Where do I start? Came in and the fans were howling and computer is super slow and the system restore was shut off also. Did some scans but come up with nothing...Thanks
Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Comuter is super slow/delayed...Malware?
Started by
DirtSoldier
, Mar 13 2012 02:27 AM
3 replies to this topic
Back to top- BC Ads
- BleepingComputer.com
#2
Broni
-
- BC Advisor
-
- 27,318 posts
The Coolest BC Computer
- Gender:Male
- Location:Daly City, CA
Posted 13 March 2012 - 09:34 PM
Download Security Check from HERE, and save it to your Desktop.
* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.
=============================================================================
Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
====================================================================================
Please download MiniToolBox and run it.
Checkmark following boxes:
=============================================================================
Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.
Be sure to restart the computer.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
=============================================================================
Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.
=============================================================================
Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
- Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
====================================================================================
Please download MiniToolBox and run it.
Checkmark following boxes:
- Report IE Proxy Settings
- Report FF Proxy Settings
- List content of Hosts
- List IP configuration
- List Winsock Entries
- List last 10 Event Viewer log
- List Installed Programs
- List Devices (do NOT change any settings here)
- List Users, Partitions and Memory size
=============================================================================
Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.
Be sure to restart the computer.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
=============================================================================
Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
My Website
My help doesn't cost a penny, but if you'd like to consider a donation, click 
#3
DirtSoldier
-
- Members
-
- 29 posts
Member
Posted 14 March 2012 - 12:13 AM
So the computer slowness seems to be happing when you move the arrow and typing.... this took forever to type 
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
SpywareBlaster 4.6
CCleaner
Java™ 6 Update 31
Adobe Flash Player ( 10.3.183.11) Flash Player Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Microsoft Security Client Antimalware MpCmdRun.exe
``````````End of Log````````````
Farbar Service Scanner Version: 01-03-2012
Ran by BannerPlus (administrator) on 13-03-2012 at 21:27:35
Running from "C:\Documents and Settings\BannerPlus\Local Settings\Temporary Internet Files\Content.IE5\90QNPNXL"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
============
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit
Extra List:
=======
Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
0x080000000400000001000000020000000300000008000000050000000600000007000000
IpSec Tag value is correct.
**** End of log ****
MiniToolBox by Farbar Version: 18-01-2012
Ran by BannerPlus (administrator) on 13-03-2012 at 21:30:52
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************
========================= IE Proxy Settings: ==============================
Proxy is not enabled.
No Proxy Server is set.
========================= FF Proxy Settings: ==============================
========================= Hosts content: =================================
127.0.0.1 localhost
========================= IP Configuration: ================================
1394 Net Adapter = 1394 Connection (Disconnected)
Dell Wireless 1390 WLAN Mini-Card = Wireless Network Connection (Connected)
Broadcom 440x 10/100 Integrated Controller = Local Area Connection (Media disconnected)
# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip
# Interface IP Configuration for "Local Area Connection"
set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp
# Interface IP Configuration for "Wireless Network Connection"
set address name="Wireless Network Connection" source=dhcp
set dns name="Wireless Network Connection" source=dhcp register=PRIMARY
set wins name="Wireless Network Connection" source=dhcp
popd
# End of interface IP configuration
Windows IP Configuration
Host Name . . . . . . . . . . . . : BanersLT
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : ph.cox.net
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physical Address. . . . . . . . . : 00-19-B9-6F-45-39
Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . : ph.cox.net
Description . . . . . . . . . . . : Dell Wireless 1390 WLAN Mini-Card
Physical Address. . . . . . . . . : 00-19-7E-42-05-AA
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 68.105.28.11
68.105.29.11
68.105.28.12
Lease Obtained. . . . . . . . . . : Tuesday, March 13, 2012 9:12:51 PM
Lease Expires . . . . . . . . . . : Monday, January 18, 2038 8:14:07 PM
Server: cdns1.cox.net
Address: 68.105.28.11
Name: google.com
Addresses: 74.125.224.129, 74.125.224.130, 74.125.224.131, 74.125.224.132
74.125.224.133, 74.125.224.134, 74.125.224.135, 74.125.224.136, 74.125.224.137
74.125.224.142, 74.125.224.128
Pinging google.com [74.125.224.66] with 32 bytes of data:
Reply from 74.125.224.66: bytes=32 time=40ms TTL=57
Reply from 74.125.224.66: bytes=32 time=52ms TTL=57
Ping statistics for 74.125.224.66:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 40ms, Maximum = 52ms, Average = 46ms
Server: cdns1.cox.net
Address: 68.105.28.11
Name: yahoo.com
Addresses: 98.139.183.24, 209.191.122.70, 98.139.127.62
Pinging yahoo.com [209.191.122.70] with 32 bytes of data:
Reply from 209.191.122.70: bytes=32 time=52ms TTL=56
Reply from 209.191.122.70: bytes=32 time=49ms TTL=56
Ping statistics for 209.191.122.70:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 49ms, Maximum = 52ms, Average = 50ms
Server: cdns1.cox.net
Address: 68.105.28.11
Name: bleepingcomputer.com
Address: 208.43.87.2
Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:
Request timed out.
