MBABService terminates upon boot up

[gsb]

I used the free edition for a while. I liked your product, purchased the full version and now I'm tortured by it. Just kiddin'. I am however expereincing a problem upon boot up. The MBABService terminates and no matter how I try I can not get it to stay running. I've gone through most of the post on this and here is my info.

I'm running XP Home Edition SP2.

Upon boot I get the MBABService terminated error.

The log says, "00:32:52 (null) ERROR WTSQueryUserToken failed with error code 1245

00:32:52 (null) MESSAGE Protection stopped.

The DDS text is as follows;

DDS (Ver_09-12-01.01) - NTFSx86

Run by Owner at 0:34:57.06 on Fri 02/12/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.445 [GMT -5:00]

AV: Norton AntiVirus *On-access scanning enabled* (Updated) {B5510F6F-87E1-47F7-A411-360BC453007C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\PeerGuardian2\pg2.exe

C:\Program Files\Rainlendar2\Rainlendar2.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Owner\Desktop\temp\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank

uSearch Bar = hxxp://www.google.com/ie

uWindow Title =

mWindow Title =

mSearchAssistant = hxxp://www.google.com/ie

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe

mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\calendar.lnk - c:\program files\rainlendar2\Rainlendar2.exe

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

Trusted Zone: intuit.com\ttlc

DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1218151525796

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

mASetup: Nitro PDF Professional - cscript //B "c:\program files\nitro pdf\professional\RemoveOldAddins.vbs"

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\gxi6nlra.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1400111&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=2&q=

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxi6nlra.default\extensions\{a4ad0c85-7978-44df-bdac-71480ced94a1}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxi6nlra.default\extensions\{a4ad0c85-7978-44df-bdac-71480ced94a1}\components\RadioWMPCore.dll

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxi6nlra.default\extensions\piclens@cooliris.com\components\coolirisstub.dll

FF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxi6nlra.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll

FF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\gxi6nlra.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll

FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npcoolirisplugin.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPcol305.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: browser.cache.memory.capacity - 16000

FF - user.js: browser.chrome.favicons - fales

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autofill - true

FF - user.js: content.max.tokenizing.time - 3000000

FF - user.js: content.maxtextrun - 4095

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 1000000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 1000000

FF - user.js: dom.disable_window_status_change - true

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: nglayout.initialpaint.delay - 1000

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 dvdmmg;dvdmmg;c:\windows\system32\drivers\dvdmmg.sys [2007-9-6 5504]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-1-30 19160]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-1-30 236368]

S2 NetFxUpdate_v1.1.4322;Microsoft .NET Framework v1.1.4322 Update;c:\windows\microsoft.net\framework\v1.1.4322\netfxupdate.exe [2004-8-10 106496]

S2 SAVRTPEL;SAVRTPEL;\??\c:\program files\norton antivirus\savrtpel.sys --> c:\program files\norton antivirus\SAVRTPEL.SYS [?]

S3 alcan5ln;Alcatel SpeedTouch USB ADSL RFC1483 Networking Driver (NDIS);c:\windows\system32\drivers\alcan5ln.sys [2005-1-3 36960]

S3 EuDisk;EASEUS Disk Enumerator;c:\windows\system32\drivers\EuDisk.sys [2009-10-30 122504]

S3 gupdate1c98871da3911e8;Google Update Service (gupdate1c98871da3911e8);c:\program files\google\update\GoogleUpdate.exe [2009-10-28 133104]

S3 NAVENG;NAVENG;\??\c:\progra~1\common~1\symant~1\virusd~1\20040805.006\naveng.sys --> c:\progra~1\common~1\symant~1\virusd~1\20040805.006\NAVENG.Sys [?]

S3 NAVEX15;NAVEX15;\??\c:\progra~1\common~1\symant~1\virusd~1\20040805.006\navex15.sys --> c:\progra~1\common~1\symant~1\virusd~1\20040805.006\NavEx15.Sys [?]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-25 42000]

S3 SAVRT;SAVRT;\??\c:\program files\norton antivirus\savrt.sys --> c:\program files\norton antivirus\SAVRT.SYS [?]

S3 Usblink;Usblink Driver;c:\windows\system32\drivers\ulink.sys [2006-4-22 40060]

S3 VNic;ULan Network Driver Module; [x]

S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2009-1-22 160640]

S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2009-1-22 5248]

=============== Created Last 30 ================

2010-02-12 05:30:56 54 ----a-w- c:\documents and settings\owner\defogger_reenable

2010-02-11 03:08:25 388 ----a-w- c:\windows\system32\QuickTime.qtp

2010-02-11 03:04:02 0 d-----w- c:\program files\Free Fire Screensaver

2010-02-11 03:03:35 0 d-----w- c:\docume~1\owner\applic~1\Laconic Software

2010-02-10 23:13:59 462864 ----a-w- c:\windows\system32\d3dx10_37.dll

2010-02-10 23:11:31 0 d-----w- c:\windows\Logs

2010-02-10 23:05:02 0 d-sh--w- c:\documents and settings\owner\PrivacIE

2010-02-10 23:02:16 0 d-sh--w- c:\documents and settings\owner\IETldCache

2010-02-10 22:59:54 0 d-----w- c:\windows\ie8updates

2010-02-10 22:57:03 0 dc-h--w- c:\windows\ie8

2010-02-10 22:38:35 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll

2010-02-10 22:38:31 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2010-02-10 22:38:31 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2010-02-10 21:26:38 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-02-01 03:16:44 0 d-----w- c:\program files\common files\L&H

2010-02-01 00:24:12 995 ----a-w- c:\windows\system32\_delpw.pif

2010-01-31 03:15:27 0 d-----w- c:\docume~1\owner\applic~1\Malwarebytes

2010-01-31 03:15:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-31 03:15:21 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-31 03:15:21 0 dc----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-01-31 03:15:21 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-26 05:11:37 172032 ----a-w- c:\windows\system32\igfxres.dll

2010-01-26 04:50:04 1024 ---h--r- c:\windows\system32\NTIBUN4.dll

2010-01-26 04:50:03 6144 ----a-w- c:\windows\system32\drivers\NTIDrvr.sys

2010-01-26 04:46:50 21248 ----a-w- c:\windows\system32\drivers\intelsmb.sys

2010-01-26 04:46:32 7424 ----a-w- c:\windows\system32\drivers\SIODRV.SYS

2010-01-26 04:46:32 36484 ----a-w- c:\windows\system32\drivers\SMBios.sys

2010-01-26 04:30:53 81920 ----a-w- c:\windows\ALCFDRTM.EXE

2010-01-26 04:26:31 2879488 ----a-w- c:\windows\SkyTel.exe

2010-01-26 04:24:47 1191936 ----a-w- c:\windows\RtlUpd.exe

2010-01-26 04:24:38 2157568 ----a-w- c:\windows\MicCal.exe

2010-01-26 04:24:37 69632 ----a-w- c:\windows\Alcmtr.exe

2010-01-26 04:02:00 315392 ----a-w- c:\windows\HideWin.exe

2010-01-26 04:01:46 16125440 ----a-w- c:\windows\RTHDCPL.exe

2010-01-26 04:01:41 49152 ----a-w- c:\windows\system32\ChCfg.exe

2010-01-26 04:01:41 282624 ----a-w- c:\windows\system32\RTSndMgr.cpl

2010-01-26 04:01:20 520192 ----a-w- c:\windows\RtlExUpd.dll

2010-01-26 00:53:21 44 ----a-w- c:\windows\system32\msssc.dll

2010-01-23 10:15:14 1089601 -c----w- c:\windows\system32\dllcache\ntprint.cat

2010-01-23 04:51:48 0 d-----w- c:\program files\common files\AnswerWorks 5.0

2010-01-21 01:51:26 0 d-----w- c:\program files\HP

2010-01-21 01:49:37 113069 ----a-w- c:\windows\hpoins07.dat

2010-01-21 01:49:36 21124 ------w- c:\windows\hpomdl07.dat

2010-01-21 01:48:27 180315 ----a-w- c:\windows\system32\hpzsnt12.dll

2010-01-20 23:16:16 0 d-----w- c:\docume~1\owner\applic~1\HpUpdate

2010-01-20 23:16:13 0 d-----w- c:\windows\Hewlett-Packard

2010-01-20 02:01:34 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-01-20 00:12:23 516768 -c--a-w- c:\windows\system32\dllcache\ativvaxx.dll

2010-01-19 21:58:23 0 d-----w- c:\windows\EHome

2010-01-19 21:28:01 26144 ----a-w- c:\windows\system32\spupdsvc.exe

2010-01-13 21:39:56 1716297 ----a-w- c:\windows\system32\InetClnt.dll

==================== Find3M ====================

2010-02-10 21:26:22 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-02-04 15:01:14 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll

2010-02-04 15:01:14 528216 ----a-w- c:\windows\system32\XAudio2_6.dll

2010-02-04 15:01:14 238936 ----a-w- c:\windows\system32\xactengine3_6.dll

2010-02-04 15:01:14 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll

2010-01-20 17:50:28 70789 -c--a-w- c:\windows\hpqins05.dat

2010-01-13 21:39:54 52424 ----a-w- c:\windows\fonts\QT2M_P.TTF

2010-01-13 21:39:54 35632 ----a-w- c:\windows\fonts\QT2_I.TTF

2010-01-13 21:39:54 35064 ----a-w- c:\windows\fonts\QT2C_P.TTF

2010-01-13 21:39:54 32764 ----a-w- c:\windows\fonts\QT2C_B.TTF

2010-01-13 21:39:54 32012 ----a-w- c:\windows\fonts\QT2C_I.TTF

2010-01-13 21:39:54 31276 ----a-w- c:\windows\fonts\QT2_B.TTF

2010-01-13 21:39:54 30892 ----a-w- c:\windows\fonts\QT2_P.TTF

2010-01-13 21:39:54 28532 ----a-w- c:\windows\fonts\OCRA2_P.TTF

2010-01-13 21:39:54 24612 ----a-w- c:\windows\fonts\OCRBMT.TTF

2010-01-13 21:39:54 20900 ----a-w- c:\windows\fonts\QT2PI_P.TTF

2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll

2009-03-04 15:19:47 0 -c-h--w- c:\program files\AppUpdate.log

2007-04-17 02:54:02 26656 -csha-w- c:\windows\system32\drivers\fidbox.dat

2007-04-17 02:53:46 1056 -csha-w- c:\windows\system32\drivers\fidbox2.dat

============= FINISH: 0:35:43.37 ===============

The "attach and ark files" are attached.

For some background this system crashed a month ago and was restored through the "ntibackup" software.

I thought I had most of the kinks worked out but this one hase been a real hassle.

I have "spybot, advanced system care and peergaurdian all removed from boot up and still had the same issue.

I do not use the pre-packaged Norton AV but I noticed in the DDS text the machine thinks it's there.

I thought I had those services disabled.

Anyway, good luck and Thank You for you support.

ark.zip

[noknojon]

This topic has been moved to HJT area -

[gsb]

Noknojon,

Sorry for the misque and Thank You.

Greg

[screen317]

Hi and welcome to Malwarebytes.

Do you still need help?

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!