================== Find3M ====================
.
2011-05-21 10:01:36	152576	----a-w-	C:\Windows\SysWow64\msclmd.dll
2011-05-21 10:01:35	175616	----a-w-	C:\Windows\System32\msclmd.dll
2011-05-20 04:54:59	35840	----a-w-	C:\Windows\SysWow64\imgutil.dll
2011-04-23 01:29:25	2303488	----a-w-	C:\Windows\System32\jscript9.dll
2011-04-23 01:19:19	2382848	----a-w-	C:\Windows\System32\mshtml.tlb
2011-04-22 23:35:56	1797632	----a-w-	C:\Windows\SysWow64\jscript9.dll
2011-04-22 23:25:54	2382848	----a-w-	C:\Windows\SysWow64\mshtml.tlb
2011-04-15 04:28:24	118864	----a-w-	C:\Windows\System32\drivers\AVGIDSDriver.sys
2011-04-09 07:02:55	5562240	----a-w-	C:\Windows\System32\ntoskrnl.exe
2011-04-09 06:58:56	142336	----a-w-	C:\Windows\System32\poqexec.exe
2011-04-09 06:02:25	3967872	----a-w-	C:\Windows\SysWow64\ntkrnlpa.exe
2011-04-09 06:02:25	3912576	----a-w-	C:\Windows\SysWow64\ntoskrnl.exe
2011-04-09 05:56:38	123904	----a-w-	C:\Windows\SysWow64\poqexec.exe
2011-04-06 23:26:58	96544	----a-w-	C:\Windows\System32\dnssd.dll
2011-04-06 23:26:58	69408	----a-w-	C:\Windows\System32\jdns_sd.dll
2011-04-06 23:26:58	237856	----a-w-	C:\Windows\System32\dnssdX.dll
2011-04-06 23:26:58	119584	----a-w-	C:\Windows\System32\dns-sd.exe
2011-04-06 23:20:16	91424	----a-w-	C:\Windows\SysWow64\dnssd.dll
2011-04-06 23:20:16	75040	----a-w-	C:\Windows\SysWow64\jdns_sd.dll
2011-04-06 23:20:16	197920	----a-w-	C:\Windows\SysWow64\dnssdX.dll
2011-04-06 23:20:16	107808	----a-w-	C:\Windows\SysWow64\dns-sd.exe
2011-04-05 07:59:54	377936	----a-w-	C:\Windows\System32\drivers\avgtdia.sys
2011-03-25 03:29:26	343040	----a-w-	C:\Windows\System32\drivers\usbhub.sys
2011-03-25 03:29:14	98816	----a-w-	C:\Windows\System32\drivers\usbccgp.sys
2011-03-25 03:29:14	325120	----a-w-	C:\Windows\System32\drivers\usbport.sys
2011-03-25 03:29:04	52736	----a-w-	C:\Windows\System32\drivers\usbehci.sys
2011-03-25 03:29:04	25600	----a-w-	C:\Windows\System32\drivers\usbohci.sys
2011-03-25 03:29:03	30720	----a-w-	C:\Windows\System32\drivers\usbuhci.sys
2011-03-25 03:28:59	7936	----a-w-	C:\Windows\System32\drivers\usbd.sys
2011-03-21 20:22:06	74272	----a-w-	C:\Windows\System32\RtNicProp64.dll
2011-03-21 20:22:06	452200	----a-w-	C:\Windows\System32\drivers\Rt64win7.sys
2011-03-21 20:22:06	107552	----a-w-	C:\Windows\System32\RTNUninst64.dll
.
============= FINISH: 21:08:19.84 ===============


----------



## Cookiegal (Aug 27, 2003)

What is the name of the file and the path to it?


----------



## sk8clayton (May 29, 2011)

Its found in my HP Games file. I believe its called Win32/Heur.dropper.
This is what comes up in the AVG log:

C:\Program Files (x86)\HP Games\Bejeweled 2 Deluxe\Bejeweled2-WT.exe:\Bejeweled2-WT.exe Virus found Win32/Heur 
C:\Program Files (x86)\HP Games\Bejeweled 2 Deluxe\Bejeweled2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Blasterball 3\BlasterBall3-WT.exe:\BlasterBall3-WT.exe:\BlasterBall3-WT.exe Virus found Win32/Heur 
C:\Program Files (x86)\HP Games\Blasterball 3\BlasterBall3-WT.exe:\BlasterBall3-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Blasterball 3\BlasterBall3-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe:\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Diner Dash 2 Restaurant Rescue\dinerdash2-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Poker Superstars III\Poker3-WT.exe:\Poker3-WT.exe:\Poker3-WT.exe Virus found Win32/Heur 
C:\Program Files (x86)\HP Games\Poker Superstars III\Poker3-WT.exe:\Poker3-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Poker Superstars III\Poker3-WT.exe Virus found Win32/Heur.dropper 
C:\Program Files (x86)\HP Games\Virtual Villagers - The Secret City\Virtual Villagers - The Secret City-WT.exe:\Virtual Villagers - The Secret City-WT.exe Virus found Win32/Heur 
C:\Program Files (x86)\HP Games\Virtual Villagers - The Secret City\Virtual Villagers - The Secret City-WT.exe Virus found Win32/Heur.dropper


----------



## Cookiegal (Aug 27, 2003)

Did you just download those things?


