[majorlag]

Work Computer.

 

VEW logs for applications.

 

I have noticed some behavioral changes in this work computer today--Shift F5 has just stopped working to check mail for Thunderbird (intermittent), and open windows selected from toolbar often do not come to the front like they were just Sunday.  Also seeing two different values for CPU usage in Process explorer for some processes:  one on the process list itself, which is fairly small, and then a larger one in the process explorer system information time graph for CPU usage.  I find that alarming.

 

Also, there is a very large process, Trusted Installer, that holds about 300k of private bytes but is showing no CPU usage...is that normal?  I ask, because I noted that Machine 2 says Volume C is owned by Trusted Installer...

 

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 08/04/2014 8:32:45 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 08/04/2014 4:32:18 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Staadpro.exe version 20.7.8.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: 2358  Start Time: 01cf52c84bcbb915  Termination Time: 2260  Application Path: C:\SProV8i\STAAD\Staadpro.exe  Report Id: b8968f8f-bed6-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 08/04/2014 4:25:04 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: AppvIsvSubsystems32.dll, version: 5.151.36.0, time stamp: 0x515df0ba Exception code: 0xc00000fd Fault offset: 0x0003e5bc Faulting process id: 0x2d1c Faulting application start time: 0x01cf51dca780add9 Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\Office15\AppvIsvSubsystems32.dll Report Id: c14da8de-bed5-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 08/04/2014 12:39:51 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Staadpro.exe version 20.7.8.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: 7bc8  Start Time: 01cf52c26ae7bb2e  Termination Time: 13  Application Path: C:\SProV8i\STAAD\Staadpro.exe  Report Id: 3f1b3974-beb6-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 08/04/2014 12:26:38 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Staadpro.exe version 20.7.8.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: 6bc0  Start Time: 01cf52c070a2558d  Termination Time: 13  Application Path: C:\SProV8i\STAAD\Staadpro.exe  Report Id: 6595ff40-beb4-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 07/04/2014 9:55:20 PM
Type: Error Category: 0
Event: 51 Source: Symantec AntiVirus
   Security Risk Found!Tracking Cookies in File: Cookie:[email protected]/ by: Manual scan.  Action: Delete succeeded.  Action Description: The file was deleted successfully.  

Log: 'Application' Date/Time: 07/04/2014 6:17:37 PM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Staadpro.exe version 20.7.8.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: 5fd0  Start Time: 01cf5044d6a4f742  Termination Time: 152  Application Path: C:\SProV8i\STAAD\Staadpro.exe  Report Id: d388d9f0-be80-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 05/04/2014 2:07:28 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: Scxpx86.dll, version: 12.2.0.5, time stamp: 0x5316a8b4 Exception code: 0xc00000fd Fault offset: 0x000293d9 Faulting process id: 0x5154 Faulting application start time: 0x01cf50287eb19eb2 Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20140404.001\Scxpx86.dll Report Id: 0915fe73-bc67-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 05/04/2014 12:44:24 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: JitV.dll, version: 0.0.0.0, time stamp: 0x509a3a7d Exception code: 0xc00000fd Fault offset: 0x0000b8a5 Faulting process id: 0x1340 Faulting application start time: 0x01cf4f7f8b6fa4df Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll Report Id: 6e5d8cf2-bc5b-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 04/04/2014 5:08:00 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: Scxpx86.dll, version: 12.2.0.5, time stamp: 0x5316a8b4 Exception code: 0xc00000fd Fault offset: 0x0002ddc6 Faulting process id: 0x7084 Faulting application start time: 0x01cf4ed2e3a84e4a Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20140403.001\Scxpx86.dll Report Id: ac7eced2-bc1b-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 03/04/2014 1:30:36 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: OUTLOOK.EXE, version: 15.0.4535.1004, time stamp: 0x5212ff76 Faulting module name: OUTLOOK.EXE, version: 15.0.4535.1004, time stamp: 0x5212ff76 Exception code: 0xc0000005 Fault offset: 0x00ac5fb5 Faulting process id: 0x72c0 Faulting application start time: 0x01cf4edbe74f6e3a Faulting application path: C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE Report Id: 8dce721a-bacf-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 03/04/2014 1:27:17 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: OUTLOOK.EXE, version: 15.0.4535.1004, time stamp: 0x5212ff76 Faulting module name: OUTLOOK.EXE, version: 15.0.4535.1004, time stamp: 0x5212ff76 Exception code: 0xc0000005 Fault offset: 0x00ac5fb5 Faulting process id: 0x166c Faulting application start time: 0x01cf41fa308068ad Faulting application path: C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE Report Id: 1763a82a-bacf-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 03/04/2014 12:14:19 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: AppvIsvSubsystems32.dll, version: 5.151.36.0, time stamp: 0x515df0ba Exception code: 0xc00000fd Fault offset: 0x000304db Faulting process id: 0x5e80 Faulting application start time: 0x01cf4dac4b61a761 Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\Office15\AppvIsvSubsystems32.dll Report Id: e5fff6da-bac4-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 01/04/2014 6:17:54 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4 Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24 Exception code: 0xc0000005 Fault offset: 0x00000000000257d5 Faulting process id: 0x1224 Faulting application start time: 0x01cf41e1f06dbb25 Faulting application path: C:\Windows\Explorer.EXE Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: f1444f02-b9c9-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 01/04/2014 1:13:58 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: JitV.dll, version: 0.0.0.0, time stamp: 0x509a3a7d Exception code: 0xc00000fd Fault offset: 0x0000b8b3 Faulting process id: 0x68a0 Faulting application start time: 0x01cf4ce6bed37fcd Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll Report Id: 7b90e361-b99f-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 31/03/2014 8:56:57 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: AppvIsvSubsystems32.dll, version: 5.151.36.0, time stamp: 0x515df0ba Exception code: 0xc00000fd Fault offset: 0x000304fd Faulting process id: 0x55f4 Faulting application start time: 0x01cf4a967589bda9 Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\Office15\AppvIsvSubsystems32.dll Report Id: fe70b2fd-b916-11e3-ba0b-b8ca3aa78c06

Log: 'Application' Date/Time: 31/03/2014 1:40:12 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: IEXPLORE.EXE, version: 11.0.9600.16521, time stamp: 0x53114399 Faulting module name: JitV.dll, version: 0.0.0.0, time stamp: 0x509a3a7d Exception code: 0xc00000fd Fault offset: 0x0000b8b3 Faulting process id: 0x52e4 Faulting application start time: 0x01cf4a967630fe71 Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Faulting module path: C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll Report Id: fb583c1d-b8d9-11e3-ba0b-b8ca3aa78c06

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 08/04/2014 5:24:14 AM
Type: Warning Category: 0
Event: 129 Source: Symantec AntiVirus
   Reputation check timed out during unproven file evaluation, likely due to network delays.

Log: 'Application' Date/Time: 08/04/2014 12:50:01 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\v01000302_NSBABridgeSuite.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:46:14 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\roane.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:44:30 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\knox(1).zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:44:25 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\jefferson.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:41:24 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\OLD Desktop\blount.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:40:12 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\ENGR\USGS Seismic\AASHTO\InstallData.exe due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:34:32 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\Downloads\v01000302_NSBABridgeSuite.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:31:38 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\Downloads\roane.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 08/04/2014 12:30:14 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\Downloads\jefferson.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 11:02:01 PM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD C\Documents and Settings\achutsell\Desktop\TOOLS\CIS_Setup_3.5.57173.439_XP_Vista_x64.exe due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 11:00:52 PM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD C\Documents and Settings\achutsell\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.ZIP due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 10:59:25 PM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\blount.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 10:58:06 PM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\ENGR\USGS Seismic\AASHTO\InstallData.exe due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 7:23:06 PM
Type: Warning Category: 0
Event: 59 Source: Outlook
Outlook disabled the following add-in(s):



ProgID: XobniMainConnectorShim.Connect
GUID: {79A399F3-DAA1-46C8-AB92-27C7CBE43251}
Name: Xobni
Description: Xobni
Load Behavior: 3
HKLM: 1
Location: c:\program files (x86)\xobni\xobnimainconnectorshim.dll
Threshold Time (Milliseconds): 1000
Time Taken (Milliseconds): 4103
Disable Reason: This add-in caused Outlook to start slowly.
Policy Exception (Allow List): 0

Log: 'Application' Date/Time: 07/04/2014 6:04:33 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\roane.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 6:02:50 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\knox(1).zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 6:02:45 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Downloads\jefferson.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 5:59:39 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\OLD Desktop\blount.zip due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent


Log: 'Application' Date/Time: 07/04/2014 5:58:27 AM
Type: Warning Category: 0
Event: 6 Source: Symantec AntiVirus
   Could not scan 1 files inside C:\Users\achutsell\Documents\OLD Desktop\OLD COMPUTER\V&M\OLD G\ACH\MyDocs\ENGR\USGS Seismic\AASHTO\InstallData.exe due to extraction errors encountered by the Decomposer Engines.Application has encountered an error.
For more information, please go to: http://www.symantec....ld=symantec_ent

 

Edited by majorlag, 08 April 2014 - 06:55 AM.

[Advertisements]

 Machine 2.

 

Open a command window with admin rights on the second machine and type:

net  start  dhcp

Does it say the service has been started?

 

Yes.

 

How about

net start bfe

Does it say it has already started?

 

Yes.

 

Try:

netsh  winsock  reset catalog
NetSH WinHTTP reset proxy
netsh int ipv4 reset %userprofile%\Desktop\reset4.log
netsh int ipv6 reset %userprofile%\Desktop\reset6.log

Reset success. 

No proxy.

Commands not found for the int ipv4 or v6 resets.  I checked my syntax and typing several times for both.

 

 

Reboot and then try to

ping 127.0.0.1

Yes.

 

Also try uninstalling Comodo as the firewall might just be hosed.  Try running a boottime scan with Avast:

 

Uninstalled.

 

First mute the speakers so it won't wake you up when Windows loads.  Click on the Orange ball.  Click on Scans.  Change Quickscan to Boot-time Scan.  Click on Settings.  Where it says Heuristic Sensitivity click on the last rectangle so that all of them are  orange and it says High.  Check both boxes.  Then change When a threat is found ... to:  Move to Chest.  OK.  Now click on Start.  Close the Avast window and then reboot.  The scan will start.  It will tell you where it will save the report.  Usually it's
C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.  When Windows loads Click on the Orange Ball then Scan, Then Scan History (at the bottom of the page). Click on the last scan and then Detailed Report.  Did it find anything?

 

Yes.  Log attached.

 Avast Log.4.8.14.pdf   808.31KB   209 downloads

 

Since all three of your PCs are having problems it may be that the router has been compromised.  If you have a separate cable or dsl modem then you can just reset the router by sticking a pin in the hole in the back and holding it for 10 seconds.  If you have a single modem/router then you will need to reenter the DSL or cable info after the reset.  Or if you know what you are doing you can just logon to the router and see if it has dhcp turned on and what dns address it is using and if there are any strange routes in it.
 

I noticed that Trusted Installer has ownership rights of my C: drive, and many of the "access denied" processes are running under an access denied user account.    I did not investigate permissions on any individual files.

 

Thank you for your continued help!

 

 

 

[majorlag]

 Machine 2.

 

Open a command window with admin rights on the second machine and type:

net  start  dhcp

Does it say the service has been started?

 

Yes.

 

How about

net start bfe

Does it say it has already started?

 

Yes.

 

Try:

netsh  winsock  reset catalog
NetSH WinHTTP reset proxy
netsh int ipv4 reset %userprofile%\Desktop\reset4.log
netsh int ipv6 reset %userprofile%\Desktop\reset6.log

Reset success. 

No proxy.

Commands not found for the int ipv4 or v6 resets.  I checked my syntax and typing several times for both.

 

 

Reboot and then try to

ping 127.0.0.1

Yes.

 

Also try uninstalling Comodo as the firewall might just be hosed.  Try running a boottime scan with Avast:

 

Uninstalled.

 

First mute the speakers so it won't wake you up when Windows loads.  Click on the Orange ball.  Click on Scans.  Change Quickscan to Boot-time Scan.  Click on Settings.  Where it says Heuristic Sensitivity click on the last rectangle so that all of them are  orange and it says High.  Check both boxes.  Then change When a threat is found ... to:  Move to Chest.  OK.  Now click on Start.  Close the Avast window and then reboot.  The scan will start.  It will tell you where it will save the report.  Usually it's
C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.  When Windows loads Click on the Orange Ball then Scan, Then Scan History (at the bottom of the page). Click on the last scan and then Detailed Report.  Did it find anything?

 

Yes.  Log attached.

 Avast Log.4.8.14.pdf   808.31KB   209 downloads

 

Since all three of your PCs are having problems it may be that the router has been compromised.  If you have a separate cable or dsl modem then you can just reset the router by sticking a pin in the hole in the back and holding it for 10 seconds.  If you have a single modem/router then you will need to reenter the DSL or cable info after the reset.  Or if you know what you are doing you can just logon to the router and see if it has dhcp turned on and what dns address it is using and if there are any strange routes in it.
 

I noticed that Trusted Installer has ownership rights of my C: drive, and many of the "access denied" processes are running under an access denied user account.    I did not investigate permissions on any individual files.

 

Thank you for your continued help!

 

 

 

[RKinner]

Microsoft Windows [Version 6.1.7601]
Copyright © 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>netsh int ipv4 reset %userprofile%\Desktop\reset4.log
Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.


C:\Windows\system32>

 

 

This is the result of the command that didn't work on your PC. (This is Windows 7 right?  On XP the command is slightly different:

netsh  int ip reset %userprofile%\desktop\reset.log

) The "%userprofile%\Desktop\reset4.log" is just a file name and should put it on the desktop.  You can try a different file name or leave off the %userprofile%\desktop and see if that works.  You can try:

netsh  int  /?

This should bring up the help menu:

 

The following commands are available:

Commands in this context:
6to4           - Changes to the `netsh interface 6to4' context.
?              - Displays a list of commands.
dump           - Displays a configuration script.
help           - Displays a list of commands.
httpstunnel    - Changes to the `netsh interface httpstunnel' context.
ipv4           - Changes to the `netsh interface ipv4' context.
ipv6           - Changes to the `netsh interface ipv6' context.
isatap         - Changes to the `netsh interface isatap' context.
portproxy      - Changes to the `netsh interface portproxy' context.
set            - Sets configuration information.
show           - Displays information.
tcp            - Changes to the `netsh interface tcp' context.
teredo         - Changes to the `netsh interface teredo' context.

The following sub-contexts are available:
 6to4 httpstunnel ipv4 ipv6 isatap portproxy tcp teredo

To view help for a command, type the command, followed by a space, and then
 type ?.

 

And then

netsh  int  ipv4 /?

The following commands are available:

Commands in this context:
?              - Displays a list of commands.
add            - Adds a configuration entry to a table.
delete         - Deletes a configuration entry from a table.
dump           - Displays a configuration script.
help           - Displays a list of commands.
install        - Install the IP protocol.
reset          - Reset the IP configurations.
set            - Sets configuration information.
show           - Displays information.
uninstall      - Uninstall the IP protocol.
 

 

Where does it fail?

 

Starting to smell like a router.

What make and model of router do you have?  Is there a separate Cable or DSL modem?

 

 

TrustedInstaller owns my Win 7 C:\ drive too so that's apparently normal.  I do not have TrustedInstaller.exe running in my task list.

 

 

On the work PC the errors are all Symantec, Prostaad or Outlook (including something called xobni).  Symantec is complaining about a bunch of zip files not unzipping.  This could be a problem with Symantec or it could be caused by hard drive or RAM corruption.  See if you can right click on one of them ( C:\Users\achutsell\Downloads\roane.zip due ) and Extract All then right click on each extracted file and have Symantec scan the file.  That will tell us if Symantec is at fault.

[majorlag]

Machine 2.

 

Actually, it said "command not found" last night.  I'll check it again, step by step this evening.

 

The router is an old D-Link DI-604 wired router.  DSL modem is Westell, but I don't remember the model at the moment, and it was set up in bridged mode.  All home machines are physically disconnected from network cables right now.

 

Just happened to think of something...a few weeks ago, not long after a reported Yahoo mail attack, my AT&T email address was compromised, and was sending mail to people via webmail, and actually sending fragments of old emails as well.  A few weeks before that, I'd been talking with a trusted friend about my network hardware and emailed him the router model.  Maybe the email hacker used that information and my known public IP to get in?

 

OK.  It does concern me greatly though that so many of the system processes report as being access denied when queried with process explorer.  I don't recall if I've tried that using "run as administrator" mode or not. 

 

I did try two days ago connecting to another router to see if I could even get to the router setup page, but was unable to do so.  I may give that a try again tonight now that Machine 2 can actually ping.

 

Work PC.  

 

Extracted the roane.zip files, scanned both OK with Symantec.  No risks found.

[RKinner]

With Win 7 it's best to right click on Command Prompt and select Run As Admin.  Most of the netsh commands require it.

 

If you don't have access to a file you can right click on it and Properties, Security, Advanced, Owner, Edit, Change Owner To.  Then you should be able to change the permissions to allow yourself full control.

 

Your router uses 192.168.0.1 by default if you reset it.

 

To reset the system settings to factory defaults, please follow these steps: 

1. Leave the device powered on, do not disconnect the power 

2. Press the reset button and hold (use a paper-clip) 

3. Keep the button pressed about 10 seconds 

4. Release the button 

The DI-604 will then automatically reboot itself. 

 

 

 

So if it doesn't automatically get a DHCP IP address set it up manually to use 192.168.0.3 , subnet mask 255.255.255.0 and gateway as 192.168.0.1 use 8.8.8.8 and 192.168.0.1 as the DNS addresses.

 

Then see if you can ping 192.168.0.1.  IF that works try to get to 192.168.0.1 with a browser.  (  To log in as an administrator, enter the username of “admin” and the 

password (there are no default password, leave it blank). Click the OK button.  )

 

Work PC:

 

The fact that the file is good indicates that Symantec probably isn't.  Needs to be reinstalled.

 

 

 

 

[majorlag]

I'm not positive I'll be able to manually edit the DHCP IP info on the router unless I'm able to access it from another functional (and I suppose sacrificial) computer.  Am I correct in thinking that theoretically should be able to access the router with it not connected to the modem?  I have vague recollections of doing that some years ago...

 

I'll try your suggestions, and also check to see if running process explorer as an administrator resolves the "access denied" issue.  I don't recall having that problem before, however.

 

Thank you for your time!

[RKinner]

Disconnect the three PCs from the router.  Reset the router.  Then attempt to talk to the router with PC #2.  Should matter if the router is connected to the modem.  It should still talk to you.  If the DHCP is not working for some reason then you can manually set PC#2 to 192.168.0.3 with mask 255.255.255.0 and default gateway of 192.168.0.1 with DNS of 8.8.8.8. and 192.168.0.1 (We don't want to make changes to the freshly reset router.  Just see if we can talk to it.)

 

IF that doesn't work then go into Device Manager (right click on Computer and select Manage) and find your netwrok adapter.  Right click on it and Delete or uninstall and then reboot.  Windows should reinstall it again.

[majorlag]

Busy night, and mostly not good news, I think.  Starting with Machine 2:

 

First, I can view all the processes now--I guess Machine 2 wasn't set to autorun procexp as administrator.

 

I retried the netsh int ipv4 reset commands and got the OK responses like you showed.  Rebooted.  Reset the D-Link 604, hooked up the LAN cable and tried to ping it.  PC did not show as connected, and pulled a 169.xx IP, ping resulted in general failure.  Assigned IP address manually, tried again.  I think it showed as being connected to an unknown network, but still got ping general failure.  So, deleted the network adapter and tunneling device and rebooted.  They were rediscovered, I reenteredd the manual IP address, but used 192.168.0.199 as the gateway mask, for a D-Link DIR 810L, my backup router.

 

So, I reset my backup router (which had temporarilay been connected to the other infected computers as I was trying to get one of the machines to ping something, back before coming here), to be sure it would go into DHCP mode, instead of pass through. Hooked it up, showed as connected to an unknown network with no network access.  Tried pinging it, and got 3 request timed out, followed by a 4th:

 

"reply from  192.168.0.3 destination host unreachable"

 

So, I turned on smsniff on the adapter and saw absolutely tons of UDP & TCP  traffic, mostly going to ports 5355 and 8912, from random looking ports on the local adapter.  Most of these were LLMNR service.  Many were directed to 224.0.0.252.  THe very first entry I captured was UDP from 192.168.0.3:137 to 192.168.0.255:137, net bios.  A colossal amount of traffic for an adapter with no network access, I though..   

 

Also saw a large TCP dump from 192.168.0.3 to 192.168.0.3, with references to microsoft and certified, I don't remember all of it and forgot to print it out.  A lot of data.

 

I also saw a lot of the UDP datagrams I'd normally see going to my home server, overlord, but the text for overlord was variable case and there appeared to be extra crap in most of them...random characters  Most of these were directed at 224.0.0.252.

 

Work machine

 

NOthing much to report here, it's behavior has been relatively normal except when I'm pushing it really hard.  However, I'm very concerned because our local server went down at almost exactly 3 AM this morning, which was almost exactly when I was attacked Sunday morning.  It has failed to restart, has hung trying to initialize the remote network adapter.  I am fearful these are all related. 

 

I'm open to any and all suggestions you may have at this point...

 

Thanks so much for your help.

 

 

 

 

[RKinner]

I'm going off island today so won't be back on line until late.

 

Does the router show any traffic?  Usually the lights will blink.  When you plug up the PC to the router does the Ethernet light come on on the router?

 

used 192.168.0.199 as the gateway mask,

 

 

Typo?  Mask should be 255.255.255.0  Default Address should be 192.168.0.199 if that's what the router uses. (Very odd value by the way usually they use either 0.1 or 1.1 or 0.254 or 1.254)

 

LLMNR will not pass the Internet so it may just be trying to find local friends.

 

I never got the Avast log.  you attached the old OTL file again.

 

Can you download some files and burn them to a CD or DVD at work?  Then we could move them to the desktop of PC2 and run Combofix and a few other programs and see if we can find something.  (I've bolded the downloads in the following instructions)

 

 

Download aswMBR.exe  to your desktop.
Double click aswMBR.exe
uncheck trace disk IO calls
Click the "Scan" button to start scan (Accept the Avast Engine)
On completion of the scan if the Fix button is enabled (not the FixMBR button) press it and then run a new scan and  click save log, save it to your desktop and post in your next reply
If the Fix button is not enabled then just click save log, save it to your desktop and post in your next reply

ComboFix

:!: It must be saved to your desktop, do not run it from your browser:!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well.  See: http://www.bleepingc...opic114351.html


Download and Save this file --  to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Double click on ComboFix to start the program.  



    * :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
    
    
    * A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.  

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.


Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then run it.
Double click on TDSSKiller.exe and to start the program.  

If TDSSKiller alerts you that the system needs to reboot, please consent.

Run TDSSKiller again but this time:
before you hit the Scan  hit  Change Parameters and check the two items under Additional Options. OK then Scan.
In this mode it is prone to false positives so do not change the SKIP option to DELETE unless it says TDSS.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.



Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:
http://www.malwareby...lwarebytes_free

SAVE  Malwarebytes' Anti-Malware to your desktop.

    * Double-click mbam-setup.exe to start the program.
    * follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform quick scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.

    * Be sure that everything is checked, and click Remove Selected.

    * When completed, a log will open in Notepad. Please save it to a convenient location.
    * The log can also be found here:
            C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    * Post that log back here.


Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

 

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Double-click VEW.exe
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.


Copy the text in the code box:

DRIVES
nnetsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\assembly\GAC_32\*.ini
%systemroot%\assembly\GAC_64\*.ini
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.exe
%APPDATA%\*.
/md5start
pnrpnsp.dll
nwprovau.dll
nlaapi.dll
napinsp.dll
mswsock.dll
winrnr.dll
wshelper.dll
services.exe
atapi.sys
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
csrss.exe
PrintIsolationHost.exe
consrv.dll
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

Run OTL

Paste (Ctrl + v) the copied text in the box where it says Custom Scan/Fixes

Select the All option in the Extra Registry group then Run Scan.

You should get two logs.  Please copy and paste both of them.
 

[majorlag]

Sorry, I must've attached the wrong file.

 

Avast boot scan from Machine 2.

 

 Avast Log.4.8.14.pdf   33.77KB   351 downloads

[majorlag]

Had to work really late and ran out of time to do all the requested actions, unfortunately.

 

Machine 2

 

Ran aswMBR.  The Fix button did not pop up.  Log attached.

 

Ran ComboFix.  The log is also attached. 

 

Ran TDSSkiller.  Nothing the first time, two hits the second time, but none identified as TDSS.

 

Uninstalled MBAM.   It reported being unable to remove all files automatically.  I installed the new version and started its scan.  I should be able to complete the other items later on today or late tonightl

 

Thank you for your continued help!

 

 aswMBR.pdf   39.72KB   276 downloads

 

 ComboFixLog.4.10.pdf   1.37MB   228 downloads

 

 ComboFixLog.4.10 - Part 2.pdf   1.38MB   642 downloads

 

 

Edited by majorlag, 10 April 2014 - 07:22 AM.

[RKinner]

In a Command prompt that you got by right clicking and Run As Admin type (with an Enter after each line):

net  stop  cryptsvc
ren  %systemroot%\System32\Catroot2 oldcatroot2
net  start  cryptsvc

Do you get any errors?

 

[majorlag]

Sorry I haven't responded in the last few days, been working almost around the clock. Started the last of those scans (OTL) on Machine 2 this morning before coming in to work, but I forgot to bring the logs.

net stop cryptsvc
ren %systemroot%\System32\Catroot2 oldcatroot2
net start cryptsvc

No errors, all completed successfully.

Thanks for your patience.

[RKinner]

When you get home again, run Combofix as before. Does it still list a lot of files under sigcheck?

 

There is a program called Windows Repair All in One which you might try:

 

Download Complete Internet Repair to your desktop

Unzip all the files to their own folder on the desktop
Within the folder double click CIntRep
The program will then run
Select the items I have highlighted
Press go
Let me know if it is able to conduct the repair, there is a log at the bottom

 

Open a Command Prompt.  (Right click and Run As Admin)

net  start  >  \junk.txt
ipconfig  /all  >>  \junk.txt
notepad  \junk.txt

[majorlag]

Thank you for your help!

 

Machine 2

 

OK, a lot of stuff to cover.  I do have internet access from a junk machine at home now, and can copy/paste logs.  I do not have all the logs of everything for posting right now, I'll have to get the VEW logs to you in the morning, as I only printed them out and will have to scan them at work.

 

The only MBAM logs I saw were from 4/6, but they are attached.

 

FRST & Addition attached.Today's Combofix log attached, & Comint.  And the junk.txt ipconfig output.

 

OTL apparently crashed while running and had locked up the machine.  I didn't try rerunning.

 

And, apparently I was incorrect:  the backup router is at 0.1 and not 0.199, because it is working fine on this machine.  The D-Link 604 is clearly dead, however.  Is it normal for a dead router to scramble up machines so badly?

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by srhutsell at 2014-04-11 21:42:25
Running from C:\Users\srhutsell\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.60629.2348 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0630.16.41755 - ATI) Hidden
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{BCC01139-903A-6FC7-3358-85B0AE332601}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2016 - Avast Software)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0630.16.41755 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0630.16.41755 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0630.16.41755 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help English (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help French (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help German (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0630.0015.41755 - ATI) Hidden
ccc-utility64 (Version: 2011.0630.16.41755 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.08 - Piriform)
CloudReading (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.0.31.1111 - Foxit Corporation)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 27.0.4.0 - COMODO)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.1.1031 - Foxit Corporation)
HP Officejet Pro 8100 Basic Device Software (HKLM\...\{E6403545-8324-47B4-ADCD-4F8A4CD8A1E1}) (Version: 28.0.1321.0 - Hewlett-Packard Co.)
Malwarebytes Anti-Malware version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{91E30409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 en-US)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neo's SafeKeys v3 (HKCU\...\Neo's SafeKeys v3) (Version: 3.1.4.0 - Aplin Software)
NirSoft SmartSniff (HKLM-x32\...\NirSoft SmartSniff) (Version:  - )
Paint.NET v3.36 (HKLM\...\{43602F34-1AA3-44FB-AEB2-D08C2C737440}) (Version: 3.36.0 - dotPDN LLC)
Pantech PCSuite (HKLM-x32\...\{A35A53C3-E4FD-4A84-B69D-D7B125CD4E66}) (Version: 1.0 - Pantech)
Pantech PCSuite (x32 Version: 1.0 - Pantech) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.0.1136 - SUPERAntiSpyware.com)
SUPERAntiSpyware Free Edition (HKLM-x32\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.29.0.1004 - SUPERAntiSpyware.com)
VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)
Windows Home Server 2011 Connector (HKLM\...\{C1E4D639-4A33-4314-809E-89BD0EF48522}) (Version: 6.1.8800.16400 - Microsoft Corporation)

==================== Restore Points  =========================

12-03-2014 07:00:23 Windows Update
19-03-2014 07:00:25 Windows Update
26-03-2014 06:05:50 Windows Update
01-04-2014 06:03:16 Windows Update
06-04-2014 07:50:28 avast! antivirus system restore point
07-04-2014 00:12:33 Restore Operation
08-04-2014 05:39:37 Removed Windows Home Server 2011 Connector
08-04-2014 05:41:17 Removed Windows Home Server 2011 Connector
10-04-2014 07:07:32 ComboFix created restore point

==================== Hosts content: ==========================

2009-07-13 22:34 - 2014-04-10 03:14 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {09B36CEF-6DD3-4223-9215-5032BF60F28B} - System32\Tasks\SUPERAntiSpyware Scheduled Task 501d43ed-97cc-46be-93a8-bfa21dc4efab => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-05-04] (SUPERAdBlocker.com)
Task: {18CCE488-7FA4-4792-9207-2AED885BEBB2} - System32\Tasks\Microsoft\Windows\Windows Server\UploadCEIPData => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {2F52FD9D-64B6-461F-BB59-20A6EE91D63D} - System32\Tasks\Microsoft\Windows\Windows Server\Health Definition Updates => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {4F563729-D3C0-473D-B2BC-00A8C4F0E408} - System32\Tasks\Microsoft\Windows\Windows Server\Backup_On_Idle => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {698338DA-4091-4ED6-A9BB-5C361E8A1110} - System32\Tasks\Microsoft\Windows\Windows Server\RenewClientCertificate => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {88A910CA-EA06-44C1-99E8-4F74E1CDBEAA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {9D475AE2-2414-4099-AC88-D010CA5D41F7} - System32\Tasks\Microsoft\Windows\Windows Server\Backup => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {BB56207F-7265-4AE6-BD78-C8143FEAE6D1} - System32\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805} => C:\ProgramData\cis26F0.exe [2013-11-11] (COMODO)
Task: {BE9065BC-2EA8-4C8A-89F6-7CBF67AED9A4} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-06] (AVAST Software)
Task: {D320C769-2F1D-4DF0-B82F-C7AFA89D3454} - System32\Tasks\Microsoft\Windows\Windows Server\SaveCEIPData => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {DF0F40A5-487F-4666-BFB1-52A21CD30EDB} - System32\Tasks\Microsoft\Windows\Windows Server\InstallAddIns => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: {E1EBE810-51EB-4D06-B54E-FDD381C54224} - System32\Tasks\SUPERAntiSpyware Scheduled Task 53e97ced-da88-404b-9dde-635c877baa69 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2011-05-04] (SUPERAdBlocker.com)
Task: {FF4FC77E-430A-4C43-AB1E-FC6C75026366} - System32\Tasks\Microsoft\Windows\Windows Server\Alert Evaluations => C:\Program Files\Windows Server\Bin\RunTask.exe [2012-11-02] (Microsoft Corporation)
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 501d43ed-97cc-46be-93a8-bfa21dc4efab.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 53e97ced-da88-404b-9dde-635c877baa69.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

==================== Loaded Modules (whitelisted) =============

2012-11-22 09:48 - 2012-11-22 09:48 - 00034304 _____ () C:\Windows\System32\ssi5mlm.dll
2013-05-29 08:19 - 2013-05-29 08:19 - 02094216 _____ () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
2011-06-30 00:14 - 2011-06-30 00:14 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-03-14 14:20 - 2011-03-14 14:20 - 00098304 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-11-30 13:19 - 2013-10-31 19:27 - 36229696 _____ () C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Reader.exe
2014-04-06 04:13 - 2014-04-06 04:13 - 02189824 _____ () C:\Program Files\AVAST Software\Avast\defs\14040600\algo.dll
2013-12-25 00:07 - 2013-12-25 00:07 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-11-30 13:19 - 2013-09-27 15:19 - 00561152 _____ () C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\CommentsSummary.fpi
2013-11-30 13:19 - 2013-09-27 16:54 - 01746432 _____ () C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\Speech.fpi

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

==================== Disabled items from MSCONFIG ==============

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/09/2014 05:02:13 AM) (Source: .NET Runtime) (User: )
Description: Application: Launchpad.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ObjectDisposedException
Stack:
   at System.IO.FileStream.get_Length()
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.RotatingLogTraceListener.UpdateWriter(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.Write(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.TraceData(System.Diagnostics.TraceEventCache, System.String, System.Diagnostics.TraceEventType, Int32, System.Object)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogTraceSource.TraceData(System.Diagnostics.TraceEventType, Int32, Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogOrchestrator.Write(Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.Write(System.Object, System.Collections.Generic.IEnumerable`1<System.String>, Int32, Int32, System.Diagnostics.TraceEventType, System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.WriteInfo(System.Object, System.String)
   at Microsoft.WindowsServerSolutions.Administration.Controls.AlertsView.AlertsViewer.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.Windows.Forms.Form.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at Microsoft.WindowsServerSolutions.LaunchPad.MainWindow.alertsViewDialog_FormClosed(System.Object, System.Windows.Forms.FormClosedEventArgs)
   at System.Windows.Forms.Form.WmClose(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.NativeWindow.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)

Error: (04/06/2014 08:15:42 PM) (Source: System Restore) (User: )
Description: The restore point selected was damaged or deleted during the restore (Scheduled Checkpoint).

Error: (04/06/2014 09:37:11 AM) (Source: .NET Runtime) (User: )
Description: Application: Launchpad.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ObjectDisposedException
Stack:
   at System.IO.FileStream.get_Length()
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.RotatingLogTraceListener.UpdateWriter(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.Write(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.TraceData(System.Diagnostics.TraceEventCache, System.String, System.Diagnostics.TraceEventType, Int32, System.Object)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogTraceSource.TraceData(System.Diagnostics.TraceEventType, Int32, Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogOrchestrator.Write(Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.Write(System.Object, System.Collections.Generic.IEnumerable`1<System.String>, Int32, Int32, System.Diagnostics.TraceEventType, System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.WriteInfo(System.Object, System.String)
   at Microsoft.WindowsServerSolutions.Administration.Controls.AlertsView.AlertsViewer.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.Windows.Forms.Form.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at Microsoft.WindowsServerSolutions.LaunchPad.MainWindow.alertsViewDialog_FormClosed(System.Object, System.Windows.Forms.FormClosedEventArgs)
   at System.Windows.Forms.Form.WmClose(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.NativeWindow.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)

Error: (04/06/2014 04:05:13 AM) (Source: .NET Runtime) (User: )
Description: Application: Launchpad.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.NullReferenceException
Stack:
   at System.Windows.Forms.ListView+ListViewNativeItemCollection.get_Item(Int32)
   at System.Windows.Forms.ListView+ListViewItemCollection.get_Item(Int32)
   at System.Windows.Forms.ListView+ListViewNativeItemCollection.Clear()
   at System.Windows.Forms.ListView.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at Microsoft.WindowsServerSolutions.Administration.Controls.AlertsView.AlertsViewer.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.Windows.Forms.Form.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at Microsoft.WindowsServerSolutions.LaunchPad.MainWindow.alertsViewDialog_FormClosed(System.Object, System.Windows.Forms.FormClosedEventArgs)
   at System.Windows.Forms.Form.WmClose(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)

Error: (03/19/2014 01:49:04 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/18/2014 09:42:35 PM) (Source: System Restore) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x81000101).

Error: (03/18/2014 02:01:03 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/17/2014 01:22:02 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/16/2014 01:04:16 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/15/2014 02:36:02 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

System errors:
=============
Error: (04/11/2014 09:38:10 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (04/10/2014 10:22:08 AM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (04/10/2014 03:14:41 AM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (04/10/2014 03:14:08 AM) (Source: Application Popup) (User: )
Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (04/10/2014 03:12:12 AM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (04/09/2014 05:04:34 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (04/09/2014 05:02:13 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (04/09/2014 04:50:56 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (04/09/2014 04:48:26 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (04/08/2014 07:28:48 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Microsoft Office Sessions:
=========================
Error: (04/09/2014 05:02:13 AM) (Source: .NET Runtime)(User: )
Description: Application: Launchpad.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ObjectDisposedException
Stack:
   at System.IO.FileStream.get_Length()
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.RotatingLogTraceListener.UpdateWriter(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.Write(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.TraceData(System.Diagnostics.TraceEventCache, System.String, System.Diagnostics.TraceEventType, Int32, System.Object)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogTraceSource.TraceData(System.Diagnostics.TraceEventType, Int32, Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogOrchestrator.Write(Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.Write(System.Object, System.Collections.Generic.IEnumerable`1<System.String>, Int32, Int32, System.Diagnostics.TraceEventType, System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.WriteInfo(System.Object, System.String)
   at Microsoft.WindowsServerSolutions.Administration.Controls.AlertsView.AlertsViewer.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.Windows.Forms.Form.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at Microsoft.WindowsServerSolutions.LaunchPad.MainWindow.alertsViewDialog_FormClosed(System.Object, System.Windows.Forms.FormClosedEventArgs)
   at System.Windows.Forms.Form.WmClose(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.NativeWindow.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)

Error: (04/06/2014 08:15:42 PM) (Source: System Restore)(User: )
Description: Scheduled Checkpoint

Error: (04/06/2014 09:37:11 AM) (Source: .NET Runtime)(User: )
Description: Application: Launchpad.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ObjectDisposedException
Stack:
   at System.IO.FileStream.get_Length()
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.RotatingLogTraceListener.UpdateWriter(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.Write(System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.TraceListeners.LogTraceListener.TraceData(System.Diagnostics.TraceEventCache, System.String, System.Diagnostics.TraceEventType, Int32, System.Object)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogTraceSource.TraceData(System.Diagnostics.TraceEventType, Int32, Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogOrchestrator.Write(Microsoft.WindowsServerSolutions.Diagnostics.Logging.LogEventInfo)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.Write(System.Object, System.Collections.Generic.IEnumerable`1<System.String>, Int32, Int32, System.Diagnostics.TraceEventType, System.String)
   at Microsoft.WindowsServerSolutions.Diagnostics.Logging.Log.WriteInfo(System.Object, System.String)
   at Microsoft.WindowsServerSolutions.Administration.Controls.AlertsView.AlertsViewer.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.Windows.Forms.Form.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at Microsoft.WindowsServerSolutions.LaunchPad.MainWindow.alertsViewDialog_FormClosed(System.Object, System.Windows.Forms.FormClosedEventArgs)
   at System.Windows.Forms.Form.WmClose(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
   at System.Windows.Forms.NativeWindow.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.DefWndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Control.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)

Error: (04/06/2014 04:05:13 AM) (Source: .NET Runtime)(User: )
Description: Application: Launchpad.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.NullReferenceException
Stack:
   at System.Windows.Forms.ListView+ListViewNativeItemCollection.get_Item(Int32)
   at System.Windows.Forms.ListView+ListViewItemCollection.get_Item(Int32)
   at System.Windows.Forms.ListView+ListViewNativeItemCollection.Clear()
   at System.Windows.Forms.ListView.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at Microsoft.WindowsServerSolutions.Administration.Controls.AlertsView.AlertsViewer.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at System.Windows.Forms.Control.Dispose(Boolean)
   at System.Windows.Forms.ContainerControl.Dispose(Boolean)
   at System.Windows.Forms.Form.Dispose(Boolean)
   at System.ComponentModel.Component.Dispose()
   at Microsoft.WindowsServerSolutions.LaunchPad.MainWindow.alertsViewDialog_FormClosed(System.Object, System.Windows.Forms.FormClosedEventArgs)
   at System.Windows.Forms.Form.WmClose(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.Form.WndProc(System.Windows.Forms.Message ByRef)
   at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr, Int32, IntPtr, IntPtr)

Error: (03/19/2014 01:49:04 AM) (Source: VSS)(User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/18/2014 09:42:35 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x81000101

Error: (03/18/2014 02:01:03 AM) (Source: VSS)(User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/17/2014 01:22:02 AM) (Source: VSS)(User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/16/2014 01:04:16 AM) (Source: VSS)(User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

Error: (03/15/2014 02:36:02 AM) (Source: VSS)(User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dc4596fd-8f1b-4130-922c-dcb215ee4e32}

CodeIntegrity Errors:
===================================
  Date: 2014-04-10 03:14:08.639
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-04-10 03:14:08.378
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 22:45:02.942
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 22:45:02.848
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 22:45:02.755
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 22:45:02.677
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 20:39:04.227
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 20:39:04.134
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 20:26:39.622
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-07-10 20:26:39.451
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Percentage of memory in use: 29%
Total physical RAM: 4863.3 MB
Available physical RAM: 3419.6 MB
Total Pagefile: 9724.79 MB
Available Pagefile: 7358.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:596.07 GB) (Free:534.24 GB) NTFS
Drive d: (Apr 09 2014) (CDROM) (Total:2.16 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: A4BC9746)

Partition: GPT Partition Type.

==================== End Of Log ============================

 

 

ComboFix 14-04-09.02 - srhutsell 04/13/2014   0:16.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4863.3622 [GMT -4:00]
Running from: c:\users\srhutsell\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2014-03-13 to 2014-04-13  )))))))))))))))))))))))))))))))
.
.
2014-04-13 04:21 . 2014-04-13 04:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-13 04:21 . 2014-04-13 04:21 -------- d-----w- c:\users\ahutsell2001\AppData\Local\temp
2014-04-13 04:21 . 2014-04-13 04:21 -------- d-----w- c:\users\Admin\AppData\Local\temp
2014-04-12 01:41 . 2014-04-12 01:42 -------- d-----w- C:\FRST
2014-04-12 01:41 . 2014-04-12 01:45 -------- d-----w- c:\windows\system32\catroot2
2014-04-10 07:51 . 2014-04-10 07:51 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-10 07:51 . 2014-04-10 07:51 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-04-10 07:51 . 2014-04-03 13:51 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-04-10 07:51 . 2014-04-03 13:51 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-10 07:51 . 2014-04-03 13:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-04-10 06:20 . 2014-04-10 06:20 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{03D5D204-D9B6-4177-B9B2-95ED85032566}\offreg.dll
2014-04-09 08:59 . 2014-04-09 08:59 -------- d-----w- c:\users\srhutsell\AppData\Local\ElevatedDiagnostics
2014-04-08 05:29 . 2013-11-11 14:58 4900568 ----a-w- c:\programdata\cis26F0.exe
2014-04-06 08:54 . 2014-04-06 08:54 -------- d-----w- c:\program files (x86)\NirSoft
2014-04-06 07:53 . 2014-04-06 07:53 43152 ----a-w- c:\windows\avastSS.scr
2014-04-04 05:59 . 2014-03-07 04:43 10521840 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{03D5D204-D9B6-4177-B9B2-95ED85032566}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-06 08:14 . 2013-07-14 18:31 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-06 08:14 . 2013-07-14 18:31 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-06 07:53 . 2013-12-25 04:07 84816 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-04-06 07:53 . 2013-07-10 00:57 423240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-04-06 07:53 . 2013-07-10 00:57 208928 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-04-06 07:53 . 2013-07-10 00:57 1039096 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-04-06 07:53 . 2013-07-10 00:57 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-04-06 07:53 . 2013-07-10 00:57 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-04-06 07:53 . 2013-07-10 00:57 334648 ----a-w- c:\windows\system32\aswBoot.exe
2014-04-06 07:53 . 2013-07-10 00:57 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-03-19 07:00 . 2013-07-10 04:03 90015360 ----a-w- c:\windows\system32\MRT.exe
2014-03-01 06:05 . 2014-03-12 06:00 23133696 ----a-w- c:\windows\system32\mshtml.dll
2014-03-01 05:17 . 2014-03-12 06:00 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-03-01 05:16 . 2014-03-12 06:00 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-03-01 04:58 . 2014-03-12 06:00 2765824 ----a-w- c:\windows\system32\iertutil.dll
2014-03-01 04:52 . 2014-03-12 06:00 66048 ----a-w- c:\windows\system32\iesetup.dll
2014-03-01 04:51 . 2014-03-12 06:00 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-03-01 04:42 . 2014-03-12 06:00 53760 ----a-w- c:\windows\system32\jsproxy.dll
2014-03-01 04:40 . 2014-03-12 06:00 33792 ----a-w- c:\windows\system32\iernonce.dll
2014-03-01 04:37 . 2014-03-12 06:00 574976 ----a-w- c:\windows\system32\ieui.dll
2014-03-01 04:33 . 2014-03-12 06:00 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-01 04:33 . 2014-03-12 06:00 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-03-01 04:32 . 2014-03-12 06:00 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2014-03-01 04:23 . 2014-03-12 06:00 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-01 04:17 . 2014-03-12 06:00 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2014-03-01 04:11 . 2014-03-12 06:00 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-03-01 04:02 . 2014-03-12 06:00 195584 ----a-w- c:\windows\system32\msrating.dll
2014-03-01 03:54 . 2014-03-12 06:00 5768704 ----a-w- c:\windows\system32\jscript9.dll
2014-03-01 03:52 . 2014-03-12 06:00 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2014-03-01 03:51 . 2014-03-12 06:00 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2014-03-01 03:42 . 2014-03-12 06:00 627200 ----a-w- c:\windows\system32\msfeeds.dll
2014-03-01 03:38 . 2014-03-12 06:00 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-03-01 03:37 . 2014-03-12 06:00 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2014-03-01 03:35 . 2014-03-12 06:00 2041856 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-01 03:18 . 2014-03-12 06:00 13051904 ----a-w- c:\windows\system32\ieframe.dll
2014-03-01 03:14 . 2014-03-12 06:00 4244480 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-03-01 03:10 . 2014-03-12 06:00 2334208 ----a-w- c:\windows\system32\wininet.dll
2014-03-01 03:00 . 2014-03-12 06:00 1964032 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2014-03-01 02:38 . 2014-03-12 06:00 1393664 ----a-w- c:\windows\system32\urlmon.dll
2014-03-01 02:32 . 2014-03-12 06:00 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2014-03-01 02:25 . 2014-03-12 06:00 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2014-02-07 01:23 . 2014-03-12 06:00 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-12 05:55 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-12 05:55 624128 ----a-w- c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-12 05:55 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-12 05:55 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-12 06:00 484864 ----a-w- c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-12 06:00 381440 ----a-w- c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-12 06:00 228864 ----a-w- c:\windows\system32\wwansvc.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-01-20 6563608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-06-30 336384]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-06 3854640]
.
c:\users\srhutsell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
procexp.exe [2013-8-16 2799296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files (x86)\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 ----a-w- c:\program files (x86)\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 initMonitor;Windows Server Initialization Service;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SASENUM;SASENUM;c:\program files (x86)\SUPERAntiSpyware\SASENUM.SYS;c:\program files (x86)\SUPERAntiSpyware\SASENUM.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 arXfrSvc;Windows Server Media Center TV Archive Transfer Service;c:\program files\Windows Server\Bin\Microsoft.HomeServer.Archive.TransferService.exe;c:\program files\Windows Server\Bin\Microsoft.HomeServer.Archive.TransferService.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
S2 HealthAlertsSvc;Windows Server Health Service;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 LANConfig;Windows Server LAN Configuration;c:\program files\Windows Server\Bin\LANConfigSvc.exe;c:\program files\Windows Server\Bin\LANConfigSvc.exe [x]
S2 NotificationsProviderSvc;Windows Server Notifications Provider Service;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 providers_system;Windows Server Download Service;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 ServiceProviderRegistry;Windows Server Service Provider Registry;c:\program files\Windows Server\Bin\ProviderRegistryService.exe;c:\program files\Windows Server\Bin\ProviderRegistryService.exe [x]
S2 SqmProviderSvc;Windows Server SQM Service;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 WhsMcClient;Windows Server Media Center Client Service;c:\program files\Windows Server\Bin\WhsMcClient.exe;c:\program files\Windows Server\Bin\WhsMcClient.exe [x]
S2 WSConnectorUpdate;Windows Server Connector Update;c:\program files\Windows Server\Bin\WSConnectorUpdate.exe;c:\program files\Windows Server\Bin\WSConnectorUpdate.exe [x]
S2 WSS_ComputerBackupProviderSvc;Windows Server Client Computer Backup Provider Service;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S3 BackupReader;BackupReader;c:\windows\system32\DRIVERS\BackupReader.sys;c:\windows\SYSNATIVE\DRIVERS\BackupReader.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2014-04-13 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 501d43ed-97cc-46be-93a8-bfa21dc4efab.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2014-04-12 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 53e97ced-da88-404b-9dde-635c877baa69.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-06 07:53 290888 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launchpad"="c:\program files (x86)\Windows Server\Bin\Launchpad.exe" [BU]
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{23E194A9-4AC7-436E-B26B-BA50A034DC4D}: NameServer = 8.8.8.8,192.168.0.199
FF - ProfilePath - c:\users\srhutsell\AppData\Roaming\Mozilla\Firefox\Profiles\gzywid7h.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-04-13  00:22:51
ComboFix-quarantined-files.txt  2014-04-13 04:22
.
Pre-Run: 576,466,993,152 bytes free
Post-Run: 576,022,441,984 bytes free
.
- - End Of File - - B3D4888E4577C94B35850184DD0852E1
A36C5E4F47E84449FF07ED3517B43A31
 

 

                                            ./
                                          (o o)
--------------------------------------oOOo-(_)-oOOo--------------------------------------
[13/04/2014 17:07:12] Resetting all TCP/IP Interfaces, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:12] TCP/IP interfaces reset successful.
[13/04/2014 17:07:13] TCP/IP v6 interfaces reset successful.
[13/04/2014 17:07:13] You may need to restart your computer for the settings to take effect.
[13/04/2014 17:07:13] Finished resetting the Internet Protocol (TCP/IP).

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Attempting to reset Winsock catalog, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Successfully reset the Winsock Catalog.
[13/04/2014 17:07:13] Finished repairing Winsock

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Releasing TCP/IP connections, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Successfully released TCP/IP connections.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Renewing TCP/IP connections, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Successfully renewed TCP/IP adapters.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:13] Configuring the Windows Event Log Service, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:14] Windows Event Log Service Configured.
[13/04/2014 17:07:14] Starting the Windows Event Log Service.....
[13/04/2014 17:07:14] Windows Event Log Service Started Successfully.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:14] Flushing DNS Resolver Cache, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:14] Successfully flushed DNS Resolver Cache.
[13/04/2014 17:07:14] Refreshing all DHCP leases and re-registering DNS names, Please wait.....
[13/04/2014 17:07:20] Registration of the DNS resource records has been initiated.
[13/04/2014 17:07:20] Note: Any errors will be reported in the 'Event Viewer' in about 15 minutes.
[13/04/2014 17:07:20] Note: Click on 'File' and then 'Event Viewer...' to open the Event Viewer.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:20] Repairing Internet Explorer 11.0.9600, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:20] RegSvr32.exe: "C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll"' registration succeeded.
[13/04/2014 17:07:20] RegSvr32.exe: "C:\Program Files\Internet Explorer\DiagnosticsTap.dll"' registration succeeded.
[13/04/2014 17:07:21] RegSvr32.exe: "C:\Program Files\Internet Explorer\F12.dll"' registration succeeded.
[13/04/2014 17:07:21] RegSvr32.exe: "C:\Program Files\Internet Explorer\F12Tools.dll"' registration succeeded.
[13/04/2014 17:07:21] RegSvr32.exe: "C:\Program Files\Internet Explorer\hmmapi.dll"' Specified module not found
[13/04/2014 17:07:21] RegSvr32.exe: "C:\Program Files\Internet Explorer\iedvtool.dll"' registration succeeded.
[13/04/2014 17:07:21] RegSvr32.exe: "C:\Program Files\Internet Explorer\ieproxy.dll"' registration succeeded.
[13/04/2014 17:07:21] RegSvr32.exe: "C:\Program Files\Internet Explorer\msdbg2.dll"' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\pdm.dll"' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\pdmproxy100.dll"' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\perf_nt.dll"' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\perfcore.dll"' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\Timeline_is.dll"' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: actxprxy.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: asctrls.ocx' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: browseui.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:22] RegSvr32.exe: cdfview.dll' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: comcat.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: comctl32.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: corpol.dll' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: cryptdlg.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\custsat.dll"' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: digest.dll' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: dispex.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: dxtmsft.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: dxtrans.dll' registration succeeded.
[13/04/2014 17:07:22] RegSvr32.exe: extmgr.dll' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: "C:\Program Files\Internet Explorer\hmmapi.dll"' Specified module not found
[13/04/2014 17:07:22] RegSvr32.exe: hlink.dll' registration succeeded.
[13/04/2014 17:07:23] RegSvr32.exe: ieaksie.dll' Specified module not found
[13/04/2014 17:07:23] RegSvr32.exe: ieapfltr.dll' Error number: 0x80070005
[13/04/2014 17:07:23] RegSvr32.exe: iedkcs32.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:23] RegSvr32.exe: "C:\Program Files\Internet Explorer\iedvtool.dll"' registration succeeded.
[13/04/2014 17:07:23] RegSvr32.exe: iedvtool.dll' Specified module not found
[13/04/2014 17:07:23] RegSvr32.exe: ieframe.dll' registration succeeded.
[13/04/2014 17:07:23] RegSvr32.exe: iepeers.dll' registration succeeded.
[13/04/2014 17:07:23] RegSvr32.exe: "C:\Program Files\Internet Explorer\ieproxy.dll"' registration succeeded.
[13/04/2014 17:07:23] RegSvr32.exe: ieproxy.dll' Specified module not found
[13/04/2014 17:07:24] RegSvr32.exe: iesetup.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:24] RegSvr32.exe: imgutil.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:24] RegSvr32.exe: inetcpl.cpl' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:24] RegSvr32.exe: inetcpl.cpl' registration succeeded.
[13/04/2014 17:07:24] RegSvr32.exe: initpki.dll' Specified module not found
[13/04/2014 17:07:24] RegSvr32.exe: inseng.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:24] RegSvr32.exe: jscript.dll' registration succeeded.
[13/04/2014 17:07:24] RegSvr32.exe: licmgr10.dll' registration succeeded.
[13/04/2014 17:07:24] RegSvr32.exe: mlang.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:24] RegSvr32.exe: mobsync.dll' Specified module not found
[13/04/2014 17:07:24] RegSvr32.exe: msapsspc.dll' Specified module not found
[13/04/2014 17:07:24] RegSvr32.exe: mscoree.dll' registration succeeded.
[13/04/2014 17:07:24] RegSvr32.exe: mscorier.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: mscories.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: msdbg2.dll' Specified module not found
[13/04/2014 17:07:25] RegSvr32.exe: mshta.exe' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: mshtml.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: mshtmled.dll' registration succeeded.
[13/04/2014 17:07:25] RegSvr32.exe: msident.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: msieftp.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: msnsspc.dll' Specified module not found
[13/04/2014 17:07:25] RegSvr32.exe: msr2c.dll' Specified module not found
[13/04/2014 17:07:25] RegSvr32.exe: msrating.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:25] RegSvr32.exe: mstime.dll' Specified module not found
[13/04/2014 17:07:25] RegSvr32.exe: msxml.dll' Specified module not found
[13/04/2014 17:07:25] RegSvr32.exe: ole32.dll' registration succeeded.
[13/04/2014 17:07:25] RegSvr32.exe: oleacc.dll' registration succeeded.
[13/04/2014 17:07:25] RegSvr32.exe: occache.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:27] RegSvr32.exe: oleaut32.dll' registration succeeded.
[13/04/2014 17:07:27] RegSvr32.exe: "C:\Program Files\Internet Explorer\pdm.dll"' registration succeeded.
[13/04/2014 17:07:27] RegSvr32.exe: plugin.ocx' Specified module not found
[13/04/2014 17:07:27] RegSvr32.exe: pngfilt.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:27] RegSvr32.exe: proctexe.ocx' Specified module not found
[13/04/2014 17:07:27] RegSvr32.exe: scrobj.dll' Error number: 0x80070005
[13/04/2014 17:07:27] RegSvr32.exe: sendmail.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:27] RegSvr32.exe: setupwbv.dll' Specified module not found
[13/04/2014 17:07:27] RegSvr32.exe: shdocvw.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:27] RegSvr32.exe: tdc.ocx' registration succeeded.
[13/04/2014 17:07:27] RegSvr32.exe: url.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:28] RegSvr32.exe: urlmon.dll' registration succeeded.
[13/04/2014 17:07:28] RegSvr32.exe: urlmon.dll,NI,HKLM' Specified module not found
[13/04/2014 17:07:28] RegSvr32.exe: vbscript.dll' registration succeeded.
[13/04/2014 17:07:29] RegSvr32.exe: "C:\Program Files\microsoft shared\vgx\vgx.dll"' Specified module not found
[13/04/2014 17:07:29] RegSvr32.exe: webcheck.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:29] Finished repairing Internet Explorer 11.0.9600

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:29] Repairing Windows Update / Automatic Updates, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:29] Stopping the BITS Service.....
[13/04/2014 17:07:29] BITS was not started in the first place.
[13/04/2014 17:07:29] Stopping the Automatic Updates (wuauserv) Service.....
[13/04/2014 17:07:29] Automatic Updates (wuauserv) Service Stopped Successfully.
[13/04/2014 17:07:29] Clearing File Stores (Update History).....
[13/04/2014 17:07:29] Clearing [C:\Windows\SoftwareDistribution\Download].....
[13/04/2014 17:07:29] [C:\Windows\SoftwareDistribution\Download] Cleared.
[13/04/2014 17:07:29] Clearing [C:\Windows\SoftwareDistribution\DataStore].....
[13/04/2014 17:07:30] Clearing [C:\Windows\system32\CatRoot2].....
[13/04/2014 17:07:31] [C:\Windows\system32\CatRoot2] Cleared.
[13/04/2014 17:07:31] Setting BITS Security Descriptor.....
[13/04/2014 17:07:31] BITS Security Descriptor Set.
[13/04/2014 17:07:31] Setting Automatic Updates (wuauserv) Service Security Descriptor.....
[13/04/2014 17:07:31] Automatic Updates (wuauserv) Security Descriptor Set.
[13/04/2014 17:07:31] Configuring the Automatic Updates (wuauserv) Service.....
[13/04/2014 17:07:31] Automatic Updates (wuauserv) Service Configured.
[13/04/2014 17:07:31] Configuring BITS.....
[13/04/2014 17:07:32] BITS Configured.
[13/04/2014 17:07:32] Registering WUAU DLLs.....
[13/04/2014 17:07:32] RegSvr32.exe: actxprxy.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: atl.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: browseui.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:32] RegSvr32.exe: corpol.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: cryptdlg.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: dispex.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: dssenh.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: gpkcsp.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: initpki.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: jscript.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: mshtml.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:32] RegSvr32.exe: msscript.ocx' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: msxml.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: msxml2.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: msxml3.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: msxml4.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: msxml6.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: muweb.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: ole.dll' Specified module not found
[13/04/2014 17:07:32] RegSvr32.exe: ole32.dll' registration succeeded.
[13/04/2014 17:07:32] RegSvr32.exe: oleaut.dll' Specified module not found
[13/04/2014 17:07:33] RegSvr32.exe: oleaut32.dll' registration succeeded.
[13/04/2014 17:07:33] RegSvr32.exe: qmgr.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:33] RegSvr32.exe: qmgrprxy.dll' registration succeeded.
[13/04/2014 17:07:33] RegSvr32.exe: gpkcsp.dll' Specified module not found
[13/04/2014 17:07:33] RegSvr32.exe: rsaenh.dll' registration succeeded.
[13/04/2014 17:07:33] RegSvr32.exe: sccbase.dll' Specified module not found
[13/04/2014 17:07:34] RegSvr32.exe: scrobj.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: scrrun.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: shdocvw.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:34] RegSvr32.exe: shell.dll' Specified module not found
[13/04/2014 17:07:34] RegSvr32.exe: shell32.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: slbcsp.dll' Specified module not found
[13/04/2014 17:07:34] RegSvr32.exe: softpub.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: urlmon.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: vbscript.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: winhttp.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:34] RegSvr32.exe: wintrust.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: wshext.dll' Error number: 0x80070005
[13/04/2014 17:07:34] RegSvr32.exe: wuapi.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: wuaueng.dll' Error number: 0x80070005
[13/04/2014 17:07:34] RegSvr32.exe: wuaueng1.dll' Specified module not found
[13/04/2014 17:07:34] RegSvr32.exe: wucltui.dll' Specified module not found
[13/04/2014 17:07:34] RegSvr32.exe: wucltux.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: wups.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: wups2.dll' registration succeeded.
[13/04/2014 17:07:34] RegSvr32.exe: wuweb.dll' Specified module not found
[13/04/2014 17:07:34] RegSvr32.exe: wuwebv.dll' registration succeeded.
[13/04/2014 17:07:34] WUAU DLLs Reregistered.
[13/04/2014 17:07:35] Resetting proxy settings.....
[13/04/2014 17:07:35] Proxy settings reset successfully.
[13/04/2014 17:07:35] Restarting the Automatic Updates (wuauserv) Service.....
[13/04/2014 17:07:35] Automatic Updates (wuauserv) Service Restarted.
[13/04/2014 17:07:35] Restarting the BITS Service.....
[13/04/2014 17:07:35] BITS Service Restarted.
[13/04/2014 17:07:35] Clearing the BITS queue.....
[13/04/2014 17:07:35] BITS queue cleared.
[13/04/2014 17:07:35] Initiating Windows Updates detection right away.....
[13/04/2014 17:07:36] Finished repairing Windows Update / Automatic Updates.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:36] Repairing SSL / HTTPS / Cryptography service, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:36] Configuring the Cryptographic Service.....
[13/04/2014 17:07:36] Cryptographic Service Configured.
[13/04/2014 17:07:36] Stopping the Cryptographic Service.....
[13/04/2014 17:07:36] Cryptographic service Stopped Successfully.
[13/04/2014 17:07:36] Clearing [C:\Windows\system32\CatRoot].....
[13/04/2014 17:07:36] [C:\Windows\system32\CatRoot] cleared.
[13/04/2014 17:07:36] Re-registering SSL / HTTPS / Cryptography DLLs.....
[13/04/2014 17:07:37] RegSvr32.exe: cryptdlg.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: cryptext.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: cryptui.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: dssenh.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: gpkcsp.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: initpki.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: licdll.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: mssign32.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: mssip32.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: regwizc.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: rsaenh.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: scardssp.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: sccbase.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: scecli.dll' registration succeeded.
[13/04/2014 17:07:37] RegSvr32.exe: slbcsp.dll' Specified module not found
[13/04/2014 17:07:37] RegSvr32.exe: softpub.dll' registration succeeded.
[13/04/2014 17:07:38] RegSvr32.exe: winhttp.dll' Module loaded but entry-point DllRegisterServer was not found.
[13/04/2014 17:07:38] RegSvr32.exe: wintrust.dll' registration succeeded.
[13/04/2014 17:07:38] SSL / HTTPS / Cryptography DLLs re-registered.
[13/04/2014 17:07:38] Restarting the Cryptographic Service.....
[13/04/2014 17:07:38] Cryptographic Service restarted.
[13/04/2014 17:07:38] Finished repairing SSL / HTTPS / Cryptography service.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:38] Resetting the Windows Firewall configuraton, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:40] Windows Firewall configuration reset successful.
[13/04/2014 17:07:40] Finished resetting the Windows Firewall configuraton.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:40] Restoring the default Windows HOSTS file, Please wait.....
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:40] Writing data to the HOSTS file.....
[13/04/2014 17:07:40] HOSTS file created successfully.

-----------------------------------------------------------------------------------------
[13/04/2014 17:07:40] You will need to reboot your computer before the settings will take effect.
-----------------------------------------------------------------------------------------
[13/04/2014 17:07:43] Your computer is restarting now.....

-----------------------------------------------------------------------------------------

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 29 days old and could be outdated)
Ran by srhutsell (administrator) on HUTSELL2S on 11-04-2014 21:41:57
Running from C:\Users\srhutsell\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\WhsMcClient.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\WSConnectorUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\LANConfigSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\ProviderRegistryService.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\Launchpad.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Reader.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Launchpad] - C:\Program Files\Windows Server\Bin\Launchpad.exe [1099360 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-06-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-06] (AVAST Software)
Winlogon\Notify\!SASWinLogon-x32: C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
HKU\S-1-5-21-3455503661-4230816971-2044476751-1022\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6563608 2014-01-20] (SUPERAntiSpyware)
Startup: C:\Users\srhutsell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\procexp.exe (Sysinternals - www.sysinternals.com)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.c...referrer:source?}
SearchScopes: HKLM - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = http://toolbar.ask.c...rchTerms}&crm=1
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.co...osoft:{language}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.co...osoft:{language}
SearchScopes: HKCU - {CF739809-1C6C-47C0-85B9-569DBB141420} URL = http://toolbar.ask.c...rchTerms}&crm=1
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
ShellExecuteHooks-x32: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL [77824 2008-05-13] (SuperAdBlocker.com)
Tcpip\..\Interfaces\{23E194A9-4AC7-436E-B26B-BA50A034DC4D}: [NameServer]8.8.8.8,192.168.0.199

FireFox:
========
FF ProfilePath: C:\Users\srhutsell\AppData\Roaming\Mozilla\Firefox\Profiles\gzywid7h.default
FF Homepage: hxxp://www.msn.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Extension: NoScript - C:\Users\srhutsell\AppData\Roaming\Mozilla\Firefox\Profiles\gzywid7h.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-08-18]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-07-09]

==================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2011-08-11] (SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-06] (AVAST Software)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2094216 2013-05-29] ()
R2 HealthAlertsSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
S2 initMonitor; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 NotificationsProviderSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 providers_system; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 ServiceProviderRegistry; C:\Program Files\Windows Server\Bin\ProviderRegistryService.exe [41568 2012-11-02] (Microsoft Corporation)
R2 SqmProviderSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 WSS_ComputerBackupProviderSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-06] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-06] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-06] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SASENUM; C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS [7408 2009-10-12] ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
U3 catchme; \??\C:\ComboFix\catchme.sys [X]
U3 aswMBR; \??\C:\Users\SRHUTS~1\AppData\Local\Temp\aswMBR.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-04-11 21:41 - 2014-04-11 21:42 - 00010861 _____ () C:\Users\srhutsell\Desktop\FRST.txt
2014-04-11 21:41 - 2014-04-11 21:41 - 00000000 ____D () C:\FRST
2014-04-11 21:41 - 2014-04-09 10:47 - 02157056 _____ (Farbar) C:\Users\srhutsell\Desktop\FRST64.exe
2014-04-10 03:51 - 2014-04-10 03:51 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-10 03:51 - 2014-04-10 03:51 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-10 03:51 - 2014-04-10 03:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-10 03:51 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-10 03:51 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-10 03:51 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-10 03:49 - 2014-04-09 10:46 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\srhutsell\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-10 03:45 - 2014-04-09 10:49 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\srhutsell\Desktop\tdsskiller.exe
2014-04-10 03:07 - 2014-04-10 03:39 - 00000000 ____D () C:\Qoobox
2014-04-10 03:07 - 2014-04-10 03:16 - 00000000 ____D () C:\Windows\erdnt
2014-04-10 03:07 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-10 03:07 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-10 03:07 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-10 03:07 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-10 03:07 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-10 03:07 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-10 03:07 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-10 03:07 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-10 03:04 - 2014-04-09 10:45 - 05196025 ____R (Swearware) C:\Users\srhutsell\Desktop\ComboFix.exe
2014-04-10 02:58 - 2014-04-09 10:43 - 04745728 _____ (AVAST Software) C:\Users\srhutsell\Desktop\aswmbr.exe
2014-04-09 05:39 - 2014-04-09 05:33 - 00053064 _____ () C:\Users\srhutsell\Desktop\smsniff.4.9.14.ssp
2014-04-09 05:03 - 2014-04-09 05:03 - 00000000 ____D () C:\Windows\LastGood
2014-04-08 01:44 - 2014-04-08 01:44 - 00000292 _____ () C:\Windows\PFRO.log
2014-04-08 01:29 - 2014-04-08 01:29 - 00003310 _____ () C:\Windows\System32\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}
2014-04-08 01:29 - 2013-11-11 10:58 - 04900568 _____ (COMODO) C:\ProgramData\cis26F0.exe
2014-04-08 01:13 - 2014-04-09 05:03 - 00000392 _____ () C:\Windows\setupact.log
2014-04-08 01:13 - 2014-04-08 01:13 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-06 22:37 - 2014-04-06 22:43 - 00000000 ____D () C:\Users\srhutsell\Desktop\Cleanup Aisle 5
2014-04-06 04:54 - 2014-04-06 04:54 - 00000000 ____D () C:\Users\srhutsell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft SmartSniff
2014-04-06 04:54 - 2014-04-06 04:54 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-04-06 04:31 - 2014-04-06 04:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-06 03:53 - 2014-04-06 03:53 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-12 02:00 - 2014-03-01 02:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 02:00 - 2014-03-01 01:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 02:00 - 2014-03-01 01:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 02:00 - 2014-03-01 00:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 02:00 - 2014-03-01 00:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 02:00 - 2014-03-01 00:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 02:00 - 2014-03-01 00:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 02:00 - 2014-03-01 00:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 02:00 - 2014-03-01 00:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 02:00 - 2014-03-01 00:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 02:00 - 2014-03-01 00:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 02:00 - 2014-03-01 00:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 02:00 - 2014-03-01 00:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 02:00 - 2014-03-01 00:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 02:00 - 2014-03-01 00:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 02:00 - 2014-03-01 00:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 02:00 - 2014-03-01 00:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 02:00 - 2014-02-28 23:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 02:00 - 2014-02-28 23:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 02:00 - 2014-02-28 23:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 02:00 - 2014-02-28 23:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 02:00 - 2014-02-28 23:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 02:00 - 2014-02-28 23:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 02:00 - 2014-02-28 23:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 02:00 - 2014-02-28 23:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 02:00 - 2014-02-28 23:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 02:00 - 2014-02-28 23:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 02:00 - 2014-02-28 23:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 02:00 - 2014-02-28 23:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 02:00 - 2014-02-28 23:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 02:00 - 2014-02-28 23:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 02:00 - 2014-02-28 23:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 02:00 - 2014-02-28 23:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 02:00 - 2014-02-28 23:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 02:00 - 2014-02-28 22:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 02:00 - 2014-02-28 22:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 02:00 - 2014-02-28 22:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 02:00 - 2014-02-28 22:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 02:00 - 2014-02-28 22:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 02:00 - 2014-02-28 22:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 02:00 - 2014-02-06 21:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 02:00 - 2014-01-28 22:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 02:00 - 2014-01-28 22:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 02:00 - 2014-01-27 22:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-12 01:55 - 2014-02-03 22:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 01:55 - 2014-02-03 22:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 01:55 - 2014-02-03 22:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 01:55 - 2014-02-03 22:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

==================== One Month Modified Files and Folders =======

2014-04-11 21:42 - 2014-04-11 21:41 - 00010861 _____ () C:\Users\srhutsell\Desktop\FRST.txt
2014-04-11 21:41 - 2014-04-11 21:41 - 00000000 ____D () C:\FRST
2014-04-11 21:38 - 2013-07-14 15:56 - 00000518 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 501d43ed-97cc-46be-93a8-bfa21dc4efab.job
2014-04-11 21:38 - 2013-06-21 07:18 - 02065621 _____ () C:\Windows\WindowsUpdate.log
2014-04-11 02:00 - 2013-07-14 15:56 - 00000518 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 53e97ced-da88-404b-9dde-635c877baa69.job
2014-04-10 03:51 - 2014-04-10 03:51 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-10 03:51 - 2014-04-10 03:51 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-10 03:51 - 2014-04-10 03:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-10 03:51 - 2013-08-15 22:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-10 03:39 - 2014-04-10 03:07 - 00000000 ____D () C:\Qoobox
2014-04-10 03:39 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Default
2014-04-10 03:16 - 2014-04-10 03:07 - 00000000 ____D () C:\Windows\erdnt
2014-04-10 03:14 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-09 10:49 - 2014-04-10 03:45 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\srhutsell\Desktop\tdsskiller.exe
2014-04-09 10:47 - 2014-04-11 21:41 - 02157056 _____ (Farbar) C:\Users\srhutsell\Desktop\FRST64.exe
2014-04-09 10:46 - 2014-04-10 03:49 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\srhutsell\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-09 10:45 - 2014-04-10 03:04 - 05196025 ____R (Swearware) C:\Users\srhutsell\Desktop\ComboFix.exe
2014-04-09 10:43 - 2014-04-10 02:58 - 04745728 _____ (AVAST Software) C:\Users\srhutsell\Desktop\aswmbr.exe
2014-04-09 06:42 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2014-04-09 05:33 - 2014-04-09 05:39 - 00053064 _____ () C:\Users\srhutsell\Desktop\smsniff.4.9.14.ssp
2014-04-09 05:10 - 2009-07-14 00:45 - 00015008 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-09 05:10 - 2009-07-14 00:45 - 00015008 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-09 05:07 - 2009-07-14 01:13 - 00782470 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-09 05:03 - 2014-04-09 05:03 - 00000000 ____D () C:\Windows\LastGood
2014-04-09 05:03 - 2014-04-08 01:13 - 00000392 _____ () C:\Windows\setupact.log
2014-04-09 05:03 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-09 04:59 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-09 04:41 - 2013-07-09 20:57 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-08 01:44 - 2014-04-08 01:44 - 00000292 _____ () C:\Windows\PFRO.log
2014-04-08 01:35 - 2013-07-09 21:15 - 00000000 ____D () C:\ProgramData\COMODO
2014-04-08 01:35 - 2013-07-09 21:15 - 00000000 ____D () C:\Program Files\COMODO
2014-04-08 01:29 - 2014-04-08 01:29 - 00003310 _____ () C:\Windows\System32\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}
2014-04-08 01:13 - 2014-04-08 01:13 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-06 22:43 - 2014-04-06 22:37 - 00000000 ____D () C:\Users\srhutsell\Desktop\Cleanup Aisle 5
2014-04-06 22:37 - 2013-06-21 04:22 - 00000000 ____D () C:\Windows\Panther
2014-04-06 21:42 - 2010-11-16 00:28 - 00000000 ____D () C:\Users\srhutsell\Documents\xmas
2014-04-06 20:16 - 2013-07-10 23:30 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-04-06 05:10 - 2013-07-11 23:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-06 04:54 - 2014-04-06 04:54 - 00000000 ____D () C:\Users\srhutsell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft SmartSniff
2014-04-06 04:54 - 2014-04-06 04:54 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-04-06 04:31 - 2014-04-06 04:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-06 04:14 - 2013-07-14 14:31 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-06 04:14 - 2013-07-14 14:31 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-06 03:54 - 2013-07-09 20:57 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-06 03:53 - 2014-04-06 03:53 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-06 03:53 - 2013-12-25 00:07 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-04-06 03:53 - 2013-07-09 20:57 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-06 03:53 - 2013-07-09 20:57 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-06 03:53 - 2013-07-09 20:57 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-06 03:53 - 2013-07-09 20:57 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-06 03:53 - 2013-07-09 20:57 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-06 03:53 - 2013-07-09 20:57 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-06 03:53 - 2013-07-09 20:57 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-03 09:51 - 2014-04-10 03:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-10 03:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-10 03:51 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-19 03:02 - 2013-07-10 18:43 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-19 03:00 - 2013-07-10 00:03 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-12 03:19 - 2009-07-14 00:45 - 00417392 _____ () C:\Windows\system32\FNTCACHE.DAT

Files to move or delete:
====================
C:\ProgramData\cis26F0.exe

Some content of TEMP:
====================
C:\Users\srhutsell\AppData\Local\Temp\Checkupdate.exe
C:\Users\srhutsell\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\srhutsell\AppData\Local\Temp\gcapi_dll.dll
C:\Users\srhutsell\AppData\Local\Temp\gtapi_signed.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-04-09 00:41

==================== End Of Log ============================

 

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.04.06.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
srhutsell :: HUTSELL2S [administrator]

4/6/2014 9:25:34 PM
mbam-log-2014-04-06 (21-25-34).txt

Scan type: Full scan (C:\|E:\|F:\|G:\|H:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 431284
Time elapsed: 49 minute(s), 26 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\Admin\Documents\ShopAtHome_App_C88217904_D0_R92237.exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.
C:\Users\srhutsell\Documents\ShopAtHome_App_C88217904_D0_R92237.exe (PUP.Optional.ShopAtHome.A) -> Quarantined and deleted successfully.

(end)

 

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.04.06.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
srhutsell :: HUTSELL2S [administrator]

4/6/2014 10:31:59 PM
mbam-log-2014-04-06 (22-31-59).txt

Scan type: Full scan (C:\|E:\|F:\|G:\|H:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 43029
Time elapsed: 5 minute(s), 28 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

These Windows services are started:

   AMD External Events Utility
   Application Information
   avast! Antivirus
   Background Intelligent Transfer Service
   Base Filtering Engine
   CNG Key Isolation
   COM+ Event System
   COMODO Dragon Update Service
   Cryptographic Services
   DCOM Server Process Launcher
   Desktop Window Manager Session Manager
   DHCP Client
   Diagnostic Policy Service
   Diagnostic Service Host
   Distributed Link Tracking Client
   DNS Client
   Encrypting File System (EFS)
   Function Discovery Provider Host
   Group Policy Client
   IKE and AuthIP IPsec Keying Modules
   IP Helper
   Machine Debug Manager
   Multimedia Class Scheduler
   Net.Tcp Port Sharing Service
   Network Connections
   Network List Service
   Network Location Awareness
   Network Store Interface Service
   Plug and Play
   PnP-X IP Bus Enumerator
   Portable Device Enumerator Service
   Power
   Print Spooler
   Program Compatibility Assistant Service
   Remote Access Connection Manager
   Remote Procedure Call (RPC)
   RPC Endpoint Mapper
   SAS Core Service
   Secondary Logon
   Secure Socket Tunneling Protocol Service
   Security Accounts Manager
   Security Center
   Server
   Shell Hardware Detection
   SSDP Discovery
   Superfetch
   System Event Notification Service
   Task Scheduler
   TCP/IP NetBIOS Helper
   Telephony
   Themes
   User Profile Service
   Windows Audio
   Windows Audio Endpoint Builder
   Windows Defender
   Windows Driver Foundation - User-mode Driver Framework
   Windows Event Log
   Windows Firewall
   Windows Font Cache Service
   Windows Management Instrumentation
   Windows Presentation Foundation Font Cache 3.0.0.0
   Windows Search
   Windows Server Client Computer Backup Provider Service
   Windows Server Connector Update
   Windows Server Download Service
   Windows Server Health Service
   Windows Server LAN Configuration
   Windows Server Media Center Client Service
   Windows Server Notifications Provider Service
   Windows Server Service Provider Registry
   Windows Server SQM Service
   Windows Update
   Workstation

The command completed successfully.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : HUTSELL2S
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
   Physical Address. . . . . . . . . : 78-AC-C0-BE-D4-A8
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes