[RESOLVED] I think i need some help, malware ?

Printable View

Show 40 post(s) from this thread on one page

April 8th, 2013, 03:31 PM
revanyab

[2013/04/02 23:38:45 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013/04/02 23:37:38 | 000,000,935 | ---- | C] () -- C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
[2013/04/02 23:34:53 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2013/04/02 23:34:53 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2013/04/02 23:34:52 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2013/04/02 23:28:49 | 000,000,290 | ---- | C] () -- C:\Users\landon\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2013/04/02 23:28:49 | 000,000,272 | ---- | C] () -- C:\Users\landon\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2013/04/02 23:14:38 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013/04/02 23:14:25 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013/04/02 23:10:07 | 2393,763,840 | -HS- | C] () -- C:\hiberfil.sys
[2012/09/13 18:47:00 | 000,180,224 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012/05/02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll
[2012/01/17 11:24:10 | 000,055,296 | ---- | C] () -- C:\Windows\System32\ASGT.exe

========== ZeroAccess Check ==========

[2009/07/13 21:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 21:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/13 18:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 18:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

========== Purity Check ==========

< End of report >
------------------------------------------------------------------------------------------------
April 8th, 2013, 03:32 PM
revanyab

OTL Extras logfile created on: 4/3/2013 10:23:23 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\landon\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.97 Gb Total Physical Memory | 1.57 Gb Available Physical Memory | 52.93% Memory free
5.94 Gb Paging File | 4.19 Gb Available in Paging File | 70.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931.41 Gb Total Space | 861.11 Gb Free Space | 92.45% Space Free | Partition Type: NTFS
Drive D: | 974.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: LANDON-PC | User Name: landon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2233508094-571757954-3134433615-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00F63EB1-B4F9-4F3B-8002-826DF65DFD91}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{26BC34F3-0034-421A-B5F4-FEEEBD9081AA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{3879D11B-40CC-42ED-9CEF-46247D67CFFB}" = lport=138 | protocol=17 | dir=in | app=system |
"{3A385B14-BE4E-4A7A-96EE-0FC5C00DA693}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3F664FE4-D0DA-4DFA-97EC-8794D78D512A}" = rport=139 | protocol=6 | dir=out | app=system |
"{42F2981F-AEF0-4100-AD90-0DB5FB84106A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{446D619B-B159-4A5C-8438-6C8789EB2235}" = lport=445 | protocol=6 | dir=in | app=system |
"{57DB9324-B6DE-4D52-ABC7-DAD0255A0F35}" = rport=10243 | protocol=6 | dir=out | app=system |
"{5C88BFF6-B88F-4EB0-A8C3-098F7011451F}" = lport=137 | protocol=17 | dir=in | app=system |
"{68B04590-5626-49DD-88C3-F2123244E6C9}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6B6EBAA7-7679-4423-8E85-BD3BD2687AAF}" = lport=139 | protocol=6 | dir=in | app=system |
"{6EE8F096-9E37-49DA-B3F4-8E546BDFE452}" = rport=138 | protocol=17 | dir=out | app=system |
"{740D2369-B260-4805-84EE-2B0F51457EA5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{90BFD6AD-D150-46C9-A118-3C8EE28B505A}" = rport=445 | protocol=6 | dir=out | app=system |
"{92382E49-F0F5-4941-8EAE-95E71223EA85}" = rport=137 | protocol=17 | dir=out | app=system |
"{A95147D0-717E-4CD6-B963-7D2423C8DA75}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA7833CE-11DB-4F4E-929C-1E7A0F594CAD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BF8F96B3-B2DF-44FE-A348-36032A0C092E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D35C6999-15F0-4B7C-8085-73F465CC09B9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DF1C7417-22C9-4E6A-B57A-4FA255672E08}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FC86011A-DBD4-42BA-9FCB-8F02ECA6077D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05ED7F91-AF72-4777-AC94-37B283C2C4B6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1C2092C6-D1D1-4FEA-A115-DA392479F9D8}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2E4A44FA-DA20-4836-A27F-F3A6953835B6}" = protocol=58 | dir=out | [email protected],-503 |
"{302743DE-B739-4A6D-80DA-FB2AC09AE5AC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{36A2764F-9055-4A91-B356-BC05154B26CB}" = protocol=17 | dir=in | app=c:\users\landon\appdata\roaming\utorrent\utorrent.exe |
"{383FEEAD-49F2-4238-9A23-CCF6B8F79AE6}" = protocol=6 | dir=out | app=system |
"{3C8521DD-1BC9-46BD-82B7-65E494518C20}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{57326507-E2C3-40D8-B6F1-CA9413D07D3B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{592312DA-CEF6-4961-A670-DC8E6BB8F1BC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5C2C40A8-EF50-4715-84BE-33F7FED82E44}" = protocol=58 | dir=in | [email protected],-28545 |
"{722475CB-8A5B-40BF-9524-E76E8D8EC1A4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{759C462A-4487-45F8-81FB-090F02C8F44C}" = protocol=6 | dir=in | app=c:\users\landon\appdata\roaming\utorrent\utorrent.exe |
"{75DDF6ED-C788-4F77-AC40-341828C980A5}" = protocol=1 | dir=in | [email protected],-28543 |
"{7A6420A8-1B93-44DC-99D4-40D5B267C222}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{92D4F6F3-100B-4183-84E2-260B2E4933D6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9C7C6184-4D65-4AA6-88C4-2BA57C392745}" = protocol=1 | dir=out | [email protected],-28544 |
"{AF26194A-EED7-4ACB-9E99-0A93A35D9783}" = protocol=58 | dir=in | app=system |
"{B861372C-B3D7-4790-9D03-C7D5DF426ECD}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{BE5EF7BD-3CCC-47B7-B9A5-64E1F74AFC1E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CC32B741-9D96-4806-8BE1-9E3299732A4E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D25649C4-82A6-4D83-9A4B-024537EA1109}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EC4D145A-3531-4860-A166-A388D6617740}" = protocol=58 | dir=out | [email protected],-28546 |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{003A5708-9078-45C9-A2FE-EBBF422B3D0A}" = ASUS Utility
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0E80B6F3-90C4-19E3-09F0-80E3D6F77BE2}" = AMD Accelerated Video Transcoding
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1D18AB8A-E17E-3976-CDAF-59267E51D452}" = CCC Help Hungarian
"{24C573A1-EC90-FAE6-B364-876C4424ECD5}" = AMD VISION Engine Control Center
"{29869252-8FA3-8A6E-5817-0AB00BB18853}" = AMD AVIVO Codecs
"{2BC0EF85-1DEB-9A6C-9BF2-EC822445508D}" = CCC Help Danish
"{325F8CE4-8A6D-0996-7AE3-7A82434EA9E2}" = ccc-utility
"{3B5F0996-E1C5-B5AE-0853-C14A23CC72B1}" = AMD Drag and Drop Transcoding
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{52E503DB-BFCC-7A86-1D79-9A9B382D927C}" = CCC Help Swedish
"{532F6E8A-AF97-41C3-915F-39F718EC07D1}" = ASUS GPU Tweak
"{544F938F-74F9-B63A-8CEF-1EDD5F33BC38}" = CCC Help Portuguese
"{579E3FF1-BF0A-E27E-C314-076CE90923B5}" = Catalyst Control Center Localization All
"{5F7308C0-56FF-415A-B34C-44A90A892A95}" = Catalyst Control Center - Branding
"{676BB3CD-5619-37C6-ED91-9094E2F6AC16}" = CCC Help Thai
"{717BCD9F-D72B-DBAB-A956-5F744F461FFA}" = CCC Help Chinese Traditional
"{723C5684-1690-C87B-1032-5CCE81155344}" = AMD Media Foundation Decoders
"{7AD1EF43-2B11-3E55-B654-30D08DFB4EF8}" = CCC Help Finnish
"{7E052F74-10A7-42E7-84EB-01C172F5AB5D}" = SlimDrivers
"{8549EA55-CFB6-1547-7F08-D8DA4CDBC621}" = CCC Help Greek
"{855D931E-E706-8902-B60C-CAC3883FB5D9}" = CCC Help Italian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89944750-64A7-E18B-67E0-9B2D42931C76}" = AMD Fuel
"{8F3BA881-4A5B-F8C2-A96D-F9E20FBE82C2}" = CCC Help French
"{90157C5D-D791-4D36-8C2B-7553DC01D601}" = ASUS VGA Driver
"{926AB766-B50B-7199-1C82-2140EC6388B6}" = CCC Help Turkish
"{95D9B497-BC3B-330C-918C-D575E5AFA655}" = CCC Help Dutch
"{9B43EF9D-3B8E-A8F4-06FE-5AA0E21B5ACE}" = AMD Catalyst Install Manager
"{9C547017-E05F-1136-3F2C-D1623F3E847A}" = CCC Help Russian
"{9E3D5097-6BBC-670A-A125-3CDA1EBE20F2}" = CCC Help Chinese Standard
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{BA0F9EA0-1313-976B-4809-A5535AB8E207}" = HydraVision
"{CD63B924-92EC-FE8F-4BE2-F2DD40123C69}" = CCC Help Korean
"{D1830075-2A3A-AF1C-3687-21AD501825E6}" = Catalyst Control Center InstallProxy
"{D3FD197D-AACC-41C0-70C8-303B9F1E444D}" = CCC Help Czech
"{E3E41E66-85C4-CF25-48FA-4828614C82DD}" = CCC Help English
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F30B7B8D-F376-79F9-F00E-5D57F0960023}" = CCC Help Spanish
"{F4554429-E662-5C6A-0FDE-3E3E9AF064C5}" = CCC Help Norwegian
"{FD7414B7-7AB4-9945-83DA-E0543AC31706}" = CCC Help Japanese
"{FD786AC4-C4AA-6AB1-5C96-B06B0DC5C1D4}" = CCC Help German
"{FDFD3BAE-B1CB-D0B2-A5A9-3BABFD09EADA}" = CCC Help Polish
"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager
"Google Chrome" = Google Chrome
"InstallShield_{532F6E8A-AF97-41C3-915F-39F718EC07D1}" = ASUS GPU Tweak
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"N360" = Norton 360
"Steam App 22380" = Fallout: New Vegas
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 8870" = BioShock Infinite
"uTorrent" = µTorrent
"VLC media player" = VLC media player 2.0.5

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 4/3/2013 2:32:59 AM | Computer Name = landon-PC | Source = VSS | ID = 8194
Description =

Error - 4/3/2013 5:54:17 PM | Computer Name = landon-PC | Source = VSS | ID = 8194
Description =

Error - 4/3/2013 9:41:19 PM | Computer Name = landon-PC | Source = VSS | ID = 8194
Description =

Error - 4/3/2013 9:41:30 PM | Computer Name = landon-PC | Source = System Restore | ID = 8193
Description =

Error - 4/4/2013 12:05:56 AM | Computer Name = landon-PC | Source = Application Hang | ID = 1002
Description = The program symerr.exe version 4.3.0.7 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: d44 Start Time:
01ce30e7fdd29c54 Termination Time: 4 Application Path: C:\Program Files\Norton 360\Engine\20.3.0.36\symerr.exe

Report
Id: c5454db8-9cdc-11e2-bbda-bc5ff4874aff

Error - 4/4/2013 12:20:42 AM | Computer Name = landon-PC | Source = Application Hang | ID = 1002
Description = The program symerr.exe version 4.3.0.7 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 11e0 Start Time:
01ce30ea7df09c16 Termination Time: 32 Application Path: C:\Program Files\Norton 360\Engine\20.3.0.36\symerr.exe

Report
Id: f7656905-9cde-11e2-bbda-bc5ff4874aff

[ System Events ]
Error - 4/3/2013 10:56:49 PM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7023
Description = The Server service terminated with the following error: %%1062

Error - 4/4/2013 12:23:09 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Steam
Client Service service to connect.

Error - 4/4/2013 12:23:09 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7000
Description = The Steam Client Service service failed to start due to the following
error: %%1053

Error - 4/4/2013 12:30:37 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7034
Description = The ASGT service terminated unexpectedly. It has done this 1 time(s).

Error - 4/4/2013 12:30:39 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 4/4/2013 12:38:31 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7034
Description = The ASGT service terminated unexpectedly. It has done this 1 time(s).

Error - 4/4/2013 12:38:33 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 4/4/2013 12:54:56 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 4/4/2013 1:07:27 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 4/4/2013 1:14:27 AM | Computer Name = landon-PC | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

< End of report >
April 8th, 2013, 03:35 PM
revanyab

computer so far today hasnt tried to randomly restart on me even with it being on this long, i think this could be doing the trick :)
April 8th, 2013, 03:53 PM
Broni
OTL logs are clean.

Last scans...

http://dev.discussions.virtualdr.forums.relay.cool/ Download Security Check from here or here and save it to your Desktop.
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

http://dev.discussions.virtualdr.forums.relay.cool/ Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
- Make sure the following options are checked:
  - Internet Services
  - Windows Firewall
  - System Restore
  - Security Center
  - Windows Update
  - Windows Defender
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
http://dev.discussions.virtualdr.forums.relay.cool/ Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
http://dev.discussions.virtualdr.forums.relay.cool/ Please run a free online scan with the ESET Online Scanner
- Disable your antivirus program
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, click on List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
April 8th, 2013, 10:32 PM
revanyab

Results of screen317's Security Check version 0.99.62
Windows 7 x86 (UAC is enabled)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
Google Chrome 25.0.1364.97
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

-------------------------------------------------------------------------------------------------------------------
Farbar Service Scanner Version: 03-03-2013
Ran by landon (administrator) on 08-04-2013 at 19:30:38
Running from "C:\Users\landon\Desktop"
Windows 7 Home Premium (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-04-03 15:18] - [2013-01-03 21:55] - 1287528 ____A (Microsoft Corporation) BBCEAEFF1FD72A026F827CBB2F4AA8AD

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll
[2013-04-03 15:17] - [2010-12-20 22:38] - 0073728 ____A (Microsoft Corporation) A661A76333057B383A06E65F0073222F

C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-04-03 15:25] - [2012-06-01 21:45] - 0139264 ____A (Microsoft Corporation) F2FDE6C8DBAAD44CC58D1E07E4AF4EED

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****
April 10th, 2013, 04:51 PM
revanyab

I also ran the Eset scan and it didnt produce a log because it didnt find anything. Am i Clean? and if i am what is the best way to check an external hard drive for threats? I have an external hard drive i put some files on that i need and would like to know the safest way of getting those off
April 10th, 2013, 07:53 PM
Broni
Install Panda USB Vaccine, or BitDefender’s USB Immunizer on your computer to protect it from any infected USB device.
Then you'll be safe to plug your external drive in and scan it with your AV program.

================================

Your computer is clean http://dev.discussions.virtualdr.forums.relay.cool/

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:

:OTL :Commands [purity] [emptytemp] [EMPTYFLASH] [emptyjava] [CLEARALLRESTOREPOINTS] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure Windows Updates are current (Service Pack 1!!!)

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tuto...r-safe-online/

14. Please, let me know, how your computer is doing.
April 11th, 2013, 02:39 PM
revanyab

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: landon
->Temp folder emptied: 5103 bytes
->Temporary Internet Files folder emptied: 16213860 bytes
->Google Chrome cache emptied: 268760694 bytes
->Flash cache emptied: 715 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2555 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 272.00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: landon
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: landon

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 04112013_113413

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Thank you very much :)
April 11th, 2013, 02:40 PM
Broni

Quote:

14. Please, let me know, how your computer is doing.

....
April 11th, 2013, 02:46 PM
revanyab

no random restarts and everything running fine. I now just have to reinstall a couple games and i will be happy, Thanks again
April 11th, 2013, 03:09 PM
Broni

Way to go!! http://dev.discussions.virtualdr.forums.relay.cool/
Good luck and stay safe :)
April 18th, 2013, 06:55 PM
revanyab

I was fine for about a week or so with no isssues and now it is doing the same thing again. :(
April 18th, 2013, 07:00 PM
Broni

Specify what the issues are.
April 18th, 2013, 07:10 PM
revanyab

the same as last time, random restarts event log says "The attempt by user landon-PC\landon to restart/shutdown computer LANDON-PC failed" when i cancel the restart as it tries to force close everything.
I also had this error earlier today before it tried to restart
Faulting application name: mmc.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3f1
Faulting module name: MFC42u.dll, version: 6.6.8064.0, time stamp: 0x4d79b3c1
Exception code: 0xc0000005
Fault offset: 0x0001cff9
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
April 18th, 2013, 07:22 PM
Broni

Are your Windows updates current?

Quote:

3. Make sure Windows Updates are current (Service Pack 1!!!)

Show 40 post(s) from this thread on one page