----------



## sk8clayton (May 29, 2011)

no. the HP games came with my computer.


----------



## Cookiegal (Aug 27, 2003)

They look like false positives. I see someone else questioned the Bejeweled one on the AVG forums and submitted it to be checked as a false positive.

You could try releasing one or two of them from quarantine and then uploading them for analysis as follows:

Please go to *VirusTotal* and upload the following file for scanning.

Click *Browse* and locate the file on your computer then click Open and submit the file.

If confronted with two options, choose *Reanalyse file now*
Wait for the scan to finish and then copy and paste the URL from your browser address bar in your next reply please.

You may have to disable AVG if it won't let you do this as it may detect them again.


----------



## sk8clayton (May 29, 2011)

http://www.virustotal.com/file-scan...8c749fc8a7c13a817801bd7b7f9c93eebd-1308524787


----------



## Cookiegal (Aug 27, 2003)

AVG is the only scanner detecting it which does seem to indicate a false positive. To be sure, you could submit it to AVG per these instructions:

http://forums.avg.com/ww-en/avg-free-forum?sec=thread&act=show&id=395

Let me know how that turns out.


----------



## sk8clayton (May 29, 2011)

i send in the file for them to analyze. but is there anyway to help me fix my computer from randomly freezing? its never done this before and out of no where it just starts freezing after an hour or less of being turned on.


----------



## Cookiegal (Aug 27, 2003)

Did that behaviour just start around the same time of those detections?

Perhaps put an exception in AVG for the HP Games so they don't continue to get detected.


----------



## sk8clayton (May 29, 2011)

these behaviors have been recent. I discovered the Win32/Heur after scanning because of the freezes. I even bought a registery scanner/repairer and that helped for a time but now it's freezing again. When I first turn it on it will last for maybe 2 hours but then after it freezes once it freezes every 30 mins or less.


----------



## Cookiegal (Aug 27, 2003)

We can run ComboFix but before doing so you will have to uninstall AVG as they are not compatible. So please uninstall AVG via the Control Panel and then use the removal tool at this link:

http://www.avg.com/us-en/utilities

After that, reboot the machine and install another free anti-virus program, such as Avira Antivir before running ComboFix:

http://www.avira.com/en/avira-free-antivirus

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## sk8clayton (May 29, 2011)

ComboFix log:

