1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Windows Vista-multiple programs "Not Responding"

Discussion in 'Virus & Other Malware Removal' started by DRR, Dec 23, 2010.

Thread Status:
Not open for further replies.
  1. DRR

    DRR Thread Starter

    Joined:
    Dec 12, 2010
    Messages:
    7
    I have recently changed to Malware and gotten rid of Norton replacing it with MS Essentials thinking perhaps Norton was consuming too many resources. It has been suggested that I may have a virus despite Norton Security. . Of note, when running the GMER program, the attached file was the first immediate response although it seemed to be running in the background but not adding anything new to the screen. After 10 minutes I saved this file and left for work. I returned 10 hours later and it was still "scanning' and soon crashed Windows. Not sure if I was supposed to have stopped the scan regardless but nevertheless, here are the requested files as I have understood them to be done. I would appreciate any assistance. Thanks!


    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 9:01:48 PM, on 12/19/2010
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v7.00 (7.00.6002.18005)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Windows\WindowsMobile\wmdSync.exe
    C:\Windows\sttray.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Users\Diane and Larry\Downloads\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: agihelper.AGUtils - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - mscoree.dll (file missing)
    O1 - Hosts: ::1 localhost
    O2 - BHO: agihelper.AGUtils - {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll (file missing)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - C:\Program Files\Iconix\IEAddOn\IconixBHO_44.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    O4 - HKLM\..\Run: [IconixOEAddOn] "C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe"
    O4 - HKLM\..\Run: [Syncables] C:\Program Files\syncables\syncables desktop\syncables.exe
    O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
    O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
    O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
    O4 - Startup: Skyscape SmartUpdate.lnk = C:\Program Files\Common Files\Skyscape\SmartUpdate.exe
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
    O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
    O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra button: (no name) - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_44.dll
    O9 - Extra 'Tools' menuitem: Email ID Preferences - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\Iconix\IEAddOn\IconixBHO_44.dll
    O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_44.dll
    O9 - Extra 'Tools' menuitem: About Email ID - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\Iconix\IEAddOn\IconixBHO_44.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\neonsp.2043.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\neonsp.2043.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\neolsp.2043.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\neolsp.2043.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\neolsp.2043.dll
    O15 - Trusted Zone: http://www.myfamily.com
    O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{AFD5EA11-3557-40A7-8A12-40E6D1318F5C}: NameServer = 8.8.8.8,128.95.112.1
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: AG Core Services (AGCoreService) - AG Interactive - C:\Program Files\AGI\core\4.2.0.10753\AGCoreService.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: Iconix Update Service (IconixService) - Unknown owner - C:\Program Files\Common Files\Iconix\IconixService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 10692 bytes


    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Diane and Larry at 5:04:24.24 on Mon 12/20/2010
    Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_23
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3069.1122 [GMT -8:00]

    AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\AGI\core\4.2.0.10753\AGCoreService.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Common Files\Iconix\IconixService.exe
    C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\PSIService.exe
    c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Windows\system32\svchost.exe -k WindowsMobile
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Windows\WindowsMobile\wmdSync.exe
    C:\Windows\sttray.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Users\Diane and Larry\Downloads\HijackThis.exe
    C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\Diane and Larry\Downloads\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uSearch Page = hxxp://www.google.com
    uStart Page = hxxp://www.google.com/
    uWindow Title = Internet Explorer provided by Dell
    uSearch Bar = hxxp://www.google.com/ie
    uDefault_Search_URL = hxxp://www.google.com/ie
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: agihelper.AGUtils: {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll
    BHO: agihelper.AGUtils: {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: RoboForm BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
    BHO: IconixBHOClass Class: {761233b6-f228-49e4-8f6b-668499d4e55a} - c:\program files\iconix\ieaddon\IconixBHO_44.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
    TB: {C17590D2-ECB4-4B15-8820-F58798DCC118} - No File
    TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    TB: {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - No File
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
    mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRun: [IconixOEAddOn] "c:\program files\iconix\oeaddon\OEdmn_6.exe"
    mRun: [Syncables] c:\program files\syncables\syncables desktop\syncables.exe
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
    mRun: [SigmatelSysTrayApp] sttray.exe
    dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
    StartupFolder: c:\users\dianea~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\skysca~1.lnk - c:\program files\common files\skyscape\SmartUpdate.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
    IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
    IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
    IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
    IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
    IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
    IE: {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - {44E212AB-13EA-4CA4-BE65-197FBA170412} - c:\program files\iconix\ieaddon\IconixBHO_44.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
    IE: {BC3F6B6D-2E49-4603-B028-7411655713F3} - {0CC2F28D-D415-4FC6-A2E4-54B4D983609A} - c:\program files\iconix\ieaddon\IconixBHO_44.dll
    LSP: %SystemRoot%\System32\neolsp.2043.dll
    Trusted Zone: myfamily.com\www
    Trusted Zone: olympicmedical.org\access
    DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: {AFD5EA11-3557-40A7-8A12-40E6D1318F5C} = 8.8.8.8,128.95.112.1