Request timed out.
Ping statistics for 208.43.87.2:
Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 19 b9 6f 45 39 ...... Broadcom 440x 10/100 Integrated Controller - Packet Scheduler Miniport
0x3 ...00 19 7e 42 05 aa ...... Dell Wireless 1390 WLAN Mini-Card - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.5 30
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.5 192.168.0.5 30
192.168.0.5 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.0.255 255.255.255.255 192.168.0.5 192.168.0.5 30
224.0.0.0 240.0.0.0 192.168.0.5 192.168.0.5 30
255.255.255.255 255.255.255.255 192.168.0.5 2 1
255.255.255.255 255.255.255.255 192.168.0.5 192.168.0.5 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================
Catalog5 01 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 02 C:\Windows\System32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 01 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 12 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 13 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 14 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 15 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
========================= Event log errors: ===============================
Application errors:
==================
Error: (03/13/2012 07:10:58 PM) (Source: Application Hang) (User: )
Description: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (03/13/2012 07:08:14 PM) (Source: Application Hang) (User: )
Description: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (03/13/2012 07:01:51 PM) (Source: Application Hang) (User: )
Description: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (03/12/2012 07:34:06 PM) (Source: Application Error) (User: )
Description: Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x715b9e59.
Processing media-specific event for [explorer.exe!ws!]
Error: (03/12/2012 07:33:11 PM) (Source: Application Error) (User: )
Description: Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x715b9e59.
Processing media-specific event for [explorer.exe!ws!]
Error: (03/11/2012 01:56:59 AM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80072f8f, P2 endsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/10/2012 08:50:21 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80072f8f, P2 endsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/06/2012 11:14:48 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80240016, P2 begininstall, P3 install, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/05/2012 10:58:46 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80070424, P2 beginsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/05/2012 10:53:47 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80070424, P2 beginsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
System errors:
=============
Error: (03/13/2012 09:12:18 PM) (Source: Microsoft Antimalware) (User: )
Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted: %24
Error Code: 0x80070002
Error description: The system cannot find the file specified.
Signature version: 0.0.0.0;0.0.0.0
Engine version: %600
Error: (03/12/2012 10:49:47 PM) (Source: Service Control Manager) (User: )
Description: The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The MBAMService service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 07:48:28 PM) (Source: Service Control Manager) (User: )
Description: The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 07:26:13 PM) (Source: Service Control Manager) (User: )
Description: The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
Microsoft Office Sessions:
=========================
Error: (03/13/2012 07:10:58 PM) (Source: Application Hang)(User: )
Description: wmplayer.exe11.0.5721.5145hungapp0.0.0.000000000
Error: (03/13/2012 07:08:14 PM) (Source: Application Hang)(User: )
Description: wmplayer.exe11.0.5721.5145hungapp0.0.0.000000000
Error: (03/13/2012 07:01:51 PM) (Source: Application Hang)(User: )
Description: wmplayer.exe11.0.5721.5145hungapp0.0.0.000000000
Error: (03/12/2012 07:34:06 PM) (Source: Application Error)(User: )
Description: explorer.exe6.0.2900.5512unknown0.0.0.0715b9e59
Error: (03/12/2012 07:33:11 PM) (Source: Application Error)(User: )
Description: explorer.exe6.0.2900.5512unknown0.0.0.0715b9e59
Error: (03/11/2012 01:56:59 AM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80072f8fendsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/10/2012 08:50:21 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80072f8fendsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/06/2012 11:14:48 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80240016begininstallinstall3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/05/2012 10:58:46 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80070424beginsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/05/2012 10:53:47 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80070424beginsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
=========================== Installed Programs ============================
Adobe Flash Player 10 Plugin (Version: 10.3.183.11)
Adobe Flash Player 11 ActiveX (Version: 11.1.102.55)
Adobe Reader 9.5.0 (Version: 9.5.0)
CCleaner (Version: 3.15)
Compatibility Pack for the 2007 Office system (Version: 12.0.6514.5001)
Google Earth (Version: 6.1.0.5001)
Google Update Helper (Version: 1.3.21.99)
Google Updater (Version: 2.4.2432.1652)
Java Auto Updater (Version: 2.0.7.1)
Java™ 6 Update 31 (Version: 6.0.310)
Malwarebytes Anti-Malware version 1.60.1.1000 (Version: 1.60.1.1000)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Antimalware (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office XP Small Business (Version: 10.0.6626.0)
Microsoft Security Client (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 2.1.1116.0)
Microsoft Silverlight (Version: 4.1.10111.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
MotoHelper MergeModules (Version: 1.2.0)
Move Media Player
SpywareBlaster 4.6 (Version: 4.6.0)
Update for Windows XP (KB2641690) (Version: 1)
Windows Internet Explorer 8 (Version: 20090308.140743)
========================= Devices: ================================
Name: 1394 Net Adapter
Description: 1394 Net Adapter
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: NIC1394
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Optiarc DVD+-RW AD-5540A
Description: CD-ROM Drive
Class Guid: {4D36E965-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.
========================= Memory info: ===================================
Percentage of memory in use: 31%
Total physical RAM: 2038.37 MB
Available physical RAM: 1390.8 MB
Total Pagefile: 3931.18 MB
Available Pagefile: 3470.07 MB
Total Virtual: 2047.88 MB
Available Virtual: 1969.53 MB
========================= Partitions: =====================================
1 Drive c: () (Fixed) (Total:143.99 GB) (Free:120.28 GB) NTFS
========================= Users: ========================================
User accounts for \\BANERSLT
Administrator BannerPlus Guest
HelpAssistant SUPPORT_388945a0
**** End of log ****
Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org
Database version: v2012.03.14.01
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
BannerPlus :: BANERSLT [administrator]
Protection: Enabled
3/13/2012 9:35:46 PM
mbam-log-2012-03-13 (21-35-46).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 193333
Time elapsed: 5 minute(s), 16 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
aswMBR version 0.9.9.1649 Copyright© 2011 AVAST Software
Run date: 2012-03-13 21:43:41
-----------------------------
21:43:41.281 OS Version: Windows 5.1.2600 Service Pack 3
21:43:41.281 Number of processors: 2 586 0xE0C
21:43:41.281 ComputerName: BANERSLT UserName:
21:43:42.187 Initialize success
21:51:20.015 AVAST engine defs: 12031301
21:51:32.359 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:51:32.359 Disk 0 Vendor: WDC_WD1600BEVS-75RST0 04.01G04 Size: 152627MB BusType: 3
21:51:32.406 Disk 0 MBR read successfully
21:51:32.406 Disk 0 MBR scan
21:51:32.468 Disk 0 unknown MBR code
21:51:32.468 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
21:51:32.531 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 147448 MB offset 96390
21:51:32.562 Disk 0 Partition - 00 0F Extended LBA 2047 MB offset 302086260
21:51:32.609 Disk 0 Partition 3 00 DB CP/M / CTOS Dell 8.0 3074 MB offset 306279225
21:51:33.703 Disk 0 Partition 4 00 DD MSDOS5.0 2047 MB offset 302086323
21:51:33.984 Disk 0 scanning sectors +312576705
21:51:34.109 Disk 0 scanning C:\WINDOWS\system32\drivers
21:51:58.250 Service scanning
21:52:15.203 Service MpKsl195f9b7a c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FE535BDC-2C43-472D-918D-5E9D394225C6}\MpKsl195f9b7a.sys **LOCKED** 32
21:52:31.218 Modules scanning
21:52:39.312 Disk 0 trace - called modules:
21:52:39.343 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
21:52:39.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a74cab8]
21:52:39.343 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\0000006c[0x8a6e4340]
21:52:39.343 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a735940]
21:52:40.046 AVAST engine scan C:\WINDOWS
21:52:54.281 AVAST engine scan C:\WINDOWS\system32
21:57:25.656 AVAST engine scan C:\WINDOWS\system32\drivers
21:57:54.000 AVAST engine scan C:\Documents and Settings\BannerPlus
22:03:43.828 AVAST engine scan C:\Documents and Settings\All Users
22:05:03.843 File: C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Statistics\2-0-18B229C1.lsf **HIDDEN**
22:05:35.453 Scan finished successfully
22:06:48.218 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\BannerPlus\Desktop\MBR.dat"
22:06:48.234 The log file has been saved successfully to "C:\Documents and Settings\BannerPlus\Desktop\aswMBR.txt"
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
SpywareBlaster 4.6
CCleaner
Java™ 6 Update 31
Adobe Flash Player ( 10.3.183.11) Flash Player Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Microsoft Security Client Antimalware MpCmdRun.exe
``````````End of Log````````````
Farbar Service Scanner Version: 01-03-2012
Ran by BannerPlus (administrator) on 13-03-2012 at 21:27:35
Running from "C:\Documents and Settings\BannerPlus\Local Settings\Temporary Internet Files\Content.IE5\90QNPNXL"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
============
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit
Extra List:
=======
Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
0x080000000400000001000000020000000300000008000000050000000600000007000000
IpSec Tag value is correct.