ComboFix 11-06-22.02 - Delaney 06/23/2011 0:32.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3835.2520 [GMT -7:00]
Running from: c:\users\Delaney\Downloads\puppy.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
.
.
2011-06-23 07:50 . 2011-06-23 07:50	0	---ha-w-	c:\users\Delaney\AppData\Local\BIT4B73.tmp
2011-06-23 07:38 . 2011-06-23 07:38	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-06-23 07:31 . 2011-06-23 07:31	0	---ha-w-	c:\users\Delaney\AppData\Local\BIT46F2.tmp
2011-06-22 23:26 . 2011-06-22 23:28	--------	d-----w-	C:\ComboFix
2011-06-22 23:10 . 2011-06-22 23:11	--------	d-----w-	c:\users\Delaney\AppData\Local\{B0E46679-C321-4FCD-BFD5-30822FBCA0C8}
2011-06-21 20:52 . 2011-06-21 20:52	--------	d-----w-	c:\programdata\{E91883C8-8CDC-46A4-A45F-CB40EB82ED60}
2011-06-21 19:58 . 2011-06-21 19:59	--------	d-----w-	c:\users\Delaney\AppData\Local\{41CE182D-078F-4F41-A813-89970B47F059}
2011-06-21 08:22 . 2011-06-21 08:22	0	---ha-w-	c:\users\Delaney\AppData\Local\BIT4C4C.tmp
2011-06-21 00:18 . 2011-06-21 00:18	--------	d-----w-	C:\99d01a0b9fbc0effa376
2011-06-21 00:16 . 2011-06-21 00:40	--------	d-----w-	c:\users\Delaney\AppData\Roaming\Uniblue
2011-06-21 00:16 . 2011-06-21 00:40	--------	d-----w-	c:\program files (x86)\Uniblue
2011-06-21 00:16 . 2011-06-21 00:16	--------	dc-h--w-	c:\programdata\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}
2011-06-21 00:16 . 2011-06-21 00:16	--------	d-----w-	c:\users\Delaney\AppData\Local\PackageAware
2011-06-20 20:50 . 2011-06-20 20:52	--------	d-----w-	c:\users\Delaney\AppData\Local\{632CF22C-F935-4AD1-84AD-CAACB06F4D1E}
2011-06-20 19:01 . 2011-06-20 19:01	--------	d-----w-	c:\users\Delaney\AppData\Local\{24765768-40C7-42AB-B25C-4214B6E67E09}
2011-06-20 05:42 . 2011-06-20 05:42	--------	d-----w-	c:\users\Delaney\AppData\Local\{87A608B6-92AA-4A27-8B3D-D5E5FE1EA2D3}
2011-06-20 04:03 . 2011-06-20 04:03	--------	d-----w-	c:\users\Delaney\AppData\Local\{482940FA-DC1D-4838-96EE-AF7D65160402}
2011-06-20 02:18 . 2011-06-20 02:18	--------	d-----w-	c:\users\Delaney\AppData\Local\{C73BE5AD-D524-4099-AD91-19855AF002AC}
2011-06-20 01:57 . 2011-06-20 01:57	--------	d-----w-	c:\users\Delaney\AppData\Local\{4436AD72-26BF-40B1-AB26-E14489D777C0}
2011-06-19 21:38 . 2011-06-19 21:38	--------	d-----w-	c:\users\Delaney\AppData\Local\{BA5FB49F-E125-4D79-9ED5-E9625397973A}
2011-06-19 02:13 . 2011-06-19 02:13	--------	d-----w-	c:\users\Delaney\AppData\Local\{959E6DB1-DB32-40A9-9804-9752F2828168}
2011-06-18 22:32 . 2011-06-18 22:32	--------	d-----w-	c:\users\Delaney\AppData\Local\{099ECC23-9FCB-427B-BB58-D73359C130EB}
2011-06-18 19:26 . 2011-06-18 19:26	--------	d-----w-	c:\users\Delaney\AppData\Local\{FA7EB374-CDD9-4D48-9368-73F37C2EE961}
2011-06-17 23:42 . 2011-06-17 23:42	--------	d-----w-	C:\_OTS
2011-06-17 21:58 . 2011-06-17 21:59	--------	d-----w-	c:\users\Delaney\AppData\Local\{651AAB4B-BABA-4236-8732-B871F530C852}
2011-06-17 21:50 . 2011-06-17 21:52	--------	d-----w-	c:\users\Delaney\AppData\Local\{C130E785-85BB-446C-9C30-D66487FAC360}
2011-06-17 21:37 . 2011-06-17 21:37	--------	d-----w-	c:\users\Delaney\AppData\Local\{AC312FBB-550A-4341-BF2C-1C00EC81C33B}
2011-06-17 20:49 . 2011-06-17 20:49	--------	d-----w-	c:\users\Delaney\AppData\Local\{E7A009C9-273D-4297-9F95-082F88B9B8F1}
2011-06-17 20:32 . 2011-06-17 20:32	--------	d-----w-	c:\users\Delaney\AppData\Local\{9BDD5EFB-3514-488E-886F-772E946E438B}
2011-06-17 06:21 . 2011-04-25 05:33	1923968	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-06-17 06:21 . 2011-04-25 02:34	499200	----a-w-	c:\windows\system32\drivers\afd.sys
2011-06-17 06:21 . 2011-04-27 02:40	158208	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-06-17 06:21 . 2011-04-27 02:39	128000	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-06-17 06:21 . 2011-04-27 02:39	289280	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-06-17 06:21 . 2011-05-28 03:06	3135488	----a-w-	c:\windows\system32\win32k.sys
2011-06-17 06:21 . 2011-04-29 03:06	467456	----a-w-	c:\windows\system32\drivers\srv.sys
2011-06-17 06:21 . 2011-04-29 03:05	410112	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-06-17 06:21 . 2011-04-29 03:05	168448	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-06-17 06:20 . 2011-02-25 06:22	861696	----a-w-	c:\windows\system32\oleaut32.dll
2011-06-17 06:20 . 2011-02-25 05:34	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2011-06-16 23:26 . 2011-05-03 05:29	976896	----a-w-	c:\windows\system32\inetcomm.dll
2011-06-16 23:26 . 2011-05-03 04:30	741376	----a-w-	c:\windows\SysWow64\inetcomm.dll
2011-06-16 22:57 . 2011-06-16 22:58	--------	d-----w-	c:\users\Delaney\AppData\Local\{E7695D6A-E5AE-43DB-A74F-99F647ACE926}
2011-06-16 04:10 . 2011-06-16 04:10	--------	d-----w-	c:\users\Delaney\AppData\Local\{E5BBFA45-19CE-4B03-ACA9-1DD65ACD2A81}
2011-06-16 03:47 . 2011-06-16 03:48	--------	d-----w-	c:\users\Delaney\AppData\Local\{DADBC8D1-31C4-48BD-8FA9-5438268CFC7C}
2011-06-15 20:53 . 2011-06-15 20:53	--------	d-----w-	c:\users\Delaney\AppData\Local\{88E9EC12-7A1C-4D3D-B25E-5BFF273F942D}
2011-06-15 08:06 . 2011-06-15 08:06	--------	d-----w-	c:\users\Delaney\AppData\Local\{0B3B7581-D6BD-4105-A734-5BE6D9243F3F}
2011-06-14 20:04 . 2011-06-14 20:05	--------	d-----w-	c:\users\Delaney\AppData\Local\{8698F432-C66C-49A8-B095-7DFFB4AE8C66}
2011-06-13 21:52 . 2011-06-13 21:52	--------	d-----w-	c:\users\Delaney\AppData\Local\{EFA3551A-4835-4658-8272-A7F5703B2862}
2011-06-13 18:15 . 2011-06-13 18:15	--------	d-----w-	c:\users\Delaney\AppData\Local\{FFACE3E0-14E7-4FD7-97BD-D7AA79745F2D}
2011-06-13 06:14 . 2011-06-13 06:14	--------	d-----w-	c:\users\Delaney\AppData\Local\{CA6A1543-8C2E-4FED-8BD6-3B0A30221FA2}
2011-06-12 21:50 . 2011-06-12 21:50	--------	d-----w-	c:\users\Delaney\AppData\Local\{C388929F-231D-4957-84A0-9CC1592E4265}
2011-06-12 06:28 . 2011-06-12 06:28	--------	d-----w-	c:\users\Delaney\AppData\Local\{2113F531-F655-4A2E-987D-FA3F07A1923A}
2011-06-11 22:01 . 2011-06-11 22:01	--------	d-----w-	c:\program files\iPod
2011-06-11 22:01 . 2011-06-11 22:04	--------	d-----w-	c:\program files\iTunes
2011-06-11 22:01 . 2011-06-11 22:04	--------	d-----w-	c:\program files (x86)\iTunes
2011-06-11 18:24 . 2011-06-11 18:27	--------	d-----w-	c:\users\Delaney\AppData\Local\{C3FD225E-3881-4039-B763-61586AFDC57B}
2011-06-11 02:30 . 2011-06-11 02:31	--------	d-----w-	c:\users\Delaney\AppData\Local\{DDBE03F5-5F11-45A8-B1BC-08F7154B2A64}
2011-06-09 23:00 . 2011-06-09 23:04	--------	d-----w-	c:\users\Delaney\AppData\Local\{992E79AE-46E8-4409-A54C-CD85B451CCBE}
2011-06-09 02:32 . 2011-06-09 02:33	--------	d-----w-	c:\users\Delaney\AppData\Local\{CB83F8A9-CB9B-4625-AC4A-511D014DC82E}
2011-06-08 04:50 . 2011-06-08 04:50	--------	d-----w-	c:\users\Delaney\AppData\Local\{3CBD91B0-F8AA-46D2-983C-0C693C370B39}
2011-06-08 00:34 . 2011-06-08 00:34	--------	d-----w-	c:\users\Delaney\AppData\Local\{D29C3A21-24F1-4996-8EFD-A81598E67BA1}
2011-06-06 22:03 . 2011-06-06 22:04	--------	d-----w-	c:\users\Delaney\AppData\Local\{BA7BD62F-7A8C-4CFE-A32B-A43D209727E8}
2011-06-05 20:22 . 2011-06-07 05:10	--------	d-----w-	c:\users\Delaney\AppData\Local\WMTools Downloaded Files
2011-06-05 20:06 . 2011-06-05 20:06	--------	d-----w-	c:\users\Delaney\AppData\Local\{C1AAC3AA-5DA4-4F9B-AC6E-A3FCCBEB529B}
2011-06-05 08:05 . 2011-06-05 08:05	--------	d-----w-	c:\users\Delaney\AppData\Local\{F6BCFC76-65B5-4993-8333-BE6FA2DAF992}
2011-06-05 03:34 . 2011-06-05 03:34	--------	d-----w-	c:\program files (x86)\Movie Maker 2.6
2011-06-04 20:03 . 2011-06-04 20:04	--------	d-----w-	c:\users\Delaney\AppData\Local\{C51830E3-568D-495E-9787-B752552E084D}
2011-06-04 00:40 . 2011-06-04 00:44	--------	d-----w-	c:\users\Delaney\AppData\Roaming\PFStaticIP
2011-06-04 00:39 . 2011-06-04 00:39	--------	d-----w-	c:\program files (x86)\PFStaticIP
2011-06-04 00:16 . 2011-06-04 00:20	--------	d-----w-	c:\users\Delaney\AppData\Local\{9A3FB40C-EC4F-4460-B0F3-A016A612878E}
2011-06-02 23:15 . 2011-06-02 23:15	404640	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-02 22:46 . 2011-06-02 22:46	--------	d-----w-	c:\users\Delaney\AppData\Local\{5617245E-B494-4511-85BF-9F58A0F83640}
2011-06-02 01:14 . 2011-06-02 01:15	--------	d-----w-	c:\users\Delaney\AppData\Local\{29EB45E1-ACCE-43A2-8258-122B457F63DA}
2011-05-31 23:54 . 2011-05-31 23:54	--------	d-----w-	c:\program files (x86)\ESET
2011-05-31 23:04 . 2011-05-31 23:06	--------	d-----w-	c:\users\Delaney\AppData\Local\{4DD2E3C3-018C-48F0-8011-295A1D75EB35}
2011-05-30 23:40 . 2011-05-30 23:40	--------	d-----w-	c:\users\Delaney\AppData\Roaming\Malwarebytes
2011-05-30 23:39 . 2010-12-21 01:09	38224	----a-w-	c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-30 23:39 . 2011-05-30 23:39	--------	d-----w-	c:\programdata\Malwarebytes
2011-05-30 23:39 . 2011-05-30 23:40	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-30 23:39 . 2010-12-21 01:08	24152	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-05-30 21:34 . 2011-05-30 21:35	--------	d-----w-	c:\users\Delaney\AppData\Local\{10513C5D-0018-48A6-A086-C9B09DFC467C}
2011-05-30 05:47 . 2011-05-30 05:47	--------	d-----w-	c:\users\Delaney\AppData\Local\{ECAF9AA6-56B1-4070-84F5-505AAD1D39EA}
2011-05-29 17:44 . 2011-05-29 17:46	--------	d-----w-	c:\users\Delaney\AppData\Local\{3F9F4CCB-0972-40C3-A90F-236ACA0DA6AE}
2011-05-29 05:37 . 2011-05-29 05:39	--------	d-----w-	c:\users\Delaney\AppData\Local\{ED922517-DC77-4919-BAA3-CC0D6B39BD35}
2011-05-29 00:39 . 2011-05-29 00:39	--------	d-----w-	c:\users\Delaney\AppData\Local\{C05B9FF3-1CD9-4300-9018-A5B1F058A59D}
2011-05-28 20:06 . 2011-05-28 20:06	--------	d-----w-	c:\users\Delaney\AppData\Local\{9AFC25C1-886C-43C3-8E2C-C0562BC287A8}
2011-05-28 02:31 . 2011-05-28 02:31	--------	d-----w-	c:\windows\SysWow64\spool
2011-05-28 01:21 . 2011-06-07 05:44	--------	d-----w-	c:\users\Delaney\AppData\Roaming\Publish Providers
2011-05-28 01:16 . 2011-05-28 01:16	--------	d-----w-	c:\users\Delaney\AppData\Local\Sony
2011-05-28 01:15 . 2011-05-28 01:15	--------	d-----w-	c:\programdata\Sony
2011-05-28 01:15 . 2011-05-28 01:15	--------	d-----w-	c:\program files (x86)\Sony
2011-05-28 00:58 . 2011-05-28 00:58	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2011-05-28 00:21 . 2011-05-28 02:28	--------	d-----w-	c:\users\Delaney\AppData\Roaming\Sony
2011-05-27 23:10 . 2011-05-27 23:14	--------	d-----w-	c:\users\Delaney\AppData\Local\{45D9F687-51BC-4F76-A142-18E3745C7BBB}
2011-05-26 23:23 . 2011-05-26 23:26	--------	d-----w-	c:\users\Delaney\AppData\Local\{71ADE3D0-1796-49AB-8EA6-60BBA483B47A}
2011-05-26 23:12 . 2011-05-26 23:12	--------	d-----w-	c:\users\Delaney\AppData\Local\{EC40FACC-BB06-4DD4-B945-1583C5C96162}
2011-05-25 23:10 . 2011-04-22 22:15	27520	----a-w-	c:\windows\system32\drivers\Diskdump.sys
2011-05-25 23:02 . 2011-05-25 23:04	--------	d-----w-	c:\users\Delaney\AppData\Local\{6F4DFD89-8711-431F-AFBE-A684802FE084}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-20 05:46 . 2010-12-20 03:03	737072	----a-w-	c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-06-20 05:45 . 2010-12-24 23:34	4283672	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-06-20 05:44 . 2010-12-20 03:02	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-06-19 04:40 . 2010-12-24 23:34	737072	----a-w-	c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-06-19 04:39 . 2010-12-20 03:03	4283672	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-06-19 04:38 . 2010-12-16 07:17	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-06-19 04:38 . 2010-12-24 23:33	539968	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-06-11 19:27 . 2010-12-16 07:17	539968	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-21 10:01 . 2009-07-14 02:36	152576	----a-w-	c:\windows\SysWow64\msclmd.dll
2011-05-21 10:01 . 2009-07-14 02:36	175616	----a-w-	c:\windows\system32\msclmd.dll
2011-05-20 04:55 . 2011-05-20 04:55	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-05-20 04:55 . 2011-05-20 04:55	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2011-05-20 04:55 . 2011-05-20 04:55	1126912	----a-w-	c:\windows\SysWow64\wininet.dll
2011-05-20 04:55 . 2011-05-20 04:55	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2011-05-20 04:55 . 2011-05-20 04:55	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2011-05-20 04:55 . 2011-05-20 04:55	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2011-05-20 04:55 . 2011-05-20 04:55	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2011-05-20 04:55 . 2011-05-20 04:55	63488	----a-w-	c:\windows\SysWow64\tdc.ocx
2011-05-20 04:55 . 2011-05-20 04:55	367104	----a-w-	c:\windows\SysWow64\html.iec
2011-05-20 04:55 . 2011-05-20 04:55	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2011-05-20 04:55 . 2011-05-20 04:55	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2011-05-20 04:55 . 2011-05-20 04:55	1427456	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2011-05-20 04:55 . 2011-05-20 04:55	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2011-05-20 04:55 . 2011-05-20 04:55	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2011-05-20 04:55 . 2011-05-20 04:55	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2011-05-20 04:55 . 2011-05-20 04:55	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2011-05-20 04:54 . 2011-05-20 04:54	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2011-05-20 04:54 . 2011-05-20 04:54	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2011-05-20 04:54 . 2011-05-20 04:54	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2011-05-20 04:54 . 2011-05-20 04:54	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-05-20 04:54 . 2011-05-20 04:54	222208	----a-w-	c:\windows\system32\msls31.dll
2011-05-20 04:54 . 2011-05-20 04:54	1389056	----a-w-	c:\windows\system32\wininet.dll
2011-05-20 04:54 . 2011-05-20 04:54	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2011-05-20 04:54 . 2011-05-20 04:54	12288	----a-w-	c:\windows\system32\mshta.exe
2011-05-20 04:54 . 2011-05-20 04:54	114176	----a-w-	c:\windows\system32\admparse.dll
2011-05-20 04:54 . 2011-05-20 04:54	49664	----a-w-	c:\windows\system32\imgutil.dll
2011-05-20 04:54 . 2011-05-20 04:54	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-05-20 04:54 . 2011-05-20 04:54	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-05-20 04:54 . 2011-05-20 04:54	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-05-20 04:54 . 2011-05-20 04:54	111616	----a-w-	c:\windows\system32\iesysprep.dll
2011-05-20 04:54 . 2011-05-20 04:54	76800	----a-w-	c:\windows\system32\tdc.ocx
2011-05-20 04:54 . 2011-05-20 04:54	448512	----a-w-	c:\windows\system32\html.iec
2011-05-20 04:54 . 2011-05-20 04:54	85504	----a-w-	c:\windows\system32\iesetup.dll
2011-05-20 04:54 . 2011-05-20 04:54	1492992	----a-w-	c:\windows\system32\inetcpl.cpl
2011-05-20 04:54 . 2011-05-20 04:54	30720	----a-w-	c:\windows\system32\licmgr10.dll
2011-05-20 04:54 . 2011-05-20 04:54	603648	----a-w-	c:\windows\system32\vbscript.dll
2011-05-20 04:54 . 2011-05-20 04:54	165888	----a-w-	c:\windows\system32\iexpress.exe
2011-05-20 04:54 . 2011-05-20 04:54	160256	----a-w-	c:\windows\system32\wextract.exe
2011-04-09 07:02 . 2011-05-11 00:08	5562240	----a-w-	c:\windows\system32\ntoskrnl.exe
2011-04-09 06:58 . 2011-05-16 01:02	142336	----a-w-	c:\windows\system32\poqexec.exe
2011-04-09 06:02 . 2011-05-11 00:08	3967872	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-11 00:08	3912576	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-16 01:02	123904	----a-w-	c:\windows\SysWow64\poqexec.exe
2011-04-06 23:26 . 2011-04-06 23:26	96544	----a-w-	c:\windows\system32\dnssd.dll
2011-04-06 23:26 . 2011-04-06 23:26	69408	----a-w-	c:\windows\system32\jdns_sd.dll
2011-04-06 23:26 . 2011-04-06 23:26	237856	----a-w-	c:\windows\system32\dnssdX.dll
2011-04-06 23:26 . 2011-04-06 23:26	119584	----a-w-	c:\windows\system32\dns-sd.exe
2011-04-06 23:20 . 2011-04-06 23:20	91424	----a-w-	c:\windows\SysWow64\dnssd.dll
2011-04-06 23:20 . 2011-04-06 23:20	75040	----a-w-	c:\windows\SysWow64\jdns_sd.dll
2011-04-06 23:20 . 2011-04-06 23:20	197920	----a-w-	c:\windows\SysWow64\dnssdX.dll
2011-04-06 23:20 . 2011-04-06 23:20	107808	----a-w-	c:\windows\SysWow64\dns-sd.exe
.
.
((((((((((((((((((((((((((((( [email protected]_23.45.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-30 11:06 . 2011-06-23 00:13	62366 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-06-22 23:21	54830 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-06-23 07:29	54830 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-18 12:12 . 2011-06-23 07:29	21510 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3191000418-4245246833-2286775888-1000_UserData.bin
- 2011-06-22 23:44 . 2011-06-22 23:44	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-06-23 07:39 . 2011-06-23 07:39	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-06-22 23:44 . 2011-06-22 23:44	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-06-23 07:39 . 2011-06-23 07:39	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 05:01 . 2011-06-22 23:43	397600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-06-23 07:39	397600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-11-19 02:13 . 2011-06-23 07:39	8149180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3191000418-4245246833-2286775888-1000-8192.dat
- 2010-11-19 02:13 . 2011-06-22 23:43	8149180 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3191000418-4245246833-2286775888-1000-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPAdvisorDock"="c:\program files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe" [2010-09-28 1715768]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-02-22 2363392]
"EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2009-10-10 25623336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-11 98304]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-30 421888]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2009-11-19 54576]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-06-08 421160]
"MFARestart"="c:\programdata\MFAData\pack\avgrunasx.exe" [BU]
.
c:\users\Delaney\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files (x86)\Microsoft Office\Office12\GROOVE.EXE [2011-1-11 337264]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-11 136176]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-11 136176]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 PCTINDIS5X64;PCTINDIS5X64 NDIS Protocol Driver; [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2010-02-05 98208]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-02-26 127984]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-01-27 102968]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-02-04 92216]
S2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-02-22 18:38	451872	----a-w-	c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-11 22:38]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-11 22:38]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3191000418-4245246833-2286775888-1000Core.job
- c:\users\Delaney\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-03 06:41]
.
2011-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3191000418-4245246833-2286775888-1000UA.job
- c:\users\Delaney\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-03 06:41]
.
2011-06-21 c:\windows\Tasks\HPCeeScheduleForDelaney.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05 10:53]
.
2011-06-23 c:\windows\Tasks\RegistryBooster.job
- c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2011-06-21 09:42]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-20 6489704]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-01-12 451072]
"RtkOSD"="c:\program files (x86)\Realtek\Audio\OSD\RtVOsd64.exe" [2010-02-05 995840]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-30 172032]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-01-27 8192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
TCP: Interfaces\{3375D107-FCDF-40EF-878C-FEBBE2F64527}: NameServer = 192.168.0.1
TCP: Interfaces\{3375D107-FCDF-40EF-878C-FEBBE2F64527}\B496D6265627C69765D20534D275962756C6563737: NameServer = 192.168.0.1
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
.
**************************************************************************
.
Completion time: 2011-06-23 00:53:54 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-23 07:53
.
Pre-Run: 216,014,123,008 bytes free
Post-Run: 215,986,712,576 bytes free
.
- - End Of File - - 1FD8E5F104FA5A0C5EA2DBC46BE7C26A

Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:58:31 AM, on 6/23/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Electronic Arts\EADM\Core.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Microsoft Office\Office12\GROOVE.EXE
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Delaney\Downloads\HijackThis.exe
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MFARestart] "C:\ProgramData\MFAData\pack\avgrunasx.exe" /usereg
O4 - HKCU\..\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files (x86)\Microsoft Office\Office12\GROOVE.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3375D107-FCDF-40EF-878C-FEBBE2F64527}: NameServer = 192.168.0.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: CinemaNow Service - CinemaNow, Inc. - C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Health Check Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Wireless Assistant Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: RtVOsdService Installer (RtVOsdService) - Realtek Semiconductor Corp. - C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12522 bytes


----------



## Cookiegal (Aug 27, 2003)

It appears ComboFix ran more than once. Please look in this folder:

C:\qoobox\

for any log files that look like this and copy and post those results.

ComboFix2.txt


----------



## sk8clayton (May 29, 2011)

ComboFix did run more then once because my computer froze in the middle of it running so i thought I'd do it again. 
This time when it froze i decided to close the laptop and open it and when i did a notice came up telling me that it stopped responding due to overheating. i then felt the vent for air being pushed out and realized the fans weren't running. i also have noticed that my laptop has been getting really hot way faster then before. is it possible that the fan is broken and that is what is causing it to freeze frequently? and i didn't see any other log file.


----------



## Cookiegal (Aug 27, 2003)

Yes, that is indeed possible. You should get that checked out.


----------



## sk8clayton (May 29, 2011)

ok well i now bought a cooling pad as I'm soon going to send in my laptop to HP to get the fan fixed.
it stopped freezing since i got it. but out of no where i got another blue screen and now it freezes again. this is so frustrating


----------



## Cookiegal (Aug 27, 2003)

Can you attach the minidump that should have been created by the BSOD please? You'll have to zip it (compress it) first and attach is as a .zip file.

It should be located at C:\Windows\Minidump\Minidump.dmp


----------



## sk8clayton (May 29, 2011)

it will not allow me to zip the minidump folder.

it says "file not found or no read permission"


----------



## Cookiegal (Aug 27, 2003)

Try copying the file to the desktop first and then see if you can zip it. If not, try it in safe mode.


----------



## sk8clayton (May 29, 2011)

minidump:


----------



## Cookiegal (Aug 27, 2003)

Did you copy the file and upload that? I don't know why it says "shortcut" so I wonder if you only created a shortcut to the file in its original location.

I don't read the dumps and will be asking someone to do it for us but want to be sure it's the correct file first.


----------



## sk8clayton (May 29, 2011)

i sent it to the desktop from the original location so it would allow me to zip it.


----------



## Cookiegal (Aug 27, 2003)

If you sent it to the desktop then it only created a shortcut. You need to copy the file. If it won't let you then try doing it in safe mode.


----------



## sk8clayton (May 29, 2011)

this time i copied it to the desktop instead of sending it to it.


----------



## valis (Sep 24, 2004)

On Tue 7/5/2011 11:26:59 AM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\070511-30342-01.dmp
This was probably caused by the following module: clwvd.sys (clwvd+0x1429) 
Bugcheck code: 0xD1 (0xFFFFF8800A48A000, 0x2, 0x1, 0xFFFFF880048D1429)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: clwvd.sys . 
Google query: clwvd.sys DRIVER_IRQL_NOT_LESS_OR_EQUAL


----------



## valis (Sep 24, 2004)

that appears to be related to the cyber link webcam.....do you have one of those attached?


----------



## Cookiegal (Aug 27, 2003)

Thanks Tim.


----------



## valis (Sep 24, 2004)

de nada. 

Glad to help. Curious to see if that actually solves it, or if that device is still attached. If not, dump the driver and go from there.


----------



## sk8clayton (May 29, 2011)

i do have the device attached. so what exactly do i do?


----------



## valis (Sep 24, 2004)

I'd go to the cyberlink site and update the driver.


----------



## sk8clayton (May 29, 2011)

i downloaded an upgrade for cyberlink youcam and it said that the installation was aborted because i dont have the full version.


----------



## valis (Sep 24, 2004)

full version of what? The webcam? Is it trial software? If so, I'd either buy it or uninstall it.


----------



## sk8clayton (May 29, 2011)

yes of the webcam...its not a trial but it came with my laptop. i guess i'll try to buy it. other then that i noticed that my laptop only freezes after i plug it in to charge. and today wen i turned it on it made a continuous beeping sound, then stopped and started up normally.


----------



## valis (Sep 24, 2004)

what is the make and model of the laptop? Generally one doesn't have to purchase the drivers for the webcam that cam with the laptop, as that's built into the chassis......If you can get me the make and model, I'll see what I can find.

The continuous beeping is curious, and maybe not in a good way. When you booted, was it plugged in? If so, is this the factory electrical cord you are using, or have you purchased a second one?

If you could do the following, that would help quite a bit. We only need the last 3 or so entries:

go to start > run > eventvwr.msc. That will open an explorer like window with applications, security, and system in the left pane. Click on system and see if there are any exclamation points near to when it last froze; if so, double click on the item in the right pane, click on the two pieces of paper to copy it to your clipboard, and then come back here and paste the results. Then do the same for the applications folder; look for any exclamation marks that are near in time to when your pc is freezing.

thanks, 

v


----------



## valis (Sep 24, 2004)

also, after you copy them over here, right click on the applications folder in the left pane > clear all events. You will be prompted if you wish to save the entries, just click no, and then do the same with the system folder. Then reboot, and run through the entries in my post 35 again. This will serve to flush out the event logs and then we can see what is being written on bootup.

thanks, 

v


----------



## sk8clayton (May 29, 2011)

model name: HP G42-243CL Notebook PC
product number: WQ649UA#ABA
It was not plugged in when booted except the cooling pad. Also, the charger is the one that came with the laptop.

Log Name: System
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 7/12/2011 3:08:00 AM
Event ID: 4001
Task Category: None
Level: Warning
Keywords: 
User: SYSTEM
Computer: Delaney-PC
Description:
WLAN AutoConfig service has successfully stopped.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
<EventID>4001</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>2</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2011-07-12T10:08:00.728581200Z" />
<EventRecordID>251436</EventRecordID>
<Correlation />
<Execution ProcessID="552" ThreadID="1244" />
<Channel>System</Channel>
<Computer>Delaney-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-WLAN-AutoConfig
Date: 7/11/2011 11:09:47 PM
Event ID: 10002
Task Category: None
Level: Warning
Keywords: 
User: SYSTEM
Computer: Delaney-PC
Description:
WLAN Extensibility Module has stopped.

Module Path: C:\Windows\system32\athihvs.dll

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
<EventID>10002</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2011-07-12T06:09:47.304749000Z" />
<EventRecordID>251317</EventRecordID>
<Correlation />
<Execution ProcessID="768" ThreadID="4088" />
<Channel>System</Channel>
<Computer>Delaney-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
C:\Windows\system32\athihvs.dll
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 7/11/2011 11:09:35 PM
Event ID: 10010
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Delaney-PC
Description:
The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10010</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-07-12T06:09:35.000000000Z" />
<EventRecordID>251266</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Delaney-PC</Computer>
<Security />
</System>
<EventData>
{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 7/11/2011 4:50:10 AM
Event ID: 10010
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Delaney-PC
Description:
The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10010</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-07-11T11:50:10.000000000Z" />
<EventRecordID>250908</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Delaney-PC</Computer>
<Security />
</System>
<EventData>
{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
</EventData>
</Event>


----------



## valis (Sep 24, 2004)

I checked here, and did not see a driver for the webcam........you may want to call HP support and go from there......


----------

