BleepingComputer.com: Permissions issue / infection

A while back I had a nasty set of viruses that required some extensive help to remove - that seemed to be completely effective but now I've got a new smaller concern.

I'm running Vista Home P 32 and have one user account with admin privileges that, despite Windows recommendations, I use exclusively. A few weeks back I turned off the UAC because I was having problems with the user account and specifically the network connections taskbar icon was saying I wasn't connected to networks when indeed I was, beyond this the only other noticeable symptom was HP updater reporting that "access is denied" when it would do it's weekly check for printer driver updates. The similar "Connection status: unknown - access is denied" is the message the network icon in the taskbar would provide.

At the time I disabled UAC and went on with life. This week my wifes computer got railroaded by a nasty virus that required reformatting which has prompted me to deal with my own small issue more carefully.

I read other posts with similar concerns to mine, ran MBAM and HiJackThis, then jumped the gun and following advice given to another user (I know... I know...) and ran RootRepeal. That caused a BSOD with the message Kernel Data Inpage Error, 0x0000007A and referenced the file volmgr.sys. I'm not a pro but had to run HiJack in the past and nothing stood out as especially odd.

Not an immediate concern - but something I'd like to resolve for my own wellbeing. (MBAM found 1 IE adware... removed successfully - it was a single file and I think unrelated to my concern.)

Thanks in advance for your time.

Maybe irrelevant: but I'm a firefox user, and firefox has prompted me that it's not the default browser each of the last 3 times i've opened it... haven't touched IE or anything else in between.

This post has been edited by kbears: 10 April 2011 - 09:12 PM

Hello, most likely a Hardware/software issue with that error. But before we send you to Vista to fix this run an online scan.
did you do any next steps in Rootrepeal?

This may help your permissions,
Go to File association fixes for Windows Vista

Click the exe box
Instructions:
To fix the association for a particular file type, download the corresponding fix from the above links table (Use Right-click - Save as option in your browser to download the fixes). Unzip the fix and extract the .REG file to the Desktop. Right-click the REG file and choose Merge. Note that you need to be an administrator to apply these fixes.


I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check and check Remove found threats
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

Ran the exe file from the windows file association fix page. No apparent immediate change.

Here's the eset file...

C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\4a14144e-308f0330 multiple threats deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\12879fc2-49daccad a variant of Java/TrojanDownloader.OpenStream.NBF trojan deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\56049c17-799f4ef8 multiple threats deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\126cbbd9-1434f28d a variant of Java/TrojanDownloader.OpenStream.NBF trojan deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\d6429c3-1b6537c5 a variant of Java/TrojanDownloader.OpenStream.NBF trojan deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\2c5d539e-3706f210 multiple threats deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\5c13e1e3-35a8315b multiple threats deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\49955968-740b5ca3 Java/Agent.Z trojan deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1d4e2af1-32f9a9d9 Java/TrojanDownloader.OpenConnection.DT trojan deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\16e2db37-3c153b34 a variant of Java/TrojanDownloader.OpenStream.NBF trojan deleted - quarantined
C:\Users\sleverentz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\2e1a20f7-23057e0a Java/Agent.AD trojan deleted - quarantined

For permissions.

Use Inherit.exe to fix inappropriate permissions.
Use this fix, when you see a box that states “Windows cannot not access the specified device, path, or file. You may have inappropriate permissions to access the item”.

Download This File
Save it next to mbam.exe (this file is located in the Malwarebytes Anti-malware home folder). Once done, drag and drop mbam.exe into Inherit.exe. Click OK and attempt to run Malwarebytes Anti-malware once again.



Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Please ask any needed questions,post logs and Let us know how the PC is running now.

Apparently the permissions fix is being held up by a permissions problem... when I attempted to save to the MBAM folder I got an error that I didn't have access to save the file there and was redirected to save it to my user account folder. After saving I tried to move it to the MBAM folder but was met with a prompt that "You'll need to provide administrator access to move this folder."

Help?

Have you tried saving Inherit.exe,MABM, etc...to the desktop and right clicking and selecting Run as Administrator?

Sorry for the dumb issue - moved the inherit.exe file to the desktop and placed an MBAM shortcut there.. worked fine. MBAM came back clean.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6338

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

4/11/2011 8:22:36 PM
mbam-log-2011-04-11 (20-22-36).txt

Scan type: Quick scan
Objects scanned: 164210
Time elapsed: 7 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

No problem,is all else good now here?

The original issue still exists - MBAM is clean, but the network still lists Connection Status: unknown, Firefox still prompts that it's not the default browser every time I open it, and still cant install new programs - iTunes specifically reported that the Windows Installer wasnt able to be accessed.

