Solved AV Cannot Remove Virus in Restore Point

[Resolved] AV Cannot Remove Virus in Restore Point

A few weeks back I needed to install some older copies of Adobe Reader for testing. I downloaded a copy of v9 from some site (I can't recall) that had numerous past versions of Reader. On August 17th F-prot AV software gave the following warning:

Event Type: Warning
Event Source: F-PROT Antivirus
Event Category: Scanner
Event ID: 4096
Date: 8/17/2012
Time: 7:43:44 PM
User: NT AUTHORITY\SYSTEM
Computer: CHIPPC1
Description:
Found file, C:\Documents and Settings\username\Desktop\PDFReaderSetup-v9.exe, infected with W32/InstallCore.G.gen!Eldorado

The same warning was repeated that night at 10 pm. I securely erased the file. I think a version of it remains, however, in one of my restore points. Every day since August 31st my daily scan throws the following warning:

Event Type: Warning
Event Source: F-PROT Antivirus
Event Category: Scanner
Event ID: 4096
Date: 9/9/2012
Time: 8:35:06 PM
User: NT AUTHORITY\SYSTEM
Computer: CHIPPC1
Description:
Found file, C:\System Volume Information\_restore{93CAB7B2-1578-4C6C-B99A-8DDCED75ED58}\RP332\A0057893.exe, infected with W32/InstallCore.G.gen!Eldorado

F-prot says it cannot be removed. I suspect that it is blocked from editing restore files.

Arie, Broni and the rest of the WindowsBBS team have helped me numerous times over the years. I have started running the various scans requested for a new post and will upload the logs as soon as possible. These scans do take quite a few hours to run. In the meantime, is there something I should do to get rid of the infected restore point? MalwareBytes and F-prot could not clean it.

Thanks!
Chip

 

F-Prot AV Log

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.6.5
Virus signature file from: 9/9/2012, 2:49 AM

Scan name: [Custom Scan]
Path to scan: C:\|

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 9/9/2012, 10:27:03 PM
---------------------------------------------------------------------

[Not scanning] <excluded> C:\asyncmac.zip
[Unscannable] <Unknown format or compression method> C:\dell\drivers\Phaser6180_WinXP03V_PS_English.exe
[Error] <Scanning error> C:\Documents and Settings\All Users\Application Data\Adobe\ARM\Reader_10.1.1\AdobeARM.bin
[Warning] <Could not open file> C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log
[Warning] <Could not open file> C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log
[Warning] <Could not open file> C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb
[Warning] <Could not open file> C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb
[Warning] <Could not open file> C:\Documents and Settings\username\Application Data\FRISK Software\F-PROT Antivirus for Windows\ReportFiles\2012-09-09T10-27-03 - [Custom Scan].txt
[Warning] <Could not open file> C:\Documents and Settings\username\Application Data\Mozilla\Firefox\Profiles\uxbww9bj.Chip2012\parent.lock
[Unscannable] <File is encrypted> C:\Documents and Settings\username\Application Data\StarExplorer\StarExplorer.smg->StarExplorer.smg
[Error] <Scanning error> C:\Documents and Settings\username\Desktop\Expand\ADBEAFETCS4_LS7.7z.part
[Unscannable] <File is damaged> C:\Documents and Settings\username\Desktop\Expand\AdbeRdr1001_en_US.exe->(7Z)
[Unscannable] <File is encrypted> C:\Documents and Settings\username\Desktop\Expand\AppRemover.exe->(RAR)->AVSDKList.zip->output.xml
[Unscannable] <File is damaged> C:\Documents and Settings\username\Desktop\Expand\March 2009 Files\Desktop Collapse\000000\PD7.zip->PD7.exe->(CAB)->\Data1.cab
[Unscannable] <File is damaged> C:\Documents and Settings\username\Desktop\Expand\March 2009 Files\Desktop Collapse\000000\PD7.zip->PD7.exe->(CAB)
[Unscannable] <File is encrypted> C:\Documents and Settings\username\Desktop\Expand\March 2009 Files\Desktop Collapse\000000\starexplorer_100_224_full.exe->(RAR)->se_default.sel->starexplorer.sel
[Unscannable] <File is damaged> C:\Documents and Settings\username\Desktop\Expand\March 2009 Files\Encoder_en.exe->(CAB)->Setup\EnComn.cab
[Unscannable] <File is damaged> C:\Documents and Settings\username\Desktop\Expand\March 2009 Files\en_office_professional_plus_2010_w64_x16-32213\en_office_professional_plus_2010_w64_x16-32213.exe->(CAB)->ProPrWW.cab
[Unscannable] <File is damaged> C:\Documents and Settings\username\Desktop\Expand\March 2009 Files\en_office_professional_plus_2010_w64_x16-32213\en_office_professional_plus_2010_w64_x16-32213.exe->(CAB)->ProPrWW2.cab
[Warning] <Could not open file> C:\Documents and Settings\username\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[Warning] <Could not open file> C:\Documents and Settings\username\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[Warning] <Could not open file> C:\Documents and Settings\username\Local Settings\temp\BCG49D.tmp
[Warning] <Could not open file> C:\Documents and Settings\username\Local Settings\temp\mmc13CA07A8.xml
[Warning] <Could not open file> C:\Documents and Settings\username\ntuser.dat
[Warning] <Could not open file> C:\Documents and Settings\username\ntuser.dat.LOG
[Warning] <Could not open file> C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[Warning] <Could not open file> C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[Warning] <Could not open file> C:\Documents and Settings\LocalService\NTUSER.DAT
[Warning] <Could not open file> C:\Documents and Settings\LocalService\ntuser.dat.LOG
[Warning] <Could not open file> C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[Warning] <Could not open file> C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[Warning] <Could not open file> C:\Documents and Settings\NetworkService\NTUSER.DAT
[Warning] <Could not open file> C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[Unscannable] <File is damaged> C:\Program Files\Common Files\Adobe\Installers\Adobe ExtendScript Toolkit 2 2.0.2.log.gz->(packed)
[Unscannable] <File is damaged> C:\Program Files\Microsoft Expression\Encoder 4\SDK\Samples\TemplatePlugin\Templates\ModifiedSL3Standard\SmoothStreaming.xap->SmoothStreaming.dll
[Unscannable] <File is damaged> C:\Program Files\Microsoft Expression\Encoder 4\SDK\SamplesVB\TemplatePlugin\Templates\ModifiedSL3Standard\MediaPlayerTemplate.xap->MediaPlayer.dll
[Unscannable] <File is damaged> C:\Program Files\Microsoft Expression\Encoder 4\SDK\SamplesVB\TemplatePlugin\Templates\ModifiedSL3Standard\SmoothStreaming.xap->SmoothStreaming.dll
[Unscannable] <File is encrypted> C:\Program Files\Star Explorer\se_default.sel->starexplorer.sel
[Found application] <W32/InstallCore.G.gen!Eldorado (not disinfectable, generic)> C:\System Volume Information\_restore{93CAB7B2-1578-4C6C-B99A-8DDCED75ED58}\RP332\A0057893.exe
[Unscannable] <File is damaged> C:\temp\TrueImageServerEcho.8398_s_en.exe->(ZIP)->AcronisTrueImageServer.msi
[Not scanning] <excluded> C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a
[Not scanning] <excluded> C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a
[Not scanning] <excluded> C:\WINDOWS\assembly\GAC_MSIL\Intuit.QuickBooks.FCS\1.3.0.0__5b3f47ba29970ccb
[Not scanning] <excluded> C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a
[Not scanning] <excluded> C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.ConfigUXv4\v4.0_4.0.66.0__3ff6b78e2989595a
[Not scanning] <excluded> C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.Update\v4.0_4.0.66.0__3ff6b78e2989595a
[Not scanning] <excluded> C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35
[Unscannable] <File is damaged> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.cab
[Unscannable] <File is damaged> C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\netfx_core.mzz
[Unscannable] <File is damaged> C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\netfx_extended.mzz
[Unscannable] <File is damaged> C:\WINDOWS\SoftwareDistribution\Download\541c10d4ce622d74ba1c91396cc846759acfa238->(CAB)->silverlight.7z
[Warning] <Could not open file> C:\WINDOWS\system32\config\default
[Warning] <Could not open file> C:\WINDOWS\system32\config\default.LOG
[Warning] <Could not open file> C:\WINDOWS\system32\config\SAM
[Warning] <Could not open file> C:\WINDOWS\system32\config\SAM.LOG
[Warning] <Could not open file> C:\WINDOWS\system32\config\SECURITY
[Warning] <Could not open file> C:\WINDOWS\system32\config\SECURITY.LOG
[Warning] <Could not open file> C:\WINDOWS\system32\config\software
[Warning] <Could not open file> C:\WINDOWS\system32\config\software.LOG
[Warning] <Could not open file> C:\WINDOWS\system32\config\system
[Warning] <Could not open file> C:\WINDOWS\system32\config\system.LOG
[Not scanning] <excluded> C:\WINDOWS\system32\dllcache\asyncmac.sys
[Not scanning] <excluded> C:\WINDOWS\system32\drivers\asyncmac.sys
[Not scanning] <excluded> C:\WINDOWS\system32\drivers\asyncmac.zip
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\ps5ui.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\pscript.hl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\pscript.nt_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\pscript5.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\tcpmon.in_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xr6180dn.in_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xr6180dn.pp_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrpsckre.ch_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrpsckre.fp_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrpsckrr.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrpsckru.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrx6180n.in_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrx6180n.pp_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrzadcog.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrzarl32.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrzdhb32.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrzkrlai.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrzkrxa3.dl_
[Unscannable] <Unknown format or compression method> C:\Xerox\6180_PS_Driver\xrzpmc3.dl_

---------------------------------------------------------------------
Scan ended: 9/10/2012, 12:27:27 AM
Duration: 2:00:24

Scan result:

Scanned files: 187721
Infected objects: 1
Disinfected objects: 0
Quarantined files: 0
---------------------------------------------------------------------

** Note there were over 5,000 files that F-prot could not scan because they were encrypted. I deleted these from the above as I checked and they are legitimate. Running Malwarebytes now...

 

Malwarebytes Log

Malwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.09.09.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
chip :: CHIPPC1 [administrator]

Protection: Enabled

9/10/2012 1:09:51 AM
mbam-log-2012-09-10 (01-09-51).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 450926
Time elapsed: 1 hour(s), 55 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

GMER log (this took hours to run)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-09-10 12:58:00
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-18 WDC_WD2500AAJS-75B4A0 rev.01.03A01
Running: vz814svv.exe; Driver: C:\DOCUME~1\CLEVIN~1\LOCALS~1\Temp\uwtdqpow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies) ZwQueryValueKey [0xB81C9258]

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB6B3A360, 0x3E57A5, 0xE8000020]
init C:\WINDOWS\system32\DRIVERS\aksifdh.sys entry point in "init" section [0xB8161090]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\SearchIndexer.exe[2000] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\Program Files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe[2140] KERNEL32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 10005230 C:\Program Files\Anonymizer\Anonymizer Software\Common\Anx.System.dll (rscoree/Remotesoft, Inc.)
.text C:\program files\real\realplayer\update\realsched.exe[4280] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs FStopW.sys (FPAV - RealTime Protector/FRISK Software International)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs 1
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs C:\WINDOWS\system32\acaptuser32.dll

---- EOF - GMER 1.0.15 ----

 

aswMBR Log Files - hope QuickScan is OK

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-10 13:15:46
-----------------------------
13:15:46.113 OS Version: Windows 5.1.2600 Service Pack 3
13:15:46.113 Number of processors: 2 586 0x403
13:15:46.113 ComputerName: CHIPPC1 UserName: chip
13:16:01.262 Initialize success
13:16:52.039 The log file has been saved successfully to "C:\Documents and Settings\username\Desktop\aswMBR-log1.txt "
13:17:01.355 AVAST engine defs: 12091001
13:17:21.150 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-18
13:17:21.150 Disk 0 Vendor: WDC_WD2500AAJS-75B4A0 01.03A01 Size: 238418MB BusType: 3
13:17:21.150 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-20
13:17:21.150 Disk 1 Vendor: WDC_WD2500AAJS-75B4A0 01.03A01 Size: 238418MB BusType: 3
13:17:21.181 Disk 0 MBR read successfully
13:17:21.181 Disk 0 MBR scan
13:17:21.228 Disk 0 Windows XP default MBR code
13:17:21.228 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 238409 MB offset 63
13:17:21.228 Disk 0 scanning sectors +488263545
13:17:21.322 Disk 0 scanning C:\WINDOWS\system32\drivers
13:17:43.598 Service scanning
13:18:23.171 Modules scanning
13:18:30.118 Disk 0 trace - called modules:
13:18:30.134 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
13:18:30.134 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8afc3ab8]
13:18:30.134 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-18[0x8af85d98]
13:18:30.789 AVAST engine scan C:\WINDOWS
13:18:40.546 AVAST engine scan C:\WINDOWS\system32
13:23:55.860 AVAST engine scan C:\WINDOWS\system32\drivers
13:24:19.508 AVAST engine scan C:\Documents and Settings\clevinson
13:43:52.792 AVAST engine scan C:\Documents and Settings\All Users
13:47:17.958 Scan finished successfully
13:54:52.750 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\username\Desktop\MBR.dat "
13:54:52.766 The log file has been saved successfully to "C:\Documents and Settings\username\Desktop\aswMBR-new log.txt "

 

DDS.txt file

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1
Run by chip at 14:00:27 on 2012-09-10
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2205 [GMT -7:00]
.
AV: F-PROT Antivirus for Windows *Enabled/Updated* {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\Profiles\Desktop\SAC\x32\SACSrv.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\Program Files\Secunia\PSI\sua.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Anonymizer\Anonymizer Software\Common\AnonMgmtSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
C:\WINDOWS\Profiles\Desktop\SAC\x32\SACMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 9\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 9\SnagPriv.exe
C:\Program Files\TechSmith\SnagIt 9\snagiteditor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: CitiUSBrowserHelper Class: {387edf53-1cf2-4523-bc2f-13462651be8c} - c:\program files\virtual account numbers\BhoCitUS.dll
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ws_ftp pro\wsbho2k0.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\12.2.5.32\AVG Secure Search_toolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\12.2.5.32\AVG Secure Search_toolbar.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [Adobe Acrobat Synchronizer] "c:\program files\adobe\acrobat 10.0\acrobat\AdobeCollabSync.exe "
mRun: [F-PROT Antivirus Tray application] c:\program files\frisk software\f-prot antivirus for windows\FProtTray.exe
mRun: [Citi Virtual Account Numbers] c:\progra~1\virtua~1\CitiVAN.exe /lang=en_RG /dontopenmycards
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [DT ACR] c:\program files\common files\portrait displays\shared\DT_startup.exe -ACR
mRun: [NUSB3MON] "c:\program files\renesas electronics\usb 3.0 host controller driver\application\nusb3mon.exe "
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [vProt] "c:\program files\avg secure search\vprot.exe "
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE -startup
mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 10.0\acrobat\Acrobat_sl.exe "
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe "
mRun: [SafeNetCertMngr] "c:\windows\profiles\desktop\sac\x32\SACMonitor.exe "
mRun: [ROC_ROC_JULY_P1] "c:\program files\avg secure search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\snagit~1.lnk - c:\program files\techsmith\snagit 9\SnagIt32.exe
mPolicies-explorer: NoWelcomeScreen = 1 (0x1)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\opanda\iexif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\opanda\iexif 2.3\IExifCom.htm
IE: {DE700910-58F7-4D2E-B7E6-3BA2DA1B6806} - c:\progra~1\virtua~1\CitiVAN.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: globalsign.com\system
Trusted Zone: globalsign.com\systemeu
Trusted Zone: globalsign.com\www
Trusted Zone: intuit.com\ttlc
DPF: {00000033-9593-4264-8B29-930B3E4EDCCD} - hxxps://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall33.cab
DPF: {00000035-9593-4264-8B29-930B3E4EDCCD} - hxxps://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall35.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} - hxxp://theoracle2/connectcomputer/nshelp.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1345057140468
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://meeting.juniper.net/dana-cached/setup/JuniperSetupSP1.cab
TCP: Interfaces\{384397BF-7F03-4A0C-8A9E-AA57194AC88E} : NameServer = 192.168.1.33,8.8.8.8
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - c:\program files\common files\g7ps\shared files\g7psdll\G7PS.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\12.2.6\ViProtocol.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\username\application data\mozilla\firefox\profiles\uxbww9bj.chip2012\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT206400&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B31027f3f-6c1c-4017-bc7e-27ad22e9bbdb%7D&mid=435b573cc34347d0b7e4d15a340738e6-3a3a7d2802eeb494993bc9159610032caaea0e64&ds=st011&v=11.1.0.12&lang=en&pr=sa&d=2012-07-13%2016%3A19%3A39&sap=ku&q=
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\username\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\program files (x86)\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files (x86)\adobe\reader 10.0\reader\browser\nppdf32.dll
FF - plugin: c:\program files (x86)\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin2.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin3.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin4.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin5.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin6.dll
FF - plugin: c:\program files (x86)\quicktime\plugins\npqtplugin7.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\avg secure search\sitesafetyinstaller\12.2.6\npsitesafety.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\hewlett-packard\hp virutal rooms client launcher plugin\nphpvrl.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\photodex presenter\npPxPlay.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_265.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
============= SERVICES / DRIVERS ===============
.
R0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2008-11-13 704800]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-4-25 28544]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-9-3 27496]
R2 AnonMgmtSvc;Anonymizer Management Service;c:\program files\anonymizer\anonymizer software\common\AnonMgmtSvc.exe [2008-11-17 37560]
R2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-5-10 20968]
R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\frisk software\f-prot antivirus for windows\FPAVServer.exe [2011-10-6 84136]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2012-2-6 13672]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-10-2 655944]
R2 PdiService;Portrait Displays SDK Service;c:\program files\common files\portrait displays\drivers\pdisrvc.exe [2010-8-31 109168]
R2 SACSrv;SACSrv;c:\windows\profiles\desktop\sac\x32\SACSrv.exe [2012-4-16 9872]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-4-18 399416]
R2 vToolbarUpdater12.2.6;vToolbarUpdater12.2.6;c:\program files\common files\avg secure search\vtoolbarupdater\12.2.6\ToolbarUpdater.exe [2012-9-3 722528]
R3 iKeyEnum;Rainbow iKey Enumerator;c:\windows\system32\drivers\IKEYENUM.SYS [2012-8-15 11616]
R3 iKeyIFD;Rainbow iKey Virtual Reader;c:\windows\system32\drivers\IKEYIFD.SYS [2012-8-15 18080]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-10-2 22344]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2010-7-27 60800]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2010-7-27 140672]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2010-5-10 57248]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-10 250568]
S3 EvoMouseDriverFilterHidUsb;Evoluent Mouse Driver Filter;c:\windows\system32\drivers\evomousedriverfilterhidusb.sys --> c:\windows\system32\drivers\EvoMouseDriverFilterHidUsb.sys [?]
S3 EvoMouseDriverMini;EvoMouseDriverMini;c:\windows\system32\drivers\evomousedrivermini.sys --> c:\windows\system32\drivers\EvoMouseDriverMini.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-24 114144]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
S3 RnbToken;Rainbow iKey Token Service;c:\windows\system32\drivers\RNBTOKEN.SYS [2012-8-15 21472]
S3 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-4-18 993848]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-09-04 04:10:42 -------- d-----w- c:\windows\system32\cache
2012-09-04 04:10:34 27496 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-08-30 04:17:32 -------- d-----w- C:\1 from Thumb Drive Aug2012
2012-08-20 20:45:56 -------- d-----w- C:\PST backup
2012-08-15 18:38:37 -------- dc-h--w- c:\windows\ie8
2012-08-15 18:27:17 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-08-15 18:26:50 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2012-08-15 07:25:02 48296 ----a-w- c:\windows\system32\drivers\aksifdh.sys
2012-08-15 07:25:02 34472 ----a-w- c:\windows\system32\drivers\aksup.sys
2012-08-15 07:24:24 91424 ----a-w- c:\windows\system32\iKeyAPI.dll
2012-08-15 07:24:24 75040 ----a-w- c:\windows\system32\iKey2k.dll
2012-08-15 07:24:24 165152 ----a-w- c:\windows\system32\iKeyDI.dll
2012-08-15 07:24:24 107808 ----a-w- c:\windows\system32\iKeyUI.dll
2012-08-15 07:24:10 21472 ----a-w- c:\windows\system32\drivers\RNBTOKEN.SYS
2012-08-15 07:24:10 18080 ----a-w- c:\windows\system32\drivers\IKEYIFD.SYS
2012-08-15 07:24:10 11616 ----a-w- c:\windows\system32\drivers\IKEYENUM.SYS
2012-08-15 07:24:10 -------- d-----w- c:\program files\SafeNet
.
==================== Find3M ====================
.
2012-08-23 05:43:28 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-23 05:43:28 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58:51 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 20:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40:15 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49:33 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 ------w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 ------w- c:\windows\system32\html.iec
.
============= FINISH: 14:01:42.00 ===============

 

DDS Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/12/2008 7:05:15 PM
System Uptime: 9/10/2012 1:10:57 PM (1 hours ago)
.
Motherboard: Dell Inc. | | 0HJ054
Processor: Intel(R) Pentium(R) 4 CPU 3.40GHz | Microprocessor | 3391/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 64.444 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 228.2 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is NetworkDisk (NTFS) - 35 GiB total, 22.364 GiB free.
H: is CDROM ()
I: is FIXED (NTFS) - 466 GiB total, 352.312 GiB free.
M: is NetworkDisk (NTFS) - 518 GiB total, 60.724 GiB free.
O: is NetworkDisk (NTFS) - 70 GiB total, 29.7 GiB free.
W: is Removable
X: is Removable
Y: is Removable
Z: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Multimedia Controller
Device ID: PCI\VEN_1002&DEV_4D52&SUBSYS_A3461002&REV_00\4&5855BE9&0&10F0
Manufacturer:
Name: Multimedia Controller
PNP Device ID: PCI\VEN_1002&DEV_4D52&SUBSYS_A3461002&REV_00\4&5855BE9&0&10F0
Service:
.
==== System Restore Points ===================
.
RP272: 6/12/2012 2:01:04 PM - System Checkpoint
RP273: 6/12/2012 4:45:24 PM - Software Distribution Service 3.0
RP274: 6/13/2012 11:28:33 PM - System Checkpoint
RP275: 6/14/2012 9:31:58 AM - Installed HP Virtual Rooms Client Launcher Plugin
RP276: 6/15/2012 12:11:40 PM - System Checkpoint
RP277: 6/16/2012 3:55:56 PM - System Checkpoint
RP278: 6/17/2012 8:41:58 PM - System Checkpoint
RP279: 6/19/2012 9:49:22 AM - System Checkpoint
RP280: 6/20/2012 6:34:00 PM - System Checkpoint
RP281: 6/22/2012 10:35:01 AM - System Checkpoint
RP282: 6/24/2012 1:37:25 AM - System Checkpoint
RP283: 6/25/2012 7:52:01 AM - Software Distribution Service 3.0
RP284: 6/26/2012 8:55:09 AM - System Checkpoint
RP285: 6/27/2012 4:54:34 PM - System Checkpoint
RP286: 6/28/2012 9:22:46 PM - System Checkpoint
RP287: 6/30/2012 11:42:02 AM - System Checkpoint
RP288: 7/1/2012 6:34:37 PM - System Checkpoint
RP289: 7/2/2012 7:18:45 PM - System Checkpoint
RP290: 7/3/2012 7:31:50 PM - System Checkpoint
RP291: 7/4/2012 8:41:25 PM - System Checkpoint
RP292: 7/6/2012 1:19:03 PM - System Checkpoint
RP293: 7/8/2012 12:18:38 PM - System Checkpoint
RP294: 7/9/2012 3:37:55 PM - System Checkpoint
RP295: 7/10/2012 4:12:17 PM - System Checkpoint
RP296: 7/10/2012 11:47:33 PM - Software Distribution Service 3.0
RP297: 7/12/2012 1:07:20 AM - Installed Java(TM) 7 Update 5
RP298: 7/12/2012 1:08:16 AM - Installed JavaFX 2.1.1
RP299: 7/13/2012 7:34:02 AM - System Checkpoint
RP300: 7/14/2012 10:30:04 AM - System Checkpoint
RP301: 7/15/2012 11:15:54 AM - System Checkpoint
RP302: 7/16/2012 5:13:02 PM - System Checkpoint
RP303: 7/17/2012 6:49:12 PM - System Checkpoint
RP304: 7/18/2012 8:40:48 PM - System Checkpoint
RP305: 7/19/2012 11:50:41 PM - System Checkpoint
RP306: 7/20/2012 11:44:54 PM - Software Distribution Service 3.0
RP307: 7/22/2012 12:30:00 AM - System Checkpoint
RP308: 7/23/2012 1:59:23 PM - System Checkpoint
RP309: 7/25/2012 1:20:10 AM - System Checkpoint
RP310: 7/26/2012 2:17:31 PM - System Checkpoint
RP311: 7/26/2012 5:30:39 PM - Removed Adobe Acrobat 9 Pro Extended - English, Français, Deutsch.
RP312: 7/26/2012 5:40:25 PM - Installed Adobe Acrobat X Pro - English, Français, Deutsch.
RP313: 7/27/2012 6:08:44 PM - System Checkpoint
RP314: 7/29/2012 1:00:28 AM - System Checkpoint
RP315: 7/30/2012 4:24:20 PM - System Checkpoint
RP316: 7/31/2012 4:42:41 PM - System Checkpoint
RP317: 8/2/2012 10:47:53 AM - System Checkpoint
RP318: 8/3/2012 1:15:47 PM - System Checkpoint
RP319: 8/4/2012 1:45:52 PM - System Checkpoint
RP320: 8/5/2012 4:01:26 PM - System Checkpoint
RP321: 8/6/2012 7:26:07 PM - System Checkpoint
RP322: 8/7/2012 1:14:13 PM - Installed Epubor ADE ePub&PDF DRM Removal
RP323: 8/8/2012 11:39:38 PM - System Checkpoint
RP324: 8/10/2012 2:43:50 PM - System Checkpoint
RP325: 8/13/2012 12:04:03 PM - System Checkpoint
RP326: 8/14/2012 1:47:31 PM - Software Distribution Service 3.0
RP327: 8/15/2012 12:23:56 AM - Installed GlobalSign - SafeNet Authentication Client 8.1 SP2
RP328: 8/15/2012 11:39:50 AM - Installed Windows Internet Explorer 8.
RP329: 8/15/2012 11:41:02 AM - Software Distribution Service 3.0
RP330: 8/15/2012 12:05:39 PM - Software Distribution Service 3.0
RP331: 8/16/2012 12:58:23 PM - System Checkpoint
RP332: 8/17/2012 1:05:50 PM - System Checkpoint
RP333: 8/19/2012 10:13:29 AM - System Checkpoint
RP334: 8/20/2012 1:15:14 PM - System Checkpoint
RP335: 8/21/2012 2:06:34 PM - System Checkpoint
RP336: 8/22/2012 4:50:30 PM - System Checkpoint
RP337: 8/23/2012 5:38:14 PM - System Checkpoint
RP338: 8/24/2012 6:19:16 PM - System Checkpoint
RP339: 8/25/2012 6:37:09 PM - System Checkpoint
RP340: 8/26/2012 7:10:11 PM - System Checkpoint
RP341: 8/27/2012 10:53:02 PM - System Checkpoint
RP342: 8/28/2012 11:20:02 PM - System Checkpoint
RP343: 8/30/2012 2:11:56 PM - System Checkpoint
RP344: 8/31/2012 3:07:51 PM - System Checkpoint
RP345: 9/1/2012 4:40:44 PM - System Checkpoint
RP346: 9/3/2012 12:12:04 PM - System Checkpoint
RP347: 9/4/2012 4:19:15 PM - System Checkpoint
RP348: 9/6/2012 8:49:40 AM - System Checkpoint
RP349: 9/7/2012 12:37:18 PM - System Checkpoint
RP350: 9/8/2012 1:38:29 PM - System Checkpoint
RP351: 9/9/2012 3:14:27 PM - System Checkpoint
.
==== Installed Programs ======================
.
7-Zip 9.20
A-PDF Restrictions Remover 1.6
Acer eDisplay Management
Acrobat.com
Active@ ISO Burner
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Presenter 7
Adobe Reader X (10.1.1)
Adobe Setup
Adobe Shockwave Player 11.6
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Amazon Kindle
Anonymizer Software
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
AutoUpdate
AVG Security Toolbar
Belarc Advisor 8.1
Blender (remove only)
Bonjour
Bonjour Print Services
Broadcom 440x 10/100 Integrated Controller
BurnOn CD&DVD, Version 3.1.0 ( Build 2007-4-2, Win32, )
CamStudio
Canon Utilities Digital Photo Professional 3.9
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
CCleaner
ClubWPT
CoreAVC Professional Edition (remove only)
CPUID CPU-Z 1.54
Critical Update for Windows Media Player 11 (KB959772)
CyberLink PhotoNow
CyberLink PowerDirector
Dell Resource CD
Diskeeper Server Standard Edition
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Duplicate Email Remover
DVD Decrypter (Remove Only)
EditPlus 2
Epubor ADE ePub&PDF DRM Removal
Everio MediaBrowser HD Edition
Extract Metadata From Multiple Files Software
F-PROT Antivirus for Windows
FileZilla Client 3.5.3
Full Tilt Poker
Gammadyne Mailer
Garmin City Navigator North America NT 2011.31 Update
GlobalSign - SafeNet Authentication Client 8.1 SP2
Good Keywords v3 072809
Google Calendar Sync
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
GoToMeeting 5.2.0.952
GPL MPEG-1/2 DirectShow Decoder Filter
GSiteCrawler
Haali Media Splitter
HD264 Pack
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB969084)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Virtual Rooms Client Launcher Plugin
HTML Text Extractor
Intel(R) PRO Network Connections Drivers
InterActual Player
Ipswitch WS_FTP Pro
iWisoft Free Video Converter 1.2
Java Auto Updater
Java(TM) 6 Update 26
Java(TM) 7 Update 5
JavaFX 2.1.1
Juniper Networks Secure Meeting 6.2.0
jv16 PowerTools 2009
Lizardtech DjVu Control
MailingCheck
Malwarebytes Anti-Malware version 1.62.0.1300
Mask Pro 4.1.9a
MediaCoder 2011
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Expression Encoder 4
Microsoft Expression Encoder 4 Screen Capture Codec
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Report Viewer Redistributable 2008 (KB971119)
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Sync Framework Runtime v1.0 (x86)
Microsoft Sync Framework Services v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual Studio 2005 Tools for Office Runtime
Mozilla Firefox 15.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MyPublisher
NVIDIA Drivers
NVIDIA PhysX
Opanda IExif 2.3
Panda ActiveScan 2.0
PDF Settings
Photo Mechanic 4.6
Photo Mechanic 4.6.6
Photodex Presenter
Pivot Software
PokerStars
PowerISO
Pro Studio Manager ver.3.5
ProShow Gold
Python 2.6.5
QIF2
QuickBooks
QuickBooks Pro 2007
QuickBooks Pro 2010
QuickBooks Pro Edition 2004
QuickBooks Product Listing Service
QuickGamma 3.0.0.2
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Renesas Electronics USB 3.0 Host Controller Driver
RideMax for Disneyland 5.1
SafeNet iKey Driver v4.1.1.5
SanctionedMedia
SDK
Secunia PSI (2.0.0.3003)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Internet Explorer 7 (KB2530548)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB2559049)
Security Update for Windows Internet Explorer 7 (KB2586448)
Security Update for Windows Internet Explorer 7 (KB2618444)
Security Update for Windows Internet Explorer 7 (KB2647516)
Security Update for Windows Internet Explorer 7 (KB2675157)
Security Update for Windows Internet Explorer 7 (KB2699988)
Security Update for Windows Internet Explorer 7 (KB2722913)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2483614)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Shadow Copy Client
ShredXP
Shutterfly Express Uploader
SigmaTel Audio
SmartSound Quicktracks Plugin
SnagIt 9
Spelling Dictionaries Support For Adobe Reader 9
SPSS 16.0 for Windows
Spybot - Search & Destroy
SupportSoft Assisted Service
swMSM
SyncToy 2.0 (x86)
Tournament Indicator 1.7.8
TurboTax 2011
TurboTax 2011 WinPerFedFormset
TurboTax 2011 WinPerReleaseEngine
TurboTax 2011 WinPerTaxSupport
TurboTax 2011 wmiiper
TurboTax 2011 wrapper
TurboTax 2011 wvaiper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687400) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows Internet Explorer 8 (KB2632503)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2264107)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2492386)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB898461)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VersaCheck 2004 Silver Express
Virtual Account Numbers
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
WinZip
Yahoo! BrowserPlus 2.9.8
Yahoo! Messenger
.
==== Event Viewer Messages From Past Week ========
.
9/7/2012 7:29:40 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service winmgmt with arguments " " in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
9/5/2012 7:11:56 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
9/5/2012 12:54:26 PM, error: EFS [6028] - EFS recovery policy contains invalid recovery certificate.
9/4/2012 3:58:44 PM, error: NETLOGON [5719] - No Domain Controller is available for domain MYLAN due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.
.
==== End Of File ===========================

 

All Logs Are Now Posted for Review

Hi Broni,

Sorry I posted this piecemeal. I have now posted all requested logs and am hoping that all I need to do is wipe out the bad restore point(s). Thanks in advance!

 

Hi Broni,

I followed your instructions above and am in the process of running another full virus scan to see if the system comes clean. This scan will take over an hour. Assuming it finds nothing, is it safe to consider the PC clean and to label the thread "resolved "? Or do we need to do more tests?

 

Confirmed Clean AV Scan

The full computer scan was completed and it came back clean. The thread can be marked as resolved. Thank you!