Advertisement
Advertisement
 Search | |
| |
20-Feb-2012, 09:28 AM
#2 | |||||||
| Hi spqr05 and welcome to the forums! I'm Sunyata and I will be helping you with your computer problems. Please read the following guidelines which will help to make cleaning your machine easier:
Note to Vista and Windows 7 users:
Please download aswMBR to your desktop.
|
21-Feb-2012, 09:48 AM
#4 | |||||||
| Hello spqr05 Quote:
Quote:
Please read through these instructions to familarize yourself with what to expect when this tool runs Please download ComboFix from one of the following locations: **IMPORTANT! Save ComboFix to your Desktop. Read the following thoroughly
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message box:  Click on 'Yes', to continue scanning for malware. When finished, it will produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions. 3. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser. 4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please let me know. 5. ComboFix disconnects your machine from the internet. The connection is automatically restored before ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine. In your next reply please post the log created by ComboFix. |
21-Feb-2012, 11:56 PM
#5 | ||||||
| Hello spqr05 Quote: sometimes in the taskmanager it goes up to 80 cpu usage Can you tell me the name of the program in the task manager that behaves this way? Earlier it was firefox. But I've had it just running up and nothing is in the task manager running. I've seen csrss or lsass, search protocol but these are all running at low cpu. Firefox is high, plus this serachindexer.exe Im not sure if that's microsoft but we dont' use that one. i do see it in my toolbar. Quote: this was done in safe mode with networking, do you want me to try it in normal mode? Do you have a specific reason for running scans in safe mode? It is OK for the aswMBR scan. This next scan, however, please perform in Normal Mode if possible. The computer was struggling to do anything so I was trying to simply get it to load a browser. In safe mode overnight it was going crazy. I clicked once on mozilla and it loaded it over 100 times, then it was saying things about my database act and microsoft like it was trying to access information when I had not clicked on anything. It was ok to load after like 5 - 10 restarts this evening in normal mode but a pain in the bhind. thanks for your help again. firefox seems to take up lots of resources at times but 10 - 20% ComboFix 12-02-21.02 - Terry Durham 02/21/2012 20:37:07.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1014 [GMT -8:00] Running from: d:\documents and settings\Terry Durham\Desktop\ComboFix.exe AV: ESET Smart Security 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe c:\my documents\~WRL0807.tmp d:\documents and settings\Terry Durham\WINDOWS . . ((((((((((((((((((((((((( Files Created from 2012-01-22 to 2012-02-22 ))))))))))))))))))))))))))))))) . . 2012-02-09 17:08 . 2012-02-09 17:08 -------- d-----w- d:\documents and settings\Administrator.SPQR.000 2012-02-03 22:26 . 2012-02-03 22:26 -------- d-----w- d:\windows\system32\winrm 2012-02-03 22:26 . 2012-02-03 22:26 -------- dc-h--w- d:\windows\$968930Uinstall_KB968930$ 2012-02-03 20:13 . 2012-02-03 20:13 -------- d-----w- d:\program files\Common Files\Java 2012-02-03 20:13 . 2012-02-03 20:13 476904 ----a-w- d:\program files\Mozilla Firefox\plugins\npdeployJava1.dll 2012-02-03 20:13 . 2012-02-03 20:13 73728 ----a-w- d:\windows\system32\javacpl.cpl 2012-02-03 20:13 . 2012-02-03 20:13 472808 ----a-w- d:\windows\system32\deployJava1.dll 2012-02-03 20:13 . 2012-02-03 20:13 -------- d-----w- d:\program files\Java 2012-02-03 19:59 . 2012-02-03 19:59 -------- d-----w- d:\documents and settings\Terry Durham\Application Data\ArcSoft 2012-01-23 17:53 . 2012-01-23 17:53 -------- d-----w- d:\program files\iPod 2012-01-23 17:53 . 2012-01-23 17:54 -------- d-----w- d:\program files\iTunes . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-16 16:58 . 2010-03-03 00:08 952 --sha-w- d:\documents and settings\All Users\Application Data\KGyGaAvL.sys 2012-01-13 13:26 . 2011-05-25 16:23 414368 ----a-w- d:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-10 23:24 . 2009-08-27 15:33 20464 ----a-w- d:\windows\system32\drivers\mbam.sys 2011-11-25 21:57 . 2004-08-04 12:00 293376 ----a-w- d:\windows\system32\winsrv.dll 2012-01-29 15:55 . 2011-11-09 15:57 134104 ----a-w- d:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP OfficeJet Series 700"="d:\program files\Hewlett-Packard\HP OfficeJet Series 700\bin\ktchnsnk.exe -reg Software\Hewlett-Packard\OfficeJet Series 700\Install" [X] "egui"="d:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640] "PPort11reminder"="d:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=d:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup . [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=d:\windows\pss\Windows Search.lnkCommon Startup . [HKLM\~\startupfolder\D:^Documents and Settings^Terry Durham^Start Menu^Programs^Startup^FAXRX.lnk] path=d:\documents and settings\Terry Durham\Start Menu\Programs\Startup\FAXRX.lnk backup=d:\windows\pss\FAXRX.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] 2004-12-14 09:12 483328 ----a-w- d:\program files\Adobe\Acrobat 7.0\Distillr\acrotray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Act! Preloader] 2010-01-21 04:21 331776 ----a-w- d:\program files\ACT\Act for Windows\ActSage.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Act.Outlook.Service] 2010-01-21 04:12 28672 ----a-w- d:\program files\ACT\Act for Windows\Act.Outlook.Service.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2011-10-06 08:52 59240 ----a-w- d:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon] 2011-11-02 07:25 59240 ----a-w- d:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd] 2009-01-19 15:37 1150976 ------r- d:\program files\Brother\Brmfcmon\BrMfcWnd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3] 2009-01-09 22:53 114688 ------w- d:\program files\Brother\ControlCenter3\BrCtrCen.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ----a-w- d:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] 2003-03-12 08:03 114741 ----a-w- d:\windows\system32\dla\tfswctrl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box] 2009-09-21 16:36 122368 ----a-w- d:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch] 2008-07-10 06:05 46368 ----a-w- d:\program files\ScanSoft\PaperPort\IndexSearch.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2012-01-17 01:22 421736 ----a-w- d:\program files\iTunes\iTunesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mssSort] 2008-08-05 14:54 1647960 ----a-w- d:\program files\Maxtor\ManagerApp\msssort.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mxomssmenu] 2008-08-05 14:54 169312 ----a-w- d:\program files\Maxtor\OneTouch Status\MaxMenuMgr.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2010-01-12 06:17 13666408 ----a-w- d:\windows\system32\nvcpl.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2010-01-12 06:17 110696 ----a-w- d:\windows\system32\nvmctray.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD] 2008-07-10 06:07 29984 ----a-w- d:\program files\ScanSoft\PaperPort\pptd40nt.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-10-24 21:28 421888 ----a-w- d:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] 2002-09-11 02:57 46592 ----a-r- d:\windows\SOUNDMAN.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] 2006-10-25 16:03 210472 ----a-w- d:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard] 2002-06-18 07:01 155648 ----a-w- d:\program files\VERITAS Software\Update Manager\sgtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2011-06-09 21:06 254696 ----a-w- d:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2009-09-21 16:36 39408 ----a-w- d:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "d:\\Program Files\\ACT\\Act for Windows\\ActSage.exe"= "d:\\Program Files\\Maxtor\\ManagerApp\\MaxUtilities.exe"= "d:\\Program Files\\Brother\\Brmfl08l\\FAXRX.exe"= "d:\\Program Files\\Bonjour\\mDNSResponder.exe"= "d:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "d:\\Program Files\\iTunes\\iTunes.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "54925:UDP"= 54925:UDP:BrotherNetwork Scanner "5985:TCP"= 5985:TCP:*  isabled:Windows Remote Management . R1 ehdrv;ehdrv;d:\windows\system32\drivers\ehdrv.sys [5/14/2009 2:47 PM 107256] R2 ekrn;ESET Service;d:\program files\ESET\ESET Smart Security\ekrn.exe [5/14/2009 2:47 PM 731840] R2 Maxtor Sync Services;Maxtor Service;d:\program files\Maxtor\Sync\SyncServices.exe [8/5/2008 6:54 AM 181600] R2 MSSQL$ACT7;SQL Server (ACT7);d:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [12/10/2010 5:29 PM 29293408] S2 ACT! Scheduler;ACT! Scheduler;d:\program files\ACT\Act for Windows\Act.Scheduler.exe [1/20/2010 8:23 PM 81920] S2 nvTUNEP;nVidia WDM TVTuner;d:\windows\system32\drivers\NVTUNEP.SYS [7/24/2009 6:39 PM 15968] S2 nvtvSND;nVidia WDM TVAudio Crossbar;d:\windows\system32\drivers\NVTVSND.SYS [7/24/2009 6:39 PM 13776] S3 PLCND532;PLCND532 NDIS Protocol Driver;d:\windows\system32\drivers\PLCND532.sys [8/18/2008 1:35 PM 26656] S3 WinRM;Windows Remote Management (WS-Management);d:\windows\system32\svchost.exe -k WINRM [8/4/2004 4:00 AM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-02-13 d:\windows\Tasks\AppleSoftwareUpdate.job - d:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local IE: Convert link target to Adobe PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - d:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: intuit.com\ttlc TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1 FF - ProfilePath - d:\documents and settings\Terry Durham\Application Data\Mozilla\Firefox\Profiles\zq98iub3.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=102&sr=0&q= FF - user.js: browser.cache.disk_cache_ssl - true); user_pref(content.max.tokenizing.time, 2250000); user_pref(content.notify.backoffcount, 5); user_pref(content.notify.interval, 750000); user_pref(content.notify.ontimer, true); user_pref(content.switch.threshold, 750000); user_pref(network.http.max-connections, 48 user_pref(network.http.max-connections-per-server, 16); user_pref(network.http.max-persistent-connections-per-proxy, 16); user_pref(network.http.max-persistent-connections-per-server, 8); FF - user.js: network.http.pipelining - true); user_pref(network.http.pipelining.maxrequests, 8); user_pref(network.http.proxy.pipelining, true); user_pref(nglayout.initialpaint.delay, 750 . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) ShellIconOverlayIdentifiers-{b75ab0c8-03d5-4592-9821-a48d54d66b14} - MssShellExt.dll MSConfigStartUp-nwiz - nwiz.exe MSConfigStartUp-zzzHPSETUP - F:\Setup.exe AddRemove-NVIDIA Display Control Panel - d:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-02-21 20:43 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . Completion time: 2012-02-21 20:48:46 ComboFix-quarantined-files.txt 2012-02-22 04:48 . Pre-Run: 26,866,565,120 bytes free Post-Run: 26,570,072,064 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - FF74FEABCE87E4A29FCC0AAE2D67DA54 |
22-Feb-2012, 01:46 PM
#8 | ||||||
| OTL Extras logfile created on: 2/22/2012 10:39:08 AM - Run 1 OTL by OldTimer - Version 3.2.33.2 Folder = D:\Documents and Settings\Terry Durham\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.50 Gb Total Physical Memory | 0.93 Gb Available Physical Memory | 62.13% Memory free 3.35 Gb Paging File | 2.94 Gb Available in Paging File | 87.54% Paging File free Paging file location(s): D:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Program Files Drive C: | 407.16 Gb Total Space | 343.72 Gb Free Space | 84.42% Space Free | Partition Type: NTFS Drive D: | 58.59 Gb Total Space | 24.83 Gb Free Space | 42.38% Space Free | Partition Type: NTFS Drive E: | 37.26 Gb Total Space | 11.50 Gb Free Space | 30.87% Space Free | Partition Type: NTFS Drive H: | 20.00 Gb Total Space | 5.16 Gb Free Space | 25.81% Space Free | Partition Type: NTFS Computer Name: SPQR | User Name: Terry Durham | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "UpdatesDisableNotify" = 0 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfil e] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProf ile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet isabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet isabled:@xpsp2res.dll,-22008"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "54925:UDP" = 54925:UDP:*:Enabled:BrotherNetwork Scanner "5985:TCP" = 5985:TCP:* isabled:Windows Remote Management ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "D:\Program Files\ACT\Act for Windows\ActSage.exe" = D:\Program Files\ACT\Act for Windows\ActSage.exe:*:Enabled:ACT! 9.x/2007 -- (Sage Software, Inc.) "D:\Program Files\Maxtor\ManagerApp\MaxUtilities.exe" = D:\Program Files\Maxtor\ManagerApp\MaxUtilities.exe:*:Enabled:Maxtor Manager -- (Seagate Technology LLC) "D:\Program Files\Brother\Brmfl08l\FAXRX.exe" = D:\Program Files\Brother\Brmfl08l\FAXRX.exe:*:Enabled:FAXRX.EXE -- (Brother Industries Ltd.) "D:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = D:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet isabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)"D:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = D:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}" = ScanSoft PaperPort 11 "{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport "{07295ABF-1245-415A-BE06-863271753443}" = ShowBiz "{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = VERITAS RecordNow DX Update Manager "{0A02D347-5E53-48A5-BC49-1469393103FA}" = Brother MFL-Pro Suite MFC-495CW "{0EECD415-3431-4AAE-B13C-0D23C6AA7990}" = UpgradeTool "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = VERITAS DLA "{1240EECF-D5E1-4C1A-8337-B236E950D983}" = TurboTax 2010 wcasbpm "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216030FF}" = Java(TM) 6 Update 30 "{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (ACT7) "{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer "{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{360EDFB0-EAA2-012B-AD16-000000000000}" = TurboTax 2009 wcaiper "{36302351-EAA2-012B-AD1E-000000000000}" = TurboTax 2009 wcasbpm "{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset "{3818E081-EAA2-012B-AD94-000000000000}" = TurboTax 2009 WinBizFedFormset "{3830D551-EAA2-012B-AD9A-000000000000}" = TurboTax 2009 WinBizReleaseEngine "{383CBC31-EAA2-012B-AD9D-000000000000}" = TurboTax 2009 WinBizTaxSupport "{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset "{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine "{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport "{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper "{3C5A81D1-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{560EFF7F-252D-4841-89CD-4EEB76D5FC1F}" = Maxtor Central Axis Manager "{56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}" = GetDataBack for NTFS "{5866F83F-5347-4324-A15E-070502A65866}" = TurboTax 2010 WinBizReleaseEngine "{58795EE4-FCF7-43A4-A5F6-269E69D0CD0B}" = ACT! by Sage 2010 "{5B30AA25-BF39-4BE4-8FEE-51938BAB214D}" = TurboTax 2008 wcaiper "{5E835305-63BB-4E55-BBB7-EEBBE67774DB}" = MyDVD "{6334BBB0-8A2E-4679-B845-9CE27E72DBDA}" = TurboTax 2010 WinBizTaxSupport "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{71CBF9BB-7E07-4A9D-BF30-84C11810B242}" = ESET Smart Security "{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset "{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour "{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime "{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{87FF0E39-8490-4EB4-A557-FF12F712EF7E}" = TurboTax 2010 wcaiper "{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine "{8855FF30-19CE-4CB1-A654-87B38369CCE1}" = VERITAS RecordNow DX "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8D5D99B8-DFA2-4018-ADE9-A6B83E655C65}" = "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser "{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine "{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor "{AC76BA86-1033-0000-7760-000000000002}" = Adobe Acrobat 7.0 Professional "{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR "{B023185F-F1EF-4F97-B0BD-AE6D802226D1}" = NVIDIA WDM Drivers "{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper "{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport "{B4FEA924-630D-11D4-B78E-005004566E4D}" = ViewSonic Monitor Drivers "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C1939820-A945-11D4-86F6-0001031E5712}" = MSI MSIDVD "{C3ADD937-FD5F-4CC6-AE15-AEDEE2A20165}" = TurboTax 2010 wrapper "{C7010632-E5EE-4263-B80E-BC9D45439EB0}" = TurboTax 2010 winiper "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{E6C0F926-446B-4450-8D15-4405A9431EB7}" = TurboTax 2010 WinBizFedFormset "{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp "{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer "{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari "{F59205C8-E5FB-43F5-AAB2-16C1760D4F59}" = FaceFilter Studio Brother Edition "{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "ActiveTouchMeetingClient" = WebEx "Adobe Acrobat 7.0 Professional" = Adobe Acrobat 7.0 Professional "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "FaxTalk Communicator 4.5" = FaxTalk Communicator 4.5 "HP PrecisionScan LTX" = HP PrecisionScan LTX "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "InstallShield_{0EECD415-3431-4AAE-B13C-0D23C6AA7990}" = UpgradeTool "InstallShield_{560EFF7F-252D-4841-89CD-4EEB76D5FC1F}" = Maxtor Central Axis Manager "InstallShield_{58795EE4-FCF7-43A4-A5F6-269E69D0CD0B}" = ACT! by Sage 2010 "jZip" = jZip "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000 "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "Mozilla Firefox 10.0 (x86 en-US)" = Mozilla Firefox 10.0 (x86 en-US) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager "NVIDIAStereo" = NVIDIA Windows 95/98/ME/2000/XP Stereo Drivers "SystemRequirementsLab" = System Requirements Lab "TurboTax 2008" = TurboTax 2008 "TurboTax 2009" = TurboTax 2009 "TurboTax 2010" = TurboTax 2010 "TurboTax Business 2009" = TurboTax Business 2009 "TurboTax Business 2010" = TurboTax Business 2010 "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 ========== Last 10 Event Log Errors ========== Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt! < End of report > |
22-Feb-2012, 03:47 PM
#9 | |||||||
| Hello spqr05 Please run an OTL Fix
How is the machine behaving now? Are there still issues? |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
.
textbox. Do not include the word "Code"
.