Cannot connect to internet...

Mika · December 26, 2012

Hello and thanks in advance for providing this much appreciated service.

My system will not allow me to connect to the internet normally. None of my browsers or windows updates will connect. Norton IS appears to connect and update. This behavior all started relatively suddenly; I had not noticed any unusal behavior until I was unable to use any browser to connect to the internet (Firefox 16, IE, and Chrome).

I attempted to run a scan with Malwarebytes (previously installed - thanks for a great product!) - but it would not connect and update.

I used another computer to search for guidance on how to scan the system and I followed the guide contained at http://www.selectrealsecurity.com/malware-removal-guide - as best I could. Summary: RKill didn't fine anything, RogueKiller detected malicious registry keys and deleted them, [TDSSKiller, FixTDSS, Malwarebyes Anti-Malware, Hitman Pro, ESET on-line scanner - run in this order, all reported no threats found]. I was able to run in Safe Mode with Networking to update the database for Malwarebytes and run ESET on-line scanner. (I have the logs from RKill and RogueKiller, if those would be helpful.) The behavior persists.

Thanks for taking a look.

Here are the requested logs from DDS:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16450 BrowserJavaVersion: 1.6.0_31

Run by Micky at 20:31:28 on 2012-12-25

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8181.6446 [GMT -5:00]

.

AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe

C:\Program Files\Alienware\Command Center\AlienFusionService.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe

C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe

C:\Program Files (x86)\OSD\OSD_Service.exe

C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ccSvcHst.exe

C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe

C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\ccSvcHst.exe

C:\Program Files (x86)\AlienRespawn\sftservice.EXE

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ccSvcHst.exe

C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\DSUpd.exe

C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\AlienRespawn\Toaster.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\UI0Detect.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe

C:\Program Files\Logitech\Gaming Software\LWEMon.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe

c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\CyberLink\Shared Files\brs.exe

C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe

C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files (x86)\OSD\OSD_Main.exe

C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files\Alienware\Command Center\AlienSense\FATrayAlert.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\iPod\bin\iPodService.exe

c:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe

C:\Program Files\Alienware\Command Center\AlienFXHook64Mngr.exe

C:\Windows\explorer.exe

C:\Program Files\Alienware\Command Center\AlienFusionController.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.alienware.com/

uDefault_Page_URL = hxxp://www.alienware.com/

mWinlogon: Userinit = userinit.exe

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\coieplg.dll

BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ipsbho.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Norton Family BHO: {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\CoIEPlg.dll

BHO: SSOIEAddonBHO Class: {DA5BCE70-D057-4D63-943D-5F3927EC59F1} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\coieplg.dll

mRun: [OSD_LAUNCH] c:\Program Files (x86)\OSD\Launch.exe

mRun: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe

mRun: [FAStartup] <no file>

mRunOnce: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe

StartupFolder: C:\Users\Micky\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: NameServer = 75.75.75.75 75.75.76.76 192.168.1.1

TCP: Interfaces\{B0200DF8-F103-4CE0-A759-F06A0F228BBD} : DHCPNameServer = 150.100.11.4

TCP: Interfaces\{EFBD35C6-3D4B-4CF9-BB7B-61C9A516158A} : DHCPNameServer = 75.75.75.75 75.75.76.76 192.168.1.1

Notify: FastAccess - C:\Program Files\Alienware\Command Center\AlienSense\FALogNot.dll

SSODL: WebCheck - <orphaned>

LSA: Notification Packages = scecli FAPassSync

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [iAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe

x64-Run: [AlienFX Controller] "C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe"

x64-Run: [start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui

x64-Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

x64-Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon

x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

x64-DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Micky\AppData\Roaming\Mozilla\Firefox\Profiles\xkt2dly2.default\

FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn_2010_9_0_6\components\coFFPlgn.dll

FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\components\IPSFFPl.dll

FF - component: C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.2.0.28\coFFFw\components\coFFFw.dll

FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll

.

============= SERVICES / DRIVERS ===============

.

R0 EUBAKUP;EUBAKUP;C:\Windows\System32\drivers\eubakup.sys [2012-2-8 57480]

R0 EUBKMON;EUBKMON;C:\Windows\System32\drivers\EUBKMON.sys [2012-2-8 51336]

R0 ioatdma;Intel® QuickData Technology device;C:\Windows\System32\drivers\ioatdma.sys [2010-6-24 46792]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-8-12 55024]

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\0404000.00C\symds64.sys [2011-11-6 433200]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\0404000.00C\symefa64.sys [2011-11-6 221304]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20121130.005\BHDrvx64.sys [2012-12-21 1384608]

R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\N360x64\0404000.00C\cchpx64.sys [2011-11-6 593544]

R1 ccSet_NSM;Norton Family Settings Manager;C:\Windows\System32\drivers\NSMx64\0206000.02B\ccSetx64.sys [2012-11-12 168096]

R1 EUDSKACS;EUDSKACS;C:\Windows\System32\drivers\eudskacs.sys [2012-2-8 19592]

R1 EUFDDISK;EUFDDISK;C:\Windows\System32\drivers\EuFdDisk.sys [2012-2-8 189576]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20121221.001\IDSviA64.sys [2012-12-21 513184]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\0404000.00C\ironx64.sys [2011-11-6 150064]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\N360x64\0404000.00C\symtdiv.sys [2011-11-6 451704]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2010/08/12 03:24:13];C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [2009-4-15 146928]

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe [2010-6-24 89600]

R2 AlienFusionService;Alienware Fusion Service;C:\Program Files\Alienware\Command Center\AlienFusionService.exe [2010-5-21 14648]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-6-24 202752]

R2 EaseUS Agent;EaseUS Agent;C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [2012-2-8 61064]

R2 FAService;FAService;C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe [2010-4-4 2409800]

R2 Guard Agent;Guard Agent;C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [2012-2-8 23176]

R2 HappyOSD;HappyOSD;C:\Program Files (x86)\OSD\OSD_Service.exe [2010-1-4 16384]

R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ccsvchst.exe [2011-11-6 126400]

R2 NSL;Norton Safe Web Lite;C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe [2011-4-30 130000]

R2 NSM;Norton Family;C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\ccSvcHst.exe [2012-11-12 143928]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\AlienRespawn\SftService.exe [2010-8-12 705856]

R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Acceler.sys [2010-6-24 25136]

R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2010-8-12 35104]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;C:\Windows\System32\drivers\e1k62x64.sys [2010-6-24 294064]

R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\OSD\WinRing0x64.sys [2008-7-26 14544]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-18 169312]

S3 FACAP;facap, FastAccess Video Capture;C:\Windows\System32\drivers\facap.sys [2008-9-24 238848]

S3 IAMTVE;Driver for Intel® Active Management Technology - KCS;C:\Windows\System32\drivers\IAMTVE.sys [2010-6-24 43416]

S3 IAMTXPE;Driver for Intel® Active Management Technology - KCS;C:\Windows\System32\drivers\IAMTXPE.sys [2010-6-24 51096]

S3 ioatdma1;ioatdma1;C:\Windows\System32\drivers\qd162x64.sys [2010-6-24 40144]

S3 ioatdma2;Intel® QuickData Technology device ver.2;C:\Windows\System32\drivers\qd262x64.sys [2010-6-24 42192]

S3 iSSetup;iSSetup;C:\Windows\System32\drivers\iSSetup.sys [2010-6-24 178400]

S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2010-6-24 6952960]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Family;C:\Windows\System32\drivers\NSMx64\0206000.02B\symrdrs.sys [2012-11-12 243872]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-5-27 59392]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-9-17 1255736]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]

.

=============== Created Last 30 ================

.

2012-12-23 18:04:16 -------- d-----w- C:\Program Files (x86)\ESET

2012-12-23 04:50:48 -------- d-----w- C:\Windows\System32\catroot2

2012-12-23 04:43:55 -------- d-----w- C:\Windows\SysWow64\wbem\Performance

2012-12-23 04:43:19 303616 ----a-w- C:\SetACL.exe

2012-12-23 04:18:55 290304 ----a-w- C:\subinacl.exe

2012-12-23 04:14:43 -------- d-----w- C:\RegBackup

2012-12-23 03:57:11 -------- d-----w- C:\Tweaking.com_Windows_Repair_Logs

2012-12-23 03:52:33 -------- d-----w- C:\Program Files (x86)\Tweaking.com

2012-12-22 04:15:23 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{512A7649-01EA-4794-BFA0-CF797B9BC8BF}\offreg.dll

2012-12-22 03:32:18 -------- d-----w- C:\ProgramData\HitmanPro

2012-12-22 00:55:49 -------- d-----w- C:\Users\Micky\AppData\Local\ElevatedDiagnostics

2012-11-26 19:49:33 -------- d-----w- C:\Windows\System32\drivers\NSMx64\0206000.033

.

==================== Find3M ====================

.

2012-11-12 12:26:58 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2012-10-16 01:53:00 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-16 01:53:00 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-09-30 00:54:26 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

.

============= FINISH: 20:31:45.71 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 8/31/2010 2:44:01 PM

System Uptime: 12/25/2012 8:27:11 PM (0 hours ago)

.

Motherboard: Alienware | |

Processor: Intel® Core i7 CPU Q 840 @ 1.87GHz | CPU 1 | 1863/133mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 224 GiB total, 114.979 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Description: facap, FastAccess Video Capture

Device ID: ROOT\IMAGE\0000

Manufacturer: Sensible Vision

Name: facap, FastAccess Video Capture

PNP Device ID: ROOT\IMAGE\0000

Service: FACAP

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Intel® WiFi Link 5300 AGN

Device ID: PCI\VEN_8086&DEV_4235&SUBSYS_11218086&REV_00\4&1F21EBDD&0&00E3

Manufacturer: Intel Corporation

Name: Intel® WiFi Link 5300 AGN

PNP Device ID: PCI\VEN_8086&DEV_4235&SUBSYS_11218086&REV_00\4&1F21EBDD&0&00E3

Service: NETw5s64

.

==== System Restore Points ===================

.

RP138: 10/5/2012 11:36:27 AM - Windows Update

RP139: 10/9/2012 8:57:31 PM - Windows Update

RP140: 10/10/2012 9:51:50 PM - Windows Update

RP141: 10/16/2012 7:34:06 AM - Windows Update

RP142: 10/21/2012 6:14:32 PM - Windows Update

RP143: 10/26/2012 8:57:10 PM - Windows Update

RP144: 10/31/2012 6:14:22 PM - Windows Update

RP145: 11/7/2012 2:33:57 PM - Windows Update

RP146: 11/14/2012 8:38:01 PM - Scheduled Checkpoint

RP147: 11/22/2012 - Scheduled Checkpoint

RP148: 12/21/2012 6:25:52 PM - Scheduled Checkpoint

RP149: 12/22/2012 11:14:28 PM - Tweaking.com - Windows Repair

.

==== Installed Programs ======================

.

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Photoshop Elements 8.0

Adobe Photoshop Lightroom 4.1 64-bit

Adobe Premiere Elements 8.0

Adobe Reader 9.5.2

Advertising Center

AlienRespawn

AlienRespawn - Support Software

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Assassin's Creed

Assassin's Creed II

ATI Catalyst Install Manager

Banctec Service Agreement

Bonjour

BurnAware Free 4.6

Canon IJ Network Scan Utility

Canon IJ Network Tool

Canon MX700 series

Canon Utilities Solution Menu

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

Cisco Connect

Command Center

CyberLink PowerDVD 8

CyberLink YouCam

EaseUS Todo Backup Free 4.0

ESET Online Scanner v3

FastStone Image Viewer 4.6

FastStone Photo Resizer 3.1

FINAL FANTASY XI

FINAL FANTASY XI: Chains of Promathia

FINAL FANTASY XI: Rise of the Zilart

FINAL FANTASY XI: Treasures of Aht Urhgan

FINAL FANTASY XI: Wings of the Goddess

Google Chrome

Google Earth

Google Update Helper

ImagXpress

Intel® Network Connections 14.8.43.0

Intel® Matrix Storage Manager

iTunes

Java Auto Updater

Java 6 Update 20 (64-bit)

Java 6 Update 22

Java 6 Update 31

Logitech Gaming Software 5.02

Malwarebytes Anti-Malware version 1.65.1.1000

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft IntelliPoint 8.0

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox 17.0.1 (x86 en-US)

Mozilla Maintenance Service

MSRedist

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 9 Essentials

Nero BurnRights

Nero BurnRights Help

Nero ControlCenter

Nero CoverDesigner

Nero CoverDesigner Help

Nero Disc Copy Gadget

Nero Disc Copy Gadget Help

Nero DiscSpeed

Nero DiscSpeed Help

Nero DriveSpeed

Nero DriveSpeed Help

Nero Express Help

Nero InfoTool

Nero InfoTool Help

Nero Installer

Nero Online Upgrade

Nero Rescue Agent

Nero RescueAgent Help

Nero StartSmart

Nero StartSmart Help

NeroExpress

neroxml

Norton Family

Norton Safe Web Lite

Norton Security Suite

Notepad++

OpenOffice.org 3.3

OSD Setup

PlayOnline Viewer & Tetra Master

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.57.01

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

SmartDraw PDF Export (novaPDF 6.4 printer)

SmartSound Quicktracks for Premiere Elements 8.0

Steam

Synaptics Pointing Device Driver

Tweaking.com - Windows Repair (All in One)

Ubisoft Game Launcher

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

WIDCOMM Bluetooth Software

Windows Automated Installation Kit

.

==== Event Viewer Messages From Past Week ========

.

12/25/2012 8:13:55 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

12/25/2012 8:12:13 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

12/25/2012 8:12:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

12/25/2012 8:12:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

12/25/2012 8:12:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

12/25/2012 8:12:05 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

12/25/2012 8:11:55 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx64 ccHP ccSet_NSM discache eeCtrl EUDSKACS EUFDDISK IDSVia64 spldr SRTSPX SymIRON SYMTDIv Wanarpv6

12/25/2012 8:11:00 PM, Error: Service Control Manager [7038] - The WdiServiceHost service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

12/25/2012 8:11:00 PM, Error: Service Control Manager [7038] - The UI0Detect service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

12/25/2012 8:11:00 PM, Error: Service Control Manager [7038] - The netprofm service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

12/25/2012 8:11:00 PM, Error: Service Control Manager [7001] - The Virtual Disk service depends on the Plug and Play service which failed to start because of the following error: The service has not been started.

12/25/2012 8:11:00 PM, Error: Service Control Manager [7000] - The Portable Device Enumerator Service service failed to start due to the following error: A system shutdown is in progress.

12/25/2012 8:11:00 PM, Error: Service Control Manager [7000] - The Network List Service service failed to start due to the following error: The service did not start due to a logon failure.

12/25/2012 8:11:00 PM, Error: Service Control Manager [7000] - The Interactive Services Detection service failed to start due to the following error: The service did not start due to a logon failure.

12/25/2012 8:11:00 PM, Error: Service Control Manager [7000] - The Human Interface Device Access service failed to start due to the following error: A system shutdown is in progress.

12/25/2012 8:11:00 PM, Error: Service Control Manager [7000] - The Diagnostic Service Host service failed to start due to the following error: The service did not start due to a logon failure.

12/25/2012 8:09:41 PM, Error: Service Control Manager [7038] - The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

12/25/2012 8:09:41 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not start due to a logon failure.

12/23/2012 12:09:54 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.

12/23/2012 12:09:51 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NSM service.

12/22/2012 11:53:26 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

12/22/2012 11:03:21 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004

.

==== End Of File ===========================

Maurice Naggar · December 26, 2012

Hello Mika and welcome to MalwareBytes forums.

Please -stop- running any more tools on your own. You have already run too many, and on your own without guidance.

Do a system backup to offline media before going further.

Tell me if this is a laptop/notebook or a standard-tower or standard desktop-style system.

Are you using a wireless connection?

or is this system directly connected to your hardware-router ?

We Need to Run a Batch Script

Press the Windows-key on keyboard.
In the box, type notepad and press Enter.

Highlight the contents of the following codebox, and copy and paste that text into NOTEPAD.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset resetlog.log
shutdown -r -t 1
del /f /q "%~f0"

Select File -> Save AS.
Press the Desktop button on the left side of the save dialog.
In the box, type in Fix.bat.
Press .
Close Notepad.
Right click on your desktop, and choose .
Press Yes if prompted by User Account Control.

Mika · December 26, 2012

Hello and thank you for helping me.

As soon as I decided I wasn't making any progress, I stopped running anything except DDS to produce the logs - as directed by the forum. Your direction is well taken.

I ran a system backup and then created the batch file (safe mode w/networking) and executed the batch file (normal mode). It rebooted. There was no discernible change in behavior.

The system is an alienware laptop. I am using the wireless (which is typical), but can connect via hardwire to my router if needed/useful.

Next step?

thanks,

-Mika

Maurice Naggar · December 27, 2012

DO hardwire-connect with a cable to your router. Logoff and Restart the system fresh.

Do as much as possible of the following.

Save and close any work documents, close any apps that you started.

Temporarily turn off (disable) your antivirus program

How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Start your MBAM MalwareBytes' Anti-Malware.

Click the Settings Tab and then the General Settings sub-tab. Make sure all option lines have a checkmark.

Then click the Scanner settings sub-tab in second row of tabs. Make sure all option lines have a checkmark.

Next, Click the Update tab. Press the "Check for Updates" button.

If prompted for a Restart, do that.

When done, click the Scanner tab.

Do a Quick Scan.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

When all done, Copy & paste the MBAM scan log into a new reply.

Tell me, How is the system ?

Re-enable your antivirus program.

Mika · December 28, 2012

Hello,

I followed all of the instructions with the following two exceptions:

1) I was unable to update Malwarebytes (by pressing the "Check for Updates" button) - it never connected.

2) Since the quick scan did not find any malicious objects (log follows), there was no removal process.

The system behavior is unchanged (browsers and legit uses can not access the internet).

Next step?

thanks,

-Mika

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Database version: v2012.12.21.18

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Micky :: RAIDER [administrator]

12/27/2012 7:36:39 PM

mbam-log-2012-12-27 (19-36-39).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 269824

Time elapsed: 34 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Maurice Naggar · December 28, 2012

Please download Windows Repair (all in one) from here.

Install the program.
Please proceed to run it. On Vista, Windows 7 or 8, Right-click the executable and select Run as Administrator.
Go to Step 2 and allow it to run CheckDisk by clicking on the Do It button:
Once that is done please go to Step 3 and allow it to run the System File Check by clicking on the Do It button:
Go to Step 4 and under System Restore click on the Create button:
Next, go to the Start Repairs tab and click the Start button.
Please ensure that ONLY items seen in the image below are ticked as indicated (they're all checked by default):
Click on the box next to the Restart System when Finished. Then click on Start.

Mika · December 29, 2012

Hello,

I followed the instructions with no problems. The repair did log failures, e.g., access violations during registry and file permissions setting operations. After restarting, the system behavior is unchanged, i.e., cannot access the internet, etc.

I have included below the overall log which shows, among other things, which services could not be restarted. Please let me know if you would like me to post any of the operation logs that show which files/registry entries produced access violations.

Next step?

thanks,

-Mika

(Windows Repair Log)

Starting Repairs...

Start (12/28/2012 9:24:17 PM)

Reset Registry Permissions 01/03

HKEY_CURRENT_USER & Sub Keys

Start (12/28/2012 9:24:17 PM)

Done (12/28/2012 9:24:22 PM)

Reset Registry Permissions 02/03

HKEY_LOCAL_MACHINE & Sub Keys

Start (12/28/2012 9:24:22 PM)

Done (12/28/2012 9:25:31 PM)

Reset Registry Permissions 03/03

HKEY_CLASSES_ROOT & Sub Keys

Start (12/28/2012 9:25:31 PM)

Done (12/28/2012 9:25:59 PM)

Reset File Permissions 01/12

C:\BOOT & Sub Folders

Start (12/28/2012 9:25:59 PM)

Done (12/28/2012 9:26:01 PM)

Reset File Permissions 02/12

C:\hiberfil.sys & Sub Folders

Start (12/28/2012 9:26:01 PM)

Done (12/28/2012 9:26:04 PM)

Reset File Permissions 03/12

C:\Intel & Sub Folders

Start (12/28/2012 9:26:04 PM)

Done (12/28/2012 9:26:06 PM)

Reset File Permissions 04/12

C:\My Backups & Sub Folders

Start (12/28/2012 9:26:06 PM)

Done (12/28/2012 9:26:09 PM)

Reset File Permissions 05/12

C:\Program Files & Sub Folders

Start (12/28/2012 9:26:09 PM)

Done (12/28/2012 9:27:10 PM)

Reset File Permissions 06/12

C:\Program Files (x86) & Sub Folders

Start (12/28/2012 9:27:10 PM)

Done (12/28/2012 9:35:50 PM)

Reset File Permissions 07/12

C:\ProgramData & Sub Folders

Start (12/28/2012 9:35:50 PM)

Done (12/28/2012 9:36:53 PM)

Reset File Permissions 08/12

C:\RegBackup & Sub Folders

Start (12/28/2012 9:36:53 PM)

Done (12/28/2012 9:36:56 PM)

Reset File Permissions 09/12

C:\System Recovery & Sub Folders

Start (12/28/2012 9:36:56 PM)

Done (12/28/2012 9:36:58 PM)

Reset File Permissions 10/12

C:\Temp & Sub Folders

Start (12/28/2012 9:36:58 PM)

Done (12/28/2012 9:37:01 PM)

Reset File Permissions 11/12

C:\Tweaking.com_Windows_Repair_Logs & Sub Folders

Start (12/28/2012 9:37:01 PM)

Done (12/28/2012 9:37:03 PM)

Reset File Permissions 12/12

C:\Windows & Sub Folders

Start (12/28/2012 9:37:03 PM)

Done (12/28/2012 9:47:18 PM)

Register System Files

Start (12/28/2012 9:47:18 PM)

Done (12/28/2012 9:47:28 PM)

Repair WMI

Start (12/28/2012 9:47:29 PM)

Step 01/03 - Deleting WMI Repository...

Step 02/03 - Rebuilding WMI Repository...

Step 03/03 - Registering WMI...

Invalid Global Switch.

Done (12/28/2012 9:48:31 PM)

Repair Windows Firewall

Start (12/28/2012 9:48:31 PM)

The Internet Connection Sharing (ICS) service is not started.

More help is available by typing NET HELPMSG 3521.

The Internet Connection Sharing (ICS) service could not be started.

The service did not report an error.

More help is available by typing NET HELPMSG 3534.

The Internet Connection Sharing (ICS) service is not started.

More help is available by typing NET HELPMSG 3521.

The Internet Connection Sharing (ICS) service could not be started.

The service did not report an error.

More help is available by typing NET HELPMSG 3534.

Done (12/28/2012 9:49:07 PM)

Repair Internet Explorer

Start (12/28/2012 9:49:07 PM)

Done (12/28/2012 9:49:12 PM)

Remove Policies Set By Infections

Start (12/28/2012 9:49:12 PM)

Done (12/28/2012 9:49:16 PM)

Repair Winsock && DNS Cache

Start (12/28/2012 9:49:16 PM)

Done (12/28/2012 9:49:25 PM)

Repair Proxy Settings

Start (12/28/2012 9:49:25 PM)

Done (12/28/2012 9:49:30 PM)

Repair Windows Updates

Start (12/28/2012 9:49:30 PM)

The Windows Update service is not started.

More help is available by typing NET HELPMSG 3521.

'proxycfg.exe' is not recognized as an internal or external command,

operable program or batch file.

Done (12/28/2012 9:49:47 PM)

Set Windows Services To Default Startup

Start (12/28/2012 9:49:47 PM)

Done (12/28/2012 9:49:49 PM)

Repair MSI (Windows Installer)

Start (12/28/2012 9:49:49 PM)

The Windows Installer service is not started.

More help is available by typing NET HELPMSG 3521.

Done (12/28/2012 9:49:53 PM)

Cleaning up empty logs...

All Selected Repairs Done.

Done (12/28/2012 9:49:53 PM)

Total Repair Time: 00:26:24

...YOU MUST RESTART YOUR SYSTEM...

Maurice Naggar · December 30, 2012

Windows services

This will be a batch-fix .

Press the Windows-key on keyboard.
In the box, type notepad and press Enter.

Highlight the contents of the following codebox, and copy and paste that text into NOTEPAD.

@Echo off
sc stop wuauserv
sc stop bits
sc config dcomlaunch start= auto
sc config nsi start= auto
sc config dhcp start= auto
sc config rpcss start= auto
sc config winmgmt start= auto
sc config wscsvc start= delayed-auto
sc config bits start= delayed-auto
sc config wuauserv start= delayed-auto
sc config sdrsvc start= manual
sc config vss start= auto
sc config eventlog start= auto
sc config bfe start= auto
sc config eventsystem start= auto
sc start sdrsvc
sc start vss
sc start rpcss
sc start eventsystem
sc start bfe
sc start bits
sc start wuauserv
shutdown -r -t 1
del %0

Select File -> Save AS.
Press the Desktop button on the left side of the save dialog.
In the box, type in Fix.bat.
Press .
Close Notepad.
Right click Fix.bat on your desktop, and choose .
Press Yes if prompted by User Account Control.

This procedure will do its tasks and then it will Restart Windows.

Step 2

Check for missing or disabled Windows services, by doing the following, and post detailed results when done !!

From Start button, (or Win-key +R) and in the searcht-box type in MSCONFIG and press OK or Enter.

On Vista or Windows 7, press Windows-key on keybooard, and type in MSCONFIG

You should see the General tab. Click the General tab. It should have Normal startup selected (in the radio-box=selection)

IF it does not, then you click on Normal startup.

Click on Services tab. To get it's display of services.

Keep a written list of any changes from my list of services below. That way you and I have a reference document.

Look at the bottom line Hide all Microsoft services

IF and only IF its is checkmarked, then un-check it.

the list of servies may be shown in non-alphabetical order, so ....

Look at the heading titled "Service". Click on it as needed so the list is sorted and top of list starts with the "A" services.

You can toggle as needed to get the desired order.

IF any of below services are NOT shown, don't panic & do not stop, just write down the info for me and proceed with the others !

Then using the scroll-bar scroll down the list

Look for Background Intelligent Transfer Service. Is it shown? Is it checked? If not, click on that checkbox to checkmark.

Look for Base Filtering Engine. Is it shown? Is it checked? If not, click on that checkbox to checkmark.

Look for COM+ Event System. Is it shown? Is it checked? If not, click on that checkbox to checkmark.

Look for COM+ System Application. Is it shown? Is it checked? If not, click on that checkbox to checkmark.

Look for Cryptographic Services. Is it shown? Is it checked? If not, click on that checkbox to checkmark.

Look for Ipsec Policy Agent. Is it shown? Is it checked? If not, click on that checkbox to checkmark.

Look for Remote Procedure Call (RPC) Locator. Is it shown ? Is it checked? If not, click on that checkbox to checkmark.

Look for RPC Endpoint Mapper. Is it shown ? Is it checked? If not, click on that checkbox to checkmark.

Look for Windows Firewall. Is it shown ? Is it checked? If not, click on that checkbox to checkmark.

Look for Windows Installer. Is it shown ? Is it checked? If not, click on that checkbox to checkmark.

Look for Windows Management Instrumentation. Is it shown ? Is it checked? If not, click on that checkbox to checkmark.

Look for Windows Update. Is it shown ? Is it checked? If not, click on that checkbox to checkmark.

When done, press the Apply button, and the OK button.

You're likely to be prompted to Restart Windows, do so.

If not prompted, you do a Logoff and Restart of Windows.

Then report back here with details.

If any of the services are not shown, just let me know which.

Mika · January 1, 2013

Hi!

Step 1 executed without incident.

Step 2 details:

In the General tab: Normal mode was selected.

In the Services tab: the Hide all Microsoft Services box was not checked.

For the services you were interested in, all were listed and checked, although some were running and some not, noted below. In fact, all services in the list were checked, although not all were running.

Background Intelligent Transfer Service: Running

Base Filtering Engine: Running

COM+ Event System: Running

COM+ System Application: Stopped

Cryptographic Services: Running

Ipsec Policy Agent: Running

Remote Procedure Call (RPC) Locator: Stopped

RPC Endpoint Mapper: Running

Windows Firewall: Running

Windows Installer: Stopped

Windows Management Instrumentation: Running

Windows Update: Stopped.

Since I made no changes, the Apply button was not active, so I rebooted the system; after which, there was no apparent change in system behavior.

Please let me know if there is additional information I can provide or the next step.

Thanks and have a safe and happy New Year!

-Mika

Maurice Naggar · January 1, 2013

Happy New Year to you, Mika.

Download >> Farbar's Service Scanner utility << and Save to your Desktop.

If using Windows 7 or Vista, Right-Click on fss.exe and select Run As Admisnitrator.

If using XP, double-click to start.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are checkmarked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.

Copy & Paste contents of FSS.txt into your reply.

Mika · January 1, 2013

Hi!

Here's the log:

Farbar Service Scanner Version: 23-12-2012

Ran by sumika (administrator) on 31-12-2012 at 20:22:39

Running from "C:\Users\Micky\Documents\fixit"

Windows 7 Professional Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

Windows Defender:

==============

Other Services:

==============

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys => MD5 is legit

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Maurice Naggar · January 1, 2013

The result of FSS run is good. It -does- indicate the system can access the internet.

Please re-advise:

Is your system a laptop/notebook type, or is it a tower/desktop type?

Is your computer connected directly via cable to your hardware-internet-router?

Step 2

Download Random's System Information Tool (RSIT) by random/random from here and save it to your desktop.

RIGHT-click on RSITx64.exe & select Run as Administrator to start RSITx64.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

[color-blue]Step 3

Temporarily disable your antivirus so that it does not interfere.

How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Save and close any work documents, close any apps that you started.

Start your MBAM MalwareBytes' Anti-Malware.

Click the Settings Tab and then the General Settings sub-tab. Make sure all option lines have a checkmark.

Then click the Scanner settings sub-tab in second row of tabs. Make sure all option lines have a checkmark.

Next, Click the Update tab. Press the "Check for Updates" button.

If prompted for a Restart, do that.

When done, click the Scanner tab.

Do a Quick Scan. :excl:

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

When all done, Copy and Paste the MBAM scan log.

Re-enable your antivirus.

And tell me, How is the system now

Mika · January 1, 2013

Hi!

Step 1: (system config)

-laptop, directly connected to the (hardware) router

Step 2: RSIT

a. Since the browser cannot connect to the internet in normal mode, I downloaded RSIT while in safe mode w/networking

b. Restarted in normal mode and ran as administrator (logs below)

Step 3: Malwarebytes scan

a. Updated malwarebytes while previously in safe mode (step 2)

b. disabled anti-virus

c. checked settings as directed

d. Quick scan found no malicious objects - therefore, there was nothing to remove (log follows RSIT logs)

After checking the RSIT log, I saw that it could not download hijackthis. So I went into safe mode w/networking and downloaded it, restarted in normal mode and ran RSIT as administrator for a second time. RSIT failed to find the local copy of hijackthis and failed to download it again. I took no additional action.

System behavior is unchanged - cannot access the internet in normal mode.

Logfile of random's system information tool 1.09 (written by random/random)

Run by sumika at 2013-01-01 13:42:15

Microsoft Windows 7 Professional Service Pack 1

System drive C: has 119 GB (52%) free of 229 GB

Total RAM: 8181 MB (81% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

winlogon.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

"C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe"

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

atieclxx

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe

"taskhost.exe"

taskeng.exe {0F2846D3-8E8B-4B20-98AF-CDDFDAA685FB}

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

"C:\Program Files\IDT\WDM\sttray64.exe"

"C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe"

"C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe"

"C:\Program Files\Logitech\Gaming Software\LWEMon.exe" /noui

"C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"

"C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe" -quickstart

"C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe" "-quickstart" "-env:OOO_CWD=2C:\\Program Files (x86)\\OpenOffice.org 3\\program"

"C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe"

"C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe"

"C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"

"C:\Program Files (x86)\CyberLink\Shared Files\brs.exe"

"c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"

"C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe"

"C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe"

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe"

"C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE"

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"C:\Program Files (x86)\iTunes\iTunesHelper.exe"

FATrayAlert.exe

"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0

"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"

"C:\Program Files\Bonjour\mDNSResponder.exe"

"c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe"

"C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe"

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe"

"C:\Program Files (x86)\OSD\OSD_Service.exe"

"C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ccSvcHst.exe" /s "N360" /m "C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\diMaster.dll" /prefetch:1

"C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"

"C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe" /s "NSL" /m "C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\diMaster.dll" /prefetch:1

"C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\ccSvcHst.exe" /s "NSM" /m "C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\diMaster.dll" /prefetch:1

"C:\Program Files (x86)\OSD\OSD_Main.exe"

"C:\Program Files (x86)\AlienRespawn\sftservice.EXE"

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\SearchIndexer.exe /Embedding

"C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe"

C:\Windows\system32\wbem\wmiprvse.exe

"C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\ccSvcHst.exe" /c /a /s UserSession

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

"C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540

"C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ccSvcHst.exe" /c /a /s UserSession

"c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe" -Embedding

"c:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe"

"C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe" 66256

"C:\Program Files\Alienware\Command Center\AlienFXHook64Mngr.exe" 66256

\??\C:\Windows\system32\conhost.exe "-866004896-60237403517371222281588530427806759569-19466362281395113329-2112198890

\??\C:\Windows\system32\conhost.exe "1638286528-91040146861556987417941310311127560160-1274049511-1705848105-556862430

C:\Windows\System32\vds.exe

"C:\Program Files\iPod\bin\iPodService.exe"

C:\Windows\system32\UI0Detect.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\ehome\ehmsas.exe -Embedding

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\wbem\wmiprvse.exe

"C:\Users\Micky\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-12 43520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-30 75232]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

Symantec NCO BHO - C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\coIEPlg.dll [2011-07-13 419768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]

Symantec Intrusion Prevention - C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\IPSBHO.DLL [2009-11-16 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-03-30 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8E07826-0971-4f16-B133-047B88034E89}]

Norton Family BHO - C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\coIEPlg.dll [2012-10-18 498584]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DA5BCE70-D057-4D63-943D-5F3927EC59F1}]

SSOIEAddonBHO Class - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll [2010-04-04 539976]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-03-30 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]

{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\coIEPlg.dll [2011-07-13 419768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-10-23 1881384]

"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2009-09-15 487424]

"IAAnotif"=C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [2009-10-13 186904]

"AlienFX Controller"=C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe [2010-05-21 63304]

""= []

"Start WingMan Profiler"=C:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 120328]

"IntelliPoint"=c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2010-07-21 2327952]

"CanonSolutionMenu"=C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [2009-09-04 767312]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"OSD_LAUNCH"=c:\Program Files (x86)\OSD\Launch.exe [2010-01-04 32768]

"FATrayAlert"=C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe [2010-04-04 95560]

"FAStartup"= []

"StartCCC"=c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-12-17 98304]

"RemoteControl8"=c:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [2009-04-15 91432]

"PDVD8LanguageShortcut"=c:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [2009-04-15 50472]

"BDRegion"=c:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [2009-04-28 75048]

"UCam_Menu"=c:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2009-02-17 218408]

"EaseUs Watch"=C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe [2011-12-22 70792]

"EaseUs Tray"=C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe [2011-12-26 743560]

"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-07-31 38872]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-11 919008]

"IJNetworkScanUtility"=C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [2007-05-21 124512]

"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-08-27 59280]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]

"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2012-09-09 421776]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"=C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe [2011-01-13 165184]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

"notification packages"=scecli

FAPassSync

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"LogonHoursAction"=2

"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"PromptOnSecureDesktop"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=1

"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"MSVideo8"=VfWWDM32.dll

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"wave3"=wdmaud.drv

"midi3"=wdmaud.drv

"mixer3"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 2 months======

2013-01-01 13:15:12 ----D---- C:\rsit

2013-01-01 13:15:12 ----D---- C:\Program Files\trend micro

2013-01-01 13:09:36 ----D---- C:\Users\sumika\AppData\Roaming\Malwarebytes

2012-12-28 22:05:43 ----D---- C:\Users\sumika\AppData\Roaming\Mozilla

2012-12-28 22:05:17 ----D---- C:\Users\sumika\AppData\Roaming\Apple Computer

2012-12-28 22:05:16 ----D---- C:\Users\sumika\AppData\Roaming\ATI

2012-12-28 22:05:03 ----D---- C:\Users\sumika\AppData\Roaming\Identities

2012-12-28 22:04:23 ----SD---- C:\Users\sumika\AppData\Roaming\Microsoft

2012-12-28 22:04:23 ----D---- C:\Users\sumika\AppData\Roaming\Media Center Programs

2012-12-28 21:51:30 ----D---- C:\Windows\system32\catroot2

2012-12-28 21:49:43 ----D---- C:\Windows\SoftwareDistribution

2012-12-28 20:19:04 ----N---- C:\bootsqm.dat

2012-12-23 13:04:16 ----D---- C:\Program Files (x86)\ESET

2012-12-23 12:59:54 ----D---- C:\Program Files (x86)\Mozilla Firefox

2012-12-23 12:55:55 ----A---- C:\TDSSKiller.2.8.15.0_23.12.2012_12.55.55_log.txt

2012-12-22 23:43:58 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI

2012-12-22 23:43:19 ----A---- C:\SetACL.exe

2012-12-22 23:18:55 ----A---- C:\subinacl.exe

2012-12-22 23:15:02 ----A---- C:\Windows\tweaking.com-regbackup-RAIDER-Microsoft-Windows-7-Professional-(64-bit).dat

2012-12-22 23:14:43 ----D---- C:\RegBackup

2012-12-22 22:58:27 ----A---- C:\Windows\PSEXESVC.EXE

2012-12-22 22:57:11 ----D---- C:\Tweaking.com_Windows_Repair_Logs

2012-12-22 22:52:33 ----D---- C:\Program Files (x86)\Tweaking.com

2012-12-21 22:32:18 ----D---- C:\ProgramData\HitmanPro

2012-12-21 21:50:25 ----A---- C:\TDSSKiller.2.8.15.0_21.12.2012_21.50.25_log.txt

2012-12-21 21:47:01 ----A---- C:\Windows\ntbtlog.txt

2012-11-12 07:26:58 ----D---- C:\Program Files\Symantec

2012-11-12 07:26:48 ----D---- C:\Windows\system32\drivers\NSMx64

2012-11-12 07:26:48 ----D---- C:\Program Files (x86)\Norton Family

======List of files/folders modified in the last 2 months======

2013-01-01 13:42:56 ----D---- C:\Windows\Temp

2013-01-01 13:42:11 ----D---- C:\Windows\System32

2013-01-01 13:42:11 ----D---- C:\Windows\inf

2013-01-01 13:42:11 ----A---- C:\Windows\system32\PerfStringBackup.INI

2013-01-01 13:40:32 ----D---- C:\Windows\system32\Tasks

2013-01-01 13:34:59 ----SHD---- C:\System Volume Information

2013-01-01 13:34:15 ----D---- C:\Windows\system32\config

2013-01-01 13:27:58 ----D---- C:\Program Files (x86)\AlienRespawn

2013-01-01 13:15:12 ----RD---- C:\Program Files

2013-01-01 13:10:25 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-01-01 13:10:24 ----D---- C:\Windows\system32\drivers

2012-12-28 22:10:19 ----D---- C:\Windows\Prefetch

2012-12-28 22:04:59 ----SHD---- C:\$Recycle.Bin

2012-12-28 22:04:22 ----RD---- C:\Users

2012-12-28 22:00:21 ----D---- C:\Windows\system32\NDF

2012-12-28 21:49:43 ----D---- C:\Windows

2012-12-28 21:48:18 ----D---- C:\Windows\SysWOW64

2012-12-26 14:15:47 ----A---- C:\Windows\system32\LogVss.txt

2012-12-26 14:15:47 ----A---- C:\Windows\system32\LogMsg.txt

2012-12-26 12:52:39 ----D---- C:\Windows\Logs

2012-12-25 20:27:18 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service

2012-12-25 20:21:11 ----D---- C:\Program Files (x86)

2012-12-23 13:04:17 ----D---- C:\Windows\Downloaded Program Files

2012-12-22 23:43:55 ----D---- C:\Windows\SYSWOW64\wbem

2012-12-21 22:32:18 ----D---- C:\ProgramData

2012-11-12 07:27:15 ----D---- C:\ProgramData\Norton

2012-11-12 07:26:42 ----D---- C:\Program Files (x86)\NortonInstaller

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 EUBAKUP;EUBAKUP; C:\Windows\system32\drivers\eubakup.sys [2011-12-22 57480]

R0 EUBKMON;EUBKMON; C:\Windows\system32\drivers\EUBKMON.sys [2011-12-22 51336]

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-10-13 409624]

R0 ioatdma;Intel® QuickData Technology device; C:\Windows\System32\Drivers\ioatdma.sys [2009-07-13 46792]

R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2008-06-16 55024]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]

R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\N360x64\0404000.00C\SYMDS64.SYS [2009-10-14 433200]

R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\N360x64\0404000.00C\SYMEFA64.SYS [2011-08-21 221304]

R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]

R1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20121130.005\BHDrvx64.sys [2012-10-23 1384608]

R1 ccHP;Symantec Hash Provider; C:\Windows\system32\drivers\N360x64\0404000.00C\ccHPx64.sys [2011-08-03 593544]

R1 ccSet_NSM;Norton Family Settings Manager; C:\Windows\system32\drivers\NSMx64\0206000.02B\ccSetx64.sys [2012-08-06 168096]

R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2012-08-28 484512]

R1 EUDSKACS;EUDSKACS; \??\C:\Windows\system32\drivers\eudskacs.sys [2011-12-22 19592]

R1 EUFDDISK;EUFDDISK; \??\C:\Windows\system32\drivers\EuFdDisk.sys [2011-12-22 189576]

R1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20121230.001\IDSvia64.sys [2012-12-20 513184]

R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\N360x64\0404000.00C\SRTSPX64.SYS [2010-04-21 32304]

R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\N360x64\0404000.00C\Ironx64.SYS [2010-04-29 150064]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\Windows\System32\Drivers\N360x64\0404000.00C\SYMTDIV.SYS [2011-08-21 451704]

R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-13 59904]

R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys [2008-10-03 68608]

R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys [2008-03-03 55296]

R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys [2007-07-27 57856]

R3 Acceler;Accelerometer Service; C:\Windows\system32\DRIVERS\Acceler.sys [2009-12-02 25136]

R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-06 123408]

R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-01-06 6178816]

R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-13 41984]

R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-13 118784]

R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-27 80384]

R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2009-06-30 98344]

R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\DRIVERS\btwavdt.sys [2009-06-30 132648]

R3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]

R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2009-06-30 21160]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2009-12-09 294064]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-12-21 138912]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]

R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2009-03-09 60416]

R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-13 158720]

R3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 109056]

R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt64.sys [2009-09-15 499712]

R3 StillCam;Still Serial Digital Camera Driver; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-13 12288]

R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2012-11-12 177312]

R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-10-23 307760]

R3 WinRing0_1_2_0;WinRing0_1_2_0; \??\C:\Program Files (x86)\OSD\WinRing0x64.sys [2008-07-26 14544]

R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\WmBEnum.sys [2008-01-24 22024]

S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]

S3 dc3d;MS Hardware Device Detection Driver; C:\Windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]

S3 FACAP;facap, FastAccess Video Capture; C:\Windows\system32\DRIVERS\facap.sys [2008-09-24 238848]

S3 IAMTVE;Driver for Intel® Active Management Technology - KCS; C:\Windows\system32\DRIVERS\IAMTVE.sys [2007-04-11 43416]

S3 IAMTXPE;Driver for Intel® Active Management Technology - KCS; C:\Windows\system32\DRIVERS\IAMTXPE.sys [2007-04-11 51096]

S3 ioatdma1;ioatdma1; C:\Windows\System32\Drivers\qd162x64.sys [2009-07-13 40144]

S3 ioatdma2;Intel® QuickData Technology device ver.2; C:\Windows\System32\Drivers\qd262x64.sys [2009-07-13 42192]

S3 iSSetup;iSSetup; C:\Windows\system32\DRIVERS\iSSetup.sys [2009-10-13 178400]

S3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20121231.032\ENG64.SYS [2012-12-21 126112]

S3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20121231.032\EX64.SYS [2012-12-21 2084000]

S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\Windows\system32\DRIVERS\NETw5s64.sys [2009-09-14 6952960]

S3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2010-07-21 23952]

S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-13 12352]

S3 Point64;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point64.sys [2010-07-21 45456]

S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]

S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]

S3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\System32\Drivers\N360x64\0404000.00C\SRTSP64.SYS [2010-04-21 505392]

S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]

S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Family; C:\Windows\system32\drivers\NSMx64\0206000.02B\SymRdrS.SYS [2012-07-21 243872]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]

S3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]

S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2006-11-01 151656]

S3 WmFilter;Logitech Gaming HID Filter Driver; C:\Windows\system32\drivers\WmFilter.sys [2008-01-24 32776]

S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\Windows\system32\drivers\WmVirHid.sys [2008-01-24 15752]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe [2009-03-02 89600]

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-01-06 202752]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-08-11 55184]

R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]

R2 btwdins;Bluetooth Service; c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-08-17 868128]

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-13 27136]

R2 EaseUS Agent;EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [2011-12-22 61064]

R2 FAService;FAService; C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe [2010-04-04 2409800]

R2 Guard Agent;Guard Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [2011-12-22 23176]

R2 HappyOSD;HappyOSD; C:\Program Files (x86)\OSD\OSD_Service.exe [2010-01-04 16384]

R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2009-10-13 354840]

R2 N360;Norton Security Suite; C:\Program Files (x86)\Norton Security Suite\Engine\4.4.0.12\ccSvcHst.exe [2011-08-03 126400]

R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-10-13 935208]

R2 NSL;Norton Safe Web Lite; C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe [2010-11-23 130000]

R2 SftService;SoftThinks Agent Service; C:\Program Files (x86)\AlienRespawn\sftservice.EXE [2011-01-13 705856]

R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\STacSV64.exe [2009-09-15 240640]

R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2012-09-09 936848]

S2 AlienFusionService;Alienware Fusion Service; C:\Program Files\Alienware\Command Center\AlienFusionService.exe [2010-05-21 14648]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-27 136176]

S2 NSM;Norton Family; C:\Program Files (x86)\Norton Family\Engine\2.6.0.43\ccSvcHst.exe [2012-08-18 143928]

S3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8; c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-18 169312]

S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-13 27136]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-08-12 867080]

S3 gupdatem;Google Update Service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-27 136176]

S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-12-23 115168]

S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-13 27136]

S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-07-16 316664]

S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-13 27136]

S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-13 27136]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-03 1255736]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.09 2013-01-01 13:16:43

======Uninstall list======

-->MsiExec.exe /I{71B7840D-BB4D-409C-87A2-9EFD10BC0C3D}

Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Player 11 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_Plugin.exe -maintain plugin

Adobe Photoshop Elements 8.0-->msiexec /i {17DFE37C-064E-4834-AD8F-A4B2B4DF68F8}

Adobe Photoshop Lightroom 4.1 64-bit-->MsiExec.exe /I{F7ADB493-B913-4D61-9A63-DA736C20C3F2}

Adobe Premiere Elements 8.0-->msiexec /I {A0E583D1-23F7-4C35-9620-B169D7715E4B} REMOVEPREFS=1

Adobe Premiere Elements 8.0-->MsiExec.exe /I{A0E583D1-23F7-4C35-9620-B169D7715E4B}

Adobe Reader 9.5.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A95000000001}

Advertising Center-->MsiExec.exe /X{B2EC4A38-B545-4A00-8214-13FE0E915E6D}

AlienRespawn - Support Software-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}\setup.exe" -l0x9 -removeonly /z"dsu"

AlienRespawn-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}\setup.exe" -l0x9 -removeonly

Apple Application Support-->MsiExec.exe /I{63EC2120-1742-4625-AA47-C6A8AEC9C64C}

Apple Mobile Device Support-->MsiExec.exe /I{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}

Apple Software Update-->MsiExec.exe /I{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}

Assassin's Creed II-->"C:\Program Files (x86)\InstallShield Installation Information\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}\setup.exe" -runfromtemp -l0x0009 -removeonly

Assassin's Creed-->C:\Program Files (x86)\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x0009 -removeonly

Banctec Service Agreement-->MsiExec.exe /I{BD4B02C1-0271-4D7D-A850-19DE2E5CDF83}

Bonjour-->MsiExec.exe /X{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}

BurnAware Free 4.6-->"C:\Program Files (x86)\BurnAware Free\unins000.exe"

Canon IJ Network Scan Utility-->C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSU.EXE

Canon IJ Network Tool-->C:\Program Files (x86)\Canon\Canon IJ Network Tool\CNMNUU.exe

Canon MX700 series-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series /L0x0009

Canon Utilities Solution Menu-->C:\Program Files (x86)\Canon\SolutionMenu\uninst.exe uninst.ini uinstrsc.dll

Catalyst Control Center - Branding-->MsiExec.exe /I{69533745-1E2D-4C98-8B4A-B7643EF9E1A2}

Cisco Connect-->"C:\Program Files (x86)\Cisco Systems\Cisco Connect\Cisco Connect.exe" -uninstall

Command Center-->"C:\Program Files (x86)\InstallShield Installation Information\{AE1E0DFB-A3D9-451C-AA7F-46FD390400D4}\setup.exe" -runfromtemp -l0x0409 -removeonly

Command Center-->MsiExec.exe /X{AE1E0DFB-A3D9-451C-AA7F-46FD390400D4}

CyberLink PowerDVD 8-->"C:\Program Files (x86)\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\setup.exe" /z-uninstall

CyberLink YouCam-->"C:\Program Files (x86)\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall

EaseUS Todo Backup Free 4.0-->"C:\Program Files (x86)\EaseUS\Todo Backup\unins000.exe"

ESET Online Scanner v3-->C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe

FastStone Image Viewer 4.6-->C:\Program Files (x86)\FastStone Image Viewer\uninst.exe

FastStone Photo Resizer 3.1-->C:\Program Files (x86)\FastStone Photo Resizer\uninst.exe

FINAL FANTASY XI: Chains of Promathia-->C:\Program Files (x86)\InstallShield Installation Information\{3C0619B4-4A2C-4244-8077-488E420DF907}\setup.exe -runfromtemp -l0x0409

FINAL FANTASY XI: Rise of the Zilart-->C:\Program Files (x86)\InstallShield Installation Information\{6FC76C41-8C1D-4B43-85E7-0BAA2002F1BE}\setup.exe -runfromtemp -l0x0409

FINAL FANTASY XI: Treasures of Aht Urhgan-->C:\Program Files (x86)\InstallShield Installation Information\{A606C6FF-12E7-40BE-B777-D8F360FF00CD}\setup.exe -runfromtemp -l0x0409

FINAL FANTASY XI: Wings of the Goddess-->C:\Program Files (x86)\InstallShield Installation Information\{5B037ED7-0755-48D4-9554-808E5AF50F17}\setup.exe -runfromtemp -l0x0409

FINAL FANTASY XI-->C:\Program Files (x86)\InstallShield Installation Information\{678F6475-D227-432A-94FF-806178A34520}\setup.exe -runfromtemp -l0x0409

Google Chrome-->"C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\Installer\setup.exe" --uninstall --multi-install --chrome --system-level

Google Earth-->MsiExec.exe /X{28E82311-8616-11E1-BEB0-B8AC6F97B88E}

Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Intel® Network Connections 14.8.43.0-->MsiExec.exe /i{11107A2A-AD44-4BC8-ABB5-E88E63BCA785} ARPREMOVE=1

Intel® Matrix Storage Manager-->C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\Uninstall\imsmudlg.exe -uninstall

iTunes-->MsiExec.exe /I{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}

Java 6 Update 20 (64-bit)-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F86416020FF}

Java 6 Update 22-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216022F0}

Java 6 Update 31-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216031FF}

Logitech Gaming Software 5.02-->MsiExec.exe /X{ECDF0939-A653-44D0-8B8E-597B890F45EC}

Malwarebytes Anti-Malware version 1.70.0.1100-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"

Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /x64 /parameterfolder Client

Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148-->MsiExec.exe /X{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

Mozilla Firefox 17.0.1 (x86 en-US)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe

Mozilla Maintenance Service-->"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"

MSRedist-->MsiExec.exe /I{328687A2-2504-49FA-AE3E-08B0DEDB51EC}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

Nero 9 Essentials-->C:\Program Files (x86)\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="2M0K-K0CA-XT0U-5C2T-8MK9-P8CA-055E-6W95-MPTC-P24M-KZ01-EETX-022A-2859-M5LE-LW0U-1AL0-C660-3789-8H00"

Nero BurnRights Help-->MsiExec.exe /X{F6BDD7C5-89ED-4569-9318-469AA9732572}

Nero BurnRights-->MsiExec.exe /X{7829DB6F-A066-4E40-8912-CB07887C20BB}

Nero ControlCenter-->MsiExec.exe /X{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}

Nero ControlCenter-->MsiExec.exe /X{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}

Nero CoverDesigner Help-->MsiExec.exe /X{CE96F5A5-584D-4F8F-AA3E-9BAED413DB72}

Nero CoverDesigner-->MsiExec.exe /X{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}

Nero Disc Copy Gadget Help-->MsiExec.exe /X{60C731FB-C951-41CE-AD41-8E54C8594609}

Nero Disc Copy Gadget-->MsiExec.exe /X{F1861F30-3419-44DB-B2A1-C274825698B3}

Nero DiscSpeed Help-->MsiExec.exe /X{CC019E3F-59D2-4486-8D4B-878105B62A71}

Nero DiscSpeed-->MsiExec.exe /X{869200DB-287A-4DC0-B02B-2B6787FBCD4C}

Nero DriveSpeed Help-->MsiExec.exe /X{E5C7D048-F9B4-4219-B323-8BDB01A2563D}

Nero DriveSpeed-->MsiExec.exe /X{33CF58F5-48D8-4575-83D6-96F574E4D83A}

Nero Express Help-->MsiExec.exe /X{83202942-84B3-4C50-8622-B8C0AA2D2885}

Nero InfoTool Help-->MsiExec.exe /X{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}

Nero InfoTool-->MsiExec.exe /X{FBCDFD61-7DCF-4E71-9226-873BA0053139}

Nero Installer-->MsiExec.exe /X{E8A80433-302B-4FF1-815D-FCC8EAC482FF}

Nero Online Upgrade-->MsiExec.exe /X{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}

Nero Rescue Agent-->MsiExec.exe /X{368BA326-73AD-4351-84ED-3C0A7A52CC53}

Nero RescueAgent Help-->MsiExec.exe /X{5E08ECD1-C98E-4711-BF65-8FD736B3F969}

Nero StartSmart Help-->MsiExec.exe /X{2348B586-C9AE-46CE-936C-A68E9426E214}

Nero StartSmart-->MsiExec.exe /X{7748AC8C-18E3-43BB-959B-088FAEA16FB2}

NeroExpress-->MsiExec.exe /X{595A3116-40BB-4E0F-A2E8-D7951DA56270}

neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}

Norton Family-->C:\Program Files (x86)\NortonInstaller\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM\LicenseType\2.6.0.43\InstStub.exe /X /ARP

Norton Safe Web Lite-->C:\Program Files (x86)\NortonInstaller\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST\LicenseType\1.2.0.6\InstStub.exe /X /ARP

Norton Security Suite-->C:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360\7190B588\4.4.0.12\InstStub.exe /X

Notepad++-->C:\Program Files (x86)\Notepad++\uninstall.exe

OpenOffice.org 3.3-->MsiExec.exe /I{3E171899-0175-47CC-84C4-562ACDD4C021}

OSD Setup-->MsiExec.exe /I{98E5A0C3-86ED-4429-9386-F0DB49E958EA}

PlayOnline Viewer & Tetra Master-->C:\Program Files (x86)\InstallShield Installation Information\{47004155-7376-403E-89E9-4C9F44AAF0D0}\setup.exe -runfromtemp -l0x0409

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.57.01-->"C:\Program Files (x86)\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -runfromtemp -l0x0009 anything -removeonly

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {FD8D7C9A-E56A-3E7B-BA6D-FE68F13296E3} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {F66C3466-1FDB-347C-B3AE-FB6C50627B10} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {B5BD3CA1-11AB-35A6-B22A-6A219DC0668E} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E720AD01-93D5-3E8E-BB8D-E4EF5AF4E5DD} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {BCD37DCB-F479-3D4D-A90E-A0F7575549C4} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {FF811680-AECE-3F35-A98C-1B84B6E09168} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {6AF6C62E-4E3D-33BF-A591-9E4D53BDF22F} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {5D45782A-1099-317E-ABCC-FF63D5B21386} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E59B2174-E924-311F-8549-AD714C14664D} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DA36C2E5-6B34-3A6A-9C0A-7D1CC1C5A768} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7B82A51A-768B-3A7B-ADFA-F777097A8079} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E40184A4-4A61-3D2E-9035-CB6E1E610E07} /parameterfolder Client

SmartDraw PDF Export (novaPDF 6.4 printer)-->"C:\Program Files (x86)\SmartDraw PDF Export\PDFFilter\unins000.exe"

SmartSound Quicktracks for Premiere Elements 8.0-->"C:\Program Files (x86)\InstallShield Installation Information\{4685A344-6718-4923-AA9D-158A0A2E1CFB}\setup.exe" -runfromtemp -l0x0409 -removeonly

SmartSound Quicktracks for Premiere Elements 8.0-->MsiExec.exe /I{4685A344-6718-4923-AA9D-158A0A2E1CFB}

Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}

Synaptics Pointing Device Driver-->rundll32.exe "%ProgramFiles%\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall

Tweaking.com - Windows Repair (All in One)-->"C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\uninstall.exe" "/U:C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Uninstall\uninstall.xml"

Ubisoft Game Launcher-->"C:\Program Files (x86)\InstallShield Installation Information\{888F1505-C2B3-4FDE-835D-36353EBD4754}\setup.exe" -runfromtemp -l0x0409 -removeonly

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {29C7BE97-DE59-37A2-A687-2ADD5321948A} /parameterfolder Client

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7D799A81-5661-3159-BF92-754161CED6E6} /parameterfolder Client

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4DFA8287-EA36-3469-99FE-F568FEC81653} /parameterfolder Client

WIDCOMM Bluetooth Software-->MsiExec.exe /X{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}

Windows Automated Installation Kit-->MsiExec.exe /I{31E8F586-4EF7-4500-844D-BA8756474FF1}

======Hosts File======

127.0.0.1 localhost

======System event log======

Computer Name: Raider

Event Code: 27

Message: Intel® 82577LC Gigabit Network Connection

Network link has been disconnected.

Record Number: 1920

Source Name: e1kexpress

Time Written: 20100831211401.994023-000

Event Type: Warning

User:

Computer Name: Raider

Event Code: 4001

Message: WLAN AutoConfig service has successfully stopped.

Record Number: 1901

Source Name: Microsoft-Windows-WLAN-AutoConfig

Time Written: 20100831211329.923291-000

Event Type: Warning

User: NT AUTHORITY\SYSTEM

Computer Name: Raider

Event Code: 27

Message: Intel® 82577LC Gigabit Network Connection

Network link has been disconnected.

Record Number: 1823

Source Name: e1kexpress

Time Written: 20100831204901.873078-000

Event Type: Warning

User:

Computer Name: Raider

Event Code: 27

Message: Intel® 82577LC Gigabit Network Connection

Network link has been disconnected.

Record Number: 1214

Source Name: e1kexpress

Time Written: 20100831184911.649224-000

Event Type: Warning

User:

Computer Name: Raider

Event Code: 4001

Message: WLAN AutoConfig service has successfully stopped.

Record Number: 1189

Source Name: Microsoft-Windows-WLAN-AutoConfig

Time Written: 20100812084239.223565-000

Event Type: Warning

User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: Raider

Event Code: 1130

Message: .NET Runtime Optimization Service (2.0.50727.4952) - Version or flavor did not match with repository: Microsoft.MediaCenter.Playback

Record Number: 1264

Source Name: .NET Runtime Optimization Service

Time Written: 20100918031316.000000-000

Event Type: Warning

User:

Computer Name: Raider

Event Code: 1130

Message: .NET Runtime Optimization Service (2.0.50727.4952) - Version or flavor did not match with repository: mcepg

Record Number: 1263

Source Name: .NET Runtime Optimization Service

Time Written: 20100918031306.000000-000

Event Type: Warning

User:

Computer Name: Raider

Event Code: 1130

Message: .NET Runtime Optimization Service (2.0.50727.4952) - Version or flavor did not match with repository: ehRecObj

Record Number: 1262

Source Name: .NET Runtime Optimization Service

Time Written: 20100918031303.000000-000

Event Type: Warning

User:

Computer Name: Raider

Event Code: 1530

Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -

1 user registry handles leaked from \Registry\User\S-1-5-21-609782877-1678570109-4088673391-1000:

Process 840 (\Device\HarddiskVolume3\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-609782877-1678570109-4088673391-1000

Record Number: 1021

Source Name: Microsoft-Windows-User Profiles Service

Time Written: 20100831211328.722088-000

Event Type: Warning

User: NT AUTHORITY\SYSTEM

Computer Name: Raider

Event Code: 1008

Message: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.

Record Number: 963

Source Name: Microsoft-Windows-Search

Time Written: 20100831184400.000000-000

Event Type: Warning

User:

=====Security event log=====

Computer Name: DD7WCSM1

Event Code: 4624

Message: An account was successfully logged on.

Subject:

Security ID: S-1-5-18

Account Name: DD7WCSM1$

Account Domain: WORKGROUP

Logon ID: 0x3e7

Logon Type: 5

New Logon:

Security ID: S-1-5-18

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3e7

Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:

Process ID: 0x24c

Process Name: C:\Windows\System32\services.exe

Network Information:

Workstation Name:

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.

- Transited services indicate which intermediate services have participated in this logon request.

- Package name indicates which sub-protocol was used among the NTLM protocols.

- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Record Number: 207

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20100812084237.163562-000

Event Type: Audit Success

User:

Computer Name: DD7WCSM1

Event Code: 4672

Message: Special privileges assigned to new logon.

Subject:

Security ID: S-1-5-18

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

Record Number: 206

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20100812084237.083562-000