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\dianea~1\appdata\roaming\mozilla\firefox\profiles\c8rdocm8.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://search.imgag.com/?appid=kwtb&c=GNKWO50020&sbs=7&sc=2&f=homepage&vernum=3.2&uid=&did={43f93740-ceed-11dd-9b3d-8000600fe800}&q=
    FF - prefs.js: keyword.URL - hxxp://wstb.search.imgag.com/?c=&sbs=1&sc=&f=web&vernum=3.1.5.7613&uid=&did={f8d4a70c-98e2-4081-901d-01bf93043ede}&q=
    FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npIconixProxy2.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\users\diane and larry\appdata\roaming\mozilla\firefox\profiles\c8rdocm8.default\extensions\[email protected]\plugins\npImgCtl.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: United States English Spellchecker: [email protected] - %profile%\extensions\[email protected]
    FF - Ext: Ancestry.com Advanced Image Viewer: [email protected] - %profile%\extensions\[email protected]
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
    FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
    FF - Ext: All-in-One Gestures: {8b86149f-01fb-4842-9dd8-4d7eb02fd055} - %profile%\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
    FF - Ext: Live HTTP Headers: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a} - %profile%\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
    FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    ============= SERVICES / DRIVERS ===============

    R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
    R2 AGCoreService;AG Core Services;c:\program files\agi\core\4.2.0.10753\AGCoreService.exe [2010-7-3 20480]
    R2 IconixService;Iconix Update Service;c:\program files\common files\iconix\IconixService.exe [2008-7-31 283992]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-12-12 363344]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-12-12 20952]
    R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-6 135664]
    S3 nkhsbus;Nokia Handset USB Composite Device driver (UDP);c:\windows\system32\drivers\nkhsbus.sys [2007-10-13 27008]
    S3 nkhsmdm;Nokia Handset Drivers (UDP);c:\windows\system32\drivers\nkhsmdm.sys [2007-10-13 41216]
    S3 nkhsvsp;Nokia Handset Diagnostic Serial Port (UDP);c:\windows\system32\drivers\nkhsvsp.sys [2007-10-13 39552]
    S3 WideUSB;WideUSB Generic USB Bulk driver;c:\windows\system32\drivers\WideUSB.sys [2007-4-22 22545]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2010-12-20 03:13:37 222080 ------w- c:\windows\system32\MpSigStub.exe
    2010-12-20 02:19:23 -------- d-----w- c:\windows\system32\eu-ES
    2010-12-20 02:19:23 -------- d-----w- c:\windows\system32\ca-ES
    2010-12-20 02:19:22 -------- d-----w- c:\windows\system32\vi-VN
    2010-12-20 01:18:59 -------- d-----w- c:\windows\system32\EventProviders
    2010-12-20 01:12:46 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{27511e9a-f447-4da9-8176-1ed183ce9c10}\gapaengine.dll
    2010-12-20 01:11:49 6273872 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{d64df11c-b162-4908-b353-113da61507e8}\mpengine.dll
    2010-12-20 00:55:22 -------- d-----w- c:\program files\Microsoft Security Client
    2010-12-20 00:51:39 221568 ----a-w- c:\windows\system32\drivers\netio.sys
    2010-12-19 17:32:47 -------- d--h--w- c:\progra~2\.Syncables
    2010-12-19 17:30:54 -------- d-----w- c:\program files\syncables
    2010-12-15 21:02:02 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2010-12-15 21:02:02 352768 ----a-w- c:\windows\system32\taskschd.dll
    2010-12-15 21:02:01 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2010-12-15 21:02:00 270336 ----a-w- c:\windows\system32\taskcomp.dll
    2010-12-15 21:02:00 171520 ----a-w- c:\windows\system32\taskeng.exe
    2010-12-15 21:00:54 292352 ----a-w- c:\windows\system32\atmfd.dll
    2010-12-15 21:00:53 72704 ----a-w- c:\windows\system32\fontsub.dll
    2010-12-15 21:00:53 34304 ----a-w- c:\windows\system32\atmlib.dll
    2010-12-15 20:59:50 2048 ----a-w- c:\windows\system32\tzres.dll
    2010-12-15 20:46:54 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    2010-12-12 18:34:17 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-12-12 18:34:17 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2010-12-12 18:32:07 -------- d-----w- c:\users\dianea~1\appdata\roaming\Malwarebytes
    2010-12-12 18:32:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-12 18:32:02 -------- d-----w- c:\progra~2\Malwarebytes
    2010-12-12 18:31:59 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-12 18:31:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-12 18:28:40 195928 ----a-w- c:\program files\mozilla firefox\plugins\npIconixProxy36.dll
    2010-12-12 18:28:40 192344 ----a-w- c:\program files\mozilla firefox\extensions\{1253d21b-263b-1843-275c-1726da8b2a12}\components\FFProxy36.dll
    2010-12-12 07:03:58 -------- d-----w- c:\windows\pss
    2010-12-10 18:20:41 -------- d-----w- c:\progra~2\PCDr
    2010-12-10 18:20:27 -------- d-----w- c:\users\dianea~1\appdata\roaming\PCDr
    2010-12-09 17:02:24 -------- d-----w- c:\users\dianea~1\appdata\roaming\RoboForm
    2010-12-09 06:24:47 749832 ----a-w- c:\progra~2\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
    2010-12-04 23:07:04 -------- d-----w- c:\progra~2\GoodSync
    2010-12-04 23:07:00 -------- d-----w- c:\users\dianea~1\appdata\roaming\GoodSync
    2010-12-02 03:35:18 4280320 ----a-w- c:\windows\system32\GPhotos.scr

    ==================== Find3M ====================

    2010-12-16 23:46:27 2516 --sha-w- c:\progra~2\KGyGaAvL.sys
    2010-10-21 20:08:42 834048 ----a-w- c:\windows\system32\wininet.dll
    2010-10-21 18:30:50 389632 ----a-w- c:\windows\system32\html.iec
    2010-10-20 17:41:28 78336 ----a-w- c:\windows\system32\ieencode.dll
    2010-10-18 13:37:35 81920 ----a-w- c:\windows\system32\consent.exe
    2010-10-18 13:31:24 2038272 ----a-w- c:\windows\system32\win32k.sys
    2010-10-15 18:47:49 724992 ----a-w- c:\windows\iun6002.exe

    ============= FINISH: 5:05:39.16 ===============

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2010-12-21 06:12:58
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2 ST325082 rev.3.AD
    Running: 4tl91254.exe; Driver: C:\Users\DIANEA~1\AppData\Local\Temp\kwtdrkob.sys


    ---- Kernel code sections - GMER 1.0.15 ----

    .text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8E409340, 0x413097, 0xE8000020]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtCreateFile + 6 77B643DA 4 Bytes [28, 00, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtCreateFile + B 77B643DF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtMapViewOfSection + 6 77B64B2A 1 Byte [28]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtMapViewOfSection + 6 77B64B2A 4 Bytes [28, 03, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtMapViewOfSection + B 77B64B2F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenFile + 6 77B64BBA 4 Bytes [68, 00, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenFile + B 77B64BBF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenProcess + 6 77B64C3A 4 Bytes [A8, 01, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenProcess + B 77B64C3F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenProcessToken + B 77B64C4F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenProcessTokenEx + 6 77B64C5A 4 Bytes [A8, 02, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenProcessTokenEx + B 77B64C5F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenThread + 6 77B64CAA 4 Bytes [68, 01, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenThread + B 77B64CAF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenThreadToken + 6 77B64CBA 4 Bytes [68, 02, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenThreadToken + B 77B64CBF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtOpenThreadTokenEx + B 77B64CCF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtQueryAttributesFile + 6 77B64D5A 4 Bytes [A8, 00, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtQueryAttributesFile + B 77B64D5F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtQueryFullAttributesFile + B 77B64E0F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtSetInformationFile + 6 77B652EA 4 Bytes [28, 01, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtSetInformationFile + B 77B652EF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtSetInformationThread + 6 77B6533A 4 Bytes [28, 02, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtSetInformationThread + B 77B6533F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtUnmapViewOfSection + 6 77B655DA 1 Byte [68]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtUnmapViewOfSection + 6 77B655DA 4 Bytes [68, 03, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3240] ntdll.dll!NtUnmapViewOfSection + B 77B655DF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtCreateFile + 6 77B643DA 4 Bytes [28, 00, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtCreateFile + B 77B643DF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtMapViewOfSection + 6 77B64B2A 1 Byte [28]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtMapViewOfSection + 6 77B64B2A 4 Bytes [28, 03, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtMapViewOfSection + B 77B64B2F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenFile + 6 77B64BBA 4 Bytes [68, 00, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenFile + B 77B64BBF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcess + 6 77B64C3A 4 Bytes [A8, 01, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcess + B 77B64C3F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcessToken + B 77B64C4F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcessTokenEx + 6 77B64C5A 4 Bytes [A8, 02, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenProcessTokenEx + B 77B64C5F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThread + 6 77B64CAA 4 Bytes [68, 01, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThread + B 77B64CAF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThreadToken + 6 77B64CBA 4 Bytes [68, 02, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThreadToken + B 77B64CBF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtOpenThreadTokenEx + B 77B64CCF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtQueryAttributesFile + 6 77B64D5A 4 Bytes [A8, 00, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtQueryAttributesFile + B 77B64D5F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtQueryFullAttributesFile + B 77B64E0F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationFile + 6 77B652EA 4 Bytes [28, 01, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationFile + B 77B652EF 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationThread + 6 77B6533A 4 Bytes [28, 02, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtSetInformationThread + B 77B6533F 1 Byte [E2]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtUnmapViewOfSection + 6 77B655DA 1 Byte [68]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtUnmapViewOfSection + 6 77B655DA 4 Bytes [68, 03, 16, 00]
    .text C:\Program Files\Google\Chrome\Application\chrome.exe[3680] ntdll.dll!NtUnmapViewOfSection + B 77B655DF 1 Byte [E2]

    ---- Devices - GMER 1.0.15 ----

    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
    Device fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
    Device udfs.sys (UDF File System Driver/Microsoft Corporation)

    AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] C:\Program Files\Microsoft Works\wkimgsrv.dll
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] Apartment
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] 0
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\MiscStatus\1
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\MiscStatus\[email protected] 131473
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] MicrosoftWorks.WkImgSrv.WksImagingServer.6
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] C:\Program Files\Microsoft Works\wkimgsrv.dll, 101
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] {EA7E74A3-3A70-43A0-8ED7-D96A09C6394D}
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] 6.0
    Reg HKLM\SOFTWARE\Classes\CLSID\{E1D2EC70-9460-4C9F-D7D1-AA9F10E890A2}\[email protected] IWksImagingServer
     

    Attached Files:

  2. DRR

    DRR Thread Starter

    Joined:
    Dec 12, 2010
    Messages:
    7
    I posted my logs on 12/23 and now I don't even see it listed any longer. Never got a response. Would appreciate help.
    DRR
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/970281

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice