DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17496
Run by Diana at 16:05:24 on 2014-12-18
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6031.3807 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Enabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\SysWOW64\AsHookDevice.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Secunia\PSI\PSIA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe
C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe
C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Windows\System32\vds.exe
C:\Program Files (x86)\Secunia\PSI\sua.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DFDWiz.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.com/?gws_rd=ssl
uProxyOverride = <-loopback>
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
uRun: [WinPatrol] C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe -expressboot
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [EaseUs Watch] "C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe"
mRun: [EaseUs Tray] "C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe"
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: C:\Users\Diana\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SECUNI~1.LNK - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:28
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxp://download.macromedia.com/pub/shockwave/cabs/authorware/awswaxf.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{59695647-A96B-44F9-B00A-07A63E9F4A60} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon
x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
x64-DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Diana\AppData\Roaming\Mozilla\Firefox\Profiles\tom6abi5.default\
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll
.
============= SERVICES / DRIVERS ===============
.
R0 EUBAKUP;EUBAKUP;C:\Windows\System32\drivers\eubakup.sys [2012-3-21 57480]
R0 EUBKMON;EUBKMON;C:\Windows\System32\drivers\EUBKMON.sys [2012-3-21 48264]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-7-17 269008]
R1 EUDSKACS;EUDSKACS;C:\Windows\System32\drivers\eudskacs.sys [2012-3-21 19592]
R1 EUFDDISK;EUFDDISK;C:\Windows\System32\drivers\EuFdDisk.sys [2012-3-21 189576]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-8-11 140672]
R2 Device Handle Service;Device Handle Service;C:\Windows\SysWOW64\AsHookDevice.exe [2010-8-2 203392]
R2 EaseUS Agent;EaseUS Agent;C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [2012-3-21 61064]
R2 Guard Agent;Guard Agent;C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [2012-3-21 23176]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2014-1-3 14624]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-3-20 125584]
R2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2012-6-27 1326176]
R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2012-6-27 681056]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-8-2 2314240]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-8-2 56344]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-8-2 271872]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-8-22 368624]
R3 PSI;PSI;C:\Windows\System32\drivers\psi_mf.sys [2011-12-16 17976]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;C:\Windows\System32\drivers\BVRPMPR5a64.SYS [2012-5-10 35840]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-8-2 61280]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2009-8-6 704864]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-12-10 114688]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-8-6 129752]
S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;C:\Windows\System32\drivers\netr28x.sys [2009-6-10 620544]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-5-2 19456]
S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2012-6-10 31800]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-5-2 56832]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2014-7-28 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-6-9 1255736]
.
=============== File Associations ===============
.
FileExt: .js: JSFile=C:\Windows\System32\WScript.exe "%1" %* [UserChoice]
.
=============== Created Last 30 ================
.
2014-12-18 14:04:56 11870360 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B426D71B-E714-43CA-9611-8906AADAA7AF}\mpengine.dll
2014-12-18 10:07:46 1188440 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{93E599F1-7459-4803-91D4-4302967EA7F6}\gapaengine.dll
2014-12-18 10:07:32 11870360 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-12-17 18:49:53 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2014-12-17 18:49:53 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2014-12-11 08:10:21 -------- d-----w- C:\Windows\System32\appraiser
2014-12-11 08:02:21 4121600 ----a-w- C:\Windows\System32\mf.dll
2014-12-11 08:02:21 3209728 ----a-w- C:\Windows\SysWow64\mf.dll
2014-12-10 10:48:44 1188440 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{97EE246C-EB8A-41FD-A5A3-0322C7F66913}\gapaengine.dll
2014-12-10 10:33:03 830976 ----a-w- C:\Windows\System32\appraiser.dll
2014-12-10 10:33:03 741376 ----a-w- C:\Windows\System32\invagent.dll
2014-12-10 10:33:03 192000 ----a-w- C:\Windows\System32\aepic.dll
2014-12-10 10:33:03 1232040 ----a-w- C:\Windows\System32\aitstatic.exe
2014-12-10 10:33:03 1083392 ----a-w- C:\Windows\System32\aeinv.dll
2014-12-10 10:33:02 413184 ----a-w- C:\Windows\System32\generaltel.dll
2014-12-10 10:33:02 396800 ----a-w- C:\Windows\System32\devinv.dll
2014-12-10 10:33:01 227328 ----a-w- C:\Windows\System32\aepdu.dll
2014-12-09 20:26:02 3981488 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
2014-12-03 06:31:20 227048 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll
2014-11-25 18:59:38 18638520 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL
2014-11-20 21:15:18 -------- d-----w- C:\$RECYCLE.BIN
2014-11-20 21:14:58 -------- d-sh--w- C:\Users\Diana\AppData\Local\EmieBrowserModeList
2014-11-19 09:31:16 1217192 ----a-w- C:\Windows\SysWow64\FM20.DLL
.
==================== Find3M ====================
.
2014-12-09 20:26:12 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-12-09 20:26:12 701104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-11-22 03:06:23 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-11-22 03:06:11 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2014-11-22 02:50:39 66560 ----a-w- C:\Windows\System32\iesetup.dll
2014-11-22 02:50:10 580096 ----a-w- C:\Windows\System32\vbscript.dll
2014-11-22 02:49:54 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2014-11-22 02:48:20 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
2014-11-22 02:35:29 114688 ----a-w- C:\Windows\System32\ieetwcollector.exe
2014-11-22 02:34:51 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
2014-11-22 02:34:07 6039552 ----a-w- C:\Windows\System32\jscript9.dll
2014-11-22 02:26:31 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-11-22 02:20:44 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-11-22 02:14:16 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-11-22 02:07:43 501248 ----a-w- C:\Windows\SysWow64\vbscript.dll
2014-11-22 02:07:17 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-11-22 02:06:32 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05:02 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2014-11-22 01:54:30 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2014-11-22 01:47:10 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2014-11-22 01:46:58 2125312 ----a-w- C:\Windows\System32\inetcpl.cpl
2014-11-22 01:40:04 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29:26 4299264 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-11-22 01:28:21 2358272 ----a-w- C:\Windows\System32\wininet.dll
2014-11-22 01:22:49 2052096 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-11-22 01:21:57 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:00:20 1888256 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-11-14 20:07:00 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-11-11 03:09:06 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll
2014-11-11 03:08:52 241152 ----a-w- C:\Windows\System32\pku2u.dll
2014-11-11 03:08:48 728064 ----a-w- C:\Windows\System32\kerberos.dll
2014-11-11 02:44:45 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44:32 186880 ----a-w- C:\Windows\SysWow64\pku2u.dll
2014-11-11 02:44:25 550912 ----a-w- C:\Windows\SysWow64\kerberos.dll
2014-11-11 01:46:26 119296 ----a-w- C:\Windows\System32\drivers\tdx.sys
2014-11-08 03:16:08 2048 ----a-w- C:\Windows\System32\tzres.dll
2014-11-08 02:45:09 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2014-10-30 11:25:26 275080 ------w- C:\Windows\System32\MpSigStub.exe
2014-10-30 02:03:43 165888 ----a-w- C:\Windows\System32\charmap.exe
2014-10-30 01:45:43 155136 ----a-w- C:\Windows\SysWow64\charmap.exe
2014-10-25 01:57:59 77824 ----a-w- C:\Windows\System32\packager.dll
2014-10-25 01:32:37 67584 ----a-w- C:\Windows\SysWow64\packager.dll
2014-10-18 02:05:23 861696 ----a-w- C:\Windows\System32\oleaut32.dll
2014-10-18 01:33:18 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2014-10-14 02:16:37 155064 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2014-10-14 02:13:06 683520 ----a-w- C:\Windows\System32\termsrv.dll
2014-10-14 02:13:00 3241984 ----a-w- C:\Windows\System32\msi.dll
2014-10-14 02:12:57 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
2014-10-14 02:09:31 146432 ----a-w- C:\Windows\System32\msaudite.dll
2014-10-14 02:07:31 681984 ----a-w- C:\Windows\System32\adtschema.dll
2014-10-14 01:50:47 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2014-10-14 01:50:41 2363904 ----a-w- C:\Windows\SysWow64\msi.dll
2014-10-14 01:49:38 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2014-10-14 01:47:30 146432 ----a-w- C:\Windows\SysWow64\msaudite.dll
2014-10-14 01:46:02 681984 ----a-w- C:\Windows\SysWow64\adtschema.dll
2014-10-10 00:57:42 3198976 ----a-w- C:\Windows\System32\win32k.sys
2014-10-03 02:12:23 310272 ----a-w- C:\Windows\System32\WsmWmiPl.dll
2014-10-03 02:12:23 2020352 ----a-w- C:\Windows\System32\WsmSvc.dll
2014-10-03 02:12:22 346624 ----a-w- C:\Windows\System32\WSManMigrationPlugin.dll
2014-10-03 02:12:22 181248 ----a-w- C:\Windows\System32\WsmAuto.dll
2014-10-03 02:12:00 500224 ----a-w- C:\Windows\System32\AUDIOKSE.dll
2014-10-03 02:11:54 284672 ----a-w- C:\Windows\System32\EncDump.dll
2014-10-03 02:11:51 680960 ----a-w- C:\Windows\System32\audiosrv.dll
2014-10-03 02:11:51 440832 ----a-w- C:\Windows\System32\AudioEng.dll
2014-10-03 02:11:51 296448 ----a-w- C:\Windows\System32\AudioSes.dll
2014-10-03 02:11:49 266240 ----a-w- C:\Windows\System32\WSManHTTPConfig.exe
2014-10-03 01:45:03 248832 ----a-w- C:\Windows\SysWow64\WSManMigrationPlugin.dll
2014-10-03 01:45:03 214016 ----a-w- C:\Windows\SysWow64\WsmWmiPl.dll
2014-10-03 01:45:03 145920 ----a-w- C:\Windows\SysWow64\WsmAuto.dll
2014-10-03 01:45:03 1177088 ----a-w- C:\Windows\SysWow64\WsmSvc.dll
2014-10-03 01:44:42 442880 ----a-w- C:\Windows\SysWow64\AUDIOKSE.dll
2014-10-03 01:44:26 374784 ----a-w- C:\Windows\SysWow64\AudioEng.dll
2014-10-03 01:44:26 195584 ----a-w- C:\Windows\SysWow64\AudioSes.dll
2014-10-03 01:44:25 198656 ----a-w- C:\Windows\SysWow64\WSManHTTPConfig.exe
2014-10-01 15:11:26 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-10-01 15:11:16 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-10-01 15:11:12 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-09-25 02:08:38 371712 ----a-w- C:\Windows\System32\qdvd.dll
2014-09-25 01:40:50 519680 ----a-w- C:\Windows\SysWow64\qdvd.dll
.
============= FINISH: 16:05:43.04 ===============
My computer is not backed up. How can it be as nothing is designated correctly. I just finished the email. You gave me some suggestions. One you thought was on my computer and usable.
I tried to send a new DDS from an old one. It would not post. No post button was available. I need to start fresh. I will leave it on here while I finish up getting another project done.
the disk they say is failing is
ST31000528A8 ATA Device
Hi, Diana.
I'm sorry to hear about the hard drive failing. You have multiple ways of backing up important documents and pictures before having the hard drive replaced.
1) Copy to a USB stick, CD, DVD.
2) Copy files and pictures to the cloud:
-- This is an old document but shows how easy it is to set up OneDrive, which was renamed from SkyDrive after my article was published, Moving to SkyDrive (http://securitygarden.blogspot.com/2013/02/moviing-to-skydrive.html).
-- There is also this Microsoft FAQ: OneDrive desktop app for Windows: FAQ - OneDrive Help (http://windows.microsoft.com/en-us/onedrive/windows-app-faq#1TC=other).
-- You can also use OneDrive on your iPad, OneDrive for iOS on the App Store on iTunes (https://itunes.apple.com/us/app/onedrive-for-ios/id477537958?mt=8).
Note: You will need a Microsoft Account to use OneDrive. If you don't have one, see How do I sign up for a Microsoft account? - Windows Help (http://windows.microsoft.com/en-us/windows-live/sign-up-create-account-how)
3. Dropbox also has cloud storage but since I don't use it, you're on your own.
4. Just take your computer to a local, trustworthy, PC repair shop. You can have them back up your files and replace your hard drive. However, I'd still make sure I backed up important files separately.
Replace my hard drive? So you see something in the log. How does this usually happen? Why did it happen. What is the usual cost? My extra USB drives are dead except for one. I can't believe this.
What part of my computer is dying or died? I will need as many details as you can give me. If it is my fault I still want to know. Is the mail problem part of this?
How close is it to crashing? There is no trustworthy little shop to do this work. I got this from Best Buy who were scammers. Their Geek squad was never trained at a school.
I am not able to do this now. I am leaving town until Sunday nite. If I turn off the computer will it save it or harm it.
If my computer is dead then am I able to use the applications on my iPad and iPhone? This is just horrible.
Hi, Diana.
The log you provided shows me programs and services running on the computer, recent changes but has nothing to do with the hardware of the computer. With out a working hard drive, your computer is dead. It has nothing to do with the mail problem. Hardware wears out.
Checking the Seagate site for the model of your hard drive, it isn't even listed, unless there is a typo in what you provided and the correct model is ST31000528A
S which has been around at least 5.5 years. After the three-year point in the life of a hard drive, there is a 12% chance per year that your drive will die.
The install date of your operating system was 6/5/2011, which means that your hard drive has been in use over 3.5 years -- longer if it was upgraded from a previous operating system or if the hard drive which was "the last one of this computer" was a refurbished hard drive, not a new drive (quote below from your previous thread).
Quote from: SellieS on November 27, 2014, 10:50:59 PM
Unfortunately, Diana was set up by a computer technician who told me this was his way of dividing the former set up of files from the new because of problems. I agreed and was told to use the files under Diana. However, it was a quick solution for him and not for me. Add my attempt to get rid of duplicates for about 15 minutes and more chaos ensued when I tried to go back to a start point.
Background ==Best Buy sold me a hard drive (with all the software installed) that was corrupt. After I brought it back and a decent guy from the Geek Squad confronted the manager of the store and the manager of the Geek Squad, who both denied the computer was corrupt, and said they were lying because he looked at the computer before it went out. The crowd of customers cheered. They gave me the last one of this computer and installed software again (that I paid for) and you have been part of the journey since.
As to cost of a new hard drive, prices for a 1TB hard drive range from ~$55 and up, plus the cost of installing the operating system and transferring data.
Whether your computer will restart after being shut down or will remain operating if you leave it running, I cannot answer that. The first and most important thing you need to do is to make sure you have backed up important files and photos that cannot be replaced if lost. If you don't wish to purchase a new USB stick (you can get an excellent quality 32GB SanDisk Cruzer for ~$15), see my instructions above for backing up to the cloud.
As to how close it is to crashing, there is no way for me to answer that. You can check the drive with Seagate's SeaTools but it is more important to back up your critical files first.
Diana, when you return, please try this and let us know what the result is ...
Open the Command Prompt window by clicking the Start button (https://www.landzdown.com/proxy.php?request=http%3A%2F%2Fres2.windows.microsoft.com%2Fresbox%2Fen%2Fwindows%25207%2Fmain%2F4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818.jpg&hash=b8670ad0ccd26b2410858eafea0d95ebc5ec4ebf)
In the search box, type Command Prompt, and then in the list of results click Command Prompt.
In the Command Prompt window, type wmic and press Enter. Then type diskdrive get status and press Enter.
Under "Status" you'll see a report. If everything is working properly, you'll see the status OK displayed. If you see something else, let us know what it is ... that will indicate problems and errors retrieving SMART (Self-Monitoring, Analysis, and Reporting Technology) information.
See this example:
(https://www.landzdown.com/proxy.php?request=http%3A%2F%2Fcdn5.howtogeek.com%2Fwp-content%2Fuploads%2F2013%2F01%2F605x284xwmic-diskdrive-get-status.png.pagespeed.ic.5WZc68Aj1A.png&hash=9337ad21f24b58a8c39149cbddb0d2ecc9c608db)
Thank you Winchester for looking at this
The notice that I received with the failure numbers and Corinne corrected
are ST31000528A8 ATA Device. She thinks the last number is an s but I see that I wrote down an 8 which I didn't give her. I am not receiving the message anymore. Thanks
Winchester, regarding the ATA device, I did give her the last number as 8 and she researched it and found it to be s. Sorry.
Quote from: SellieS on December 21, 2014, 06:17:04 AM
I am not receiving the message anymore.
Diana, real hard drive problems don't "cure" themselves magically, whether there is an "8" or a "S" at the end doesn't diagnose a potential problem. I don't know how often you have set the Windows Action Center to check the hard drive reliability, but the purpose of SMART technology is to do a predictive failure analysis and tell you when failure is imminent. It can also be a false warning, but it is worth investigating the situation before you end up with a computer that can only be used as a door stop or to prop open a window. Your choice, of course.
Winchester,
I did run the test you set up for me last night. It is above your current message. I missed a part of it?
QuoteStatus
Pred Fail
Pred Fail = Predicted Failure.
Translation: An element (in this case a SMART-enabled hard disk) might be functioning correctly, but a failure is predicted soon.
If the status shows as "Degraded" or "Pred Fail" it's likely that the drive is going to fail and needs to be replaced. If the drive is having issues and the logged failures haven't crossed a threshold the drive may still report as "OK". However, if SMART is saying there's a problem, you should be able to trust it.
I'd follow Corrine's instructions above and make sure you have everything backed up.
Once you've done that, we can suggest some tools to run to get a better sense of the hard drive status.
I have gotten everything out that is important. Have been going thru it for a quite a while.
Security Essentials has a pop up saying detected threats are being cleaned. No action needed.
Winchester, I have taken out what I need. Backed it up. I want to continue looking for the problem and what happened to computer if you want want to continue. I was surprised when you offered to take another look. I have been waiting for it to die. Whenever you are ready I am.
Since you have backed up your important files, let's try Seagate SeaTools for Windows and test the hard drive: http://www.seagate.com/support/downloads/item/seatools-win-master/
QuoteSeaTools for Windows
SeaTools for Windows tests SATA, USB, 1394, ATA (PATA/IDE) and SCSI drives. It installs onto your system. SeaTools for Windows is completely data safe. If the drive passes SeaTools for Windows, your troubleshooting can move to other areas.
Visit the SeaTools for Windows download page at the above link, accept the license agreement, and follow the download and installation instructions listed below the agreement.
User Guide: http://www.seagate.com/files/www-content/support-content/downloads/seatools/en-us/seatools-for-windows-en-us.pdf
SeaTools will test your SMART-compliant disk drive for media defects, perform a read test and physical head test, and ensure the hard drive is functioning correctly. The test results will indicate Pass or Fail.
Before I began your Seatools MSE found a large Trojan and with Chkdsk I allowed it to deleted corrupt file records segments. It worked quickly. There thousands. The Trojan is described below: I will start Sea tools now.
This threat is part of the Win32/Chroject malware family. This family of threats can use your PC to perform click fraud. They run in the background and use a significant amount of your PC power and network bandwidth. This can severely impact the performance of your PC, the speed of your Internet connection, and may lead to excess data usage charges from your Internet service provider.
The results of the Sea Tools.
With regards to the MSE warning ...
Looking over your latest log, there is no sign of anything unusual in AppData, and that tlafxog.dll wasn't there. Any idea what website you went to that caused this infection?
Back to the hard drive ...
There is a tab on the left of SeaTools that says "Fail Info" ... can you post what is contained there please?
I have to be honest, I think this hard drive is on its last legs :sad:
I can give you what I have maybe not what you want. It was an extremely hard task for me. The uploaded results - snips (3) came out on top of each other. I also was prompted to do a chkdsk today and I did. It deleted more corrupt files so it said. Also, got a notice that Adobe cannot be opened. Winchester, I can only believe this Trojan came from an email. I am vigilant about emails and block what is suspicious. I have been in safe mode for awhile. When Corinne got rid of a Trojan I had email problems waiting for me. Comcast is the villain and I have Outlook and lost all those files. Nothing is synced.
I would like to know if the Trojan still exists. I probably should not be sending emails to people right?
I realize the hard drive is in bad shape. I don't expect miracles. When I restart computers MegaTrends comes up with a lot of information and ends with bad hard drive. I wish I knew how to save that screen to show you.
OK, here come what I have. It is three screens I captured after using Sea Tools. Those screens were hard to come be. I am doing this for you, Winchester. I'm hoping there is something interesting to come out of this.
Here is the end. I can run the tools again if you need me too. Thanks
(I just saw the more attachments where I can browse again after I have given you 4...sigh.)
I wish you had held off on the chkdsk for a bit :undecided: ... I would have suggested you run the /r command rather than the more automated default version. C'est la vie.
I'm afraid there isn't much to be done. You said your files are backed up. The next decision is whether you want to replace the hard drive or not.
I am sorry. I should have asked. Is there anything I can do to give you a last look.
Did we get the Trojan? Can I send email to friends without infecting them?
No, nothing about this computer's life has been normal starting with Best Buy. The extra USB ports are shot. In spite of all this continued craziness, reviews on this computer had it dying in the first year. I was caught off guard when BB did not have the computer I picked out.
I would like your opinion on a good computer PC. I only need a new operating system and a good track ball. I don't want cheap. If I could, I would buy a MAC. That is not possible. Most of my friends have them. Do you? I bet you put your own together.
Anyone in the DC area who you trust to install new Outlook, Microsoft 365 or regular and sync iPhone and Pad?
In the past life, I had someone to build a computer for me. Yes, I was the director of the night school and hired the computer IT people. I paid them well and they are no longer in the area. Nor do I work in an office where there is an IT guy or others learning like I used to. I started by writing code. Now I don't understand half of the directions and feel stupid and annoying for not being able to follow directions.
I will have to find an article on how terms have changed for someone like me. Since my last computer was built to last by a friend. it worked for 13 years and there were fewer hackers, clowns, idiots who like sending out Trojans.
Let me know your thoughts on brands and good equipment. Also, can I email folks. Oh, and when my hard drive dies, will my iPad and phone work?
Thanks for being so available. Diana
Winchester, It's a holiday so I expect you have other things on your mind..
I'm afraid to use my dying PC unless you tell we got the Trojan.......I have no idea how this has ended with it.....any insight. I left a post asking your opinion on new PCs.....any ideas.
Thanks......
Quote from: SellieS on December 23, 2014, 11:36:55 PM
Is there anything I can do to give you a last look.
No, and no real reason to go any further with diagnostics. I'm confident your drive is failing. The next step is up to you (replace it, replace the computer, etc). The "right decision" for you is kind of hard for any of us to make.
QuoteDid we get the Trojan? Can I send email to friends without infecting them?
Did you have MSE remove what it found? Your screenshot was taken before you went any further ... you said earlier "Security Essentials has a pop up saying detected threats are being cleaned. No action needed." If you let MSE finish the job, the trojan is quarantined.
It wouldn't do any harm to run MSE manually and do a quick double check to see if it finds anything. There are also plenty of good/free online antivirus scanners that can give a second opinion, ESET comes to mind.
If you infected any friends, the damage has already been done. If they got that same email you think was the culprit, they may have infected themselves without any "help" from you.
QuoteI would like your opinion on a good computer PC. I only need a new operating system and a good track ball. I don't want cheap. If I could, I would buy a MAC. That is not possible. Most of my friends have them. Do you? I bet you put your own together.
I don't have a Mac, I use Windows. My current laptop has 8.1 installed, but no touchscreen as that isn't the "way I work". I have had 3 "put your own together" desktops, they all worked very well for many years. I'd have no issues buying a desktop from a local store, I'd also have no issues buying a desktop system from Dell, Staples, Best Buy, et al. I've never built a laptop, wouldn't be interested in doing so. I use Lenovo ThinkPads myself, but there are a lot of other good Lenovo models (my significant other has an IdeaPad), and I'm sure others here can chime in with what brands they "like". I've always been a fan of the round red TrackPoint stick, couldn't go back to a mouse or a touchpad.
You could also go to the MS Store for computers without added extras ...
QuoteAnyone in the DC area who you trust to install new Outlook, Microsoft 365 or regular and sync iPhone and Pad?
Sorry, the only person I know in DC is a crooked politician, I doubt you want him to look at your computer. It's bad enough that folks trust him with their wallets :cool:
QuoteOh, and when my hard drive dies, will my iPad and phone work?
Well, if everything is all synched, your phone and tablet will continue to work with everything current and updated. It would be like your refrigerator ceasing to work but your toaster and microwave continue to work. Obviously when your hard drive dies, you won't be able to transfer things from that computer to your other devices.
QuoteThanks for being so available. Diana
That's the purpose of this support forum :D
Quote from: SellieS on December 25, 2014, 08:56:42 PM
Winchester, It's a holiday so I expect you have other things on your mind..
Yes, indeed, spent a nice few days with friends and family. I hope your holiday was nice :smiley:
QuoteI'm afraid to use my dying PC unless you tell we got the Trojan.......I have no idea how this has ended with it.....any insight. I left a post asking your opinion on new PCs.....any ideas.
I think I answered your questions in the post prior to this one. As for how it "ended", hardware fails. It can happen under warranty, it can happen the day after your warranty expires, it may never happen. There is no way to predict "when", however things like hard drives have built-in diagnostics to prepare you for the impending problem so you have time to act before things go totally pear-shaped. Anything with moving parts can fail. Ever replace a car transmission, tires, or brakes?
Winchester tell me more about your red track ball. I found an Anesso. Name may be slightly off. I had a Kensington which is a really big ball and I had to palm and loved it and they quit making them for PCs. I, too, loved it.
Computer still working well. It died but it got better.
Thanks.....
Winchester73 was referring to the Lenovo Thinkpad trackball. See the little red knob on the laptop:
(https://tse2.mm.bing.net/th?id=HN.607993732594664015&w=160&h=120&pid=1.7)
Personally, for ergonomic reasons, I love my Evoluent Vertical Mouse, http://evoluent.com/.
Quote from: SellieS on December 30, 2014, 05:30:29 AM
Computer still working well. It died but it got better.
What do you mean "it got better"?
As Corrine said, I was referring to the pointing stick on the keyboard of the ThinkPad.
(Note to Corrine ... that photo looks like my old T61 keyboard :D )
I like your mouse Corinne and will get it.
Winchester, my computer is running well. It had slowed down and now is working fine. I'm surprised so I give daily updates.i have rebooted and micro trend says hard drive is bad.
Life goes on...
Thanks...
Quote from: SellieS on December 30, 2014, 04:48:06 PM
micro trend says hard drive is bad.
I'm not familiar with "micro trend" :uhm:
It is the page that comes up when I reboot and it has all the information about the bios and questions if you want to run it in safe mode and concludes with the status of the computer-it's a black screen with white text.
There is a security company called Trend Micro but if you google Micro Trend you get information about a Sri Lankan car.
Source: http://en.wikipedia.org/wiki/Micro_Trend
en.wikipedia.org/wiki/American_Megatrends
will get you there.
Diana,
I told you; Winchester73 told you; the results of the tests you ran told you; and whether you call it "micro trend" or American Megatrends, your computer hardware has told you: your hard drive is dying. I am sorry but, as much as we would like to, there is nothing more we can do to help you with this computer.
Not the best way to end the year so let's look forward to a better 2015!
Quote from: SellieS on December 31, 2014, 08:12:00 PM
American_Megatrends
Diana, not to pile on here, but it really helps all of us if we get accurate information. It's hard to offer useful help without it. Frankly, "micro trend" and "American Megatrends" isn't precise enough.
IMO, your computer is on borrowed time. Make sure you continue to back up your important files.
Quote
my computer is running well. It had slowed down and now is working fine.
It likely won't be doing so for an extended period of time :(
American MegaTrends is the name. I had to reboot to get the correct name as it only comes up right away at that time. I thought every one got that screen. I scroll thru the updated computer info and it tells me the hard drive is bad.
I am not asking for any more help. I moved on to asking about brands of computers and mice. I got a very good recommendation. This computer was given a death sentence and you told me it could go at any time. I was only giving you an update.
It works well for the time being and everything is backedup. I'm prepared for the end of it. I am done grieving over it. The help Corrine gave me extended the life of it because she removed 1 or 2 viruses and I fixed my mail after Comcast went down. A lot of work to end up this way. I am sorry Corrine and Winchester that you misunderstood. Thanks again.
Let us know when you get a new computer, Diana. Happy New Year!
Corrine and Winchester,
In an episode of the television series Mash Hawkeye cooks up a scheme to raise money for the orphanage. He talks about how great the new guy is and everyone is convinced they have seen him and agree he is just what the unit needs. So the guy starts receiving checks and Hawkeye passes them to "him." When Frank wonders why he hasn't seen him in a while BJ confides in Frank that it all happened very suddenly and he was dead.
When the dead guy started receiving checks again Hawkeye asked BJ how he explained that to Frank. BJ said it was easy. I just told him he died but lucky for him he got better.
My last couple of lines of my story from Mash ended up blank. I gave you a similar "dead then got better " sentence After I gave up on the computer and all of a sudden it lived again. For no good reason I thought you would remember that line out of mash from 50 years ago as people used it a lot in my neck of the woods
Thank you for all you have done and all your patience and I hope next year is better than the last. Diana