No apparent malware at the moment. Any reason for RootRepeal to have caused a BSOD?

HiJack This logs are usually above my understanding level, but a few items here looked fishy and worth posting:



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:18:16 PM, on 4/12/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\Explorer.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugin-container.exe
C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugin-container.exe
C:\Users\sleverentz\Desktop\HijackThis.exe

This post has been edited by boopme: 12 April 2011 - 07:28 PM

Hello. edited out the HJT log. They are not supposed to be posted here in AII. I looked clean of malware tho'.

Please download MiniToolBox and run it.

Checkmark following checkboxes:

• Flush DNS
  
• Report IE Proxy Settings
  
• Reset IE Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List last 10 Event Viewer log
  
• List Users, Partitions and Memory size.

Click Go and post the result (Result.txt).

I apologize for including the HJT.

Here's the MiniToolBox results...



MiniToolBox by Farbar
Ran by sleverentz (administrator) at 2011-04-12 21:44:05
Windows Vista ™ Home Premium Service Pack 2 (X86)

***************************************************************************


================= Flush DNS: ==============================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

================= End of Flush DNS ========================================

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= End of IE Proxy Settings ========================

"Reset IE Proxy Settings": Proxy Settings were reset.

=============== Hosts content: ============================================

127.0.0.1 localhost

=============== End of Hosts ==============================================

================= IP Configuration: =======================================

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : sleverentz
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : gateway.2wire.net

Wireless LAN adapter Wireless Network Connection 3:

Connection-specific DNS Suffix . : gateway.2wire.net
Description . . . . . . . . . . . : Broadcom 4321AG 802.11a/b/g/draft-n Wi-Fi Adapter
Physical Address. . . . . . . . . : 00-1A-73-65-7D-A4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::911a:9b0c:a379:9637%14(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.65(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, April 11, 2011 11:44:42 PM
Lease Expires . . . . . . . . . . : Wednesday, April 13, 2011 5:24:08 PM
Default Gateway . . . . . . . . . : 192.168.1.254
DHCP Server . . . . . . . . . . . : 192.168.1.254
DHCPv6 IAID . . . . . . . . . . . : 419437171
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-0E-0F-89-44-00-1B-24-59-8D-BD
DNS Servers . . . . . . . . . . . : 192.168.1.254
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : d117.org
Description . . . . . . . . . . . : NVIDIA nForce 10/100 Mbps Ethernet #5
Physical Address. . . . . . . . . : 00-1B-24-34-FC-50
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.gateway.2wire.net
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.d117.org
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 14:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : gateway.2wire.net
Description . . . . . . . . . . . : isatap.gateway.2wire.net
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: homeportal
Address: 192.168.1.254

Name: google.com
Addresses: 74.125.225.20
74.125.225.19
74.125.225.17
74.125.225.18
74.125.225.16



Pinging google.com [74.125.225.18] with 32 bytes of data:

Reply from 74.125.225.18: bytes=32 time=25ms TTL=54

Reply from 74.125.225.18: bytes=32 time=24ms TTL=52



Ping statistics for 74.125.225.18:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 24ms, Maximum = 25ms, Average = 24ms

Server: homeportal
Address: 192.168.1.254

Name: yahoo.com
Addresses: 72.30.2.43
98.137.149.56
209.191.122.70
67.195.160.76
69.147.125.65



Pinging yahoo.com [209.191.122.70] with 32 bytes of data:

Reply from 209.191.122.70: bytes=32 time=76ms TTL=53

Reply from 209.191.122.70: bytes=32 time=78ms TTL=53



Ping statistics for 209.191.122.70:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 76ms, Maximum = 78ms, Average = 77ms



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
14 ...00 1a 73 65 7d a4 ...... Broadcom 4321AG 802.11a/b/g/draft-n Wi-Fi Adapter
13 ...00 1b 24 34 fc 50 ...... NVIDIA nForce 10/100 Mbps Ethernet #5
1 ........................... Software Loopback Interface 1
16 ...00 00 00 00 00 00 00 e0 isatap.gateway.2wire.net
18 ...00 00 00 00 00 00 00 e0 isatap.d117.org
19 ...00 00 00 00 00 00 00 e0 isatap.gateway.2wire.net
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.65 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.65 281
192.168.1.65 255.255.255.255 On-link 192.168.1.65 281
192.168.1.255 255.255.255.255 On-link 192.168.1.65 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.65 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.65 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
14 281 fe80::/64 On-link
14 281 fe80::911a:9b0c:a379:9637/128
On-link
1 306 ff00::/8 On-link
14 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

================= End of IP Configuration =================================

========================= Event log errors: ===============================

Application errors:
==================
Error: (04/12/2011 10:36:05 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Details:
TraverseDir : Unable to FindFirstFile.

System Error:
Access is denied.

Error: (04/12/2011 10:36:01 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Details:
TraverseDir : Unable to FindFirstFile.

System Error:
Access is denied.

Error: (04/11/2011 11:45:06 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp4580070005

Error: (04/11/2011 10:12:40 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp4580070005

Error: (04/11/2011 08:30:51 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp4580070005

Error: (04/11/2011 11:56:30 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4041

Error: (04/11/2011 11:56:30 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4041

Error: (04/11/2011 11:56:30 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/11/2011 11:56:29 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3042

Error: (04/11/2011 11:56:29 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3042


System errors:
=============
Error: (04/11/2011 11:46:53 PM) (Source: DCOM) (User: )
Description: {28778B62-8481-400D-8E8A-A4C81ED3F65C}

Error: (04/11/2011 11:46:04 PM) (Source: Service Control Manager) (User: )
Description: Partizan
SASKUTIL

Error: (04/11/2011 11:46:04 PM) (Source: Service Control Manager) (User: )
Description: Lavasoft Ad-Aware Service%%3

Error: (04/11/2011 11:44:45 PM) (Source: Microsoft-Windows-TaskScheduler) (User: SYSTEM)
Description: 2147549183

Error: (04/11/2011 10:14:19 PM) (Source: DCOM) (User: )
Description: {28778B62-8481-400D-8E8A-A4C81ED3F65C}

Error: (04/11/2011 10:13:49 PM) (Source: Service Control Manager) (User: )
Description: Partizan
SASKUTIL

Error: (04/11/2011 10:13:49 PM) (Source: Service Control Manager) (User: )
Description: Lavasoft Ad-Aware Service%%3

Error: (04/11/2011 10:12:14 PM) (Source: Microsoft-Windows-TaskScheduler) (User: SYSTEM)
Description: 2147549183

Error: (04/11/2011 08:32:17 PM) (Source: DCOM) (User: )
Description: {28778B62-8481-400D-8E8A-A4C81ED3F65C}

Error: (04/11/2011 08:31:29 PM) (Source: Service Control Manager) (User: )
Description: Partizan
SASKUTIL


Microsoft Office Sessions:
=========================
Error: (03/23/2011 03:16:20 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 195326 seconds with 4560 seconds of active time. This session ended with a crash.

Error: (02/16/2011 08:20:10 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/11/2011 07:29:36 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 291 seconds with 60 seconds of active time. This session ended with a crash.

Error: (02/06/2011 04:57:38 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/04/2011 04:00:37 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/01/2011 07:56:54 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/01/2011 07:56:25 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/01/2011 07:54:44 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/01/2011 07:53:18 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/01/2011 07:52:54 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.


========================= End of Event log errors =========================

========================= Memory info: ====================================

Percentage of memory in use: 56%
Total physical RAM: 1981.87 MB
Available physical RAM: 860.13 MB
Total Pagefile: 4210.26 MB
Available Pagefile: 2661.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1962.84 MB

======================= Partitions: =======================================

1 Drive c: () (Fixed) (Total:140.85 GB) (Free:60.65 GB) NTFS
2 Drive d: (HP_RECOVERY) (Fixed) (Total:8.2 GB) (Free:2.41 GB) NTFS
4 Drive g: (Cruzer) (Removable) (Total:1.86 GB) (Free:0.81 GB) FAT

================= Users: ==================================================

User accounts for \\SLEVERENTZ

-------------------------------------------------------------------------------
Administrator Guest sleverentz
The command completed successfully.

================= End of Users ============================================

I followed the directions here to generate a log file of the SFC /scannow results I got.

The SFC log is below... something wrong with servicemodelinstallrc.dll which is a rare issue based on some googling. Don't believe I had a Windows vista cd at home - I'm convinced there never was one in the computer packaging when I bought it - I had been under the impression that it was a given you got a operating system cd.



2011-04-13 14:33:16, Info CSI 00000006 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:33:16, Info CSI 00000007 [SR] Beginning Verify and Repair transaction
2011-04-13 14:33:36, Info CSI 00000009 [SR] Verify complete
2011-04-13 14:33:39, Info CSI 0000000a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:33:39, Info CSI 0000000b [SR] Beginning Verify and Repair transaction
2011-04-13 14:33:56, Info CSI 0000000d [SR] Verify complete
2011-04-13 14:33:57, Info CSI 0000000e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:33:57, Info CSI 0000000f [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:02, Info CSI 00000011 [SR] Verify complete
2011-04-13 14:34:02, Info CSI 00000012 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:02, Info CSI 00000013 [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:06, Info CSI 00000015 [SR] Verify complete
2011-04-13 14:34:06, Info CSI 00000016 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:06, Info CSI 00000017 [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:10, Info CSI 00000019 [SR] Verify complete
2011-04-13 14:34:11, Info CSI 0000001a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:11, Info CSI 0000001b [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:15, Info CSI 0000001d [SR] Verify complete
2011-04-13 14:34:15, Info CSI 0000001e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:15, Info CSI 0000001f [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:18, Info CSI 00000021 [SR] Verify complete
2011-04-13 14:34:19, Info CSI 00000022 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:19, Info CSI 00000023 [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:22, Info CSI 00000025 [SR] Verify complete
2011-04-13 14:34:22, Info CSI 00000026 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:22, Info CSI 00000027 [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:26, Info CSI 00000029 [SR] Verify complete
2011-04-13 14:34:27, Info CSI 0000002a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:27, Info CSI 0000002b [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:32, Info CSI 0000002d [SR] Verify complete
2011-04-13 14:34:33, Info CSI 0000002e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:33, Info CSI 0000002f [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:40, Info CSI 00000031 [SR] Verify complete
2011-04-13 14:34:41, Info CSI 00000032 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:41, Info CSI 00000033 [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:47, Info CSI 00000035 [SR] Verify complete
2011-04-13 14:34:49, Info CSI 00000036 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:49, Info CSI 00000037 [SR] Beginning Verify and Repair transaction
2011-04-13 14:34:55, Info CSI 00000039 [SR] Verify complete
2011-04-13 14:34:55, Info CSI 0000003a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:34:55, Info CSI 0000003b [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:03, Info CSI 0000003d [SR] Verify complete
2011-04-13 14:35:03, Info CSI 0000003e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:03, Info CSI 0000003f [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:10, Info CSI 00000041 [SR] Verify complete
2011-04-13 14:35:10, Info CSI 00000042 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:10, Info CSI 00000043 [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:16, Info CSI 00000045 [SR] Verify complete
2011-04-13 14:35:17, Info CSI 00000046 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:17, Info CSI 00000047 [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:23, Info CSI 00000049 [SR] Verify complete
2011-04-13 14:35:23, Info CSI 0000004a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:23, Info CSI 0000004b [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:33, Info CSI 0000004d [SR] Verify complete
2011-04-13 14:35:34, Info CSI 0000004e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:34, Info CSI 0000004f [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:39, Info CSI 00000051 [SR] Verify complete
2011-04-13 14:35:39, Info CSI 00000052 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:39, Info CSI 00000053 [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:42, Info CSI 00000055 [SR] Verify complete
2011-04-13 14:35:42, Info CSI 00000056 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:42, Info CSI 00000057 [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:46, Info CSI 00000059 [SR] Verify complete
2011-04-13 14:35:47, Info CSI 0000005a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:47, Info CSI 0000005b [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:51, Info CSI 0000005d [SR] Verify complete
2011-04-13 14:35:51, Info CSI 0000005e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:51, Info CSI 0000005f [SR] Beginning Verify and Repair transaction
2011-04-13 14:35:57, Info CSI 00000061 [SR] Verify complete
2011-04-13 14:35:58, Info CSI 00000062 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:35:58, Info CSI 00000063 [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:03, Info CSI 00000065 [SR] Verify complete
2011-04-13 14:36:04, Info CSI 00000066 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:04, Info CSI 00000067 [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:08, Info CSI 00000069 [SR] Verify complete
2011-04-13 14:36:09, Info CSI 0000006a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:09, Info CSI 0000006b [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:14, Info CSI 0000006d [SR] Verify complete
2011-04-13 14:36:15, Info CSI 0000006e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:15, Info CSI 0000006f [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:18, Info CSI 00000071 [SR] Verify complete
2011-04-13 14:36:19, Info CSI 00000072 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:19, Info CSI 00000073 [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:25, Info CSI 00000075 [SR] Verify complete
2011-04-13 14:36:25, Info CSI 00000076 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:25, Info CSI 00000077 [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:28, Info CSI 00000079 [SR] Verify complete
2011-04-13 14:36:29, Info CSI 0000007a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:29, Info CSI 0000007b [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:38, Info CSI 0000007d [SR] Verify complete
2011-04-13 14:36:39, Info CSI 0000007e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:39, Info CSI 0000007f [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:43, Info CSI 00000081 [SR] Verify complete
2011-04-13 14:36:44, Info CSI 00000082 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:44, Info CSI 00000083 [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:48, Info CSI 00000085 [SR] Verify complete
2011-04-13 14:36:49, Info CSI 00000086 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:49, Info CSI 00000087 [SR] Beginning Verify and Repair transaction
2011-04-13 14:36:53, Info CSI 00000089 [SR] Verify complete
2011-04-13 14:36:53, Info CSI 0000008a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:36:53, Info CSI 0000008b [SR] Beginning Verify and Repair transaction
2011-04-13 14:37:02, Info CSI 0000008d [SR] Verify complete
2011-04-13 14:37:04, Info CSI 0000008e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:37:04, Info CSI 0000008f [SR] Beginning Verify and Repair transaction
2011-04-13 14:37:19, Info CSI 00000091 [SR] Verify complete
2011-04-13 14:37:20, Info CSI 00000092 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:37:20, Info CSI 00000093 [SR] Beginning Verify and Repair transaction
2011-04-13 14:37:33, Info CSI 00000095 [SR] Verify complete
2011-04-13 14:37:34, Info CSI 00000096 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:37:34, Info CSI 00000097 [SR] Beginning Verify and Repair transaction
2011-04-13 14:37:55, Info CSI 0000009a [SR] Verify complete
2011-04-13 14:37:56, Info CSI 0000009b [SR] Verifying 100 (0x00000064) components
2011-04-13 14:37:56, Info CSI 0000009c [SR] Beginning Verify and Repair transaction
2011-04-13 14:38:09, Info CSI 0000009e [SR] Verify complete
2011-04-13 14:38:11, Info CSI 0000009f [SR] Verifying 100 (0x00000064) components
2011-04-13 14:38:11, Info CSI 000000a0 [SR] Beginning Verify and Repair transaction
2011-04-13 14:38:23, Info CSI 000000a3 [SR] Verify complete
2011-04-13 14:38:25, Info CSI 000000a4 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:38:25, Info CSI 000000a5 [SR] Beginning Verify and Repair transaction
2011-04-13 14:38:43, Info CSI 000000a7 [SR] Verify complete
2011-04-13 14:38:44, Info CSI 000000a8 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:38:44, Info CSI 000000a9 [SR] Beginning Verify and Repair transaction
2011-04-13 14:39:10, Info CSI 000000b3 [SR] Verify complete
2011-04-13 14:39:11, Info CSI 000000b4 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:39:11, Info CSI 000000b5 [SR] Beginning Verify and Repair transaction
2011-04-13 14:39:33, Info CSI 000000b7 [SR] Verify complete
2011-04-13 14:39:34, Info CSI 000000b8 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:39:34, Info CSI 000000b9 [SR] Beginning Verify and Repair transaction
2011-04-13 14:39:49, Info CSI 000000bb [SR] Verify complete
2011-04-13 14:39:51, Info CSI 000000bc [SR] Verifying 100 (0x00000064) components
2011-04-13 14:39:51, Info CSI 000000bd [SR] Beginning Verify and Repair transaction
2011-04-13 14:40:08, Info CSI 000000bf [SR] Verify complete
2011-04-13 14:40:09, Info CSI 000000c0 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:40:09, Info CSI 000000c1 [SR] Beginning Verify and Repair transaction
2011-04-13 14:40:51, Info CSI 000000c3 [SR] Verify complete
2011-04-13 14:40:53, Info CSI 000000c4 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:40:53, Info CSI 000000c5 [SR] Beginning Verify and Repair transaction
2011-04-13 14:41:22, Info CSI 000000c9 [SR] Verify complete
2011-04-13 14:41:24, Info CSI 000000ca [SR] Verifying 100 (0x00000064) components
2011-04-13 14:41:24, Info CSI 000000cb [SR] Beginning Verify and Repair transaction
2011-04-13 14:42:17, Info CSI 000000cd [SR] Verify complete
2011-04-13 14:42:19, Info CSI 000000ce [SR] Verifying 100 (0x00000064) components
2011-04-13 14:42:19, Info CSI 000000cf [SR] Beginning Verify and Repair transaction
2011-04-13 14:43:56, Info CSI 000000d1 [SR] Verify complete
2011-04-13 14:43:58, Info CSI 000000d2 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:43:58, Info CSI 000000d3 [SR] Beginning Verify and Repair transaction
2011-04-13 14:44:33, Info CSI 000000d5 [SR] Verify complete
2011-04-13 14:44:34, Info CSI 000000d6 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:44:34, Info CSI 000000d7 [SR] Beginning Verify and Repair transaction
2011-04-13 14:44:41, Info CSI 000000d9 [SR] Verify complete
2011-04-13 14:44:42, Info CSI 000000da [SR] Verifying 100 (0x00000064) components
2011-04-13 14:44:42, Info CSI 000000db [SR] Beginning Verify and Repair transaction
2011-04-13 14:44:49, Info CSI 000000dd [SR] Verify complete
2011-04-13 14:44:50, Info CSI 000000de [SR] Verifying 100 (0x00000064) components
2011-04-13 14:44:50, Info CSI 000000df [SR] Beginning Verify and Repair transaction
2011-04-13 14:45:24, Info CSI 000000f5 [SR] Verify complete
2011-04-13 14:45:24, Info CSI 000000f6 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:45:24, Info CSI 000000f7 [SR] Beginning Verify and Repair transaction
2011-04-13 14:45:47, Info CSI 00000101 [SR] Verify complete
2011-04-13 14:45:48, Info CSI 00000102 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:45:48, Info CSI 00000103 [SR] Beginning Verify and Repair transaction
2011-04-13 14:45:57, Info CSI 00000105 [SR] Verify complete
2011-04-13 14:45:58, Info CSI 00000106 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:45:58, Info CSI 00000107 [SR] Beginning Verify and Repair transaction
2011-04-13 14:46:15, Info CSI 00000109 [SR] Verify complete
2011-04-13 14:46:16, Info CSI 0000010a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:46:16, Info CSI 0000010b [SR] Beginning Verify and Repair transaction
2011-04-13 14:46:31, Info CSI 0000010d [SR] Verify complete
2011-04-13 14:46:32, Info CSI 0000010e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:46:32, Info CSI 0000010f [SR] Beginning Verify and Repair transaction
2011-04-13 14:46:58, Info CSI 00000112 [SR] Verify complete
2011-04-13 14:46:59, Info CSI 00000113 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:46:59, Info CSI 00000114 [SR] Beginning Verify and Repair transaction
2011-04-13 14:47:20, Info CSI 00000116 [SR] Verify complete
2011-04-13 14:47:20, Info CSI 00000117 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:47:20, Info CSI 00000118 [SR] Beginning Verify and Repair transaction
2011-04-13 14:47:29, Info CSI 0000011a [SR] Verify complete
2011-04-13 14:47:30, Info CSI 0000011b [SR] Verifying 100 (0x00000064) components
2011-04-13 14:47:30, Info CSI 0000011c [SR] Beginning Verify and Repair transaction
2011-04-13 14:47:56, Info CSI 0000011e [SR] Verify complete
2011-04-13 14:47:57, Info CSI 0000011f [SR] Verifying 100 (0x00000064) components
2011-04-13 14:47:57, Info CSI 00000120 [SR] Beginning Verify and Repair transaction
2011-04-13 14:48:14, Info CSI 00000122 [SR] Verify complete
2011-04-13 14:48:15, Info CSI 00000123 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:48:15, Info CSI 00000124 [SR] Beginning Verify and Repair transaction
2011-04-13 14:48:36, Info CSI 00000126 [SR] Verify complete
2011-04-13 14:48:37, Info CSI 00000127 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:48:37, Info CSI 00000128 [SR] Beginning Verify and Repair transaction
2011-04-13 14:49:20, Info CSI 0000014d [SR] Verify complete
2011-04-13 14:49:21, Info CSI 0000014e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:49:21, Info CSI 0000014f [SR] Beginning Verify and Repair transaction
2011-04-13 14:50:05, Info CSI 00000151 [SR] Verify complete
2011-04-13 14:50:05, Info CSI 00000152 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:50:05, Info CSI 00000153 [SR] Beginning Verify and Repair transaction
2011-04-13 14:51:54, Info CSI 00000155 [SR] Verify complete
2011-04-13 14:51:54, Info CSI 00000156 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:51:54, Info CSI 00000157 [SR] Beginning Verify and Repair transaction
2011-04-13 14:52:42, Info CSI 00000159 [SR] Verify complete
2011-04-13 14:52:43, Info CSI 0000015a [SR] Verifying 100 (0x00000064) components
2011-04-13 14:52:43, Info CSI 0000015b [SR] Beginning Verify and Repair transaction
2011-04-13 14:53:04, Info CSI 0000015d [SR] Verify complete
2011-04-13 14:53:05, Info CSI 0000015e [SR] Verifying 100 (0x00000064) components
2011-04-13 14:53:05, Info CSI 0000015f [SR] Beginning Verify and Repair transaction
2011-04-13 14:53:17, Info CSI 00000161 [SR] Verify complete
2011-04-13 14:53:17, Info CSI 00000162 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:53:17, Info CSI 00000163 [SR] Beginning Verify and Repair transaction
2011-04-13 14:53:30, Info CSI 00000165 [SR] Verify complete
2011-04-13 14:53:31, Info CSI 00000166 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:53:31, Info CSI 00000167 [SR] Beginning Verify and Repair transaction
2011-04-13 14:53:44, Info CSI 0000016a [SR] Verify complete
2011-04-13 14:53:45, Info CSI 0000016b [SR] Verifying 100 (0x00000064) components
2011-04-13 14:53:45, Info CSI 0000016c [SR] Beginning Verify and Repair transaction
2011-04-13 14:54:41, Info CSI 0000016e [SR] Verify complete
2011-04-13 14:54:42, Info CSI 0000016f [SR] Verifying 100 (0x00000064) components
2011-04-13 14:54:42, Info CSI 00000170 [SR] Beginning Verify and Repair transaction
2011-04-13 14:55:12, Info CSI 00000172 [SR] Verify complete
2011-04-13 14:55:13, Info CSI 00000173 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:55:13, Info CSI 00000174 [SR] Beginning Verify and Repair transaction
2011-04-13 14:55:27, Info CSI 00000176 [SR] Verify complete
2011-04-13 14:55:27, Info CSI 00000177 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:55:27, Info CSI 00000178 [SR] Beginning Verify and Repair transaction
2011-04-13 14:56:12, Info CSI 0000017a [SR] Verify complete
2011-04-13 14:56:13, Info CSI 0000017b [SR] Verifying 100 (0x00000064) components
2011-04-13 14:56:13, Info CSI 0000017c [SR] Beginning Verify and Repair transaction
2011-04-13 14:56:32, Info CSI 0000017e [SR] Verify complete
2011-04-13 14:56:33, Info CSI 0000017f [SR] Verifying 100 (0x00000064) components
2011-04-13 14:56:33, Info CSI 00000180 [SR] Beginning Verify and Repair transaction
2011-04-13 14:56:56, Info CSI 00000182 [SR] Verify complete
2011-04-13 14:56:56, Info CSI 00000183 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:56:56, Info CSI 00000184 [SR] Beginning Verify and Repair transaction
2011-04-13 14:57:37, Info CSI 00000187 [SR] Verify complete
2011-04-13 14:57:38, Info CSI 00000188 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:57:38, Info CSI 00000189 [SR] Beginning Verify and Repair transaction
2011-04-13 14:58:03, Info CSI 0000018b [SR] Verify complete
2011-04-13 14:58:04, Info CSI 0000018c [SR] Verifying 100 (0x00000064) components
2011-04-13 14:58:04, Info CSI 0000018d [SR] Beginning Verify and Repair transaction
2011-04-13 14:58:20, Info CSI 0000018f [SR] Verify complete
2011-04-13 14:58:21, Info CSI 00000190 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:58:21, Info CSI 00000191 [SR] Beginning Verify and Repair transaction
2011-04-13 14:58:47, Info CSI 00000193 [SR] Verify complete
2011-04-13 14:58:48, Info CSI 00000194 [SR] Verifying 100 (0x00000064) components
2011-04-13 14:58:48, Info CSI 00000195 [SR] Beginning Verify and Repair transaction
2011-04-13 14:59:16, Info CSI 0000019a [SR] Verify complete
2011-04-13 14:59:17, Info CSI 0000019b [SR] Verifying 100 (0x00000064) components
2011-04-13 14:59:17, Info CSI 0000019c [SR] Beginning Verify and Repair transaction
2011-04-13 14:59:55, Info CSI 0000019e [SR] Verify complete
2011-04-13 14:59:56, Info CSI 0000019f [SR] Verifying 100 (0x00000064) components
2011-04-13 14:59:56, Info CSI 000001a0 [SR] Beginning Verify and Repair transaction
2011-04-13 15:00:25, Info CSI 000001a2 [SR] Verify complete
2011-04-13 15:00:25, Info CSI 000001a3 [SR] Verifying 100 (0x00000064) components
2011-04-13 15:00:25, Info CSI 000001a4 [SR] Beginning Verify and Repair transaction
2011-04-13 15:00:48, Info CSI 000001a6 [SR] Verify complete
2011-04-13 15:00:49, Info CSI 000001a7 [SR] Verifying 100 (0x00000064) components
2011-04-13 15:00:49, Info CSI 000001a8 [SR] Beginning Verify and Repair transaction
2011-04-13 15:00:54, Info CSI 000001aa [SR] Verify complete
2011-04-13 15:00:55, Info CSI 000001ab [SR] Verifying 100 (0x00000064) components
2011-04-13 15:00:55, Info CSI 000001ac [SR] Beginning Verify and Repair transaction
2011-04-13 15:01:07, Info CSI 000001ae [SR] Verify complete
2011-04-13 15:01:08, Info CSI 000001af [SR] Verifying 100 (0x00000064) components
2011-04-13 15:01:08, Info CSI 000001b0 [SR] Beginning Verify and Repair transaction
2011-04-13 15:01:19, Info CSI 000001b2 [SR] Verify complete
2011-04-13 15:01:21, Info CSI 000001b3 [SR] Verifying 100 (0x00000064) components
2011-04-13 15:01:21, Info CSI 000001b4 [SR] Beginning Verify and Repair transaction
2011-04-13 15:01:41, Info CSI 000001b6 [SR] Verify complete
2011-04-13 15:01:43, Info CSI 000001b7 [SR] Verifying 100 (0x00000064) components
2011-04-13 15:01:43, Info CSI 000001b8 [SR] Beginning Verify and Repair transaction
2011-04-13 15:02:47, Info CSI 000001ba [SR] Verify complete
2011-04-13 15:02:48, Info CSI 000001bb [SR] Verifying 100 (0x00000064) components
2011-04-13 15:02:48, Info CSI 000001bc [SR] Beginning Verify and Repair transaction
2011-04-13 15:03:00, Info CSI 000001be [SR] Verify complete
2011-04-13 15:03:02, Info CSI 000001bf [SR] Verifying 100 (0x00000064) components
2011-04-13 15:03:02, Info CSI 000001c0 [SR] Beginning Verify and Repair transaction
2011-04-13 15:03:13, Info CSI 000001c1 [SR] Cannot repair member file [l:50{25}]"ServiceModelInstallRC.dll" of WCF-M_SM_INS_RC_DLL, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2011-04-13 15:03:19, Info CSI 000001c2 [SR] Cannot repair member file [l:50{25}]"ServiceModelInstallRC.dll" of WCF-M_SM_INS_RC_DLL, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2011-04-13 15:03:19, Info CSI 000001c3 [SR] This component was referenced by [l:160{80}]"Package_49_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.948465-194_neutral_GDR"
2011-04-13 15:03:20, Info CSI 000001c5 [SR] Verify complete
2011-04-13 15:03:22, Info CSI 000001c6 [SR] Verifying 100 (0x00000064) components
2011-04-13 15:03:22, Info CSI 000001c7 [SR] Beginning Verify and Repair transaction
2011-04-13 15:03:40, Info CSI 000001d2 [SR] Verify complete
2011-04-13 15:03:40, Info CSI 000001d3 [SR] Verifying 5 components
2011-04-13 15:03:40, Info CSI 000001d4 [SR] Beginning Verify and Repair transaction
2011-04-13 15:03:41, Info CSI 000001d6 [SR] Verify complete
2011-04-13 15:03:41, Info CSI 000001d7 [SR] Repairing 1 components
2011-04-13 15:03:41, Info CSI 000001d8 [SR] Beginning Verify and Repair transaction
2011-04-13 15:03:41, Info CSI 000001d9 [SR] Cannot repair member file [l:50{25}]"ServiceModelInstallRC.dll" of WCF-M_SM_INS_RC_DLL, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2011-04-13 15:03:41, Info CSI 000001da [SR] Cannot repair member file [l:50{25}]"ServiceModelInstallRC.dll" of WCF-M_SM_INS_RC_DLL, Version = 6.0.6002.18005, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2011-04-13 15:03:41, Info CSI 000001db [SR] This component was referenced by [l:160{80}]"Package_49_for_KB948465~31bf3856ad364e35~x86~~6.0.1.18005.948465-194_neutral_GDR"
2011-04-13 15:03:41, Info CSI 000001dd [SR] Repair complete
2011-04-13 15:03:41, Info CSI 000001de [SR] Committing transaction
2011-04-13 15:03:41, Info CSI 000001e2 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired

Ok,it said success,but I take it it's not.
This is not malware. Look at this...
http://support.microsoft.com/kb/945925

If no joy I think you should start a topic in Vista with your SFC log and an explanation.