Outgoing IP Block

Maniac · January 14, 2013

Could you please reset it and let me know how are things then.

ldmtulsa · January 14, 2013

I assume you are asking if blocks are still happening?

So far, none this morning.

2013/01/13 12:08:35 -0600 OWNER-PC Owner IP-BLOCK 89.28.113.102 (Type: outgoing, Port: 55796, Process: svchost.exe)

2013/01/13 12:08:44 -0600 OWNER-PC Owner IP-BLOCK 89.28.113.102 (Type: outgoing, Port: 55796, Process: svchost.exe)

Maniac · January 14, 2013

That's good. Monitor it and let me know tomorrow how are things.

ldmtulsa · January 15, 2013

2013/01/14 15:14:11 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:14:19 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:14:27 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:14:35 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:14:43 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:14:51 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:14:59 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:00 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:08 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:16 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:24 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:32 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:40 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:48 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:15:56 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:16:04 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:16:13 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:16:29 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:16:45 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

2013/01/14 15:16:53 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 49872, Process: svchost.exe)

ldmtulsa · January 16, 2013

013/01/15 11:20:12 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 60955, Process: svchost.exe)

2013/01/15 11:20:20 -0600 OWNER-PC Owner IP-BLOCK 89.28.109.71 (Type: outgoing, Port: 60955, Process: svchost.exe)

2013/01/15 15:30:55 -0600 OWNER-PC Owner IP-BLOCK 206.53.50.64 (Type: outgoing, Port: 60955, Process: svchost.exe)

2013/01/15 15:31:03 -0600 OWNER-PC Owner IP-BLOCK 206.53.50.64 (Type: outgoing, Port: 60955, Process: svchost.exe)

Maniac · January 16, 2013

Go to Here and click Save File.

Double click on the file you just downloaded and when the installer window appears, click the Install button.

When the install completes click the Do a system scan and save a log file option.

This will now run a quick scan on your PC and when it completes will open a text file with the HiJackThis log information.

In the Notepad window click on Edit > Select All then click on Edit > Copy then Paste the log back here

in a reply.

It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,

so do NOT fix anything yet.

ldmtulsa · January 16, 2013

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 8:48:33 AM, on 1/16/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16457)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files (x86)\ScreenPrint32 v3\ScreenPrint32.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

C:\Program Files (x86)\AutoHotkey\AutoHotkey.exe

C:\Program Files (x86)\WebScout 2\admin.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe

C:\Users\Owner\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gmail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll

O2 - BHO: LastPass Vault - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O3 - Toolbar: LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll

O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

O4 - HKLM\..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\Run: [screenPrint32] C:\Program Files (x86)\ScreenPrint32 v3\ScreenPrint32.exe -startup

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner64.exe" /AUTO

O4 - HKCU\..\Run: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background

O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

O4 - Startup: libcard.ahk

O4 - Startup: Paula.ahk

O4 - Startup: pw.ahk

O4 - Global Startup: Install LastPass FF RunOnce.lnk = C:\Program Files (x86)\Common Files\lpuninstall.exe

O8 - Extra context menu item: Add to Evernote 4 - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html

O8 - Extra context menu item: LastPass - file://C:\Users\Owner\AppData\LocalLow\LastPass\context.html?cmd=lastpass

O8 - Extra context menu item: LastPass Fill Forms - file://C:\Users\Owner\AppData\LocalLow\LastPass\context.html?cmd=fillforms

O8 - Extra context menu item: New Note - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\NewNote.html

O9 - Extra button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar.dll

O9 - Extra 'Tools' menuitem: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar.dll

O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe

O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Cyber Web Filter (cwf2svc) - Unknown owner - C:\Program Files (x86)\WebScout 2\proxysvc.exe

O23 - Service: Dell Digital Delivery Service (DellDigitalDelivery) - Dell Products, LP. - C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)

O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 12005 bytes

Maniac · January 16, 2013

Please, open HiJackThis and select Do a system scan only.

Check the following entries:

O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

O4 - Startup: libcard.ahk

O4 - Startup: Paula.ahk

O4 - Startup: pw.ahk

Then, close all open windows except that of HijackThis, and select Fix Checked.

ldmtulsa · January 16, 2013

will this delete these files?

Maniac · January 16, 2013

No, just will disable them to startup with your Windows. Are they important for you? Do you recognize them?

ldmtulsa · January 16, 2013

Yes, I know what all 4 of them are.

ldmtulsa · January 16, 2013

the 3 .ahk files are for a program called Automate. They are little files triggered by a keystroke combination used to fill things like a password or a simple text phrase.

The evernote is a iphone/pc app that replaces the iPhone "Notes" app. Any notes entered on the iphone or the pc is synced via wifi to the other device.

Maniac · January 16, 2013

Some of them can send outgoing traffic and Malwarebytes' Anti-Malware to show you notifications, that's why I want to stop them to check where is the problem. You can do it yourself with msconfig.

http://www.netsquirrel.com/msconfig/msconfig_win7.html

Disable, reboot and check.

ldmtulsa · January 16, 2013

ok - will do.

ldmtulsa · January 16, 2013

Maniac -- do you know of any software that I could install that would monitor and log which program attempts to connect to the internet? If one exists one would think that it might point out the program that is causing my issues.

Maniac · January 17, 2013

This one is good option.

http://www.wireshark.org/download.html

ldmtulsa · January 17, 2013

no blocks yesterday

ldmtulsa · January 17, 2013

Another question. Don't know if this is a result of my issue, but I noticed today that "system protection" is turned off and I cannot get it turned on. Have been googling stuff all day an still cannot get it turned on.

Maniac · January 17, 2013

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
[*]Press "Scan".
[*]It will create a log (FSS.txt) in the same directory the tool is run.
[*]Please copy and paste the log to your reply.

ldmtulsa · January 17, 2013

Farbar Service Scanner Version: 16-01-2013

Ran by Owner (administrator) on 17-01-2013 at 16:16:20

Running from "C:\Users\Owner\Downloads"

Windows 7 Home Premium Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Attempt to access Google IP returned error. Google IP is offline

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

Other Services:

==============

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys => MD5 is legit

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

ldmtulsa · January 18, 2013

no blocks today.

Maniac · January 18, 2013

Download

Complete Internet Repair and run it.
Extract it on your desktop.
Double click on CIntRep.exe
Click on OK button for any security responses.
Put a checkmarks on all boxes.
Click on the GO button
Restart the computer

ldmtulsa · January 18, 2013

2013/01/17 23:02:14 -0600 OWNER-PC Owner IP-BLOCK 121.125.83.41 (Type: outgoing, Port: 50017, Process: svchost.exe)

2013/01/17 23:02:22 -0600 OWNER-PC Owner IP-BLOCK 121.125.83.41 (Type: outgoing, Port: 50017, Process: svchost.exe)

ldmtulsa · January 18, 2013

got one error while running -- wvaclt - windows cannot find

./

(o o)

--------------------------------------oOOo-(_)-oOOo--------------------------------------

[18/01/2013 05:21:27] Resetting all TCP/IP Interfaces, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:29] TCP/IP interfaces reset successful.

[18/01/2013 05:21:30] TCP/IP v6 interfaces reset successful.

[18/01/2013 05:21:30] You may need to restart your computer for the settings to take effect.

[18/01/2013 05:21:30] Finished resetting the Internet Protocol (TCP/IP).

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:30] Attempting to reset Winsock catalog, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:31] Successfully reset the Winsock Catalog.

[18/01/2013 05:21:31] Finished repairing Winsock

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:31] Releasing TCP/IP connections, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:31] Successfully released TCP/IP connections.

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:31] Renewing TCP/IP connections, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:36] Successfully renewed TCP/IP adapters.

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:36] Configuring the Windows Event Log Service, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:37] Windows Event Log Service Configured.

[18/01/2013 05:21:37] Starting the Windows Event Log Service.....

[18/01/2013 05:21:37] Windows Event Log Service Started Successfully.

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:37] Flushing DNS Resolver Cache, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:37] Successfully flushed DNS Resolver Cache.

[18/01/2013 05:21:37] Refreshing all DHCP leases and re-registering DNS names, Please wait.....

[18/01/2013 05:21:41] Registration of the DNS resource records has been initiated.

[18/01/2013 05:21:41] Note: Any errors will be reported in the 'Event Viewer' in about 15 minutes.

[18/01/2013 05:21:41] Note: Click on 'File' and then 'Event Viewer...' to open the Event Viewer.

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:41] Repairing Internet Explorer 9.0.8112, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:41] RegSvr32.exe: 'actxprxy.dll' registration succeeded.

[18/01/2013 05:21:41] RegSvr32.exe: 'asctrls.ocx' Specified module not found

[18/01/2013 05:21:41] RegSvr32.exe: 'browseui.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:42] RegSvr32.exe: 'cdfview.dll' Specified module not found

[18/01/2013 05:21:42] RegSvr32.exe: 'comcat.dll' registration succeeded.

[18/01/2013 05:21:42] RegSvr32.exe: 'comctl32.dll' registration succeeded.

[18/01/2013 05:21:42] RegSvr32.exe: 'corpol.dll' Specified module not found

[18/01/2013 05:21:42] RegSvr32.exe: 'cryptdlg.dll' registration succeeded.

[18/01/2013 05:21:42] RegSvr32.exe: '"C:\Program Files (x86)\Internet Explorer\custsat.dll"' Specified module not found

[18/01/2013 05:21:42] RegSvr32.exe: 'digest.dll' Specified module not found

[18/01/2013 05:21:42] RegSvr32.exe: 'dispex.dll' registration succeeded.

[18/01/2013 05:21:42] RegSvr32.exe: 'dxtmsft.dll' registration succeeded.

[18/01/2013 05:21:42] RegSvr32.exe: 'dxtrans.dll' registration succeeded.

[18/01/2013 05:21:43] RegSvr32.exe: 'extmgr.dll' Specified module not found

[18/01/2013 05:21:43] RegSvr32.exe: '"C:\Program Files (x86)\Internet Explorer\hmmapi.dll"' Specified module not found

[18/01/2013 05:21:43] RegSvr32.exe: 'hlink.dll' registration succeeded.

[18/01/2013 05:21:43] RegSvr32.exe: 'ieaksie.dll' registration succeeded.

[18/01/2013 05:21:43] RegSvr32.exe: 'ieapfltr.dll' Error number: 0x80070005

[18/01/2013 05:21:43] RegSvr32.exe: 'iedkcs32.dll' registration succeeded.

[18/01/2013 05:21:43] RegSvr32.exe: '"C:\Program Files (x86)\Internet Explorer\iedvtool.dll"' registration succeeded.

[18/01/2013 05:21:44] RegSvr32.exe: 'iedvtool.dll' Specified module not found

[18/01/2013 05:21:44] RegSvr32.exe: 'ieframe.dll' registration succeeded.

[18/01/2013 05:21:44] RegSvr32.exe: 'iepeers.dll' registration succeeded.

[18/01/2013 05:21:44] RegSvr32.exe: '"C:\Program Files (x86)\Internet Explorer\ieproxy.dll"' registration succeeded.

[18/01/2013 05:21:44] RegSvr32.exe: 'ieproxy.dll' Specified module not found

[18/01/2013 05:21:44] RegSvr32.exe: 'iesetup.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:45] RegSvr32.exe: 'imgutil.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:45] RegSvr32.exe: 'inetcpl.cpl' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:45] RegSvr32.exe: 'inetcpl.cpl' registration succeeded.

[18/01/2013 05:21:45] RegSvr32.exe: 'initpki.dll' Specified module not found

[18/01/2013 05:21:45] RegSvr32.exe: 'inseng.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:45] RegSvr32.exe: 'jscript.dll' registration succeeded.

[18/01/2013 05:21:45] RegSvr32.exe: 'licmgr10.dll' registration succeeded.

[18/01/2013 05:21:45] RegSvr32.exe: 'mlang.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:46] RegSvr32.exe: 'mobsync.dll' Specified module not found

[18/01/2013 05:21:46] RegSvr32.exe: 'msapsspc.dll' Specified module not found

[18/01/2013 05:21:46] RegSvr32.exe: 'mscoree.dll' registration succeeded.

[18/01/2013 05:21:46] RegSvr32.exe: 'mscorier.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:46] RegSvr32.exe: 'mscories.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:46] RegSvr32.exe: 'msdbg2.dll' Specified module not found

[18/01/2013 05:21:46] RegSvr32.exe: 'mshta.exe' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:46] RegSvr32.exe: 'mshtml.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:46] RegSvr32.exe: 'mshtmled.dll' registration succeeded.

[18/01/2013 05:21:46] RegSvr32.exe: 'msident.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:47] RegSvr32.exe: 'msieftp.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:47] RegSvr32.exe: 'msnsspc.dll' Specified module not found

[18/01/2013 05:21:47] RegSvr32.exe: 'msr2c.dll' Specified module not found

[18/01/2013 05:21:47] RegSvr32.exe: 'msrating.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:47] RegSvr32.exe: 'mstime.dll' Specified module not found

[18/01/2013 05:21:47] RegSvr32.exe: 'msxml.dll' Specified module not found

[18/01/2013 05:21:47] RegSvr32.exe: 'ole32.dll' registration succeeded.

[18/01/2013 05:21:47] RegSvr32.exe: 'oleacc.dll' registration succeeded.

[18/01/2013 05:21:47] RegSvr32.exe: 'occache.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:49] RegSvr32.exe: 'oleaut32.dll' registration succeeded.

[18/01/2013 05:21:49] RegSvr32.exe: '"C:\Program Files (x86)\Internet Explorer\pdm.dll"' registration succeeded.

[18/01/2013 05:21:49] RegSvr32.exe: 'plugin.ocx' Specified module not found

[18/01/2013 05:21:49] RegSvr32.exe: 'pngfilt.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:49] RegSvr32.exe: 'proctexe.ocx' Specified module not found

[18/01/2013 05:21:49] RegSvr32.exe: 'scrobj.dll' Error number: 0x80070005

[18/01/2013 05:21:49] RegSvr32.exe: 'sendmail.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:49] RegSvr32.exe: 'setupwbv.dll' Specified module not found

[18/01/2013 05:21:49] RegSvr32.exe: 'shdocvw.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:50] RegSvr32.exe: 'tdc.ocx' registration succeeded.

[18/01/2013 05:21:50] RegSvr32.exe: 'url.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:51] RegSvr32.exe: 'urlmon.dll' registration succeeded.

[18/01/2013 05:21:51] RegSvr32.exe: 'urlmon.dll,NI,HKLM' Specified module not found

[18/01/2013 05:21:51] RegSvr32.exe: 'vbscript.dll' registration succeeded.

[18/01/2013 05:21:51] RegSvr32.exe: '"C:\Program Files (x86)\microsoft shared\vgx\vgx.dll"' Specified module not found

[18/01/2013 05:21:51] RegSvr32.exe: 'webcheck.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:21:51] Finished repairing Internet Explorer 9.0.8112

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:51] Repairing Windows Update / Automatic Updates, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:21:51] Stopping the BITS Service.....

[18/01/2013 05:21:51] BITS Stopped Successfully.

[18/01/2013 05:21:51] Stopping the Automatic Updates (wuauserv) Service.....

[18/01/2013 05:21:52] Automatic Updates (wuauserv) Service Stopped Successfully.

[18/01/2013 05:21:52] Clearing File Stores (Update History).....

[18/01/2013 05:21:52] Clearing [C:\windows\SoftwareDistribution\Download].....

[18/01/2013 05:22:25] [C:\windows\SoftwareDistribution\Download] Cleared.

[18/01/2013 05:22:25] Clearing [C:\windows\SoftwareDistribution\DataStore].....

[18/01/2013 05:22:25] [C:\windows\SoftwareDistribution\DataStore] Cleared.

[18/01/2013 05:22:25] Clearing [C:\windows\SysWOW64\CatRoot2].....

[18/01/2013 05:22:26] [C:\windows\SysWOW64\CatRoot2] Cleared.

[18/01/2013 05:22:26] Setting BITS Security Descriptor.....

[18/01/2013 05:22:26] BITS Security Descriptor Set.

[18/01/2013 05:22:26] Setting Automatic Updates (wuauserv) Service Security Descriptor.....

[18/01/2013 05:22:26] Automatic Updates (wuauserv) Security Descriptor Set.

[18/01/2013 05:22:26] Configuring the Automatic Updates (wuauserv) Service.....

[18/01/2013 05:22:27] Automatic Updates (wuauserv) Service Configured.

[18/01/2013 05:22:27] Configuring BITS.....

[18/01/2013 05:22:27] BITS Configured.

[18/01/2013 05:22:27] Registering WUAU DLLs.....

[18/01/2013 05:22:27] RegSvr32.exe: 'actxprxy.dll' registration succeeded.

[18/01/2013 05:22:27] RegSvr32.exe: 'atl.dll' registration succeeded.

[18/01/2013 05:22:27] RegSvr32.exe: 'browseui.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:22:27] RegSvr32.exe: 'corpol.dll' Specified module not found

[18/01/2013 05:22:27] RegSvr32.exe: 'cryptdlg.dll' registration succeeded.

[18/01/2013 05:22:28] RegSvr32.exe: 'dispex.dll' registration succeeded.

[18/01/2013 05:22:28] RegSvr32.exe: 'dssenh.dll' registration succeeded.

[18/01/2013 05:22:28] RegSvr32.exe: 'gpkcsp.dll' Specified module not found

[18/01/2013 05:22:28] RegSvr32.exe: 'initpki.dll' Specified module not found

[18/01/2013 05:22:28] RegSvr32.exe: 'jscript.dll' registration succeeded.

[18/01/2013 05:22:28] RegSvr32.exe: 'mshtml.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:22:29] RegSvr32.exe: 'msscript.ocx' registration succeeded.

[18/01/2013 05:22:29] RegSvr32.exe: 'msxml.dll' Specified module not found

[18/01/2013 05:22:29] RegSvr32.exe: 'msxml2.dll' Specified module not found

[18/01/2013 05:22:29] RegSvr32.exe: 'msxml3.dll' registration succeeded.

[18/01/2013 05:22:29] RegSvr32.exe: 'msxml4.dll' registration succeeded.

[18/01/2013 05:22:29] RegSvr32.exe: 'msxml6.dll' registration succeeded.

[18/01/2013 05:22:30] RegSvr32.exe: 'muweb.dll' Specified module not found

[18/01/2013 05:22:30] RegSvr32.exe: 'ole.dll' Specified module not found

[18/01/2013 05:22:30] RegSvr32.exe: 'ole32.dll' registration succeeded.

[18/01/2013 05:22:30] RegSvr32.exe: 'oleaut.dll' Specified module not found

[18/01/2013 05:22:30] RegSvr32.exe: 'oleaut32.dll' registration succeeded.

[18/01/2013 05:22:30] RegSvr32.exe: 'qmgr.dll' Specified module not found

[18/01/2013 05:22:30] RegSvr32.exe: 'qmgrprxy.dll' registration succeeded.

[18/01/2013 05:22:30] RegSvr32.exe: 'gpkcsp.dll' Specified module not found

[18/01/2013 05:22:30] RegSvr32.exe: 'rsaenh.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'sccbase.dll' Specified module not found

[18/01/2013 05:22:31] RegSvr32.exe: 'scrobj.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'scrrun.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'shdocvw.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:22:31] RegSvr32.exe: 'shell.dll' Specified module not found

[18/01/2013 05:22:31] RegSvr32.exe: 'shell32.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'slbcsp.dll' Specified module not found

[18/01/2013 05:22:31] RegSvr32.exe: 'softpub.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'urlmon.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'vbscript.dll' registration succeeded.

[18/01/2013 05:22:31] RegSvr32.exe: 'winhttp.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:22:32] RegSvr32.exe: 'wintrust.dll' registration succeeded.

[18/01/2013 05:22:32] RegSvr32.exe: 'wshext.dll' Error number: 0x80070005

[18/01/2013 05:22:32] RegSvr32.exe: 'wuapi.dll' registration succeeded.

[18/01/2013 05:22:32] RegSvr32.exe: 'wuaueng.dll' Specified module not found

[18/01/2013 05:22:32] RegSvr32.exe: 'wuaueng1.dll' Specified module not found

[18/01/2013 05:22:32] RegSvr32.exe: 'wucltui.dll' Specified module not found

[18/01/2013 05:22:32] RegSvr32.exe: 'wucltux.dll' Specified module not found

[18/01/2013 05:22:33] RegSvr32.exe: 'wups.dll' registration succeeded.

[18/01/2013 05:22:33] RegSvr32.exe: 'wups2.dll' Specified module not found

[18/01/2013 05:22:33] RegSvr32.exe: 'wuweb.dll' Specified module not found

[18/01/2013 05:22:33] RegSvr32.exe: 'wuwebv.dll' registration succeeded.

[18/01/2013 05:22:33] WUAU DLLs Reregistered.

[18/01/2013 05:22:33] Resetting proxy settings.....

[18/01/2013 05:22:33] Proxy settings reset successfully.

[18/01/2013 05:22:33] Restarting the Automatic Updates (wuauserv) Service.....

[18/01/2013 05:22:34] Automatic Updates (wuauserv) Service Restarted.

[18/01/2013 05:22:34] Restarting the BITS Service.....

[18/01/2013 05:22:34] BITS Service Restarted.

[18/01/2013 05:22:35] Clearing the BITS queue.....

[18/01/2013 05:22:35] BITS queue cleared.

[18/01/2013 05:22:35] Initiating Windows Updates detection right away.....

[18/01/2013 05:23:34] Finished repairing Windows Update / Automatic Updates.

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:34] Repairing SSL / HTTPS / Cryptography service, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:34] Configuring the Cryptographic Service.....

[18/01/2013 05:23:34] Cryptographic Service Configured.

[18/01/2013 05:23:34] Stopping the Cryptographic Service.....

[18/01/2013 05:23:34] Cryptographic service Stopped Successfully.

[18/01/2013 05:23:34] Clearing [C:\windows\system32\CatRoot].....

[18/01/2013 05:23:34] [C:\windows\system32\CatRoot] cleared.

[18/01/2013 05:23:34] Re-registering SSL / HTTPS / Cryptography DLLs.....

[18/01/2013 05:23:35] RegSvr32.exe: 'cryptdlg.dll' registration succeeded.

[18/01/2013 05:23:35] RegSvr32.exe: 'cryptext.dll' registration succeeded.

[18/01/2013 05:23:35] RegSvr32.exe: 'cryptui.dll' registration succeeded.

[18/01/2013 05:23:35] RegSvr32.exe: 'dssenh.dll' registration succeeded.

[18/01/2013 05:23:35] RegSvr32.exe: 'gpkcsp.dll' Specified module not found

[18/01/2013 05:23:35] RegSvr32.exe: 'initpki.dll' Specified module not found

[18/01/2013 05:23:35] RegSvr32.exe: 'licdll.dll' Specified module not found

[18/01/2013 05:23:35] RegSvr32.exe: 'mssign32.dll' registration succeeded.

[18/01/2013 05:23:35] RegSvr32.exe: 'mssip32.dll' registration succeeded.

[18/01/2013 05:23:35] RegSvr32.exe: 'regwizc.dll' Specified module not found

[18/01/2013 05:23:35] RegSvr32.exe: 'rsaenh.dll' registration succeeded.

[18/01/2013 05:23:36] RegSvr32.exe: 'scardssp.dll' Specified module not found

[18/01/2013 05:23:36] RegSvr32.exe: 'sccbase.dll' Specified module not found

[18/01/2013 05:23:36] RegSvr32.exe: 'scecli.dll' registration succeeded.

[18/01/2013 05:23:36] RegSvr32.exe: 'slbcsp.dll' Specified module not found

[18/01/2013 05:23:36] RegSvr32.exe: 'softpub.dll' registration succeeded.

[18/01/2013 05:23:36] RegSvr32.exe: 'winhttp.dll' Module loaded but entry-point DllRegisterServer was not found.

[18/01/2013 05:23:36] RegSvr32.exe: 'wintrust.dll' registration succeeded.

[18/01/2013 05:23:36] SSL / HTTPS / Cryptography DLLs re-registered.

[18/01/2013 05:23:37] Restarting the Cryptographic Service.....

[18/01/2013 05:23:37] Cryptographic Service restarted.

[18/01/2013 05:23:37] Finished repairing SSL / HTTPS / Cryptography service.

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:37] Resetting the Windows Firewall configuraton, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:38] Windows Firewall configuration reset successful.

[18/01/2013 05:23:38] Finished resetting the Windows Firewall configuraton.

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:38] Restoring the default Windows HOSTS file, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:38] Writing data to the HOSTS file.....

[18/01/2013 05:23:38] HOSTS file created successfully.

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:38] Repairing Workgroup Computers view, Please wait.....

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:38] Finished repairing Workgroup Computers view.

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:38] You will need to reboot your computer before the settings will take effect.

-----------------------------------------------------------------------------------------

[18/01/2013 05:23:54] Your computer is restarting now.....

-----------------------------------------------------------------------------------------

ldmtulsa · January 18, 2013

noticing other crap starting to happen -- tried to open ms word and got the attached error.

Plus my little screen print utility will not work.

Do I just need to burn this down and do a complete reinstall of windows?

Outgoing IP Block

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information