Help getting rid of svchost?

stringerbell · September 13, 2013

Hey guys,

I've noticed in the past few days that my laptop is running incredibly slow. When I open up the "Processes" tab in Task Manager, svchost.exe is eating up most of my memory and causing the CPU usage to stick close to 100 percent all the time. I've tried running various malware and virus scans (malwarebytes, AVG) and have not been able to resolve the issues.

I'm wondering if anyone can help me out here?

Cheers!

MrCharlie · September 13, 2013

Welcome to the forum, please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes and use the default font)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, Adobe host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

stringerbell · September 14, 2013

Hi MrCharlie,

Thanks for your help. I deleted uTorrent, per your instrux. Below are the two reports from the DDS scans:

DDS.txt

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16506 BrowserJavaVersion: 10.21.2

Run by Owner at 21:44:55 on 2013-09-13

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3963.2068 [GMT -6:00]

.

AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

C:\Windows\system32\agr64svc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe

C:\Windows\SysWOW64\NLSSRV32.EXE

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe

C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe

C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe

c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe

C:\Windows\system32\taskeng.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RAVCpl64.exe

C:\Program Files\ltmoh\ltmoh.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Windows\System32\spool\drivers\x64\3\E_FATIADA.EXE

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe

c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\PROGRA~2\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: NCO 2.0 IE BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files (x86)\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll

BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Common Files\Symantec Shared\IDS\IPSBHO.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.5.0.2\AVG Secure Search_toolbar.dll

BHO: TopArcadeHits Games: {A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} - C:\Users\Owner\AppData\Local\TopArcadeHits\Toparcadehits.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: Show Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files (x86)\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.5.0.2\AVG Secure Search_toolbar.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

uRun: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

uRun: [surfEasy] C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe startup

uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

uRun: [ConduitFloatingPlugin_blklojfklgnogjaijkibhfjepakiocng] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3311875\plugins\TBVerifier.dll",RunConduitFloatingPlugin blklojfklgnogjaijkibhfjepakiocng

mRun: [NDSTray.exe] NDSTray.exe

mRun: [cfFncEnabler.exe] cfFncEnabler.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"

mRun: [iTSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START

mRun: [ccApp] "c:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"

mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

TCP: NameServer = 192.168.1.254 75.153.176.9

TCP: Interfaces\{0D15C9E9-8C50-4E9D-8C70-70055A90124F} : DHCPNameServer = 192.168.1.254 75.153.176.9

TCP: Interfaces\{AE283F41-237D-4312-8A50-B19CE21EC17A} : DHCPNameServer = 4.2.2.2 8.8.8.8

TCP: Interfaces\{E6FF3982-9DEB-41F7-952B-4DF0F9729637} : DHCPNameServer = 192.168.1.254 75.153.176.9

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll

SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll

STS: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [RtHDVCpl] RAVCpl64.exe

x64-Run: [skytel] Skytel.exe

x64-Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE

x64-Run: [HSON] C:\Program Files (x86)\TOSHIBA\TBS\HSON.exe

x64-Run: [smoothView] C:\Program Files (x86)\Toshiba\SmoothView\SmoothView.exe

x64-Run: [00TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe

x64-Run: [EPSON Stylus CX4800 Series] C:\Windows\System32\spool\DRIVERS\x64\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"

x64-mPolicies-Explorer: NoActiveDesktop = dword:1

x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

x64-mPolicies-System: EnableLUA = dword:0

x64-mPolicies-System: EnableUIADesktopToggle = dword:0

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll

x64-STS: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll

.

============= SERVICES / DRIVERS ===============

.

R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-10-10 45856]

R1 IDSvia64;Symantec Intrusion Prevention Driver;C:\PROGRA~3\Symantec\DEFINI~1\SymcData\ipsdefs\20120927.001\IDSvia64.sys [2012-9-28 383096]

R3 cbfs3;EldoS Callback File System driver v3;C:\Windows\System32\drivers\cbfs3.sys [2013-6-1 352144]

R3 FwLnk;FwLnk Driver;C:\Windows\System32\drivers\FwLnk.sys [2008-5-15 8704]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-9-12 25928]

R3 NETw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETw5v64.sys [2008-11-17 4751360]

S3 COH_Mon;COH_Mon;C:\Windows\System32\drivers\COH_Mon.sys [2012-8-2 25424]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2012-12-16 102368]

.

=============== File Associations ===============

.

FileExt: .js: JSFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

.

=============== Created Last 30 ================

.

==================== Find3M ====================

.

2013-09-13 19:07:16 15680 ----a-w- C:\Windows\System32\drivers\SWDUMon.sys

2013-09-12 10:26:10 79143768 ----a-w- C:\Windows\System32\mrt.exe

2013-08-15 05:40:26 45856 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys

2013-08-08 02:03:11 2775552 ----a-w- C:\Windows\System32\win32k.sys

2013-08-02 14:06:01 1706496 ----a-w- C:\Windows\System32\WMVDECOD.DLL

2013-08-02 04:09:35 1548288 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL

2013-07-31 14:17:31 17833472 ----a-w- C:\Windows\System32\mshtml.dll

2013-07-31 13:42:12 10926080 ----a-w- C:\Windows\System32\ieframe.dll

2013-07-31 13:29:19 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2013-07-31 13:20:02 1346560 ----a-w- C:\Windows\System32\urlmon.dll

2013-07-31 13:19:03 1392128 ----a-w- C:\Windows\System32\wininet.dll

2013-07-31 13:18:24 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2013-07-31 13:17:24 237056 ----a-w- C:\Windows\System32\url.dll

2013-07-31 13:16:12 85504 ----a-w- C:\Windows\System32\jsproxy.dll

2013-07-31 13:14:29 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2013-07-31 13:13:07 599040 ----a-w- C:\Windows\System32\vbscript.dll

2013-07-31 13:13:05 816640 ----a-w- C:\Windows\System32\jscript.dll

2013-07-31 13:11:46 2147840 ----a-w- C:\Windows\System32\iertutil.dll

2013-07-31 13:11:41 729088 ----a-w- C:\Windows\System32\msfeeds.dll

2013-07-31 13:09:35 96768 ----a-w- C:\Windows\System32\mshtmled.dll

2013-07-31 13:08:44 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2013-07-31 13:05:14 248320 ----a-w- C:\Windows\System32\ieui.dll

2013-07-31 10:30:56 12335104 ----a-w- C:\Windows\SysWow64\mshtml.dll

2013-07-31 10:05:18 9738752 ----a-w- C:\Windows\SysWow64\ieframe.dll

2013-07-31 10:00:20 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-07-31 09:53:17 1104896 ----a-w- C:\Windows\SysWow64\urlmon.dll

2013-07-31 09:52:44 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-07-31 09:52:34 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2013-07-31 09:51:29 231936 ----a-w- C:\Windows\SysWow64\url.dll

2013-07-31 09:49:58 65024 ----a-w- C:\Windows\SysWow64\jsproxy.dll

2013-07-31 09:48:43 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2013-07-31 09:48:28 717824 ----a-w- C:\Windows\SysWow64\jscript.dll

2013-07-31 09:48:09 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2013-07-31 09:47:20 607744 ----a-w- C:\Windows\SysWow64\msfeeds.dll

2013-07-31 09:46:37 1796096 ----a-w- C:\Windows\SysWow64\iertutil.dll

2013-07-31 09:45:59 73216 ----a-w- C:\Windows\SysWow64\mshtmled.dll

2013-07-31 09:45:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-07-31 09:42:36 176640 ----a-w- C:\Windows\SysWow64\ieui.dll

2013-07-17 20:01:51 2048 ----a-w- C:\Windows\System32\tzres.dll

2013-07-17 19:41:34 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2013-07-16 09:25:53 689152 ----a-w- C:\Windows\System32\themeui.dll

2013-07-16 04:35:16 615936 ----a-w- C:\Windows\SysWow64\themeui.dll

2013-07-10 09:47:49 677888 ----a-w- C:\Windows\SysWow64\rpcrt4.dll

2013-07-10 09:42:55 1303552 ----a-w- C:\Windows\System32\rpcrt4.dll

2013-07-09 12:04:30 1585256 ----a-w- C:\Windows\System32\ntdll.dll

2013-07-09 12:04:30 1168088 ----a-w- C:\Windows\SysWow64\ntdll.dll

2013-07-08 04:51:57 4691904 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-07-08 04:20:17 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2013-07-08 04:20:04 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll

2013-07-08 04:18:51 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2013-07-08 04:16:55 98304 ----a-w- C:\Windows\SysWow64\cryptnet.dll

2013-07-08 04:16:55 133120 ----a-w- C:\Windows\SysWow64\cryptsvc.dll

2013-07-08 04:16:54 992768 ----a-w- C:\Windows\SysWow64\crypt32.dll

2013-07-08 04:16:33 43008 ----a-w- C:\Windows\apppatch\acwow64.dll

2013-07-08 04:15:39 234496 ----a-w- C:\Windows\System32\wow64.dll

2013-07-08 04:15:25 218624 ----a-w- C:\Windows\System32\wintrust.dll

2013-07-08 04:14:21 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2013-07-08 04:12:34 174592 ----a-w- C:\Windows\System32\cryptsvc.dll

2013-07-08 04:12:34 132096 ----a-w- C:\Windows\System32\cryptnet.dll

2013-07-08 04:12:34 1276416 ----a-w- C:\Windows\System32\crypt32.dll

2013-07-08 01:39:04 26112 ----a-w- C:\Windows\SysWow64\setup16.exe

2013-07-08 01:39:03 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2013-07-08 01:39:02 2560 ----a-w- C:\Windows\SysWow64\user.exe

2013-07-05 04:45:27 1423808 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-06-17 20:50:44 39608 ----a-w- C:\Windows\System32\drivers\tapse01.sys

.

============= FINISH: 21:50:40.00 ===============

Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 8/2/2012 2:07:59 PM

System Uptime: 9/13/2013 7:31:10 PM (2 hours ago)

.

Motherboard: Intel Corp. | | Base Board Product Name

Processor: Intel® Core2 Duo CPU T5800 @ 2.00GHz | CPU | 800/800mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 289 GiB total, 14.223 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {a0a588a4-c46f-4b37-b7ea-c82fe89870c6}

Description: SDA Standard Compliant SD Host Controller

Device ID: PCI\VEN_1180&DEV_0822&SUBSYS_FF1E1179&REV_22\4&22FF54F3&0&31F0

Manufacturer: SDA Standard Compliant SD Host Controller Vendor

Name: SDA Standard Compliant SD Host Controller

PNP Device ID: PCI\VEN_1180&DEV_0822&SUBSYS_FF1E1179&REV_22\4&22FF54F3&0&31F0

Service: sdbus

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Activation Assistant for the 2007 Microsoft Office suites

Adobe Acrobat X Pro - English, Français, Deutsch

Adobe Flash Player ActiveX

Adobe Reader 8.1.2

Age of Empires Online

AppCore

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Audacity 2.0.2

Auto Clicker v1.2

AVG Security Toolbar

Backup

Bluetooth Stack for Windows by Toshiba

Bonjour

BrowserProtect

Bundled software uninstaller

Camera Assistant Software for Toshiba

ccCommon

ccCommon64

CD/DVD Drive Acoustic Silencer

Compatibility Pack for the 2007 Office system

ContinueToSave 1.74

CutePDF Writer 3.0

DriverHub

DVD MovieFactory for TOSHIBA

EPSON Printer Software

EPSON Scan

ESET Online Scanner v3

Free Mouse Auto Clicker 3.0

GearDrvs

Google Chrome

Google Drive

Google Talk Plugin

Google Toolbar for Internet Explorer

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)

IB Updater Service

IBM SPSS Statistics 19

iExplorer 3.2.2.5

ImgBurn

Intel® Graphics Media Accelerator Driver

Internet Explorer Toolbar 4.6 by SweetPacks

iTunes

Java 7 Update 21

Java Auto Updater

Java 6 Update 33

Java 6 Update 6

LiveUpdate (Symantec Corporation)

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2833941)

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Works

Microsoft XML Parser

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nitro Pro 8

Norton 360

Norton 360 (Symantec Corporation)

Norton 360 HTMLHelp

Norton Confidential Core

OpenOffice.org 3.4.1

Pando Media Booster

QuickTime

Realtek 8169 8168 8101E 8102E Ethernet Driver

Realtek High Definition Audio Driver

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02

Samsung Kies

SAMSUNG USB Driver for Mobile Phones

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760588) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760823) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2760583) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2767773) 32-Bit Edition

Security Update for Windows Media Encoder (KB2447961)

Skype™ 6.1

SPBBC 64bit

Steam

SurfEasy VPN 1.0.210

Symantec Real Time Storage Protection Component (x64)

Symantec Technical Support Controls

SymNet x64

Synaptics Pointing Device Driver

TeraCopy 2.27

TopArcadeHits

Toshiba Assist

TOSHIBA ConfigFree

TOSHIBA Disc Creator

TOSHIBA DVD PLAYER

TOSHIBA Extended Tiles for Windows Mobility Center

TOSHIBA Face Recognition

TOSHIBA Hardware Setup

TOSHIBA Recovery Disc Creator

Toshiba Registration

TOSHIBA SD Memory Utilities

TOSHIBA Software Modem

TOSHIBA Speech System Applications

TOSHIBA Speech System SR Engine(U.S.) Version1.0

TOSHIBA Speech System TTS Engine(U.S.) Version1.0

TOSHIBA Supervisor Password

TOSHIBA Value Added Package

Tropico 4 1.00

TuneUp Utilities 2013

TuneUp Utilities Language Pack (en-US)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB2836940)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update Manager for SweetPacks 1.1

VIDEOzilla v3.5

Visual Studio 2010 x64 Redistributables

VLC media player 2.0.3

VSO ConvertXToDVD

Windows Driver Package - TOSHIBA (FwLnk) System (11/19/2006 1.0.0.3)

Windows Live ID Sign-in Assistant

Windows Media Encoder 9 Series

WinRAR 4.20 (32-bit)

WinZip 16.5

.

==== Event Viewer Messages From Past Week ========

.

9/13/2013 3:03:00 PM, Error: Service Control Manager [7000] - The BrowserProtect service failed to start due to the following error: The system cannot find the file specified.

9/13/2013 12:59:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

9/13/2013 12:59:04 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

9/13/2013 12:58:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

9/13/2013 12:58:27 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC eeCtrl NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr SRTSPX SymIM SYMTDI tdx Wanarpv6 ws2ifsl

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

9/13/2013 12:58:27 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

9/13/2013 12:57:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

9/13/2013 12:57:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

9/13/2013 12:57:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}

9/13/2013 12:57:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

9/13/2013 12:57:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

9/13/2013 12:57:07 PM, Error: EventLog [6008] - The previous system shutdown at 12:54:57 PM on 9/13/2013 was unexpected.

9/13/2013 12:53:35 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.8.2.178 for the Network Card with network address 00FFAE283F41 has been denied by the DHCP server 10.8.3.9 (The DHCP Server sent a DHCPNACK message).

9/13/2013 12:48:22 PM, Error: EventLog [6008] - The previous system shutdown at 12:45:51 PM on 9/13/2013 was unexpected.

9/13/2013 12:45:09 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.8.4.26 for the Network Card with network address 00FFAE283F41 has been denied by the DHCP server 10.8.2.177 (The DHCP Server sent a DHCPNACK message).

9/13/2013 12:39:15 PM, Error: EventLog [6008] - The previous system shutdown at 12:37:08 PM on 9/13/2013 was unexpected.

9/13/2013 12:37:01 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.8.2.178 for the Network Card with network address 00FFAE283F41 has been denied by the DHCP server 10.8.4.25 (The DHCP Server sent a DHCPNACK message).

9/13/2013 12:31:33 PM, Error: EventLog [6008] - The previous system shutdown at 12:29:20 PM on 9/13/2013 was unexpected.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7034] - The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s).

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The Tablet PC Input Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

9/13/2013 12:17:52 PM, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

9/13/2013 12:17:51 PM, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

9/13/2013 12:17:51 PM, Error: Service Control Manager [7031] - The ReadyBoost service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

9/13/2013 12:17:51 PM, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

9/13/2013 12:17:51 PM, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.

9/13/2013 12:15:19 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.8.2.178 for the Network Card with network address 00FFAE283F41 has been denied by the DHCP server 10.8.2.177 (The DHCP Server sent a DHCPNACK message).

9/13/2013 12:13:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.

9/13/2013 12:12:51 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

9/13/2013 12:12:51 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).

9/13/2013 12:09:55 PM, Error: EventLog [6008] - The previous system shutdown at 10:07:40 AM on 9/13/2013 was unexpected.

9/13/2013 10:01:22 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.8.3.10 for the Network Card with network address 00FFAE283F41 has been denied by the DHCP server 10.8.2.177 (The DHCP Server sent a DHCPNACK message).

9/13/2013 1:09:44 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.8.3.10 for the Network Card with network address 00FFAE283F41 has been denied by the DHCP server 10.8.2.241 (The DHCP Server sent a DHCPNACK message).

.

==== End Of File ===========================

stringerbell · September 14, 2013

And the log from Roguekiller:

RogueKiller V8.6.11 _x64_ [sep 11 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version

Started in : Normal mode

User : Owner [Admin rights]

Mode : Scan -- Date : 09/13/2013 22:19:12

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 9 ¤¤¤

[sERVICE][bLACKLIST] HKLM\[...]\CCSet\[...]\Services : BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]) -> FOUND

[sERVICE][bLACKLIST] HKLM\[...]\CS001\[...]\Services : BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]) -> FOUND

[sERVICE][bLACKLIST] HKLM\[...]\CS002\[...]\Services : BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]) -> FOUND

[sERVICE][bLACKLIST] HKLM\[...]\CS003\[...]\Services : BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]) -> FOUND

[HJ POL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 10 ¤¤¤

[V1][sUSP PATH] TopArcadeHits.job : C:\Users\Owner\AppData\Local\TopArcadeHits\updater.exe [7] -> FOUND

[V1][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-806612272-4183551136-1458202646-1000UA.job : C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> FOUND

[V1][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-806612272-4183551136-1458202646-1000Core.job : C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> FOUND

[V1][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_TB_rmv.job : C:\Windows\TEMP\{AD8C9B1E-A23E-479C-9E1B-A6412BC845D8}.exe - --uninstall=1 [x] -> FOUND

[V1][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_HP_rmv.job : C:\Windows\TEMP\{6B4D2D28-F68A-44F7-B8D7-1BC5C41E8A45}.exe - --uninstall=1 [x] -> FOUND

[V2][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_HP_rmv : C:\Windows\TEMP\{6B4D2D28-F68A-44F7-B8D7-1BC5C41E8A45}.exe - --uninstall=1 [x] -> FOUND

[V2][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_TB_rmv : C:\Windows\TEMP\{AD8C9B1E-A23E-479C-9E1B-A6412BC845D8}.exe - --uninstall=1 [x] -> FOUND

[V2][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-806612272-4183551136-1458202646-1000Core : C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> FOUND

[V2][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-806612272-4183551136-1458202646-1000UA : C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> FOUND

[V2][sUSP PATH] TopArcadeHits : C:\Users\Owner\AppData\Local\TopArcadeHits\updater.exe [7] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com

127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com

127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com

127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com

127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com

127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000LPVT-16G33T0 ATA Device +++++

--- User ---

[MBR] c40b3a81dfb06c69a9dcebc7c912809d

[bSP] d511d35cd5662a3456534a71ce17c739 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 29533 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 60484725 | Size: 296057 Mo

2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 666809955 | Size: 151346 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_09132013_221912.txt >>

MrCharlie · September 14, 2013

Did you read this warning:

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, Adobe host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

Your Host file: (used to by-pass Adobe activation)

127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com

stringerbell · September 14, 2013

My bad, it's difficult to remember if some of these things were cracked. Do I need to delete and re-run the scans?

MrCharlie · September 14, 2013

Run RogueKiller again and click Scan

When the scan completes ..............

Click Fix Host on the right hand column under Options

Reboot and run another scan with RogueKiller and post the new log....MrC

stringerbell · September 15, 2013

Okay, deleted my cracked Adobe software and completed the steps you asked for. Here's the log of the RK scan after everything: