Free Malware Removal Forum

by **Bio-Hazard** » August 10th, 2009, 7:14 am

Hello!

I have asked some advice regarding your issue. We need to check registry entries. Thank you for being so patient with me.

Please download CCSkeys to your desktop

Double click CCSkeys.exe to run the program, it will be very quick.
When complete a Notepad file will open, please copy and paste the entire contents into your next reply

Note: A copy of the Notepad file can be found at C:\export.txt. You can delete it, along with the CCSkeys.exe after posting the contents here.

by **Bio-Hazard** » August 10th, 2009, 10:57 am

Hello!

I have received some advice regarding your issues. Please run this.

Batch file

Open Notepad (not wordpad) by click start
Click Run
Type notepad into the box and click enter
Notepad will open

Copy and Paste everything from the Code box into Notepad (not wordpad):

Code: Select all

Set A = "%CD%"
winmgmt /clearadap
winmgmt /kill
winmgmt /unregserver
winmgmt /regserver
winmgmt /resyncperf
net stop winmgmt

cd /d %systemroot%\system32\wbem
rd /S /Q repository
 

regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
 

mofcomp cimwin32.mof
mofcomp cimwin32.mfl 
mofcomp rsop.mof   
mofcomp rsop.mfl   
for /f "delims=*" %%s in ('dir /b /s *.dll') do regsvr32 /s %%s 
for /f "delims=*" %%s in ('dir /b *.mof') do mofcomp %%s 
for /f  "delims=*" %%s in ('dir /b *.mfl') do mofcomp %%s 
echo DONE reboot
pause

Go to File > Save As
Save File name as fix.bat
Change Save as Type to All Files and save the file to your desktop.
Close Notepad
Double-click fix.bat on your Desktop
At the end it will say Done reboot
Close out the command prompt
Reboot your machine

After reboot lets run the script again.

Click Start > Run type Notepad click OK.
This will open an empty Notepad file.
Copy/Paste the contents of the box below into Notepad.

Code: Select all

'Script written by Mosaic1
'To diagnose a possible problem with CryptoGraphic Services.
'This script makes no changes to your operating system
'It merely reports
'Problem has so far only been seen in Windows XP SP3!
'Be careful not to fix anything unless you have the correct Registry Files for that operating System version.

Set fso = Wscript.CreateObject("Scripting.FileSystemObject")
Dim Z
set ts = fso.CreateTextFile("CReport.txt","true")
Ts.write Now & vbcrlf & vbcrlf
Set wshshell = Wscript.CreateObject("Wscript.Shell")

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where Name = 'Cryptsvc'")
For Each objService in colListofServices

If objService.State = "Stopped" then
ts.writeline "Cryptographic services not running!"
ts.writeline  "It's  Start mode is set to: " & objService.StartMode

Wshshell.run "regedit /a  Crypt.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cryptsvc" ,, true
Wshshell.run "regedit /a  spooler.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spooler" ,,true
Wshshell.run "regedit /a  Seclogon.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Seclogon" ,,true
If not  fso.Fileexists("Crypt.txt") then ts.writeline " Warning! No export of the Cryptsvc key exists."
If fso.Fileexists("Crypt.txt") then
set cs = fso.opentextfile("Crypt.txt",1)
Do while not cs.AtEndOfStream
C = cs.readall
loop
cs.close

ts.write C & vbcrlf
fso.DeleteFile("Crypt.txt")
End IF
If not  fso.Fileexists("spooler.txt") then ts.writeline " Warning! No export of the spooler key exists."
If fso.Fileexists("spooler.txt") then
set cs = fso.opentextfile("spooler.txt",1)
Do while not cs.AtEndOfStream
spool = cs.readall
loop
cs.close
Set cs = nothing

ts.write spool & vbcrlf
fso.DeleteFile("spooler.txt")
End IF
If not  fso.Fileexists("Seclogon.txt") then ts.writeline " Warning! No export of the Seclogon key exists."
If fso.Fileexists("Seclogon.txt") then
set cs = fso.opentextfile("seclogon.txt",1)
Do while not cs.AtEndOfStream
seclogon = cs.readall
loop
cs.close
Set cs = nothing
ts.write seclogon & vbcrlf
fso.DeleteFile("seclogon.txt")
End IF

ts.write vbcrlf & " CryptoGraphic Services Failures Events:" & vbcrlf

Else If objService.State = "Running" then
ts.Writeline "Cryptographic Services is running."
Wshshell.run """CReport.txt"""
wscript.quit
End IF
End IF

Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
            & "EventCode = '7000'")
For Each objEvent in colLoggedEvents
If instr(1,ObjEvent.Message,"cryptsvc",1) <> 0 then
 Z = Z + 1
    ts.writeline "Event Code: " & objEvent.EventCode
    ts.writeline "Event date: " & WMIDateStringToDate(objEvent.TimeGenerated)
    ts.writeline "Description: " & objEvent.Message

End IF

   
Next

If Z = 0 then ts.writeline "No  failure events found for Cryptographic Services."

ts.close

Wshshell.run """CReport.txt"""

Function WMIDateStringToDate(A)
 WMIDateStringToDate = CDate(Mid(A, 5, 2) & "/" & _
 Mid(A, 7, 2) & "/" & Left(A, 4) _
 & " " & Mid (A, 9, 2) & ":" & _
 Mid(A, 11, 2) & ":" & Mid(A, _
 13, 2))
End Function

Click Format and ensure Wordwrap is unchecked.
Save as Export.vbs
Save as file type All Files or it won't work.
Now double click on Export.vbs to run it.
A file CReport.txt will open on your Desktop, please post the contents in your next reply.

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

CReport.txt
A description of how your computer is behaving

by **tenmeg** » August 10th, 2009, 1:57 pm

Hi -

CCSkey was downloaded to my Desktop. I double click the CCSkey.exe file but nothing happened?? No Notepad file was produced. I examined C: drive & there was no 'export.txt' file. Searched C: drive for this .txt file but found nothing.

=================================================

Fix.bat -
Fix.bat did not performed as you outlined in your reply.

There was a Fix.bat instruction message created. See below>>

----------------------------------------------------------------------------------------

"The following services are dependent on the Windows Management Instrumentation services. Stopping the Windows Management Instrumentation services will also stop these services."
Security Center
Windows Firewall/Internet Connection Sharing (ICS)
hpqwmiex

Do you want to continue this operation (Y/N)

-----------------------------------------------------------------------------------------

It's unclear to me at this point what I should do since Fix.bat did not performed as outlined in your reply and by stopping these services will their be a problem later?? I did not continue the operation to stop these services as it was not clear what I should do at this point.

==================================================

EXPORT.VBS - I created Notepad exactly as described in your reply, copied the 'code' into Notedpad & saved it to Desktop. Again it would not run & I received the same error message that I copied to you earlier.

by **Bio-Hazard** » August 11th, 2009, 5:44 pm

Hello!

I have received some advice regarding your issues. Please run this.

Please disconnect from the internet. When it asks the question about:

"The following services are dependent on the Windows Management Instrumentation services. Stopping the Windows Management Instrumentation services will also stop these services."
Security Center
Windows Firewall/Internet Connection Sharing (ICS)
hpqwmiex

Do you want to continue this operation (Y/N)

Answer yes.

Batch file

Open Notepad (not wordpad) by click start
Click Run
Type notepad into the box and click enter
Notepad will open

Copy and Paste everything from the Code box into Notepad (not wordpad):

Code: Select all

Set A = "%CD%"
winmgmt /clearadap
winmgmt /kill
winmgmt /unregserver
winmgmt /regserver
winmgmt /resyncperf
net stop winmgmt

cd /d %systemroot%\system32\wbem
rd /S /Q repository
 

regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
 

mofcomp cimwin32.mof
mofcomp cimwin32.mfl 
mofcomp rsop.mof   
mofcomp rsop.mfl   
for /f "delims=*" %%s in ('dir /b /s *.dll') do regsvr32 /s %%s 
for /f "delims=*" %%s in ('dir /b *.mof') do mofcomp %%s 
for /f  "delims=*" %%s in ('dir /b *.mfl') do mofcomp %%s 
echo DONE reboot
pause

Go to File > Save As
Save File name as fix.bat
Change Save as Type to All Files and save the file to your desktop.
Close Notepad
Double-click fix.bat on your Desktop
At the end it will say Done reboot
Close out the command prompt
Reboot your machine

After reboot lets run the script again.

Click Start > Run type Notepad click OK.
This will open an empty Notepad file.
Copy/Paste the contents of the box below into Notepad.

Code: Select all

'Script written by Mosaic1
'To diagnose a possible problem with CryptoGraphic Services.
'This script makes no changes to your operating system
'It merely reports
'Problem has so far only been seen in Windows XP SP3!
'Be careful not to fix anything unless you have the correct Registry Files for that operating System version.

Set fso = Wscript.CreateObject("Scripting.FileSystemObject")
Dim Z
set ts = fso.CreateTextFile("CReport.txt","true")
Ts.write Now & vbcrlf & vbcrlf
Set wshshell = Wscript.CreateObject("Wscript.Shell")

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
    ("Select * from Win32_Service Where Name = 'Cryptsvc'")
For Each objService in colListofServices

If objService.State = "Stopped" then
ts.writeline "Cryptographic services not running!"
ts.writeline  "It's  Start mode is set to: " & objService.StartMode

Wshshell.run "regedit /a  Crypt.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cryptsvc" ,, true
Wshshell.run "regedit /a  spooler.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spooler" ,,true
Wshshell.run "regedit /a  Seclogon.txt HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Seclogon" ,,true
If not  fso.Fileexists("Crypt.txt") then ts.writeline " Warning! No export of the Cryptsvc key exists."
If fso.Fileexists("Crypt.txt") then
set cs = fso.opentextfile("Crypt.txt",1)
Do while not cs.AtEndOfStream
C = cs.readall
loop
cs.close

ts.write C & vbcrlf
fso.DeleteFile("Crypt.txt")
End IF
If not  fso.Fileexists("spooler.txt") then ts.writeline " Warning! No export of the spooler key exists."
If fso.Fileexists("spooler.txt") then
set cs = fso.opentextfile("spooler.txt",1)
Do while not cs.AtEndOfStream
spool = cs.readall
loop
cs.close
Set cs = nothing

ts.write spool & vbcrlf
fso.DeleteFile("spooler.txt")
End IF
If not  fso.Fileexists("Seclogon.txt") then ts.writeline " Warning! No export of the Seclogon key exists."
If fso.Fileexists("Seclogon.txt") then
set cs = fso.opentextfile("seclogon.txt",1)
Do while not cs.AtEndOfStream
seclogon = cs.readall
loop
cs.close
Set cs = nothing
ts.write seclogon & vbcrlf
fso.DeleteFile("seclogon.txt")
End IF

ts.write vbcrlf & " CryptoGraphic Services Failures Events:" & vbcrlf

Else If objService.State = "Running" then
ts.Writeline "Cryptographic Services is running."
Wshshell.run """CReport.txt"""
wscript.quit
End IF
End IF

Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'System' and " _
            & "EventCode = '7000'")
For Each objEvent in colLoggedEvents
If instr(1,ObjEvent.Message,"cryptsvc",1) <> 0 then
 Z = Z + 1
    ts.writeline "Event Code: " & objEvent.EventCode
    ts.writeline "Event date: " & WMIDateStringToDate(objEvent.TimeGenerated)
    ts.writeline "Description: " & objEvent.Message

End IF

   
Next

If Z = 0 then ts.writeline "No  failure events found for Cryptographic Services."

ts.close

Wshshell.run """CReport.txt"""

Function WMIDateStringToDate(A)
 WMIDateStringToDate = CDate(Mid(A, 5, 2) & "/" & _
 Mid(A, 7, 2) & "/" & Left(A, 4) _
 & " " & Mid (A, 9, 2) & ":" & _
 Mid(A, 11, 2) & ":" & Mid(A, _
 13, 2))
End Function

Click Format and ensure Wordwrap is unchecked.
Save as Export.vbs
Save as file type All Files or it won't work.
Now double click on Export.vbs to run it.
A file CReport.txt will open on your Desktop, please post the contents in your next reply.

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

CReport.txt
A description of how your computer is behaving

by **tenmeg** » August 12th, 2009, 12:47 am

Hi --

I ran fix.bat as described and after it finished running I rebooted my computer. So that part was a success.

I tried once more to run Export.vbs but it gave me the same error as I reported to you earlier. See next line.

Error message: Script, Export.vbs, Line, 12, Char, 1, Class doesn't support automation, code 800A01AE, Source, Microsoft VBScript runtime error

CReport.txt file produced was empty.

COMPUTER PERFORMANCE
When I reboot my computer now it shuts down a lot faster and it restarts faster. The redirection to other web sites when a Google search is ran has not returned. I am curious why the Export.vbs will not run??

by **Bio-Hazard** » August 13th, 2009, 2:37 am

Hello!

You have disabled Cryptographic services we need to get it enabled again.

Go into mscofig and click the services tab.
Then click on the box in front of Cryptographic services.
Then click apply and ok.
Restart when prompted.

Download and Run ComboFix

Delete the previous copy of Cpmbofix first. Download ComboFix from one of these locations:

Link 1
Link 2

Here you can find a tutorial about Combofix: HOW TO USE COMBOFIX

You must download it to and run it from your Desktop
ComboFix SHOULD NOT be used unless requested by a forum helper.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. A guide to do this can be found HERE
Double click on ComboFix.exe and follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
- If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix should never take more that 20 minutes including the reboot if malware is detected.

IMPORTANT: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.This tool is not a toy and not for everyday use.

Next Reply

Please reply with:

ComboFix log (found at C:\Combofix.txt)
New HijackThis log

by **tenmeg** » August 13th, 2009, 7:19 pm

Hi - Attached is Combo Fix and HJT log files as requested. . .

==============================================================================

ComboFix 09-08-10.06 - TENMEG 08/13/2009 15:58.4.1 - NTFSx86
Running from: c:\documents and settings\TENMEG\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090707-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-07-13 to 2009-08-13 )))))))))))))))))))))))))))))))
.

2009-08-12 04:06 . 2009-08-12 04:06 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-10 16:41 . 2009-08-10 16:41 -------- dc----w- C:\Documents
2009-08-08 19:18 . 2009-02-05 21:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-08 19:18 . 2009-02-05 21:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-08 19:18 . 2009-02-05 21:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-08 19:18 . 2009-02-05 21:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-08 19:18 . 2009-02-05 21:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-08 19:18 . 2009-02-05 21:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-08 19:18 . 2009-02-05 21:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-08 19:18 . 2009-02-05 21:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-08 19:18 . 2009-02-05 21:11 1256296 -c--a-w- c:\windows\system32\aswBoot.exe
2009-08-08 19:18 . 2009-08-08 19:18 -------- dc----w- c:\program files\Alwil Software
2009-08-08 18:18 . 2009-08-13 22:48 268435456 --sha-w- c:\windows\system32\temppf.sys
2009-08-08 16:25 . 2009-08-08 16:25 -------- dc----w- C:\_OTM
2009-08-02 19:05 . 2009-08-02 19:05 -------- dc----w- c:\documents and settings\TENMEG\Application Data\AVG8
2009-08-02 19:04 . 2009-08-02 19:04 848656 -c--a-w- C:\avg_avwt_stb_all_8_32.exe
2009-08-02 03:34 . 2009-08-10 17:17 -------- dc----w- C:\malware2009
2009-07-28 01:51 . 2009-07-30 21:18 -------- dc----w- C:\HiJack2009
2009-07-27 21:48 . 2009-08-02 18:53 -------- dc----w- C:\SpreadSheet
2009-07-27 21:44 . 2009-07-27 21:44 -------- dc----w- c:\documents and settings\TENMEG\Application Data\licenses
2009-07-27 21:44 . 2009-07-27 21:46 -------- dc----w- c:\documents and settings\TENMEG\Application Data\PCMM2009
2009-07-27 05:12 . 2009-04-10 13:58 6327408 -c-ha-w- c:\documents and settings\TENMEG\Application Data\mjusbsp\in00000\setup.exe
2009-07-27 05:12 . 2009-04-10 13:55 725296 -c-ha-w- c:\documents and settings\TENMEG\Application Data\mjusbsp\ar00000\install.exe
2009-07-27 05:12 . 2008-02-29 12:42 386496 -c--a-w- c:\documents and settings\TENMEG\Application Data\mjusbsp\ar00000\magicJackSplash.exe
2009-07-27 01:20 . 2009-07-27 01:22 -------- dc----w- c:\program files\Microsoft Windows OneCare Live
2009-07-26 20:55 . 2009-07-27 01:27 -------- dc----w- c:\program files\Windows Live Safety Center
2009-07-26 19:56 . 2009-07-26 19:56 78112 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-26 19:56 . 2009-07-26 19:56 -------- dc----w- c:\documents and settings\Administrator\Application Data\muvee Technologies
2009-07-26 19:40 . 2009-07-26 19:40 16409960 -c--a-w- c:\program files\ypsybotsd162.exe
2009-07-26 18:30 . 2009-07-26 18:30 1460840 -c--a-w- c:\program files\HousecallLauncher.exe
2009-07-26 18:21 . 2009-07-26 18:21 -------- dc----w- c:\documents and settings\TENMEG\.housecall6.6
2009-07-25 18:55 . 2009-07-25 18:55 -------- dc----w- c:\program files\Downloaded Installers
2009-07-25 04:01 . 2009-07-25 04:21 -------- dc----w- C:\MediaPlayer
2009-07-25 00:25 . 2009-07-25 00:25 25740144 -c--a-w- C:\wmp11-windowsxp-x86-enu.exe
2009-07-17 22:52 . 2009-07-17 22:53 -------- dc----w- C:\Trailers Silver
2009-07-15 15:28 . 2009-07-17 17:46 -------- dc----w- C:\DirectTV

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-10 17:18 . 2008-08-17 16:30 2568 -c--a-w- c:\documents and settings\TENMEG\Application Data\wklnhst.dat
2009-08-10 01:43 . 2008-09-26 03:56 -------- dc----w- c:\documents and settings\TENMEG\Application Data\SiteClasses
2009-08-09 22:22 . 2008-09-26 03:56 -------- dc----w- c:\documents and settings\TENMEG\Application Data\Sites
2009-08-02 18:10 . 2008-08-09 19:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-02 18:10 . 2008-11-15 19:24 3775175 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-02 17:21 . 2006-01-21 02:44 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-02 04:14 . 2006-10-24 18:32 -------- d-----w- c:\program files\WinAce
2009-07-30 21:10 . 2009-04-08 16:50 -------- dc----w- c:\documents and settings\All Users\Application Data\NOS
2009-07-30 21:10 . 2009-04-08 16:50 -------- dc----w- c:\program files\NOS
2009-07-27 05:13 . 2008-08-11 05:28 -------- dc----w- c:\documents and settings\TENMEG\Application Data\mjusbsp
2009-07-26 20:40 . 2008-08-27 04:59 -------- dc----w- c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-07-13 20:36 . 2008-08-09 19:08 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 20:36 . 2008-08-09 19:08 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-26 03:56 . 2008-08-17 16:25 -------- dc----w- c:\documents and settings\TENMEG\Application Data\Intuit
2009-06-24 17:12 . 2008-12-04 22:09 65823 -c--a-w- c:\documents and settings\TENMEG\Application Data\magicJackOutlookAddIn\magicJackOutlookAddInUninst.exe
2008-09-05 04:35 . 2008-09-05 04:36 785920 -c--a-w- c:\program files\HP Product Detection.msi
2008-09-05 04:35 . 2008-09-05 04:36 3584 -c--a-w- c:\program files\1033.MST
2008-08-20 00:28 . 2008-08-20 00:28 461 -c--a-w- c:\program files\Shortcut to iTunes.lnk
2008-06-26 22:22 . 2008-06-26 22:22 812344 -c--a-w- c:\program files\HJTInstall.exe
2006-03-09 21:32 . 2006-03-09 21:32 3752 -c--a-w- c:\program files\SP32338.CVA
2006-02-21 08:12 . 2006-02-21 08:12 11085 -c--a-w- c:\program files\cpl309bk.cat
2006-02-06 21:02 . 2006-02-06 21:02 32572 -c--a-w- c:\program files\cpl309bk.inf
2006-01-26 07:53 . 2006-01-26 07:53 472 -c--a-w- c:\program files\cpl309bk.ini
2005-08-22 22:07 . 2005-08-22 22:07 1035008 -c--a-w- c:\program files\HSF_DPV.sys
2005-08-22 21:06 . 2005-08-22 21:06 231424 -c--a-w- c:\program files\HSFHWATI.sys
2005-08-22 21:06 . 2005-08-22 21:06 718464 -c--a-w- c:\program files\HSF_CNXT.sys
2005-08-18 17:13 . 2005-08-18 17:13 133528 -c--a-w- c:\program files\HSFProf.cty
2005-08-12 20:01 . 2005-08-12 20:01 577536 -c--a-w- c:\program files\HXFSetup.exe
2005-06-20 14:57 . 2005-06-20 14:57 110592 -c--a-w- c:\program files\uci32100.dll
2004-03-17 16:04 . 2004-03-17 16:04 13059 -c--a-w- c:\program files\MDMXSDK.sys
2004-03-17 16:00 . 2004-03-17 16:00 86016 -c--a-w- c:\program files\MdmXSdk.dll
2002-02-04 20:39 . 2002-02-04 20:39 23 -c--a-w- c:\program files\disk1
2005-07-14 19:31 . 2006-05-24 17:37 27648 --sha-w- c:\windows\system32\AVSredirect.dll
.

------- Sigcheck -------

[-] 2004-08-04 08:00 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2004-08-04 08:00 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll
[-] 2008-12-08 20:16 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\dllcache\user32.dll

[-] 2004-08-04 08:00 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\ws2_32.dll

[-] 2005-05-02 20:57 658944 E1E18136F9DD3DF1AD9C82193A5898A6 c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll
[-] 2006-03-04 03:58 663552 C0845ECBF4F9164E618EE381B79C9032 c:\windows\$hf_mig$\KB912812\SP2QFE\wininet.dll
[-] 2006-05-10 05:25 663552 D94CFFDB53E7AC867438E2DFD50E7CBC c:\windows\$hf_mig$\KB916281\SP2QFE\wininet.dll
[-] 2006-06-23 11:25 664576 64CE26DB72810B30F7855EA51E1DF836 c:\windows\$hf_mig$\KB918899\SP2QFE\wininet.dll
[-] 2006-09-14 08:31 664576 D207370287CF769AEBEBF03837784963 c:\windows\$hf_mig$\KB922760\SP2QFE\wininet.dll
[-] 2007-03-07 17:40 823296 B8F4DB39CA7353752F245379D285C80E c:\windows\$hf_mig$\KB931768-IE7\SP2QFE\wininet.dll
[-] 2007-04-25 09:08 823808 431DEFBB4A3D7B0DC062C1B064623A2F c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
[-] 2007-06-27 14:40 824320 D6ED5E042C5207553E7F5E842918137F c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
[-] 2007-08-20 10:02 825344 357D54BF94FE9D6D8505A96B5C2A3BCA c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
[-] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2004-08-04 08:00 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB883939$\wininet.dll
[-] 2005-05-02 20:52 657920 1A078AF3F85D10BA56444C23B3A18E74 c:\windows\$NtUninstallKB912812$\wininet.dll
[-] 2006-03-04 03:33 658432 1C0979C7A489BEE573CD0BF4AD94BB06 c:\windows\$NtUninstallKB916281$\wininet.dll
[-] 2006-05-10 05:23 658432 38AB7A56F566D9AAAD31812494944824 c:\windows\$NtUninstallKB918899$\wininet.dll
[-] 2006-06-23 11:02 658944 2B4DB890936430C71419037039502752 c:\windows\$NtUninstallKB922760$\wininet.dll
[-] 2006-09-14 08:39 658944 621AF3F6174A3F60677F5230E28BCC07 c:\windows\ie7\wininet.dll
[-] 2006-11-08 05:03 818688 92995334F993E6E49C25C6D02EC04401 c:\windows\ie7updates\KB928090-IE7\wininet.dll
[-] 2007-01-12 17:27 822784 BE43D00D802C92F01C8CC952C6F483F8 c:\windows\ie7updates\KB931768-IE7\wininet.dll
[-] 2007-03-07 17:45 822784 5B35DAE6E4886F64D1DA58C4E3E01EB9 c:\windows\ie7updates\KB933566-IE7\wininet.dll
[-] 2007-04-25 08:41 822784 0586A7F0B2FDB94D624F399D4728E7C8 c:\windows\ie7updates\KB937143-IE7\wininet.dll
[-] 2007-06-27 14:34 823808 8068CBB58FE60CC95AEB2CFF70178208 c:\windows\ie7updates\KB939653-IE7\wininet.dll
[-] 2007-08-20 10:04 824832 774435E499D8E9643EC961A6103C361F c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 826368 F6589BE784647CFDBC22EA51CCB1A57A c:\windows\system32\wininet.dll

[-] 2005-05-25 19:07 359936 63FDFEA54EB53DE2D863EE454937CE1E c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2006-01-13 17:07 360448 5562CC0A47B2AEF06D3417B733F3C195 c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2004-08-04 08:00 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB893066$\tcpip.sys
[-] 2005-05-25 19:04 359808 88763A98A4C26C409741B4AA162720C9 c:\windows\$NtUninstallKB913446$\tcpip.sys
[-] 2006-01-13 02:28 359808 583E063FDC888CA30D05C2724B0D7EF4 c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 08:00 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\winlogon.exe

[-] 2004-08-04 08:00 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 08:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2004-08-04 08:00 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe
[-] 2006-12-19 16:12 2059392 BA4B97C00A437C1CC3DA365D93EE1E9D c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\system32\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2004-08-04 08:00 2180992 CE218BC7088681FAA06633E218596CA7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\windows\$NtUninstallKB929338$\ntoskrnl.exe
[-] 2006-12-19 16:51 2182016 CEF243F6DEFD20BE4ADDE26C7ECACB54 c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\system32\ntoskrnl.exe

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-04 08:00 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe

[-] 2004-08-04 08:00 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\system32\services.exe

[-] 2004-08-04 08:00 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\lsass.exe

[-] 2004-08-04 08:00 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2004-08-04 08:00 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe

[-] 2004-08-04 08:00 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\userinit.exe

[-] 2004-08-04 08:00 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\termsrv.dll

[-] 2006-07-05 10:57 985088 0FDD84928A5DDE2510761B7EC76CCEC9 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2007-04-16 16:07 986112 09F7CB3687F86EDAA4CA081F7AB66C03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2004-08-04 08:00 983552 888190E31455FAD793312F8D087146EB c:\windows\$NtUninstallKB917422$\kernel32.dll
[-] 2006-07-05 10:55 984064 D8DB5397DE07577C1CB50BA6D23B3AD4 c:\windows\$NtUninstallKB935839$\kernel32.dll
[-] 2007-04-16 15:52 984576 A01F9CA902A88F7CED06884174D6419D c:\windows\system32\kernel32.dll

[-] 2004-08-04 08:00 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\powrprof.dll

[-] 2004-08-04 08:00 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\imm32.dll

[-] 2005-05-02 20:57 3014144 DCC5C79B99F02EEF8C826B074DBFC222 c:\windows\$hf_mig$\KB883939\SP2QFE\mshtml.dll
[-] 2006-03-23 20:31 3055616 ABCD123F888E4E97C8751378CCCC4F26 c:\windows\$hf_mig$\KB912812\SP2QFE\mshtml.dll
[-] 2006-05-19 15:06 3055104 8687E029BE63C77D4919485068C54D77 c:\windows\$hf_mig$\KB916281\SP2QFE\mshtml.dll
[-] 2006-07-28 11:30 3058176 D251679BD9EF0250201FB899EC40FD32 c:\windows\$hf_mig$\KB918899\SP2QFE\mshtml.dll
[-] 2006-09-14 08:31 3058688 CEFEA1C301139A817931BE132F0359FE c:\windows\$hf_mig$\KB922760\SP2QFE\mshtml.dll
[-] 2007-03-07 18:40 3582976 DA297A862E5F093A07D37C05F608C686 c:\windows\$hf_mig$\KB931768-IE7\SP2QFE\mshtml.dll
[-] 2007-05-08 09:25 3584000 1D4E3B86C601A2497C99790CC4D7DF26 c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\mshtml.dll
[-] 2007-07-18 21:09 3584000 7CE243CFD47AD0DC431586CB8C542A11 c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\mshtml.dll
[-] 2007-08-20 10:02 3592192 AA8A4BD78D24FCDB96DDAEE3756AA372 c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll
[-] 2007-10-30 23:48 3593216 54D8B404F17AA74C666F7F3AEF2AE459 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll
[-] 2007-12-07 02:01 3593216 976C46ED4A75FC66D9C596778898CE1E c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\mshtml.dll
[-] 2008-03-01 13:03 3593216 4EE273E2B09317C1217EF0DB91F93534 c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\mshtml.dll
[-] 2008-04-23 03:35 3593728 4D612FF5D3B7EEF200595AE6F95D5E68 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\mshtml.dll
[-] 2004-08-04 08:00 3003392 376E0843B2356CA91CEC8D9837A56FF7 c:\windows\$NtUninstallKB883939$\mshtml.dll
[-] 2005-05-02 21:52 3012608 DCFAC5470EE0A159EC4222BC28AE3EE6 c:\windows\$NtUninstallKB912812$\mshtml.dll
[-] 2006-03-23 20:32 3053568 DEAA438EA31095E14A196FF647E38D13 c:\windows\$NtUninstallKB916281$\mshtml.dll
[-] 2006-05-19 15:08 3052544 284CE76B71DD5260B42A3CCF0135AF67 c:\windows\$NtUninstallKB918899$\mshtml.dll
[-] 2006-07-28 11:28 3054080 C7074DA3D8F8C0F6C03874BA0B05069C c:\windows\$NtUninstallKB922760$\mshtml.dll
[-] 2006-09-14 08:39 3054592 BE45460D1453B7342E01EAE79BFBC681 c:\windows\ie7\mshtml.dll
[-] 2006-11-08 05:03 3577856 CBF04597F9CF7739E572276A2698FDD3 c:\windows\ie7updates\KB928090-IE7\mshtml.dll
[-] 2007-01-12 17:27 3580416 5D45318804A30CE9D6EA83066E84B4A7 c:\windows\ie7updates\KB931768-IE7\mshtml.dll
[-] 2007-03-07 17:45 3581952 190E1AE9B973049B12A67BAD478C770C c:\windows\ie7updates\KB933566-IE7\mshtml.dll
[-] 2007-05-08 09:24 3583488 5D90A7200F72DACE663EE78DE234FCC7 c:\windows\ie7updates\KB937143-IE7\mshtml.dll
[-] 2007-07-19 06:59 3583488 BD609A26B683332A0E0E1445C5724851 c:\windows\ie7updates\KB939653-IE7\mshtml.dll
[-] 2007-08-20 10:04 3584512 E267EE248CDA7667C19001C069DE867B c:\windows\ie7updates\KB942615-IE7\mshtml.dll
[-] 2007-10-30 23:42 3590656 8AB7ECF59D6EBBE986277B65ED4A40A1 c:\windows\ie7updates\KB944533-IE7\mshtml.dll
[-] 2007-12-08 05:21 3592192 A097C36412455F0C7E42377FAF8809B7 c:\windows\ie7updates\KB947864-IE7\mshtml.dll
[-] 2008-03-02 01:36 3591680 AB2C88167D78D71D93558ACECB24CC7A c:\windows\ie7updates\KB950759-IE7\mshtml.dll
[-] 2008-04-24 05:16 3591680 8976CAB317105F7431B08EA32AB73C65 c:\windows\system32\mshtml.dll

[-] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\system32\drivers\kbdclass.sys
[-] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\windows\system32\ReinstallBackups\0008\DriverFiles\i386\kbdclass.sys

[-] 2004-08-04 08:00 792064 6728270CB7DBB776ED086F5AC4C82310 c:\windows\system32\comres.dll

[-] 2004-08-04 08:00 22016 74D66B3DE265E8789153414E75175F26 c:\windows\system32\lpk.dll

[-] 2004-08-04 08:00 2944 73C1E1F395918BC2C6DD67AF7591A3AD c:\windows\system32\drivers\null.sys

[-] 2006-02-15 00:30 142464 1EE7B434BA961EF845DE136224C30FEC c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2004-08-04 06:39 142464 841F385C6CFAF66B58FBD898722BB4F0 c:\windows\$NtUninstallKB900485$\aec.sys
[-] 2006-02-15 00:22 142464 1EE7B434BA961EF845DE136224C30FEC c:\windows\Driver Cache\i386\aec.sys
[-] 2006-02-15 00:22 142464 1EE7B434BA961EF845DE136224C30FEC c:\windows\system32\drivers\aec.sys

[-] 2004-08-04 08:00 924432 DDF8D47ACF8FC3FE5F7F2B95C4D4D136 c:\windows\$NtUninstallKB924667$\mfc40u.dll
[-] 2006-11-01 19:17 927504 925F8B61ED301A317BA850EBEECBDAA0 c:\windows\system32\mfc40u.dll

[-] 2005-01-14 05:07 395776 94456045BEB4545B5EBE1DCC85951AFA c:\windows\$hf_mig$\KB873333\SP2QFE\rpcss.dll
[-] 2005-04-28 19:35 396288 DA383FB39A6F1C445F3AFC94B3EB1248 c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-07-26 04:20 398336 C369DF215D352B6F3A0B8C3469AA34F8 c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2004-08-04 08:00 395776 5C83A4408604F737717AB96371201680 c:\windows\$NtUninstallKB873333$\rpcss.dll
[-] 2005-01-14 08:55 395776 419899803CA479B73B02390318C787C0 c:\windows\$NtUninstallKB894391$\rpcss.dll
[-] 2005-04-28 19:31 395776 C8061F289E000703E7672916B7FE1571 c:\windows\$NtUninstallKB902400$\rpcss.dll
[-] 2005-07-26 04:39 397824 CE94A2BD25E3E9F4D46A7373FF455C6D c:\windows\system32\rpcss.dll

[-] 2004-08-04 08:00 33792 95FD808E4AC22ABA025A7B3EAC0375D2 c:\windows\system32\msgsvc.dll

[-] 2004-08-04 08:00 611328 A77DFB85FAEE49D66C74DA6024EBC69B c:\windows\$NtUninstallKB923191$\comctl32.dll
[-] 2006-08-25 15:45 617472 B0124CB21D28B1C9F678B566B6B57D92 c:\windows\system32\comctl32.dll
[-] 2004-08-04 08:00 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2004-08-04 08:00 1050624 5AF68A5E44734A082442668E9C787743 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
[-] 2006-08-25 15:45 1054208 C4E80875C1CF1222FC5EFD0314AE5C01 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

[-] 2004-08-04 08:00 11648 9859C0F6936E723E4892D7141B1327D5 c:\windows\system32\drivers\acpiec.sys

[-] 2004-08-04 08:00 5120 E8A12A12EA9088B4327D49EDCA3ADD3E c:\windows\system32\sfc.dll

[-] 2004-08-04 08:00 407040 96353FCECBA774BB8DA74A1C6507015A c:\windows\system32\netlogon.dll

[-] 2004-08-04 08:00 382464 2C69EC7E5A311334D10DD95F338FCCEA c:\windows\system32\qmgr.dll

[-] 2004-08-04 08:00 180224 0F78E27F563F2AAF74B91A49E2ABF19A c:\windows\system32\scecli.dll

[-] 2004-08-04 08:00 14336 02000ABF34AF4C218C35D257024807D6 c:\windows\system32\drivers\asyncmac.sys

[-] 2007-02-09 11:23 574976 05AB81909514BFD69CBB1F2C147CF6B9 c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2004-08-04 08:00 574592 B78BE402C3F63DD55521F73876951CDD c:\windows\$NtUninstallKB930916$\ntfs.sys
[-] 2007-02-09 11:10 574464 19A811EF5F1ED5C926A028CE107FF1AF c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-04 08:00 170496 92BDF74F12D6CBEC43C94D4B7F804838 c:\windows\$NtUninstallKB888402$\srsvc.dll
[-] 2004-11-17 23:25 171008 902CF9595F640E53F33C0F1637F464F9 c:\windows\system32\srsvc.dll

[-] 2004-08-04 08:00 13824 49911DD39E023BB6C45E4E436CFBD297 c:\windows\system32\wscntfy.exe

[-] 2004-08-04 08:00 435200 B62F29C00AC55A761B2E45877D85EA0F c:\windows\system32\ntmssvc.dll

[-] 2004-08-04 08:00 89088 44DB7A9BDD2FB58747D123FBF1D35ADB c:\windows\system32\rasauto.dll

[-] 2004-08-04 08:00 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\sfcfiles.dll

c:\windows\system32\appmgmts.dll ... is missing !!
c:\windows\system32\drivers\beep.sys ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" [2009-04-10 50520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-28 344064]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-19 729178]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-08-01 233534]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-12-11 267048]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-04-11 1085440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-12-04 185896]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2008-3-30 1738032]

c:\documents and settings\user\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2002-8-9 299008]
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2008-3-30 1738032]

c:\documents and settings\User.2WIRE200\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2008-3-30 1738032]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2006-8-5 450560]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0sdearlydelete\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Adobe\\Photoshop 5.0\\Photoshp.exe"=
"c:\\Program Files\\Visicom Media\\AceFTP 3 Freeware\\aceftp3free.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\TENMEG\\Application Data\\mjusbsp\\magicJack.exe"=

R3 cmuda2;C-Media USB Audio Interface;c:\windows\system32\drivers\cmuda2.sys [2004-01-05 705536]
R3 lgatbus;LG USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\lgatbus.sys [2005-06-14 43024]
R3 lgatmdm;LG CDMA USB Modem Drivers;c:\windows\system32\DRIVERS\lgatmdm.sys [2005-06-14 77104]
R3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\DRIVERS\lgatserd.sys [2005-06-14 60816]
R3 RTCore32;RTCore32;c:\program files\RightMark Memory Analyzer\RTCore32.sys [x]
R3 uts_bus;UTStarcom USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\uts_bus.sys [2007-12-05 84352]
R3 uts_mdfl;UTStarcom USB Modem Filter;c:\windows\system32\DRIVERS\uts_mdfl.sys [2007-12-05 14976]
R3 uts_mdm;UTStarcom USB Modem Drivers;c:\windows\system32\DRIVERS\uts_mdm.sys [2007-12-05 110848]
R3 uts_serd;UTStarcom USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\uts_serd.sys [2007-12-05 90880]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2005-08-22 231424]

.
Contents of the 'Scheduled Tasks' folder

2008-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 22:57]

2008-08-05 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2008-07-24 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://hp-desktop.aol.com/
uInternet Connection Wizard,ShellNext = hxxp://www.personalfirewall.comodo.com/ ... CF6FF3F27F
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-13 16:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????9?5?1?1??????? ???B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-986089347-3572095111-2355310880-1007\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9BF370D9-6452-42F3-7346-90DC10C441BA}*]
"iaogpmbcgnehhamfko"=hex:6b,61,6b,6c,63,65,6c,70,70,68,6e,67,65,65,65,6c,6f,70,
64,67,67,69,00,00
"haigjkomffndeefd"=hex:6b,61,6b,6c,63,65,6c,70,70,68,6e,67,65,65,65,6c,6f,70,
64,67,67,69,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2132)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-08-13 16:11
ComboFix-quarantined-files.txt 2009-08-13 23:11

Pre-Run: 8,883,195,904 bytes free
Post-Run: 8,957,243,392 bytes free

337 --- E O F --- 2008-08-05 00:51

=================================================================================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:15:34 PM, on 8/13/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp-desktop.aol.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.personalfirewall.comodo.com/ ... CF6FF3F27F
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKUS\S-1-5-21-986089347-3572095111-2355310880-1007\..\Run: [cdloader] "C:\Documents and Settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" MAGICJACK (User '?')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} -
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/house ... hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se1140.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9970259671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9971399281
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 7724 bytes

by **Bio-Hazard** » August 14th, 2009, 10:38 am

Hello!

I would like you to update yourself from Service pack to Service Pack 3. Are you willing to do this? If you are not please let me know.

Here is a instructions to read before doing this: Steps to take before you install Windows XP Service Pack 3

SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
Code: Select all
```
:filefind
*appmgmts.dll*
*beep.sys*
 
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

by **tenmeg** » August 14th, 2009, 3:31 pm

Hi - I live in Chandler, AZ 9 months out of the year & live 3 months during the hot summers in Livermore, CA. I don't have my back-up HD with me here in Livermore, CA. Thus I can't back-up my HD, one of the must-do operations when installing SP-3. I will have to do this later when I return to AZ at the end of Oct. 2009.

===================================================

SysLook log file attached

===================================================

SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 12:20 on 14/08/2009 by TENMEG (Administrator - Elevation successful)

========== filefind ==========

Searching for "*appmgmts.dll*"
No files found.

Searching for "*beep.sys*"
No files found.

-=End Of File=-

by **Bio-Hazard** » August 15th, 2009, 2:34 pm

Hello!

Well You dont have any malware on your system. This is just trying to fix some entries that shows in your logs. If you are willing to continue. We can try to fix some of these issues. Installing SP3 will fix the rest.

SystemLook

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
Code: Select all
```
:service
CryptSvc 
 
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

Download this tool: The WMI Diagnosis Utility -- Version 2.0

Create a new folder called c:\wmi
Extract the files into it. (This is a self extracting archive)
Right click on wmidiag.vbs
Click on Open with command prompt.
This may take a while to run.
When it had finished a text file will open, save the text file in to the new folder which you created.
Report is long but i only need to see the summary.
Go to the toolbar
Click edit and then scroll down to Find and click on that.
- Find what?
- Copy and paste next line into it.
- WMI REPORT: BEGIN
Copy from that point to the end of the file.
Paste that into your next reply.

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

WMI report
Systemlooup log
A fresh HijackThis Log ( after all the above has been done)
A description of how your computer is behaving

by **tenmeg** » August 15th, 2009, 9:19 pm

Hi - below is the WMI, SysLookUp and HJT log files requested.

=========================================================================================================

3276 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13277 17:59:34 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ----------------------------------------------------------
13278 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13279 17:59:34 (0) **
13280 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13281 17:59:34 (0) ** Windows XP - Service pack 2 - 32-bit (2600) - User '2WIRE200\TENMEG' on computer '2WIRE200'.
13282 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13283 17:59:34 (0) ** Environment: ........................................................................................................ OK..
13284 17:59:34 (0) ** There are no missing WMI system files: .............................................................................. OK.
13285 17:59:34 (0) ** There are no missing WMI repository files: .......................................................................... OK.
13286 17:59:34 (0) ** WMI repository state: ............................................................................................... NOT TESTED.
13287 17:59:34 (0) ** BEFORE running WMIDiag:
13288 17:59:34 (0) ** The WMI repository has a size of: ................................................................................... 6 MB.
13289 17:59:34 (0) ** - Disk free space on 'C:': .......................................................................................... 8488 MB.
13290 17:59:34 (0) ** - INDEX.BTR, 1146880 bytes, 8/15/2009 5:48:46 PM
13291 17:59:34 (0) ** - INDEX.MAP, 584 bytes, 8/15/2009 5:49:47 PM
13292 17:59:34 (0) ** - MAPPING.VER, 4 bytes, 8/15/2009 5:49:47 PM
13293 17:59:34 (0) ** - MAPPING1.MAP, 3176 bytes, 8/15/2009 5:49:47 PM
13294 17:59:34 (0) ** - MAPPING2.MAP, 3176 bytes, 8/15/2009 5:48:47 PM
13295 17:59:34 (0) ** - OBJECTS.DATA, 5259264 bytes, 8/15/2009 5:48:46 PM
13296 17:59:34 (0) ** - OBJECTS.MAP, 2592 bytes, 8/15/2009 5:49:47 PM
13297 17:59:34 (0) ** AFTER running WMIDiag:
13298 17:59:34 (0) ** The WMI repository has a size of: ................................................................................... 6 MB.
13299 17:59:34 (0) ** - Disk free space on 'C:': .......................................................................................... 8487 MB.
13300 17:59:34 (0) ** - INDEX.BTR, 1146880 bytes, 8/15/2009 5:58:19 PM
13301 17:59:34 (0) ** - INDEX.MAP, 584 bytes, 8/15/2009 5:58:19 PM
13302 17:59:34 (0) ** - MAPPING.VER, 4 bytes, 8/15/2009 5:58:19 PM
13303 17:59:34 (0) ** - MAPPING1.MAP, 3176 bytes, 8/15/2009 5:58:19 PM
13304 17:59:34 (0) ** - MAPPING2.MAP, 3176 bytes, 8/15/2009 5:58:11 PM
13305 17:59:34 (0) ** - OBJECTS.DATA, 5259264 bytes, 8/15/2009 5:58:18 PM
13306 17:59:34 (0) ** - OBJECTS.MAP, 2592 bytes, 8/15/2009 5:58:19 PM
13307 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13308 17:59:34 (2) !! WARNING: Windows Firewall: .......................................................................................... DISABLED.
13309 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13310 17:59:34 (0) ** DCOM Status: ........................................................................................................ OK.
13311 17:59:34 (0) ** WMI registry setup: ................................................................................................. OK.
13312 17:59:34 (0) ** INFO: WMI service has dependents: ................................................................................... 2 SERVICE(S)!
13313 17:59:34 (0) ** - Security Center (WSCSVC, StartMode='Automatic')
13314 17:59:34 (0) ** - Windows Firewall/Internet Connection Sharing (ICS) (SHAREDACCESS, StartMode='Automatic')
13315 17:59:34 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
13316 17:59:34 (0) ** Note: If the service is marked with (*), it means that the service/application uses WMI but
13317 17:59:34 (0) ** there is no hard dependency on WMI. However, if the WMI service is stopped,
13318 17:59:34 (0) ** this can prevent the service/application to work as expected.
13319 17:59:34 (0) **
13320 17:59:34 (0) ** RPCSS service: ...................................................................................................... OK (Already started).
13321 17:59:34 (0) ** WINMGMT service: .................................................................................................... OK (Already started).
13322 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13323 17:59:34 (0) ** WMI service DCOM setup: ............................................................................................. OK.
13324 17:59:34 (0) ** WMI components DCOM registrations: .................................................................................. OK.
13325 17:59:34 (0) ** WMI ProgID registrations: ........................................................................................... OK.
13326 17:59:34 (0) ** WMI provider DCOM registrations: .................................................................................... OK.
13327 17:59:34 (0) ** WMI provider CIM registrations: ..................................................................................... OK.
13328 17:59:34 (0) ** WMI provider CLSIDs: ................................................................................................ OK.
13329 17:59:34 (0) ** WMI providers EXE/DLL availability: ................................................................................. OK.
13330 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13331 17:59:34 (0) ** Overall DCOM security status: ....................................................................................... OK.
13332 17:59:34 (0) ** Overall WMI security status: ........................................................................................ OK.
13333 17:59:34 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------
13334 17:59:34 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 3.
13335 17:59:34 (0) ** - ROOT/DEFAULT, MSFT_UCScenarioControl.Name="Microsoft WMI Updating Consumer Scenario Control".
13336 17:59:34 (0) ** 'SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'MSFT_UCScenario''
13337 17:59:34 (0) ** - ROOT/SUBSCRIPTION, MSFT_UCScenarioControl.Name="Microsoft WMI Updating Consumer Scenario Control".
13338 17:59:34 (0) ** 'SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'MSFT_UCScenario''
13339 17:59:34 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer".
13340 17:59:34 (0) ** 'select * from MSFT_SCMEventLogEvent'
13341 17:59:34 (0) **
13342 17:59:34 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.
13343 17:59:34 (0) ** WMI ADAP status: .................................................................................................... OK.
13344 17:59:34 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK.
13345 17:59:34 (0) ** WMI CONNECTIONS: .................................................................................................... OK.
13346 17:59:34 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 6 ERROR(S)!
13347 17:59:34 (0) ** - Root/CIMv2, Win32_Process.Handle=1036, 0x80004002 - No such interface supported.
13348 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13349 17:59:34 (0) ** - Root/CIMv2, Win32_Process.Handle=1036, 0x80004002 - No such interface supported.
13350 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13351 17:59:34 (0) ** - Root/CIMv2, Win32_Process.Handle=1036, 0x80004002 - No such interface supported.
13352 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13353 17:59:34 (0) ** - Root/CIMv2, Win32_Process.Handle=1036, 0x80004002 - No such interface supported.
13354 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13355 17:59:34 (0) ** - Root/CIMv2, Win32_Process.Handle=3356, 0x80004002 - No such interface supported.
13356 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13357 17:59:34 (0) ** - Root/CIMv2, Win32_Process.Handle=3356, 0x80004002 - No such interface supported.
13358 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13359 17:59:34 (0) **
13360 17:59:34 (0) ** WMI MOF representations: ............................................................................................ OK.
13361 17:59:34 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.
13362 17:59:34 (1) !! ERROR: WMI ENUMERATION operation errors reported: ................................................................... 32 ERROR(S)!
13363 17:59:34 (0) ** - ROOT/CIMV2, InstancesOfAsync, 'CIM_USBDevice', 0x80004002 - .
13364 17:59:34 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
13365 17:59:34 (0) ** - ROOT/CIMV2, InstancesOfAsync, 'CIM_USBHub', 0x80004002 - .
13366 17:59:34 (0) ** MOF Registration: 'WMI information not available (This could be the case for an external application or a third party WMI provider)'
13367 17:59:34 (0) ** - Root/Default, InstancesOf, 'SystemRestore', 0x80004002 - No such interface supported.
13368 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\SR.MOF'
13369 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_Process', 0x80004002 - No such interface supported.
13370 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13371 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_OperatingSystem', 0x80004002 - No such interface supported.
13372 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13373 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_ComputerSystem', 0x80004002 - No such interface supported.
13374 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13375 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_Service', 0x80004002 - No such interface supported.
13376 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13377 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_Bios', 0x80004002 - No such interface supported.
13378 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\CIMWIN32.MOF / C:\WINDOWS\SYSTEM32\WBEM\SECRCW32.MOF'
13379 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_Tcpip_IP', 0x80004002 - No such interface supported.
13380 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13381 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_Tcpip_TCP', 0x80004002 - No such interface supported.
13382 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13383 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_Tcpip_UDP', 0x80004002 - No such interface supported.
13384 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13385 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_Tcpip_ICMP', 0x80004002 - No such interface supported.
13386 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13387 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfOS_Cache', 0x80004002 - No such interface supported.
13388 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13389 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfOS_Memory', 0x80004002 - No such interface supported.
13390 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13391 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfOS_Objects', 0x80004002 - No such interface supported.
13392 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13393 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfOS_PagingFile', 0x80004002 - No such interface supported.
13394 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13395 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfOS_Processor', 0x80004002 - No such interface supported.
13396 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13397 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfOS_System', 0x80004002 - No such interface supported.
13398 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13399 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfProc_Process', 0x80004002 - No such interface supported.
13400 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13401 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfRawData_PerfProc_Thread', 0x80004002 - No such interface supported.
13402 17:59:34 (0) ** MOF Registration: 'No located MOF file (exception)'
13403 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_Tcpip_IP', 0x80004002 - No such interface supported.
13404 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13405 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_Tcpip_TCP', 0x80004002 - No such interface supported.
13406 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13407 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_Tcpip_UDP', 0x80004002 - No such interface supported.
13408 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13409 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_Tcpip_ICMP', 0x80004002 - No such interface supported.
13410 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13411 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfOS_Cache', 0x80004002 - No such interface supported.
13412 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13413 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfOS_Memory', 0x80004002 - No such interface supported.
13414 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13415 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfOS_Objects', 0x80004002 - No such interface supported.
13416 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13417 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfOS_PagingFile', 0x80004002 - No such interface supported.
13418 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13419 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfOS_Processor', 0x80004002 - No such interface supported.
13420 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13421 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfOS_System', 0x80004002 - No such interface supported.
13422 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13423 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfProc_Process', 0x80004002 - No such interface supported.
13424 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13425 17:59:34 (0) ** - Root/CIMv2, InstancesOf, 'Win32_PerfFormattedData_PerfProc_Thread', 0x80004002 - No such interface supported.
13426 17:59:34 (0) ** MOF Registration: 'C:\WINDOWS\SYSTEM32\WBEM\WMI.MOF'
13427 17:59:34 (0) **
13428 17:59:34 (1) !! ERROR: WMI EXECQUERY operation errors reported: ..................................................................... 17 ERROR(S)!
13429 17:59:34 (0) ** - Root/Default, SELECT * FROM SystemRestore, 0x80004002 - No such interface supported.
13430 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_LogicalDisk WHERE FreeSpace > 10000000 AND DriveType = 3, 0x80004002 - No such interface supported.
13431 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_PageFileUsage, 0x80004002 - No such interface supported.
13432 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_BIOS WHERE Version IS NOT NULL, 0x80004002 - No such interface supported.
13433 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_NetworkAdapter WHERE AdapterType IS NOT NULL AND AdapterType != "Wide Area Network (WAN)" AND Description != "Packet Scheduler Miniport", 0x80041013 - (WBEM_E_PROVIDER_LOAD_FAILURE) COM cannot locate a provider referenced in the schema.
13434 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_Processor WHERE Name IS NOT NULL, 0x80004002 - No such interface supported.
13435 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_DiskDrive, 0x80004002 - No such interface supported.
13436 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_ComputerSystem, 0x80004002 - No such interface supported.
13437 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_DiskPartition, 0x80004002 - No such interface supported.
13438 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_LogicalDisk WHERE Description != "Network Connection", 0x80004002 - No such interface supported.
13439 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_SoundDevice, 0x80004002 - No such interface supported.
13440 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_VideoController, 0x80004002 - No such interface supported.
13441 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_USBController, 0x80004002 - No such interface supported.
13442 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_DesktopMonitor, 0x80004002 - No such interface supported.
13443 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_PointingDevice WHERE Status = "OK", 0x80004002 - No such interface supported.
13444 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_Keyboard, 0x80004002 - No such interface supported.
13445 17:59:34 (0) ** - Root/CIMv2, SELECT * FROM Win32_SystemDriver WHERE StartMode != "Disabled", 0x80004002 - No such interface supported.
13446 17:59:34 (0) **
13447 17:59:34 (0) ** WMI GET VALUE operations: ........................................................................................... OK.
13448 17:59:34 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.
13449 17:59:34 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.
13450 17:59:34 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.
13451 17:59:34 (0) ** WMI static instances retrieved: ..................................................................................... 640.
13452 17:59:34 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.
13453 17:59:34 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 0.
13454 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13455 17:59:34 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s):
13456 17:59:34 (0) ** DCOM: ............................................................................................................. ERROR!
13457 17:59:34 (0) ** WINMGMT: .......................................................................................................... ERROR!
13458 17:59:34 (0) ** WMIADAPTER: ....................................................................................................... ERROR!
13459 17:59:34 (0) **
13460 17:59:34 (0) ** # of additional Event Log events AFTER WMIDiag execution:
13461 17:59:34 (0) ** DCOM: ............................................................................................................. ERROR!
13462 17:59:34 (0) ** WINMGMT: .......................................................................................................... ERROR!
13463 17:59:34 (0) ** WMIADAPTER: ....................................................................................................... ERROR!
13464 17:59:34 (0) **
13465 17:59:34 (0) ** 54 error(s) 0x80004002 - (WBEM_UNKNOWN) This error code is external to WMI.
13466 17:59:34 (0) ** => This error is not a WMI error. It is a DCOM error due to the following reasons:
13467 17:59:34 (0) ** - An application has changed the COM/DCOM settings of OLE32.DLL and/or OLEAUT32.DLL.
13468 17:59:34 (0) ** - The registry settings of COM/DCOM has been damage or wrongly modified.
13469 17:59:34 (0) ** => To correct this situation, you must re-register the original COM/DCOM DLLs with REGSVR32.EXE
13470 17:59:34 (0) ** i.e. 'REGSVR32.EXE OLE32.DLL'
13471 17:59:34 (0) ** i.e. 'REGSVR32.EXE OLEAUT32.DLL'
13472 17:59:34 (0) **
13473 17:59:34 (0) **
13474 17:59:34 (0) ** 1 error(s) 0x80041013 - (WBEM_E_PROVIDER_LOAD_FAILURE) COM cannot locate a provider referenced in the schema
13475 17:59:34 (0) ** => This error is typically due to the following major reasons:
13476 17:59:34 (0) ** - The application queried by the WMI provider is not installed, not available or not running
13477 17:59:34 (0) ** at the time of the request was made. This error can also be generated because
13478 17:59:34 (0) ** the application supporting the providers has been uninstalled.
13479 17:59:34 (0) ** - Some WMI providers (i.e. RSOP Planning Mode, Exchange 2003) are implemented as a WMI service.
13480 17:59:34 (0) ** Make sure the required services are successfully started.
13481 17:59:34 (0) ** - The WMI provider binary files are not accessible (i.e. access denied ACL).
13482 17:59:34 (0) ** - A WMI provider registration problem at the CIM level (MOFCOMP.EXE) or at the COM level (REGSVR32.EXE).
13483 17:59:34 (0) ** You must re-register the WMI provider by recompiling its associated MOF file with MOFCOMP.EXE
13484 17:59:34 (0) ** Note: - If the WMI provider DLL CIM and COM registrations are correct, this error can
13485 17:59:34 (0) ** be returned because the provider has a dependency on another DLL that cannot be
13486 17:59:34 (0) ** loaded (missing or bad DLL)
13487 17:59:34 (0) ** - Dependencies can be found with the DEPENDS.EXE tool coming with the
13488 17:59:34 (0) ** Windows XP and Windows 2003 Support Tools. The command line is as follows:
13489 17:59:34 (0) ** i.e. DEPENDS.EXE <PATH><Provider.DLL>
13490 17:59:34 (0) ** => When a WMI provider fails to load, it is possible to trace the provider load process by
13491 17:59:34 (0) ** submitting, via WBEMTEST and asynchronously, the following WMI event query:
13492 17:59:34 (0) ** 'Select * From MSFT_WmiSelfEvent'
13493 17:59:34 (0) ** Then you can trace the following WMI events:
13494 17:59:34 (0) ** - Msft_WmiProvider_ComServerLoadOperationEvent
13495 17:59:34 (0) ** - Msft_WmiProvider_InitializationOperationEvent
13496 17:59:34 (0) ** - Msft_WmiProvider_LoadOperationEvent
13497 17:59:34 (0) ** and depending on the WMI operation executed, you can trace the following WMI events:
13498 17:59:34 (0) ** i.e. for an enumeration:
13499 17:59:34 (0) ** - Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Pre and Msft_WmiProvider_CreateInstanceEnumAsyncEvent_Post
13500 17:59:34 (0) ** i.e. for a put operation:
13501 17:59:34 (0) ** - Msft_WmiProvider_PutInstanceAsyncEvent_Pre and Msft_WmiProvider_PutInstanceAsyncEvent_Post
13502 17:59:34 (0) **
13503 17:59:34 (0) ** => If the software has been de-installed intentionally, then this information must be
13504 17:59:34 (0) ** removed from the WMI repository. You can use the 'WMIC.EXE' command to remove the provider
13505 17:59:34 (0) ** registration data and its set of associated classes.
13506 17:59:34 (0) ** => To correct this situation, you can:
13507 17:59:34 (0) ** - Install or start the application supporting these providers.
13508 17:59:34 (0) ** - Register the providers in CIM (MOFCOMP) or DCOM (REGSVR32).
13509 17:59:34 (0) ** Note: In this case the provider should also be listed in the 'missing WMI
13510 17:59:34 (0) ** provider DCOM registrations' or in the 'missing WMI provider files' section.
13511 17:59:34 (2) !! WARNING: Re-registering with REGSVR32.EXE all DLL from 'C:\WINDOWS\SYSTEM32\WBEM\'
13512 17:59:34 (0) ** may not solve the problem as the DLL supporting the WMI class(es)
13513 17:59:34 (0) ** can be located in a different folder.
13514 17:59:34 (0) ** You must refer to the class name to determine the software delivering the related DLL.
13515 17:59:34 (0) **
13516 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13517 17:59:34 (0) ** WMI Registry key setup: ............................................................................................. OK.
13518 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13519 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13520 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13521 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13522 17:59:34 (0) **
13523 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13524 17:59:34 (0) ** ------------------------------------------------------ WMI REPORT: END -----------------------------------------------------------
13525 17:59:34 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
13526 17:59:34 (0) **
13527 17:59:34 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!. Check 'C:\DOCUMENTS AND SETTINGS\TENMEG\LOCAL SETTINGS\TEMP\WMIDIAG-V2.0_XP___.CLI.SP2.32_2WIRE200_2009.08.15_17.57.31.LOG' for details.
13528 17:59:34 (0) **
13529 17:59:34 (0) ** WMIDiag v2.0 ended on Saturday, August 15, 2009 at 17:59 (W:62 E:84 S:1).

========================================================================================================

SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 17:52 on 15/08/2009 by TENMEG (Administrator - Elevation successful)

========== service ==========

CryptSvc - Unable to open Service Handle.

-=End Of File=-

========================================================================================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:04:24 PM, on 8/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp-desktop.aol.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.personalfirewall.comodo.com/ ... CF6FF3F27F
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-986089347-3572095111-2355310880-1007\..\Run: [cdloader] "C:\Documents and Settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" MAGICJACK (User '?')
O4 - HKUS\S-1-5-21-986089347-3572095111-2355310880-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} -
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/house ... hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se1140.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9970259671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9971399281
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 8060 bytes

by **tenmeg** » August 15th, 2009, 9:32 pm

Hi - I forgot to report on my computer operation: I'm sure sp-3 will correct some of the Windows issues. I notice that when I turn off my computer it takes several minutes to go through the basic process of shuting down and then several minutes to turn off.

by **Bio-Hazard** » August 16th, 2009, 4:10 pm

Remove HijackThis entries

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):

O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} -
Close all open windows and browsers/email etc...
Click on the Fix Checked button
When completed close the application.

Update Java Runtime:

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason it's extremely important that you keep the program up to date and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 16.

Go to HERE
Scroll down to where it says Java Runtime Environment (JRE) 6 Update 16
Click the Download button to the right
From the dropdown menu choose your platform. Which is Windows
Dont change the language box.
Click on the radio button to Accept License Agreement and after that click continue
Click on Windows Offline Installation Multi-language and save the downloaded file to your computer
Go to Start => Control Panel => Add or Remove Programs
Uninstall all old versions of Java (Java 2 Runtime Environment JRE or JSE)
Reboot your computer
Delete the folder C:\Program Files\Java if present
Install the new version by running the newly-downloaded file and follow the on-screen instructions.
Reboot your computer

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

A fresh HijackThis Log ( after all the above has been done)
A description of how your computer is behaving

by **tenmeg** » August 18th, 2009, 12:04 am

Hi - deleted the following HJT entry.

DELETED -O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A}

Unable to install JAVA. Error message says Windows Installer missing. I have tried to re-install Windows Installer
in the past but then I run into another problem with Cryptographics error that says it is not running. If I go
to Services it shows it is running?? I just limp along without it.

===================================================================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:03:31 PM, on 8/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp-desktop.aol.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.personalfirewall.comodo.com/ ... CF6FF3F27F
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-986089347-3572095111-2355310880-1007\..\Run: [cdloader] "C:\Documents and Settings\TENMEG\Application Data\mjusbsp\cdloader2.exe" MAGICJACK (User '?')
O4 - HKUS\S-1-5-21-986089347-3572095111-2355310880-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/house ... hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se1140.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 9970259671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9971399281
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 7872 bytes

===========================================================================================

I spent some time in trying to find some fix that would install Windows Installer but no luck. I keep running up against the Crypto error problem. Computer now will shut down much faster with no explanation for that increase in speed. No return of the original problems related to misdirection of searches. Because of the Installer problem I don't think I will be able to install SP-3 which would probably solve these Windows problems.

by **Bio-Hazard** » August 18th, 2009, 4:42 am

Download and run OTM

Download OTM by Old Timer and save it to your Desktop.

Double-click OTM.exe to run it.
Paste the following code under the area. Do not include the word Code.

Code: Select all

:Files
c:\documents and settings\TENMEG\Application Data\PCMM2009
c:\windows\Tasks\RegCure Program Check.job
c:\program files\RegCure\RegCure.exe
c:\windows\Tasks\RegCure.job
c:\program files\RegCure\RegCure.exe
:Commands
[emptytemp]
[Reboot]

Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
Push the large button.
OTM may ask to reboot the machine. Please do so if asked.
Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Ensure that the Cryptographic Services service is running on your computer.

Open Control Panel
Administrative Tools
Services
Select Cryptographic Service" from the list of names.
Right-click this service and select Properties.
If the service is not shown as "Started", you can start it by clicking the Start button.
You should also set the Startup type to Automatic so that it will be running when needed in future.
Close the Services control panel.
Reboot

SystemLook

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
Code: Select all
```
:service
CryptSvc 
 
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

Logs/Information to Post in Next Reply

Please post the following logs/Information in your reply:

SystemLook.txt
OTM log
A description of how your computer is behaving

Free Malware Removal Forum

Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Re: Redirected Google web searches + Random Pop Ups

Who is online