Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple dllhost.exe/Com Surrogate processes running


  • This topic is locked This topic is locked
20 replies to this topic

#1 4466jh

4466jh

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 04 October 2014 - 11:16 AM

Hello,

 

I'm having the same problem as talked about in

http://www.bleepingcomputer.com/forums/t/525236/30-dllhostexe32-com-surrogate-processes-running-cant-kill/ (which itself was based on another thread) and sure could use some help.

 

As described, I am constantly having 2 to 3 dozen instances of dllhost.ext/Com Surrogate opening up for no reason whatsoever, ending up consuming enough resources as to make any other application unresponsive.  CPU and memory are unusually high..  I can keep the Task Manager opan and continually close them one at a  time but they keep reoccurring.  It seemed like it took forever to get a DSS scan.  Any help would sure be appreciated.  Thanks

 

I have ran multiple passes of Malewarebytes and System Defender.  Also removed the drive and ran pass of Norton 360 on another system.  Ran Chkdsk (which fixed several issues).

 

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16575
Run by Mark Tucker at 8:53:49 on 2014-10-04
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.3061.1719 [GMT -5:00]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\DynDNS Updater\DynUpSvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsendersvc.exe
C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsender.exe
C:\Program Files\Hewlett-Packard\HP LinkUp Sender\LinkUpZeroC.exe
C:\Program Files\Hewlett-Packard\HP LinkUp Sender\LinkUpFTSender.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsender_gui.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\dllhost.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\dllhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://att.my.yahoo.com/
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://att.net
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: AT&&T Toolbar: {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - LocalServer32 - <no file>
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: AT&&T Toolbar: {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - LocalServer32 - <no file>
TB: AT&&T Toolbar: {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - LocalServer32 - <no file>
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [hpqSRMon] <no file>
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: SoftwareSASGeneration = dword:3
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - LocalServer32 - <no file>
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: construction.com
Trusted Zone: firstbanks.com
Trusted Zone: isqft.com
DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} - hxxp://aerialsexpress.com/ae/ecwplugins/ncs1.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{225C21AF-2FD1-4017-97F3-FFB266B81B98} : NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{225C21AF-2FD1-4017-97F3-FFB266B81B98} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{450B7088-04AD-4B1B-8A6C-0B69BBD0B1EA} : NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{450B7088-04AD-4B1B-8A6C-0B69BBD0B1EA} : DHCPNameServer = 192.168.1.1
Notify: igfxcui - igfxdev.dll
LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
============= SERVICES / DRIVERS ===============
.
R2 DynDNS Updater;DynDNS Updater;c:\program files\dyndns updater\DynUpSvc.exe [2010-4-16 103800]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 HPLinkUpZeroC;HP LinkUp Auto Discovery Service;c:\program files\hewlett-packard\hp linkup sender\LinkUpZeroC.exe [2011-10-16 258616]
R2 rgsender;Remote Graphics Sender Service;c:\program files\hewlett-packard\remote graphics sender\rgsendersvc.exe [2011-10-16 372736]
R2 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2012-5-25 247320]
R2 TeamViewer9;TeamViewer 9;c:\program files\teamviewer\version9\TeamViewer_Service.exe [2014-4-11 5037888]
R2 WDSC;WD File Management Shadow Engine;c:\program files\western digital\wd smartware\front parlor\WDSC.exe [2011-3-9 484352]
R3 hprg;hprg;c:\windows\system32\drivers\hprg.sys [2011-10-16 8760]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 WDFME;WD File Management Engine;"c:\program files\western digital\wd smartware\front parlor\wdfme\wdfme.exe" --> c:\program files\western digital\wd smartware\front parlor\wdfme\WDFME.exe [?]
S3 BrYNSvc;BrYNSvc;c:\program files\browny02\BrYNSvc.exe [2013-10-22 266240]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-2-22 55280]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-6-10 24576]
S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\drivers\ivusb.sys [2010-7-29 25112]
S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2014-3-25 74456]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-3-25 110296]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2008-1-20 21504]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2011-2-16 11520]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-9-11 770168]
S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2009-9-17 19968]
S4 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\belkin\belkin usb print and storage center\BkBackupScheduler.exe [2012-5-25 152576]
S4 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\belkin\belkin usb print and storage center\Bkapcs.exe [2012-5-25 49152]
.
=============== File Associations ===============
.
FileExt: .scr: AutoCADScriptFile=c:\windows\system32\notepad.exe "%1"
.
=============== Created Last 30 ================
.
2014-10-04 13:35:23 -------- d-sh--w- C:\$RECYCLE.BIN
2014-10-04 13:33:53 -------- d-s---w- C:\ComboFix
2014-10-04 12:10:28 256000 ----a-w- c:\windows\PEV.exe
2014-10-04 12:10:28 208896 ----a-w- c:\windows\MBR.exe
2014-10-04 12:10:23 98816 ----a-w- c:\windows\sed.exe
2014-10-04 05:36:08 -------- d-sh--w- C:\found.000
2014-10-03 01:53:51 221568 ----a-w- c:\windows\system32\drivers\netio.sys
2014-10-02 20:04:52 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-23 19:39:49 1176168 ----atw- c:\windows\system32\00006988.tmp
2014-09-23 19:38:34 1176168 ----atw- c:\windows\system32\00030766.tmp
2014-09-23 19:37:21 1176168 ----atw- c:\windows\system32\00020853.tmp
2014-09-23 19:37:04 1176168 ----atw- c:\windows\system32\00017023.tmp
2014-09-16 18:26:17 62576 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{9a0c9895-5a95-44f2-a6e7-244b00c07acf}\offreg.dll
2014-09-12 18:54:37 8581864 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{9a0c9895-5a95-44f2-a6e7-244b00c07acf}\mpengine.dll
2014-09-12 18:54:06 231584 ------w- c:\windows\system32\MpSigStub.exe
.
==================== Find3M  ====================
.
2014-09-26 14:23:12 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-26 14:22:51 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-23 19:39:48 1176168 ----atw- c:\windows\system32\00016881.tmp
2014-09-23 19:38:18 1176168 ----atw- c:\windows\system32\00003498.tmp
2014-09-23 19:30:40 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-09-23 19:30:38 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-08-23 01:03:46 297984 ----a-w- c:\windows\system32\gdi32.dll
2014-08-22 23:26:28 2054656 ----a-w- c:\windows\system32\win32k.sys
2014-08-15 14:42:27 1810432 ----a-w- c:\windows\system32\jscript9.dll
2014-08-15 14:37:03 1129472 ----a-w- c:\windows\system32\wininet.dll
2014-08-15 14:36:30 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2014-08-15 14:35:47 421376 ----a-w- c:\windows\system32\vbscript.dll
2014-08-15 14:35:34 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2014-08-15 14:34:49 11776 ----a-w- c:\windows\system32\mshta.exe
2014-08-15 14:34:47 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2014-07-25 07:35:46 875688 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2011-01-20 03:22:52 83072 ----a-w- c:\program files\Uninstall.exe
2010-11-16 12:06:05 175104 ----a-w- c:\program files\iTunes Agent.exe
2009-11-28 13:40:38 77824 ----a-w- c:\program files\Interop.iTunesLib.dll
2006-03-30 12:24:28 270336 ----a-w- c:\program files\log4net.dll
.
============= FINISH:  8:59:19.65 ===============

 

FRST scan:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-10-2014 01
Ran by Mark Tucker (administrator) on MARKT on 04-10-2014 09:59:25
Running from C:\Users\Mark Tucker\Desktop
Loaded Profile: Mark Tucker (Available profiles: Mark Tucker)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Motive Communications, Inc.) C:\Program Files\Common Files\Motive\McciCMService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Dynamic Network Services, Inc.) C:\Program Files\DynDNS Updater\DynUpSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsendersvc.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsender.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP LinkUp Sender\LinkUpZeroC.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP LinkUp Sender\LinkUpFTSender.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsender_gui.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
() C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [hpqSRMon] => [X]
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [QlbCtrl] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2007-12-06] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Microsoft Default Manager] => C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1037736 2007-08-31] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178712 2007-10-03] (Intel Corporation)
HKLM\...\Run: [hpWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-10-03] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-02-18] (Hewlett-Packard)
HKLM\...\Run: [BrStsMon00] => C:\Program Files\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [217088 2007-12-21] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1085440 2008-05-29] (Brother Industries, Ltd.)
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...\Run: [ISUSPM] => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...\MountPoints2: ##192.168.2.1#My Passport - Z:\WDSetup.exe
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...\MountPoints2: {038410ef-7327-11e0-a8ae-001b38f57570} - F:\TL-Bootstrap.exe
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...\MountPoints2: {571c342a-6f66-11e0-8911-001b38f57570} - G:\TL-Bootstrap.exe
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...\MountPoints2: {632f4f05-d850-11df-a6c5-001b38f57570} - F:\Setup.exe
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...\MountPoints2: {922e48d9-45ec-11dd-8f4d-806e6f6e6963} - F:\WIN\setup.exe
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Manager.lnk
ShortcutTarget: Desktop Manager.lnk -> C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe (No File)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.my.yahoo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://att.net
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
SearchScopes: HKLM - {8B0A8A63-D27E-476E-BCF7-9614A7362469} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscqd
SearchScopes: HKCU - {0A97161E-09B7-4A20-B25D-2A3085827CD3} URL = http://www.google.com/search?hl=en&q={searchTerms}
SearchScopes: HKCU - {625413C1-E0D4-4B9A-A5B3-ACF0C766077F} URL = http://delicious.com/search?p={searchTerms}
SearchScopes: HKCU - {668BC79E-B388-40B0-8A62-E8C0F200850A} URL =
SearchScopes: HKCU - {8B0A8A63-D27E-476E-BCF7-9614A7362469} URL =
SearchScopes: HKCU - {ADC5B5CD-925F-4E08-9D22-176546B39D6A} URL = http://www.flickr.com/search/?q={searchTerms}
SearchScopes: HKCU - {FEBB9950-FBB8-4D1C-AE8E-CD66A611B6EA} URL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=att-ie8
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} ->  No File
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: AT&&T Toolbar -> {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} ->  No File
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} -  No File
Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} http://aerialsexpress.com/ae/ecwplugins/ncs1.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{225C21AF-2FD1-4017-97F3-FFB266B81B98}: [NameServer] 216.146.35.35,216.146.36.36
Tcpip\..\Interfaces\{450B7088-04AD-4B1B-8A6C-0B69BBD0B1EA}: [NameServer] 216.146.35.35,216.146.36.36

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8064.0206 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 -> C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @viewpoint.com/VMP -> C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files\Yahoo!\Common\npyaxmpb.dll No File
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.1 -> C:\Users\Mark Tucker\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeploytk.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\SafeSearch.xml
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009-10-09]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010-01-11]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-03-18]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-01]
FF HKLM\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn
FF HKLM\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension
FF Extension: Default Manager - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2010-12-26]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [563104 2011-11-14] (Affinegy, Inc.)
S4 Belkin Local Backup Service; C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [152576 2011-04-19] () [File not signed]
S4 Belkin Network USB Helper; C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [49152 2010-02-09] () [File not signed]
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.) [File not signed]
R2 DynDNS Updater; C:\Program Files\DynDNS Updater\DynUpSvc.exe [103800 2010-04-16] (Dynamic Network Services, Inc.)
S3 getPlus® Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [33176 2009-03-03] (NOS Microsystems Ltd.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard) [File not signed]
R2 HPLinkUpZeroC; C:\Program Files\Hewlett-Packard\HP LinkUp Sender\LinkUpZeroC.exe [258616 2011-02-24] (Hewlett-Packard)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [303104 2009-01-26] (Motive Communications, Inc.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2008-07-18] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-07-18] (Hewlett-Packard) [File not signed]
R2 rgsender; C:\Program Files\Hewlett-Packard\Remote Graphics Sender\rgsendersvc.exe [372736 2010-12-10] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
R2 WDSC; C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [484352 2011-03-09] () [File not signed]
S4 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [X]
S2 WDFME; "C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 ASPI32; C:\Windows\system32\Drivers\ASPI32.sys [16512 2007-02-06] (Adaptec) [File not signed]
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-10-11] (Conexant Systems Inc.)
R3 hprg; C:\Windows\System32\DRIVERS\hprg.sys [8760 2010-12-10] (Hewlett-Packard)
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-29] (Initio Corporation)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [74456 2014-09-26] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-26] (Malwarebytes Corporation)
S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2009-01-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2009-01-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 Nmea; C:\Windows\System32\DRIVERS\pctnullport.sys [38680 2008-10-15] (PCTEL Inc.)
S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 PCASp50; C:\Windows\System32\Drivers\PCASp50.sys [27072 2007-10-12] (Printing Communications Assoc., Inc. (PCAUSA))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1810992 2009-03-27] ()
S3 swmsflt; C:\Windows\System32\drivers\swmsflt.sys [24840 2008-03-05] ()
R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [247320 2009-06-22] (silex technology, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
S3 catchme; \??\C:\Users\MARKTU~1\AppData\Local\Temp\catchme.sys [X]
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PCTINDIS5; \??\C:\Windows\system32\PCTINDIS5.SYS [X]
S3 RimUsb; System32\Drivers\RimUsb.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-04 09:59 - 2014-10-04 10:09 - 00020686 _____ () C:\Users\Mark Tucker\Desktop\FRST.txt
2014-10-04 09:56 - 2014-10-04 10:01 - 00000000 ____D () C:\FRST
2014-10-04 09:53 - 2014-10-04 09:53 - 01100800 _____ (Farbar) C:\Users\Mark Tucker\Desktop\FRST.exe
2014-10-04 09:15 - 2014-10-04 09:15 - 00001260 _____ () C:\Users\Mark Tucker\Desktop\FSS.txt
2014-10-04 09:13 - 2014-10-04 09:12 - 00415232 _____ (Farbar) C:\Users\Mark Tucker\Desktop\FSS.exe
2014-10-04 08:59 - 2014-10-04 08:59 - 00023846 _____ () C:\Users\Mark Tucker\Desktop\attach.txt
2014-10-04 08:59 - 2014-10-04 08:59 - 00012601 _____ () C:\Users\Mark Tucker\Desktop\dds.txt
2014-10-04 08:52 - 2014-10-04 08:42 - 01375089 _____ () C:\Users\Mark Tucker\Desktop\AdwCleaner.exe
2014-10-04 08:52 - 2014-10-04 08:39 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Mark Tucker\Desktop\tdsskiller.exe
2014-10-04 08:52 - 2014-10-04 08:34 - 00688992 ____R (Swearware) C:\Users\Mark Tucker\Desktop\dds.com
2014-10-04 08:49 - 2014-10-04 08:49 - 00000795 _____ () C:\Windows\setupact.log
2014-10-04 08:49 - 2014-10-04 08:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-04 08:33 - 2014-10-04 08:49 - 00000000 ___SD () C:\ComboFix
2014-10-04 07:10 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-04 07:10 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-04 07:10 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-04 07:10 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-04 07:10 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-04 07:10 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-04 07:10 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-04 07:10 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-04 07:07 - 2014-10-04 07:09 - 00000000 ____D () C:\Qoobox
2014-10-04 06:41 - 2014-10-04 06:41 - 00000000 ____D () C:\Windows\erdnt
2014-10-04 06:32 - 2014-10-04 08:39 - 05582481 _____ (Swearware) C:\Users\Mark Tucker\Desktop\ComboFix.exe
2014-10-04 00:36 - 2014-10-04 00:36 - 00000000 __SHD () C:\found.000
2014-10-03 07:13 - 2014-10-03 07:13 - 00002052 _____ () C:\Windows\epplauncher.mif
2014-10-02 20:53 - 2010-04-05 15:00 - 00221568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-10-02 15:07 - 2014-08-15 09:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-02 15:07 - 2014-08-15 09:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-02 15:07 - 2014-08-15 09:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-02 15:07 - 2014-08-15 09:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-02 15:07 - 2014-08-15 09:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-02 15:07 - 2014-08-15 09:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-02 15:07 - 2014-08-15 09:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-02 15:07 - 2014-08-15 09:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-10-02 15:07 - 2014-08-15 09:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-02 15:07 - 2014-08-15 09:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-02 15:07 - 2014-08-15 09:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-02 15:07 - 2014-08-15 09:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-10-02 15:07 - 2014-08-15 09:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-10-02 15:06 - 2014-08-15 09:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-02 15:04 - 2014-09-09 01:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-10-02 09:06 - 2014-10-02 09:06 - 00000000 _____ () C:\Users\Mark Tucker\AppData\Local\{812F3626-3DDF-44AB-A32D-559B0E7503E6}
2014-10-01 09:05 - 2014-10-01 09:05 - 00000000 _____ () C:\Users\Mark Tucker\AppData\Local\{7AE42402-A25D-44E4-941E-D3098EE49025}
2014-09-24 15:29 - 2014-10-04 09:34 - 00673438 _____ () C:\Windows\PFRO.log
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00032233.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00031776.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00031073.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00029402.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00028924.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00027329.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00020014.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00017724.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00010315.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00007185.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00005144.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00004730.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00003300.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00001148.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00031224.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028631.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028233.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028222.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00026574.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00026044.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00022891.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00019728.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00019515.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00017661.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00016881.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00016876.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00015807.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014736.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014715.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014448.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013969.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013364.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013221.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011910.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011781.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011714.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00010304.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00009756.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00006988.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00005583.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00005337.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00004829.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000944.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000508.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000300.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00032323.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031659.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031506.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031414.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030766.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030706.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030037.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00029731.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026708.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026697.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026615.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00024320.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023785.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023706.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023642.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023175.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023015.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00019113.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017930.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017759.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017657.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00015498.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00014605.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00012735.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00008885.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00007696.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00007265.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00003498.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00002923.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00000884.tmp
2014-09-23 14:37 - 2014-09-23 14:37 - 01176168 ____T () C:\Windows\system32\00020853.tmp
2014-09-23 14:37 - 2014-09-23 14:37 - 01176168 ____T () C:\Windows\system32\00017023.tmp
2014-09-12 13:54 - 2014-08-25 06:53 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-04 10:04 - 2014-08-19 13:07 - 01694008 _____ () C:\Windows\WindowsUpdate.log
2014-10-04 09:47 - 2009-03-05 08:18 - 00000433 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-10-04 09:47 - 2006-11-02 08:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-04 09:47 - 2006-11-02 07:47 - 00003344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-04 09:47 - 2006-11-02 07:47 - 00003344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-04 09:33 - 2006-11-02 08:01 - 00032540 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-04 09:27 - 2012-07-21 06:24 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-04 08:50 - 2006-11-02 05:33 - 00763586 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-04 08:49 - 2011-01-18 12:56 - 00000000 ____D () C:\Users\Mark Tucker\AppData\Local\CrashDumps
2014-10-02 18:09 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-02 17:24 - 2008-02-22 11:23 - 00000000 ____D () C:\Program Files\Microsoft Works
2014-10-02 17:24 - 2006-11-02 06:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-10-02 16:40 - 2008-04-23 17:43 - 00000000 ____D () C:\Program Files\Yahoo!
2014-10-02 16:35 - 2010-02-05 09:33 - 00000000 ____D () C:\ProgramData\Norton
2014-10-02 15:50 - 2008-02-22 10:54 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-10-02 15:37 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\rescache
2014-10-02 15:32 - 2011-12-04 09:44 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-02 15:03 - 2013-09-02 16:30 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-02 14:52 - 2013-10-22 18:16 - 00000000 ____D () C:\Program Files\Browny02
2014-10-02 14:51 - 2009-02-12 11:14 - 00000000 ____D () C:\Program Files\Common Files\Motive
2014-10-02 14:07 - 2011-10-18 10:21 - 00000394 _____ () C:\Windows\Tasks\ErrorEND.job
2014-09-26 09:23 - 2014-03-25 09:56 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 09:22 - 2014-03-25 09:56 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-25 08:41 - 2011-04-04 12:58 - 00000000 ____D () C:\Users\Mark Tucker\AppData\Roaming\HpUpdate
2014-09-23 14:30 - 2012-07-21 06:24 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-23 14:30 - 2011-05-18 12:14 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 15:42 - 2011-01-17 15:46 - 00000000 ____D () C:\Users\Mark Tucker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2014-09-22 14:46 - 2013-05-05 14:57 - 00000876 _____ () C:\Users\Mark Tucker\Desktop\Norton Installation Files.lnk
2014-09-19 12:14 - 2011-01-17 15:46 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2014-09-14 20:42 - 2009-03-13 12:48 - 00000000 ____D () C:\Program Files\Western Digital
2014-09-12 14:13 - 2011-10-18 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ErrorEND
2014-09-12 14:09 - 2011-03-01 07:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson
2014-09-11 07:01 - 2008-03-11 22:06 - 00000270 _____ () C:\Users\Public\Documents\hpqp.ini
2014-09-10 20:39 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-09-10 20:32 - 2006-11-02 05:22 - 67633152 _____ () C:\Windows\system32\config\software_previous
2014-09-10 20:32 - 2006-11-02 05:22 - 40108032 _____ () C:\Windows\system32\config\components_previous
2014-09-10 20:32 - 2006-11-02 05:22 - 29360128 _____ () C:\Windows\system32\config\system_previous
2014-09-10 20:32 - 2006-11-02 05:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2014-09-10 20:32 - 2006-11-02 05:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-09-10 20:32 - 2006-11-02 05:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-09-10 20:12 - 2008-04-23 17:35 - 00000000 ____D () C:\Users\Mark Tucker
2014-09-10 15:28 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\system32\spool
2014-09-10 15:08 - 2008-06-16 13:51 - 00000000 ____D () C:\Users\Mark Tucker\AppData\Local\Microsoft Help
2014-09-10 15:08 - 2008-04-23 18:04 - 00000000 ____D () C:\Users\Mark Tucker\AppData\Local\QuickPlay
2014-09-10 15:08 - 2008-04-23 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts
2014-09-10 15:08 - 2008-02-22 10:52 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-09-10 15:04 - 2006-11-02 06:18 - 00000000 ____D () C:\Windows\registration

Files to move or delete:
====================
C:\Users\Mark Tucker\cc_20090401_110710.reg
C:\Users\Mark Tucker\LMSetup.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-04 09:53

==================== End Of Log ============================

 

Attached File  Attach.txt   23.29KB   1 downloads


Edited by 4466jh, 04 October 2014 - 11:20 AM.


BC AdBot (Login to Remove)

 


#2 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:10 AM

Posted 06 October 2014 - 09:47 PM

Welcome to Bleeping Computer.

Please do the following:


Download attached fixlist.txt file and save it to the Desktop.


Attached File  FixList.txt   7.53KB   4 downloads

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#3 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 07 October 2014 - 08:07 AM

Thank you so much for your assistance. I really appreciate it. Here is the file that your requested.

start
HKLM\...\Run: [hpqSRMon] => [X]
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
SearchScopes: HKLM - {8B0A8A63-D27E-476E-BCF7-9614A7362469} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscqd
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00032233.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00031776.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00031073.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00029402.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00028924.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00027329.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00020014.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00017724.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00010315.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00007185.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00005144.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00004730.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00003300.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00001148.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00031224.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028631.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028233.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028222.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00026574.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00026044.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00022891.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00019728.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00019515.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00017661.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00016881.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00016876.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00015807.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014736.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014715.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014448.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013969.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013364.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013221.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011910.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011781.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011714.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00010304.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00009756.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00006988.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00005583.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00005337.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00004829.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000944.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000508.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000300.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00032323.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031659.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031506.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031414.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030766.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030706.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030037.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00029731.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026708.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026697.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026615.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00024320.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023785.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023706.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023642.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023175.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023015.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00019113.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017930.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017759.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017657.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00015498.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00014605.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00012735.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00008885.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00007696.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00007265.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00003498.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00002923.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00000884.tmp
2014-09-23 14:37 - 2014-09-23 14:37 - 01176168 ____T () C:\Windows\system32\00020853.tmp
2014-09-23 14:37 - 2014-09-23 14:37 - 01176168 ____T () C:\Windows\system32\00017023.tmp
EmptyTemp:
end

#4 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:10 AM

Posted 07 October 2014 - 11:38 AM

Hello

If you ran the FIX, then a different log will have been created on the desktop called "FIXLOG.TXT" if you could please either post or attach that one.

Also please advise if there are any outstanding issues.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#5 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 07 October 2014 - 03:35 PM

Ok I an re-running the FRST tool. It is in process of running now but the system is sooooo slow that it has been running for an hour or more. While I am waiting here is some more info on things I have done. I feel like the hardware is ok. I put another disk in and loaded win 7 and it ran like it should. No issues. When I ran the Norton 360 pass for a virus it took almost a full day for it to run. When I tried to run Malewarebytes it kept shopping in the middle. I assume from running so slow. I did take the disk out and installed it in another system and ran a pass of Malewarebytes with no issues. I am not sure that I could get IE to work long enough to send these files to you so I am coping them over to a flash drive and sending on another computer. When the FIX completes I will send it in another post. Thanks again for your help.

#6 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:10 AM

Posted 07 October 2014 - 04:11 PM

I put another disk in and loaded win 7 and it ran like it should.

 

what do you mean by this?

 

 

When I ran the Norton 360 pass for a virus it took almost a full day for it to run. When I tried to run Malewarebytes it kept shopping in the middle

 

If you are comfortable now fixing this on your own, please let me know.  If you would still like my assistance, please stop  trying to run other fixes in the middle of things, it could compromise the machine


Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#7 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 07 October 2014 - 05:35 PM

Sorry these things were done before you started on the system. I am not doing anything on my own unless directed by you. What I meant by the other disk was I installed another disk in the laptop and then installed windows 7 to verify the hardware. I then removed it and reinstalled the original disk. Here is the file you requested.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-10-2014 01
Ran by Mark Tucker at 2014-10-07 14:04:48 Run:1
Running from C:\Users\Mark Tucker\Desktop
Loaded Profile: Mark Tucker (Available profiles: Mark Tucker)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
HKLM\...\Run: [hpqSRMon] => [X]
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-3609811422-2162949216-351848069-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
SearchScopes: HKLM - {8B0A8A63-D27E-476E-BCF7-9614A7362469} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscqd
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00032233.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00031776.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00031073.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00029402.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00028924.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00027329.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00020014.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00017724.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00010315.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00007185.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00005144.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00004730.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00003300.tmp
2014-09-23 14:40 - 2014-09-23 14:40 - 01176168 ____T () C:\Windows\system32\00001148.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00031224.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028631.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028233.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00028222.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00026574.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00026044.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00022891.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00019728.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00019515.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00017661.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00016881.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00016876.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00015807.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014736.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014715.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00014448.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013969.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013364.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00013221.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011910.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011781.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00011714.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00010304.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00009756.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00006988.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00005583.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00005337.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00004829.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000944.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000508.tmp
2014-09-23 14:39 - 2014-09-23 14:39 - 01176168 ____T () C:\Windows\system32\00000300.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00032323.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031659.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031506.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00031414.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030766.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030706.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00030037.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00029731.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026708.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026697.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00026615.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00024320.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023785.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023706.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023642.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023175.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00023015.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00019113.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017930.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017759.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00017657.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00015498.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00014605.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00012735.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00008885.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00007696.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00007265.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00003498.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00002923.tmp
2014-09-23 14:38 - 2014-09-23 14:38 - 01176168 ____T () C:\Windows\system32\00000884.tmp
2014-09-23 14:37 - 2014-09-23 14:37 - 01176168 ____T () C:\Windows\system32\00020853.tmp
2014-09-23 14:37 - 2014-09-23 14:37 - 01176168 ____T () C:\Windows\system32\00017023.tmp
EmptyTemp:
end

#8 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:10 AM

Posted 07 October 2014 - 06:21 PM

Hello

was there anything more to that log as it appears incomplete?

Please run the following:

Refer to the ComboFix User's Guide
  • Download ComboFix from the following location:

    Link

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


    ---------------------------------------------------------------------------------------------
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ---------------------------------------------------------------------------------------------
NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#9 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 07 October 2014 - 07:57 PM

Received a message that "NirCmd has stopped working". It gave me the options to check online for a solution and close the program or Close the program. I chose Close the program.
Same message came up 3 additional times and I closed it each time. Did not do anything else. Finally ComboFix started scanning for infected files.

ComboFix 14-10-04.01 - Mark Tucker 10/07/2014 19:30:18.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.1541 [GMT -5:00]
Running from: c:\users\Mark Tucker\Desktop\ComboFix.exe
AV: Norton 360 Premier Edition *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton 360 Premier Edition *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton 360 Premier Edition *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Mark Tucker\AppData\Local\.#
c:\users\Mark Tucker\AppData\Roaming\redline2stapler.tmp
c:\users\Mark Tucker\g2mdlhlpx.exe
c:\users\Mark Tucker\GoToAssistDownloadHelper.exe
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\system32\00000963.tmp
c:\windows\system32\00001834.tmp
c:\windows\system32\00001840.tmp
c:\windows\system32\00001964.tmp
c:\windows\system32\00003992.tmp
c:\windows\system32\00004045.tmp
c:\windows\system32\00005393.tmp
c:\windows\system32\00005489.tmp
c:\windows\system32\00007000.tmp
c:\windows\system32\00007207.tmp
c:\windows\system32\00007354.tmp
c:\windows\system32\00008339.tmp
c:\windows\system32\00009083.tmp
c:\windows\system32\00009867.tmp
c:\windows\system32\00010780.tmp
c:\windows\system32\00012819.tmp
c:\windows\system32\00013429.tmp
c:\windows\system32\00015179.tmp
c:\windows\system32\00015186.tmp
c:\windows\system32\00015994.tmp
c:\windows\system32\00018033.tmp
c:\windows\system32\00018816.tmp
c:\windows\system32\00022998.tmp
c:\windows\system32\00023435.tmp
c:\windows\system32\00024841.tmp
c:\windows\system32\00025073.tmp
c:\windows\system32\00026114.tmp
c:\windows\system32\00026985.tmp
c:\windows\system32\00028798.tmp
c:\windows\system32\00031131.tmp
c:\windows\system32\00032575.tmp
c:\windows\system32\KBL.LOG
.
.
((((((((((((((((((((((((( Files Created from 2014-09-08 to 2014-10-08 )))))))))))))))))))))))))))))))
.
.
2014-10-08 00:40 . 2014-10-08 00:41 -------- d-----w- c:\users\Mark Tucker\AppData\Local\temp
2014-10-08 00:40 . 2014-10-08 00:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-07 19:03 . 2014-10-07 21:35 -------- d-----w- C:\FRST
2014-10-06 23:06 . 2014-10-06 23:06 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2014-10-06 19:08 . 2014-10-06 19:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2014-09-22 20:13 . 2014-09-22 20:13 142936 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2014-09-22 20:00 . 2014-09-23 16:09 -------- d-----w- c:\windows\system32\drivers\N360
2014-09-22 20:00 . 2014-09-22 20:00 -------- d-----w- c:\program files\Norton 360
2014-09-22 15:07 . 2014-09-25 21:43 -------- d-----w- c:\windows\system32\drivers\NST
2014-09-22 15:07 . 2014-09-22 15:07 -------- d-----w- c:\program files\Norton Identity Safe
2014-09-16 18:26 . 2014-09-16 18:26 62576 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{9A0C9895-5A95-44F2-A6E7-244B00C07ACF}\offreg.dll ERROR(0x00000005)
2014-09-12 18:54 . 2014-08-21 16:24 8581864 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{9A0C9895-5A95-44F2-A6E7-244B00C07ACF}\mpengine.dll ERROR(0x00000005)
2014-09-12 18:54 . 2014-08-25 11:53 231584 ------w- c:\windows\system32\MpSigStub.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-26 14:22 . 2014-03-25 14:56 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-23 19:30 . 2012-07-21 11:24 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-09-23 19:30 . 2011-05-18 17:14 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-08-23 01:03 . 2014-09-02 17:41 297984 ----a-w- c:\windows\system32\gdi32.dll
2014-08-22 23:26 . 2014-09-02 17:41 2054656 ----a-w- c:\windows\system32\win32k.sys
2011-01-20 03:22 . 2011-01-20 03:22 83072 ----a-w- c:\program files\Uninstall.exe
2010-11-16 12:06 . 2010-10-10 16:27 175104 ----a-w- c:\program files\iTunes Agent.exe
2009-11-28 13:40 . 2010-10-10 16:33 77824 ----a-w- c:\program files\Interop.iTunesLib.dll
2006-03-30 12:24 . 2010-10-10 16:27 270336 ----a-w- c:\program files\log4net.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-12-06 202032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-26 150552]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-26 141848]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-26 173592]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2012-06-06 3076096]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-21 217088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApplePhotoStreams]
2013-10-31 19:47 59720 ----a-w- c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2010-04-13 07:29 47392 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2014-07-03 18:19 43816 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Belkin Storage Manager]
2009-02-03 22:40 858624 ----a-w- c:\program files\Belkin Storage Manager\StorageManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\com.apple.dav.bookmarks.daemon]
2013-10-02 09:02 59720 ----a-w- c:\program files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter4]
2012-09-07 02:06 143360 ------w- c:\program files\ControlCenter4\BrCcBoot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-12 01:01 46368 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaLAN]
2011-11-14 20:13 1884064 ----a-w- c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2014-07-08 13:49 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-12 01:03 29984 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPort11reminder]
2007-08-31 15:01 328992 ----a-w- c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-12-20 02:27 468264 ----a-w- c:\program files\HP\QuickPlay\QPService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2014-01-17 21:24 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBC_McciTrayApp]
2007-02-28 19:35 1011200 ----a-w- c:\program files\SBC\update\SST.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 15:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2007-09-13 21:32 222504 ------w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 22:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-10-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-21 19:32]
.
2013-09-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-09 22:07]
.
2014-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-29 00:03]
.
2014-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-29 00:03]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.my.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: borders.com\www
Trusted Zone: brother.com\www
Trusted Zone: construction.com
Trusted Zone: construction.com\dodgeprojects
Trusted Zone: constructionpoints.com\jm
Trusted Zone: constructionspoints.com\sso
Trusted Zone: craigslist.org\www
Trusted Zone: firstbanks.com
Trusted Zone: firstbanks.com\www
Trusted Zone: firstbanks.com\www2
Trusted Zone: hrsaccount.com\www
Trusted Zone: isqft.com
Trusted Zone: norton.com\manage
Trusted Zone: symantec.com\webdl
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{225C21AF-2FD1-4017-97F3-FFB266B81B98}: NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{450B7088-04AD-4B1B-8A6C-0B69BBD0B1EA}: NameServer = 216.146.35.35,216.146.36.36
.
.
------- File Associations -------
.
.scr=AutoCADScriptFile
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file)
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe
MSConfigStartUp-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSConfigStartUp-HTC Sync Loader - c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
AddRemove-GoToMeeting - c:\program files\Citrix\GoToMeeting\723\G2MUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-10-07 19:41
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\21.6.0.32\N360.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\21.6.0.32\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NCO]
"ImagePath"="\"c:\program files\Norton Identity Safe\Engine\2014.7.8.23\NST.exe\" /s \"NCO\" /m \"c:\program files\Norton Identity Safe\Engine\2014.7.8.23\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\System32\Drivers\N360\1506000.020\SYMTDIV.SYS"
"TrustedImagePaths"="c:\program files\Norton 360\Engine\21.6.0.32"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2014-10-07 19:44:38
ComboFix-quarantined-files.txt 2014-10-08 00:44
.
Pre-Run: 78,484,422,656 bytes free
Post-Run: 78,401,634,304 bytes free
.
- - End Of File - - 93FBD8690EBE2389F27F226F61E74661
1A1A06F62E891045814007163C1C76C3

#10 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 08 October 2014 - 07:14 AM

System has been on all night and still seems to be responsive when I do a directory or bring up the control panel.



#11 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:10 AM

Posted 08 October 2014 - 10:00 AM

Please do the following:

Open Malwarebytes:

• On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
• Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
• A Threat Scan will begin.
• With some infections, you may see this message box.
○ 'Could not load DDA driver'
• Click 'Yes' to this message, to allow the driver to load after a restart.
• Allow the computer to restart. Continue with the rest of these instructions.
• When the scan is complete, click Apply Actions.
• Wait for the prompt to restart the computer to appear, then click on Yes.

Attach the resulting log.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#12 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 08 October 2014 - 01:10 PM

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/8/2014
Scan Time: 12:50:20 PM
Logfile: rootkit.xt.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.10.08.07
Rootkit Database: v2014.10.08.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Mark Tucker

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 322469
Time Elapsed: 15 min, 45 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)



#13 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:10 AM

Posted 08 October 2014 - 07:09 PM

Please run the following:

Please download Junkware Removal Tool to your desktop.
  • Shutdown your antivirus to avoid any conflicts.
  • Right-mouse click JRT.exe and select Run as administrator
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message

NEXT


Please advise how the computer is running now and if there are any outstanding issues.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#14 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 08 October 2014 - 08:08 PM

The computer seems to be running great (for what it is).  I see no outstanding issues at all.  Everything is working fine.

Here is the log you requested.

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.1 (10.06.2014:1)
OS: Windows Vista ™ Home Premium x86
Ran by Mark Tucker on Wed 10/08/2014 at 19:57:25.70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE2A}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE2B}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29}

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\drivercure"
Successfully deleted: [Folder] "C:\ProgramData\viewpoint"
Successfully deleted: [Folder] "C:\Users\Mark Tucker\AppData\Roaming\drivercure"
Successfully deleted: [Folder] "C:\Program Files\viewpoint"

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 10/08/2014 at 20:01:25.80
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Thank you very much for your efforts.  I appreciate it very much. 



#15 4466jh

4466jh
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:10 AM

Posted 09 October 2014 - 06:31 AM

There are system updates waiting to be loaded.  Should I go ahead and load them or wait until you are finished with the computer?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users