**** End of log ****
MiniToolBox by Farbar Version: 18-01-2012
Ran by BannerPlus (administrator) on 13-03-2012 at 21:30:52
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************
========================= IE Proxy Settings: ==============================
Proxy is not enabled.
No Proxy Server is set.
========================= FF Proxy Settings: ==============================
========================= Hosts content: =================================
127.0.0.1 localhost
========================= IP Configuration: ================================
1394 Net Adapter = 1394 Connection (Disconnected)
Dell Wireless 1390 WLAN Mini-Card = Wireless Network Connection (Connected)
Broadcom 440x 10/100 Integrated Controller = Local Area Connection (Media disconnected)
# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip
# Interface IP Configuration for "Local Area Connection"
set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp
# Interface IP Configuration for "Wireless Network Connection"
set address name="Wireless Network Connection" source=dhcp
set dns name="Wireless Network Connection" source=dhcp register=PRIMARY
set wins name="Wireless Network Connection" source=dhcp
popd
# End of interface IP configuration
Windows IP Configuration
Host Name . . . . . . . . . . . . : BanersLT
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : ph.cox.net
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller
Physical Address. . . . . . . . . : 00-19-B9-6F-45-39
Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . : ph.cox.net
Description . . . . . . . . . . . : Dell Wireless 1390 WLAN Mini-Card
Physical Address. . . . . . . . . : 00-19-7E-42-05-AA
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 68.105.28.11
68.105.29.11
68.105.28.12
Lease Obtained. . . . . . . . . . : Tuesday, March 13, 2012 9:12:51 PM
Lease Expires . . . . . . . . . . : Monday, January 18, 2038 8:14:07 PM
Server: cdns1.cox.net
Address: 68.105.28.11
Name: google.com
Addresses: 74.125.224.129, 74.125.224.130, 74.125.224.131, 74.125.224.132
74.125.224.133, 74.125.224.134, 74.125.224.135, 74.125.224.136, 74.125.224.137
74.125.224.142, 74.125.224.128
Pinging google.com [74.125.224.66] with 32 bytes of data:
Reply from 74.125.224.66: bytes=32 time=40ms TTL=57
Reply from 74.125.224.66: bytes=32 time=52ms TTL=57
Ping statistics for 74.125.224.66:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 40ms, Maximum = 52ms, Average = 46ms
Server: cdns1.cox.net
Address: 68.105.28.11
Name: yahoo.com
Addresses: 98.139.183.24, 209.191.122.70, 98.139.127.62
Pinging yahoo.com [209.191.122.70] with 32 bytes of data:
Reply from 209.191.122.70: bytes=32 time=52ms TTL=56
Reply from 209.191.122.70: bytes=32 time=49ms TTL=56
Ping statistics for 209.191.122.70:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 49ms, Maximum = 52ms, Average = 50ms
Server: cdns1.cox.net
Address: 68.105.28.11
Name: bleepingcomputer.com
Address: 208.43.87.2
Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:
Request timed out.
Request timed out.
Ping statistics for 208.43.87.2:
Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 19 b9 6f 45 39 ...... Broadcom 440x 10/100 Integrated Controller - Packet Scheduler Miniport
0x3 ...00 19 7e 42 05 aa ...... Dell Wireless 1390 WLAN Mini-Card - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.5 30
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.5 192.168.0.5 30
192.168.0.5 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.0.255 255.255.255.255 192.168.0.5 192.168.0.5 30
224.0.0.0 240.0.0.0 192.168.0.5 192.168.0.5 30
255.255.255.255 255.255.255.255 192.168.0.5 2 1
255.255.255.255 255.255.255.255 192.168.0.5 192.168.0.5 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================
Catalog5 01 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 02 C:\Windows\System32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 01 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 12 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 13 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 14 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 15 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
========================= Event log errors: ===============================
Application errors:
==================
Error: (03/13/2012 07:10:58 PM) (Source: Application Hang) (User: )
Description: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (03/13/2012 07:08:14 PM) (Source: Application Hang) (User: )
Description: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (03/13/2012 07:01:51 PM) (Source: Application Hang) (User: )
Description: Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (03/12/2012 07:34:06 PM) (Source: Application Error) (User: )
Description: Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x715b9e59.
Processing media-specific event for [explorer.exe!ws!]
Error: (03/12/2012 07:33:11 PM) (Source: Application Error) (User: )
Description: Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x715b9e59.
Processing media-specific event for [explorer.exe!ws!]
Error: (03/11/2012 01:56:59 AM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80072f8f, P2 endsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/10/2012 08:50:21 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80072f8f, P2 endsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/06/2012 11:14:48 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80240016, P2 begininstall, P3 install, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/05/2012 10:58:46 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80070424, P2 beginsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
Error: (03/05/2012 10:53:47 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 80070424, P2 beginsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 mptelemetry0, P10 mptelemetry1.
System errors:
=============
Error: (03/13/2012 09:12:18 PM) (Source: Microsoft Antimalware) (User: )
Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted: %24
Error Code: 0x80070002
Error description: The system cannot find the file specified.
Signature version: 0.0.0.0;0.0.0.0
Engine version: %600
Error: (03/12/2012 10:49:47 PM) (Source: Service Control Manager) (User: )
Description: The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The MBAMService service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 08:39:11 PM) (Source: Service Control Manager) (User: )
Description: The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 07:48:28 PM) (Source: Service Control Manager) (User: )
Description: The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
Error: (03/12/2012 07:26:13 PM) (Source: Service Control Manager) (User: )
Description: The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).
Microsoft Office Sessions:
=========================
Error: (03/13/2012 07:10:58 PM) (Source: Application Hang)(User: )
Description: wmplayer.exe11.0.5721.5145hungapp0.0.0.000000000
Error: (03/13/2012 07:08:14 PM) (Source: Application Hang)(User: )
Description: wmplayer.exe11.0.5721.5145hungapp0.0.0.000000000
Error: (03/13/2012 07:01:51 PM) (Source: Application Hang)(User: )
Description: wmplayer.exe11.0.5721.5145hungapp0.0.0.000000000
Error: (03/12/2012 07:34:06 PM) (Source: Application Error)(User: )
Description: explorer.exe6.0.2900.5512unknown0.0.0.0715b9e59
Error: (03/12/2012 07:33:11 PM) (Source: Application Error)(User: )
Description: explorer.exe6.0.2900.5512unknown0.0.0.0715b9e59
Error: (03/11/2012 01:56:59 AM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80072f8fendsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/10/2012 08:50:21 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80072f8fendsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/06/2012 11:14:48 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80240016begininstallinstall3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/05/2012 10:58:46 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80070424beginsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
Error: (03/05/2012 10:53:47 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry80070424beginsearchsearch3.0.8402.0mpsigdwn.dll3.0.8402.0microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094)NILNILNIL
=========================== Installed Programs ============================
Adobe Flash Player 10 Plugin (Version: 10.3.183.11)
Adobe Flash Player 11 ActiveX (Version: 11.1.102.55)
Adobe Reader 9.5.0 (Version: 9.5.0)
CCleaner (Version: 3.15)
Compatibility Pack for the 2007 Office system (Version: 12.0.6514.5001)
Google Earth (Version: 6.1.0.5001)
Google Update Helper (Version: 1.3.21.99)
Google Updater (Version: 2.4.2432.1652)
Java Auto Updater (Version: 2.0.7.1)
Java™ 6 Update 31 (Version: 6.0.310)
Malwarebytes Anti-Malware version 1.60.1.1000 (Version: 1.60.1.1000)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Antimalware (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office XP Small Business (Version: 10.0.6626.0)
Microsoft Security Client (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 2.1.1116.0)
Microsoft Silverlight (Version: 4.1.10111.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
MotoHelper MergeModules (Version: 1.2.0)
Move Media Player
SpywareBlaster 4.6 (Version: 4.6.0)
Update for Windows XP (KB2641690) (Version: 1)
Windows Internet Explorer 8 (Version: 20090308.140743)
========================= Devices: ================================
Name: 1394 Net Adapter
Description: 1394 Net Adapter
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: NIC1394
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Optiarc DVD+-RW AD-5540A
Description: CD-ROM Drive
Class Guid: {4D36E965-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.
