|
#31
March 6th, 2012, 01:30 AM
|
|||
|
|||
|
OTL logfile created on: 3/5/2012 8:12:20 PM - Run 5
OTL by OldTimer - Version 3.2.35.0 Folder = c:\Users\herbw2\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.99 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.48% Memory free 4.21 Gb Paging File | 2.97 Gb Available in Paging File | 70.53% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 105.18 Gb Total Space | 45.69 Gb Free Space | 43.44% Space Free | Partition Type: NTFS Computer Name: HERBW2-PC | User Name: herbw2 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/03/03 12:40:14 | 000,585,216 | ---- | M] (OldTimer Tools) -- c:\Users\herbw2\Downloads\OTL.exe PRC - [2012/02/16 09:40:41 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2012/02/02 02:44:30 | 003,329,824 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\herbw2\AppData\Local\Akamai\netsession_wi n.exe PRC - [2012/01/25 10:16:28 | 000,931,640 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe PRC - [2012/01/09 09:46:26 | 000,313,624 | ---- | M] (Speedbit Ltd.) -- C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorService.exe PRC - [2012/01/09 09:46:26 | 000,153,888 | ---- | M] (Speedbit Ltd.) -- C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorEngine.exe PRC - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011/12/17 20:34:23 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe PRC - [2011/12/12 11:03:40 | 000,290,832 | ---- | M] (Verizon) -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMes sageCenter.exe PRC - [2011/11/23 21:21:24 | 000,025,704 | R--- | M] (Amazon.com) -- C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe PRC - [2010/09/02 14:00:10 | 001,146,256 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Care\VCsystray.exe PRC - [2010/08/12 15:15:34 | 000,187,792 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe PRC - [2010/08/12 15:15:34 | 000,081,296 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Care\VCSpt.exe PRC - [2010/05/18 13:38:46 | 000,075,776 | ---- | M] (Sony of America Corporation) -- C:\Program Files\Sony\VAIO Care\listener.exe PRC - [2010/03/17 15:55:42 | 001,565,696 | ---- | M] (Alcatel-Lucent) -- C:\Program Files\Verizon\McciTrayApp.exe PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2007/12/01 17:38:16 | 000,038,400 | R--- | M] () -- C:\Program Files\Corel\Corel MediaOne\CorelIOMonitor.exe PRC - [2007/03/14 10:49:00 | 000,101,528 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe PRC - [2007/02/13 18:19:48 | 000,182,392 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe PRC - [2007/02/13 18:19:48 | 000,100,472 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe PRC - [2007/02/09 13:54:42 | 000,923,768 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Power Management\SPMgr.exe PRC - [2007/02/05 14:22:08 | 000,546,936 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe PRC - [2007/02/04 11:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe PRC - [2007/01/22 23:39:32 | 000,321,656 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\ISB Utility\ISBMgr.exe PRC - [2007/01/11 20:36:34 | 000,469,112 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe PRC - [2006/11/28 22:27:46 | 000,274,432 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe PRC - [2006/11/28 22:09:58 | 000,135,168 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe PRC - [2006/11/28 22:09:46 | 000,172,032 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe PRC - [2006/11/13 08:32:52 | 000,118,784 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe PRC - [2006/11/13 08:32:52 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe PRC - [2006/11/13 08:32:49 | 000,042,544 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApMsgFwd.exe PRC - [2006/11/02 20:40:12 | 000,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe ========== Modules (No Company Name) ========== MOD - [2012/02/18 06:36:02 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll MOD - [2012/02/17 04:46:53 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Management\8b5f54e3b382fc1720c76557ef8c8bc3\Sy stem.Management.ni.dll MOD - [2012/02/17 04:41:05 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.ServiceProce#\d0cf808e33a5123b33010b933d3b1597 \System.ServiceProcess.ni.dll MOD - [2012/02/16 18:27:57 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web\2598077ccea480c6120d3a1ad4455be0\System.We b.ni.dll MOD - [2012/02/16 09:40:41 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2012/02/16 06:45:29 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Configuration\7fd6c62196829d1e2dce5a253145d51a \System.Configuration.ni.dll MOD - [2012/02/16 06:35:48 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xm l.ni.dll MOD - [2012/02/16 06:35:13 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3 \System.Windows.Forms.ni.dll MOD - [2012/02/16 06:34:59 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing\137696d0416b65dbc1561152971488b4\Syste m.Drawing.ni.dll MOD - [2012/02/16 06:32:12 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll MOD - [2011/10/12 05:52:40 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\msc orlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni .dll MOD - [2011/06/24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011/06/24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2007/12/01 17:38:16 | 000,038,400 | R--- | M] () -- C:\Program Files\Corel\Corel MediaOne\CorelIOMonitor.exe MOD - [2007/01/23 08:12:47 | 000,061,440 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll MOD - [2007/01/23 08:12:27 | 000,077,824 | ---- | M] () -- C:\Windows\System32\hccutils.dll ========== Win32 Services (SafeList) ========== SRV - [2012/02/10 15:51:07 | 003,340,064 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai) SRV - [2012/01/25 10:16:28 | 000,931,640 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService) SRV - [2012/01/09 09:46:26 | 000,313,624 | ---- | M] (Speedbit Ltd.) [Disabled | Running] -- C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorService.exe -- (VideoAcceleratorService) SRV - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011/12/12 11:03:40 | 000,290,832 | ---- | M] (Verizon) [Auto | Running] -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMes sageCenter.exe -- (IHA_MessageCenter) SRV - [2011/11/23 21:21:24 | 000,025,704 | R--- | M] (Amazon.com) [Auto | Running] -- C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe -- (ADVService) SRV - [2011/11/16 11:23:44 | 000,377,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc) SRV - [2010/08/12 15:15:34 | 000,187,792 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector) SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/03/14 10:49:00 | 000,101,528 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC) SRV - [2007/02/13 18:19:48 | 000,182,392 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service) SRV - [2007/01/16 16:05:00 | 002,523,136 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe -- (VAIOMediaPlatform-IntegratedServer-AppServer) SRV - [2007/01/16 16:05:00 | 001,089,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe -- (VAIOMediaPlatform-UCLS-UPnP) VAIO Media Content Collection (UPnP) SRV - [2007/01/16 16:05:00 | 001,089,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe -- (VAIOMediaPlatform-IntegratedServer-UPnP) VAIO Media Integrated Server (UPnP) SRV - [2007/01/10 18:51:06 | 000,745,472 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe -- (VAIOMediaPlatform-UCLS-AppServer) SRV - [2007/01/10 13:43:24 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardware ResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service) SRV - [2007/01/08 19:06:40 | 000,397,312 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe -- (VAIOMediaPlatform-UCLS-HTTP) VAIO Media Content Collection (HTTP) SRV - [2007/01/08 19:06:40 | 000,397,312 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe -- (VAIOMediaPlatform-IntegratedServer-HTTP) VAIO Media Integrated Server (HTTP) SRV - [2007/01/08 19:01:34 | 000,491,520 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe -- (VAIOMediaPlatform-Mobile-Gateway) SRV - [2006/12/14 05:21:20 | 000,045,056 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV) SRV - [2006/12/14 05:02:08 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV) SRV - [2006/12/14 04:46:16 | 000,057,344 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR) SRV - [2006/11/28 22:27:46 | 000,274,432 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw) SRV - [2006/11/28 22:09:58 | 000,135,168 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe -- (VzFw) SRV - [2006/11/28 22:09:46 | 000,172,032 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc) SRV - [2006/11/02 20:40:12 | 000,174,656 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (catchme) DRV - [2012/01/25 10:18:14 | 000,021,520 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- c:\ProgramData\Trusteer\Rapport\store\exts\Rapport MS\baseline\RapportIaso.sys -- (RapportIaso) DRV - [2012/01/25 10:16:44 | 000,164,112 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG) DRV - [2012/01/25 10:16:44 | 000,071,440 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys -- (RapportEI) DRV - [2012/01/25 10:16:44 | 000,056,208 | ---- | M] (Trusteer Ltd.) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\RapportKELL.sys -- (RapportKELL) DRV - [2011/12/15 18:00:19 | 000,228,208 | ---- | M] () [Kernel | System | Running] -- C:\ProgramData\Trusteer\Rapport\store\exts\Rapport Cerberus\34302\RapportCerberus32_34302.sys -- (RapportCerberus_34302) DRV - [2010/03/17 15:53:38 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50) DRV - [2010/03/17 15:53:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50) DRV - [2009/12/30 10:21:18 | 000,027,192 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\revoflt.sys -- (Revoflt) DRV - [2008/08/18 05:15:48 | 000,921,600 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2007/02/08 19:03:16 | 000,002,560 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\Windows\System32\drivers\cdralw2k.sys -- (Cdralw2k) DRV - [2007/02/08 19:03:16 | 000,002,432 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\Windows\System32\drivers\cdr4_xp.sys -- (Cdr4_xp) DRV - [2007/02/08 08:27:24 | 000,807,424 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ti21sony.sys -- (ti21sony) DRV - [2007/02/01 01:37:18 | 000,027,520 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SonyNC.sys -- (SNC) DRV - [2006/11/13 22:07:45 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2006/11/13 08:32:52 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2006/10/18 14:56:30 | 000,010,216 | ---- | M] (Sony Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\DMICall.sys -- (DMICall) DRV - [2006/10/18 13:43:18 | 000,124,256 | R--- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\SearchScopes,DefaultScope = {8559919C-0A84-4B5D-A82C-54BD40405BC5} IE - HKLM\..\SearchScopes\{8559919C-0A84-4B5D-A82C-54BD40405BC5}: "URL" = http://search.aol.com/aolcom/webhome IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVer sion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=Z192&install_date=20110828 IE - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2 IE - HKU\..\SearchScopes,DefaultScope = {409F77EF-05DC-4EF1-80CB-13FDE0F637FF} IE - HKU\..\SearchScopes\{011870E8-844A-4D10-8289-4978D6C84DA3}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language }&ie={inputEncoding}&oe={outputEncoding}&startInde x={startIndex?}&startPage={startPage} IE - HKU\..\SearchScopes\{409F77EF-05DC-4EF1-80CB-13FDE0F637FF}: "URL" = http://www.bing.com/search?q={searchTerms}&form=MS8TDF&pc=MS8TDF&src=I E-SearchBox IE - HKU\..\SearchScopes\{8559919C-0A84-4B5D-A82C-54BD40405BC5}: "URL" = http://search.aol.com/aolcom/webhome IE - HKU\..\SearchScopes\{F88C01AF-7259-4F87-AFE3-B5EC4BC642C3}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=937811&p={searchTerms} IE - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www22.verizon.com/foryourhome/MyAccount/Protected/Overview/MyOverView.aspx" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: wrc@avast.com:20110101 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent) FF - HKLM\Software\MozillaPlugins\@nbc.com/DirectPlayer: File not found FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.0: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\herbw2\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll (Move Networks) FF - HKCU\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine: File not found FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \Firefox\Ext [2012/02/25 18:46:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/25 20:39:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/03/02 06:13:51 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensi ons\\moveplayer@movenetworks.com: C:\Users\herbw2\AppData\Roaming\Move Networks [2009/10/11 08:04:32 | 000,000,000 | ---D | M] [2012/03/04 09:49:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012/03/04 09:49:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2009/10/11 08:04:32 | 000,000,000 | ---D | M] (Move Media Player) -- C:\USERS\HERBW2\APPDATA\ROAMING\MOVE NETWORKS () (No name found) -- C:\USERS\HERBW2\APPDATA\ROAMING\MOZILLA\FIREFOX\PR OFILES\LBT7PERA.DEFAULT\EXTENSIONS\NOSQUINT@URANDO M.CA.XPI [2009/07/01 17:15:55 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2012/02/16 09:40:42 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2008/06/18 01:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll [2012/03/04 09:49:21 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2009/02/15 17:23:17 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\mozilla firefox\plugins\NPTURNMED.dll [2010/11/22 17:04:00 | 000,865,632 | ---- | M] (Medical Informatics Engineering, Inc.) -- C:\Program Files\mozilla firefox\plugins\npzzatif.dll [2012/02/16 05:42:53 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012/02/16 05:42:53 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2012/03/03 20:04:08 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin \IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4 - HKLM..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel MediaOne\CorelIOMonitor.exe () O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [QuickBooks Simple Start] C:\Program Files\Intuit\SimpleStartEntice\entice.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [VAIOSecurity] C:\Program Files\Sony\VAIO Security Center\VSC.exe () O4 - HKLM..\Run: [VAIOSurvey] C:\Program Files\Sony\VAIO Survey\Vista VAIO Survey.exe () O4 - HKLM..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-359212865-3667773309-2497541235-1005..\Run: [Akamai NetSession Interface] C:\Users\herbw2\AppData\Local\Akamai\netsession_wi n.exe (Akamai Technologies, Inc) O4 - Startup: C:\Users\herbw2\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Startup\CNET TechTracker.lnk = C:\Users\herbw2\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-359212865-3667773309-2497541235-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\herbw2\AppData\Roaming\DVDVideoSoftIEHelp ers\freeyoutubetomp3converter.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: vzTCPConfig http://my.verizon.com/micro/speedopt...zTCPConfig.CAB (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{7EC5F23B-DDE9-4616-8DD9-3C78B2911781}: DhcpNameServer = 192.168.1.1 68.237.161.12 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{8A1F874F-9E26-49BD-ADCA-208A805769E0}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - igfxdev.dll (Intel Corporation) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - VESWinlogon.dll (Sony Corporation) O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/03/05 19:53:35 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2012/03/05 19:53:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis [2012/03/05 04:35:22 | 000,000,000 | ---D | C] -- C:\Users\herbw2\AppData\Local\VS Revo Group [2012/03/05 04:35:19 | 000,027,192 | ---- | C] (VS Revo Group) -- C:\Windows\System32\drivers\revoflt.sys [2012/03/05 04:35:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro [2012/03/05 04:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group [2012/03/04 09:51:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012/03/04 09:49:41 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2012/03/04 09:49:41 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2012/03/04 09:49:41 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2012/03/03 20:08:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012/03/03 20:08:12 | 000,000,000 | -HSD | C] -- \$RECYCLE.BIN [2012/03/03 20:08:08 | 000,000,000 | ---D | C] -- C:\Users\herbw2\AppData\Local\temp [2012/03/03 19:50:43 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012/03/03 19:50:43 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012/03/03 19:50:43 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012/03/03 19:50:27 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2012/03/03 19:50:26 | 000,000,000 | ---D | C] -- C:\ComboFix [2012/03/03 19:50:26 | 000,000,000 | ---D | C] -- \ComboFix [2012/03/03 19:50:22 | 000,000,000 | ---D | C] -- C:\Qoobox [2012/03/03 19:50:22 | 000,000,000 | ---D | C] -- \Qoobox [2012/02/27 07:05:38 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedyPC Software [2012/02/25 19:30:59 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software [2012/02/25 17:36:01 | 000,000,000 | ---D | C] -- C:\Program Files\File Type Assistant [2012/02/25 17:35:25 | 000,000,000 | ---D | C] -- C:\Program Files\FreeFileViewer [2012/02/24 05:04:18 | 000,000,000 | ---D | C] -- C:\LocalLow [2012/02/24 05:04:18 | 000,000,000 | ---D | C] -- \LocalLow [2012/02/19 12:35:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Amazon [2012/02/16 06:12:20 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012/02/16 06:12:17 | 001,798,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012/02/16 06:12:16 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012/02/16 06:12:16 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012/02/16 06:12:16 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012/02/16 06:12:11 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012/02/16 05:26:10 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012/02/12 15:16:08 | 000,000,000 | ---D | C] -- C:\Users\herbw2\Documents\Amazon MP3 [2012/02/12 15:13:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/03/05 19:58:47 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012/03/05 19:58:47 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012/03/05 19:58:17 | 000,001,874 | ---- | M] () -- C:\Users\herbw2\Desktop\HijackThis.lnk [2012/03/05 18:54:25 | 000,011,264 | ---- | M] () -- C:\Users\herbw2\Documents\HW Trust Financials 2011.xlr [2012/03/05 18:49:11 | 000,010,752 | ---- | M] () -- C:\Users\herbw2\Documents\HW Trust Financials 2010.xlr [2012/03/05 18:44:10 | 000,010,752 | ---- | M] () -- C:\Users\herbw2\Documents\HW Trust Financials 2009.xlr [2012/03/05 17:58:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/03/05 08:08:30 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics [2012/03/05 04:35:20 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk [2012/03/04 09:49:20 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2012/03/04 09:49:20 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2012/03/04 09:49:20 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2012/03/04 09:49:20 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2012/03/03 20:04:08 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2012/03/02 09:40:52 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\YouTube Downloader.lnk [2012/03/02 05:59:33 | 000,000,166 | ---- | M] () -- C:\Users\herbw2\fixer.reg [2012/03/01 04:30:01 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat [2012/03/01 04:30:01 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat [2012/02/28 04:18:50 | 000,000,680 | ---- | M] () -- C:\Users\herbw2\AppData\Local\d3d9caps.dat [2012/02/25 21:14:01 | 244,779,465 | ---- | M] () -- C:\Windows\MEMORY.DMP [2012/02/25 20:39:50 | 000,000,870 | ---- | M] () -- C:\Users\herbw2\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2012/02/25 20:39:50 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012/02/25 19:31:36 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2012/02/19 12:35:11 | 000,001,807 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Unbox.lnk [2012/02/19 12:35:11 | 000,001,753 | ---- | M] () -- C:\Users\Public\Desktop\Amazon Unbox.lnk [2012/02/18 06:36:03 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012/02/16 06:53:52 | 000,660,266 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012/02/16 06:53:52 | 000,126,170 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012/02/16 06:26:24 | 000,331,240 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012/02/12 15:13:20 | 000,001,992 | ---- | M] () -- C:\Users\Public\Desktop\Amazon Cloud Player.lnk [2012/02/12 07:08:54 | 000,005,642 | -HS- | M] () -- C:\Windows\System32\KGyGaAvL.sys [2012/02/09 05:55:57 | 000,222,996 | ---- | M] () -- C:\test.xml [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/03/05 19:53:35 | 000,001,874 | ---- | C] () -- C:\Users\herbw2\Desktop\HijackThis.lnk [2012/03/05 04:35:20 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk [2012/03/03 19:50:43 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012/03/03 19:50:43 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012/03/03 19:50:43 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012/03/03 19:50:43 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012/03/03 19:50:43 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012/03/03 17:12:17 | 000,011,264 | ---- | C] () -- C:\Users\herbw2\Documents\HW Trust Financials 2011.xlr [2012/03/01 07:18:26 | 000,000,166 | ---- | C] () -- C:\Users\herbw2\fixer.reg [2012/02/19 12:35:11 | 000,001,807 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Unbox.lnk [2012/02/19 12:35:11 | 000,001,753 | ---- | C] () -- C:\Users\Public\Desktop\Amazon Unbox.lnk [2012/02/12 15:13:20 | 000,001,992 | ---- | C] () -- C:\Users\Public\Desktop\Amazon Cloud Player.lnk [2012/01/10 06:12:40 | 000,222,996 | ---- | C] () -- \test.xml [2011/11/23 20:02:20 | 000,000,680 | ---- | C] () -- C:\Users\herbw2\AppData\Local\d3d9caps.dat [2011/07/19 13:59:55 | 000,000,106 | ---- | C] () -- C:\Windows\VaultMediaClient.INI [2011/04/26 03:52:31 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat [2011/04/26 03:52:31 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat [2011/03/24 06:04:38 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2010/07/27 13:48:03 | 000,000,091 | ---- | C] () -- C:\Windows\QBChanUtil_Trigger.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:07BF512B @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP  1B5B4F1< End of report > 
|
|
#32
March 6th, 2012, 02:00 AM
|
||||
|
||||
|
Didn't budge.
Click here and download jpshortstuff's SystemLook to your desktop, then click that file to open the scan display. In the open textbox, copy and paste the following (inside the Code box below): Code:
:folderfind *Toolbar4* *SearchPredict* *SPEEDbit*
|
|
#33
March 6th, 2012, 10:12 AM
|
|||
|
|||
|
SystemLook 30.07.11 by jpshortstuff
Log created at 05:06 on 06/03/2012 by herbw2 Administrator - Elevation successful ========== folderfind ========== Searching for "*Toolbar4*" No folders found. Searching for "*SearchPredict" No folders found. Searching for "*SPEEDbit*" C:\LocalLow\Speedbit d------ [10:04 24/02/2012] C:\Program Files\SpeedBit Video Accelerator d------ [14:46 09/01/2012] C:\Users\Public\Documents\Speedbit d------ [14:46 09/01/2012] -= EOF =-
|
|
#34
March 7th, 2012, 12:53 AM
|
||||
|
||||
|
Okay. Before we start a removal procedure, I suspect SpeedBit is loading itself into the Winsock there. If we remove it incorrectly, that could lead to having no Internet access after. Let's check, then start the removal steps.
Go to Start Search, type cmd.exe in the Start Search box. Cmd.exe will appear at the top of the Menu. Rightclick on it and choose "Run as administrator". At the prompt copy/paste the following, pressing Enter after each: netsh winsock show catalog > looker.txt && notepad looker.txt Your drive will be scanned and when finished, Notepad will pop up with some information. Copy and paste it in this thread. Sorry - this will be a longish log file, but the details may prove helpful.
|
|
#35
March 7th, 2012, 01:09 AM
|
|||
|
|||
|
/Hi jintan,
Appreciate all the help. When I type in cmd.exe I get the black screen, but no menu. Clicking on the Windopws32 cmd.exe title does not give a run as admin option? Really appreiate your help Herb W
|
|
#36
March 7th, 2012, 02:02 AM
|
||||
|
||||
|
You should just see this, when you open the command window (cmd.exe).
 So no menu. Just copy paste this, and press Enter: netsh winsock show catalog > looker.txt && notepad looker.txt (Note - I created that on an XP machine, just to provide an idea)
|
|
#37
March 7th, 2012, 09:56 AM
|
|||
|
|||
|
Winsock Catalog Provider Entry
------------------------------------------------------ Entry Type: Layered Chain Entry Description: SBLSP over [MSAFD Tcpip [TCP/IP]] Provider ID: {B2AF1AA6-5F84-44D4-96A0-7F012F25DFA2} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4100 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 1 Protocol: 6 Protocol Chain Length: 2 Protocol Chain: 4099 : 1001 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Layered Chain Entry Description: SBLSP over [MSAFD Tcpip [UDP/IP]] Provider ID: {A0264959-D77C-480D-A5B3-909F33D101D0} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4101 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 2 Protocol: 17 Protocol Chain Length: 2 Protocol Chain: 4099 : 1002 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Layered Chain Entry Description: SBLSP over [MSAFD Tcpip [TCP/IPv6]] Provider ID: {FD20C2E7-8BCE-40B5-AE38-546BB4C91758} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4102 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 1 Protocol: 6 Protocol Chain Length: 2 Protocol Chain: 4099 : 1004 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Layered Chain Entry Description: SBLSP over [RSVP TCPv6 Service Provider] Provider ID: {C6CCE733-6F65-45D0-9437-8519B1D6CB59} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4103 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 1 Protocol: 6 Protocol Chain Length: 2 Protocol Chain: 4099 : 1015 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Layered Chain Entry Description: SBLSP over [RSVP TCP Service Provider] Provider ID: {09AA43D5-F43C-4206-B34B-63DEF65F723A} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4104 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 1 Protocol: 6 Protocol Chain Length: 2 Protocol Chain: 4099 : 1016 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Layered Chain Entry Description: SBLSP over [RSVP UDP Service Provider] Provider ID: {DFD7B3BE-FE99-43E9-9F8A-B00D6426A1DC} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4105 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 2 Protocol: 17 Protocol Chain Length: 2 Protocol Chain: 4099 : 1018 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD Tcpip [TCP/IP] Provider ID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1001 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 1 Protocol: 6 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD Tcpip [UDP/IP] Provider ID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1002 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 2 Protocol: 17 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD Tcpip [RAW/IP] Provider ID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1003 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 3 Protocol: 0 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD Tcpip [TCP/IPv6] Provider ID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1004 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 1 Protocol: 6 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD Tcpip [UDP/IPv6] Provider ID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1005 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 2 Protocol: 17 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD Tcpip [RAW/IPv6] Provider ID: {F9EAB0C0-26D4-11D0-BBBF-00AA006C34E4} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1006 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 3 Protocol: 0 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: RSVP TCPv6 Service Provider Provider ID: {9D60A9E0-337A-11D0-BD88-0000C082E69A} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1015 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 1 Protocol: 6 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: RSVP TCP Service Provider Provider ID: {9D60A9E0-337A-11D0-BD88-0000C082E69A} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1016 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 1 Protocol: 6 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: RSVP UDPv6 Service Provider Provider ID: {9D60A9E0-337A-11D0-BD88-0000C082E69A} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1017 Version: 2 Address Family: 23 Max Address Length: 28 Min Address Length: 28 Socket Type: 2 Protocol: 17 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: RSVP UDP Service Provider Provider ID: {9D60A9E0-337A-11D0-BD88-0000C082E69A} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 1018 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 2 Protocol: 17 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8A1F874F-9E26-49BD-ADCA-208A805769E0}] SEQPACKET 0 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4087 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 5 Protocol: -2147483648 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip_{8A1F874F-9E26-49BD-ADCA-208A805769E0}] DATAGRAM 0 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4088 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 2 Protocol: -2147483648 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7EC5F23B-DDE9-4616-8DD9-3C78B2911781}] SEQPACKET 4 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4089 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 5 Protocol: -4 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7EC5F23B-DDE9-4616-8DD9-3C78B2911781}] DATAGRAM 4 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4090 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 2 Protocol: -4 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{97899663-AE28-46DB-855C-223D7F5FFB41}] SEQPACKET 2 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4091 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 5 Protocol: -2 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{97899663-AE28-46DB-855C-223D7F5FFB41}] DATAGRAM 2 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4092 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 2 Protocol: -2 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{8A1F874F-9E26-49BD-ADCA-208A805769E0}] SEQPACKET 1 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4093 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 5 Protocol: -1 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{8A1F874F-9E26-49BD-ADCA-208A805769E0}] DATAGRAM 1 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4094 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 2 Protocol: -1 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{929E3EFA-D4A4-4E62-A08A-AF9278A91600}] SEQPACKET 3 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4095 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 5 Protocol: -3 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{929E3EFA-D4A4-4E62-A08A-AF9278A91600}] DATAGRAM 3 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4096 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 2 Protocol: -3 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{7EC5F23B-DDE9-4616-8DD9-3C78B2911781}] SEQPACKET 5 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4097 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 5 Protocol: -5 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Base Service Provider Description: MSAFD NetBIOS [\Device\NetBT_Tcpip6_{7EC5F23B-DDE9-4616-8DD9-3C78B2911781}] DATAGRAM 5 Provider ID: {8D5F1830-C273-11CF-95C8-00805F48A192} Provider Path: %SystemRoot%\system32\mswsock.dll Catalog Entry ID: 4098 Version: 2 Address Family: 17 Max Address Length: 20 Min Address Length: 20 Socket Type: 2 Protocol: -5 Protocol Chain Length: 1 Winsock Catalog Provider Entry ------------------------------------------------------ Entry Type: Layered Service Provider Description: SBLSP Provider ID: {8AF4FBB8-3D99-4023-93C6-F7C81237DD22} Provider Path: C:\PROGRA~1\SPEEDB~1\sblsp.dll Catalog Entry ID: 4099 Version: 2 Address Family: 2 Max Address Length: 16 Min Address Length: 16 Socket Type: 0 Protocol: 0 Protocol Chain Length: 0 Name Space Provider Entry ------------------------------------------------------ Description: Network Location Awareness Legacy (NLAv1) Namespace Provider ID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83} Name Space: 15 Active: 1 Version: 0 Name Space Provider Entry ------------------------------------------------------ Description: E-mail Naming Shim Provider Provider ID: {964ACBA2-B2BC-40EB-8C6A-A6DB40161CAE} Name Space: 37 Active: 1 Version: 0 Name Space Provider Entry ------------------------------------------------------ Description: PNRP Cloud Namespace Provider Provider ID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D} Name Space: 39 Active: 1 Version: 0 Name Space Provider Entry ------------------------------------------------------ Description: PNRP Name Namespace Provider Provider ID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D} Name Space: 38 Active: 1 Version: 0 Name Space Provider Entry ------------------------------------------------------ Description: Tcpip Provider ID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B} Name Space: 12 Active: 1 Version: 0 Name Space Provider Entry ------------------------------------------------------ Description: NTDS Provider ID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC} Name Space: 32 Active: 1 Version: 0 Name Space Provider Entry ------------------------------------------------------ Description: mdnsNSP Provider ID: {B600E6E9-553B-4A19-8696-335E5C896153} Name Space: 12 Active: 1 Version: 1
|
|
#38
March 7th, 2012, 11:17 PM
|
||||
|
||||
|
Yeah, loading everywhere there. That is a type of Internet filter, so can monitor or change Internet traffic. If we make changes incorrectly - no Internet. I will need to verify how to correctly restore a Vista LSP chain, and will post after I have confirmed the correct steps.
|
|
#40
March 8th, 2012, 10:42 PM
|
||||
|
||||
|
The logs showed you have Apple's Bonjour installed (used as web support for things like iPods), but it oddly enough is not showing in this Winsock view, which it should. You may need to uninstall and reinstall it, but at least resetting the Winsock will not involve it.
Go to Start Search, type cmd.exe in the Start Search box. Cmd.exe will appear at the top of the Menu. Rightclick on it and choose "Run as administrator". At the prompt copy/paste the following, pressing Enter after each: sc stop VideoAcceleratorService sc delete VideoAcceleratorService You should get verification on those. Then still in the command Window, type each of the following, pressing Enter after each. netsh winsock reset Then type exit and press Enter to close the command window. Reboot, and run and post a new OTL scan log please.
|
|
#44
March 9th, 2012, 12:50 AM
|
||||
|
||||
|
Nuts - what a pest.
Be sure to continue to temporarily disable any protective software when running the scan tools we use here. Open notepad (go to Start, Run, type notepad and press Enter) and copy/paste the text in the codebox below into it: Code:
KillAll:: Driver:: VideoAcceleratorService You should now have both ComboFix and that CFScript.txt on the desktop. Just left click/hold on the CFScript.txt file, and drag it into ComboFix to start the scan. ComboFix will now run as it did before. Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.
|
|
#45
March 9th, 2012, 01:25 AM
|
|||
|
|||
|
I have the Combo/fix and CFScript notebook files. Combo/Fix is in reduced functionality mode. Problem is I find that I don't know how to drag CFScript in ComboFix. I tried everything I can think of. Thanks.
Herbw
|
 |
| Bookmarks |
«
Previous Topic
|
Next Topic
»
| Topic Tools | |
|
|
All times are GMT +1. The time now is 08:35 AM.