========================= Memory info: ===================================
Percentage of memory in use: 31%
Total physical RAM: 2038.37 MB
Available physical RAM: 1390.8 MB
Total Pagefile: 3931.18 MB
Available Pagefile: 3470.07 MB
Total Virtual: 2047.88 MB
Available Virtual: 1969.53 MB
========================= Partitions: =====================================
1 Drive c: () (Fixed) (Total:143.99 GB) (Free:120.28 GB) NTFS
========================= Users: ========================================
User accounts for \\BANERSLT
Administrator BannerPlus Guest
HelpAssistant SUPPORT_388945a0
**** End of log ****
Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org
Database version: v2012.03.14.01
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
BannerPlus :: BANERSLT [administrator]
Protection: Enabled
3/13/2012 9:35:46 PM
mbam-log-2012-03-13 (21-35-46).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 193333
Time elapsed: 5 minute(s), 16 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
aswMBR version 0.9.9.1649 Copyright© 2011 AVAST Software
Run date: 2012-03-13 21:43:41
-----------------------------
21:43:41.281 OS Version: Windows 5.1.2600 Service Pack 3
21:43:41.281 Number of processors: 2 586 0xE0C
21:43:41.281 ComputerName: BANERSLT UserName:
21:43:42.187 Initialize success
21:51:20.015 AVAST engine defs: 12031301
21:51:32.359 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:51:32.359 Disk 0 Vendor: WDC_WD1600BEVS-75RST0 04.01G04 Size: 152627MB BusType: 3
21:51:32.406 Disk 0 MBR read successfully
21:51:32.406 Disk 0 MBR scan
21:51:32.468 Disk 0 unknown MBR code
21:51:32.468 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
21:51:32.531 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 147448 MB offset 96390
21:51:32.562 Disk 0 Partition - 00 0F Extended LBA 2047 MB offset 302086260
21:51:32.609 Disk 0 Partition 3 00 DB CP/M / CTOS Dell 8.0 3074 MB offset 306279225
21:51:33.703 Disk 0 Partition 4 00 DD MSDOS5.0 2047 MB offset 302086323
21:51:33.984 Disk 0 scanning sectors +312576705
21:51:34.109 Disk 0 scanning C:\WINDOWS\system32\drivers
21:51:58.250 Service scanning
21:52:15.203 Service MpKsl195f9b7a c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FE535BDC-2C43-472D-918D-5E9D394225C6}\MpKsl195f9b7a.sys **LOCKED** 32
21:52:31.218 Modules scanning
21:52:39.312 Disk 0 trace - called modules:
21:52:39.343 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
21:52:39.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a74cab8]
21:52:39.343 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\0000006c[0x8a6e4340]
21:52:39.343 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a735940]
21:52:40.046 AVAST engine scan C:\WINDOWS
21:52:54.281 AVAST engine scan C:\WINDOWS\system32
21:57:25.656 AVAST engine scan C:\WINDOWS\system32\drivers
21:57:54.000 AVAST engine scan C:\Documents and Settings\BannerPlus
22:03:43.828 AVAST engine scan C:\Documents and Settings\All Users
22:05:03.843 File: C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Statistics\2-0-18B229C1.lsf **HIDDEN**
22:05:35.453 Scan finished successfully
22:06:48.218 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\BannerPlus\Desktop\MBR.dat"
22:06:48.234 The log file has been saved successfully to "C:\Documents and Settings\BannerPlus\Desktop\aswMBR.txt"
#4
Broni
-
- BC Advisor
-
- 27,318 posts
The Coolest BC Computer
- Gender:Male
- Location:Daly City, CA
Posted 14 March 2012 - 08:52 PM
I don't see anything malicious.
I suggest you start new topic in Windows forum.
I suggest you start new topic in Windows forum.
My Website
My help doesn't cost a penny, but if you'd like to consider a donation, click
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
