Fake Security Protection Virus

Started by Sebstian, June 13, 2011, 01:24:16 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Print
Go Down Pages1
User actions

Sebstian

June 13, 2011, 01:24:16 AM
A Fake Security Protection program started and I was no longer able to open any programs on my computer. Anytime I attempted to open a program the icon on the bottom left of my screen said it was infected with the W32/Blaster.worm. I could not open Task Manager or anything. Right upon start up I received a Dialog Box stating "Error loading \3\DLCXtime.dll. Then the security program started up running a scan saying a bunch of files were infected. Thank you so much for looking into this. This website seems to be very informative and I am very happy I found you guys! Here are the requested logs per your instructions.

What I have done: Ran a full scan on Spybot. It only found two tracking cookies which I can't recall what they were. The last think I remember doing was updated firefox since I have not used that in sometime.

I am running Windows Vista.
-------------------------------------------------------------------------------
Results of screen317's Security Check version 0.99.13  
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8  
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!  
Norton AntiVirus    
Norton Internet Security (Symantec Corporation)  
Norton Internet Security    
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
MVPS Hosts File  
Spybot - Search & Destroy
Java(TM) SE Runtime Environment 6
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player    10.0.12.36  
Adobe Reader 8.1.5
Out of date Adobe Reader installed!
Mozilla Firefox (3.0.6) Firefox Out of Date!  
````````````````````````````````
Process Check:  
objlist.exe by Laurent
``````````End of Log````````````
------------------------------------------------------------------------------
.
DDS (Ver_2011-06-12.02) - NTFSx86 NETWORK
Internet Explorer: 8.0.6001.19048
Run by The Garcia at 17:53:32 on 2011-06-12
Microsoft® Windows Vista™ Ultimate   6.0.6002.2.1252.1.1033.18.2022.1429 [GMT -7:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\windows defender\MpCmdRun.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uWindow Title = Internet Explorer provided by Dell
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.5\NppBho.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File
TB: Show Norton Toolbar: {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.5\UIBHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Security Protection] c:\programdata\defender.exe
mRun: [OEM07Mon.exe] c:\windows\OEM07Mon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [<NO NAME>]
mRun: [dlcxmon.exe] "c:\program files\dell photo aio printer 926\dlcxmon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [DLCXCATS] rundll32 \3\DLCXtime.dll,_RunDLLEntry@16
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\setpoint.lnk - c:\program files\setpoint\SetPoint.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\npjpi160.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {AB6633A8-60A9-4F5D-B66C-ABE268CC3227} - hxxp://www.solidworks.com/sw/support/subscription/sldimdownload.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{55C8EE4C-9F69-46E6-AC82-97253DBE1994} : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{5C7A113B-D8AF-4078-A364-9B9B0472C2CE} : DhcpNameServer = 192.168.2.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll
mASetup: {7070D8E0-650A-46b3-B03C-9497582E6A74} - %SystemRoot%\system32\soundschemes.exe /AddRegistration
mASetup: {B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24} - %SystemRoot%\system32\soundschemes2.exe /AddRegistration
Hosts: 127.0.0.1   www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\the garcia\appdata\roaming\mozilla\firefox\profiles\p86y9o1v.default\
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npclntax_ZangoSA.dll
FF - plugin: c:\users\the garcia\appdata\local\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\users\the garcia\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: XULRunner: {2C21CF44-DA74-4A66-B649-C18943E25356} - c:\users\the garcia\appdata\local\{2C21CF44-DA74-4A66-B649-C18943E25356}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
============= SERVICES / DRIVERS ===============
.
R3 DLXPDisplayName;DLXPDisplayName;c:\windows\system32\drivers\DLACPI.sys [2008-10-16 14656]
R3 IntelDH;IntelDH Driver;c:\windows\system32\drivers\IntelDH.sys [2008-10-16 5632]
S1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20091110.002\IDSvix86.sys [2009-11-12 272432]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2007-2-12 208896]
S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-12-3 21504]
S2 gupdate1c9a44f9c7c1900;Google Update Service (gupdate1c9a44f9c7c1900);c:\program files\google\update\GoogleUpdate.exe [2009-3-13 133104]
S2 MCLServiceATL;Intel(R) Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2007-6-27 157912]
S2 NMSCore;Intel(R) NMSCore;c:\program files\common files\intel\inteldh\nms\nmscore\NMSCore.exe [2007-6-27 317656]
S2 nmsunidr;UniDriver for NMS;c:\windows\system32\drivers\nmsunidr.sys [2007-2-18 5376]
S2 QualityManager;Intel(R) Quality Manager;c:\program files\intel\inteldh\intel media server\media server\bin\QualityManager.exe [2007-6-27 272600]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\solidworks corp\solidworks\swscheduler\DTSCoordinatorService.exe [2009-3-19 83240]
S3 CXSONORA;AVerMedia 23885 AvStream Video Capture;c:\windows\system32\drivers\A885VCap.sys [2008-10-16 733824]
S3 DHTRACE;Intel(R) DHTrace Controller;c:\program files\common files\intel\inteldh\bin\DHTraceController.exe [2007-6-27 39640]
S3 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-10-16 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-3-13 133104]
S3 OEM07Vfx;Creative Camera OEM007 Video VFX Driver;c:\windows\system32\drivers\OEM07Vfx.sys [2008-10-16 7424]
S3 OEM07Vid;Creative Camera OEM007 Driver;c:\windows\system32\drivers\OEM07Vid.sys [2008-10-16 235552]
S3 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2008-12-4 1251720]
S3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2008-10-3 37936]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]
SUnknown CDAVFS;CDAVFS;

  • .
    =============== File Associations ===============
    .
    .scr=AutoCADScriptFile
    .
    =============== Created Last 30 ================
    .
    2011-06-12 04:10:13   0   ---ha-w-   c:\users\the garcia\appdata\local\BITF99.tmp
    2011-06-12 04:05:02   869376   ----a-w-   c:\programdata\defender.exe
    2011-06-12 04:04:38   952832   ----a-w-   c:\program files\mozilla firefox\0.6944212985124077.exe
    2011-06-10 08:18:25   6962000   ----a-w-   c:\programdata\microsoft\windows defender\definition updates\{f16356df-78d9-4fdb-9a37-53075f84a509}\mpengine.dll
    2011-05-26 09:39:01   --------   d-----w-   c:\users\the garcia\appdata\roaming\Dell
    .
    ==================== Find3M  ====================
    .
    2011-04-06 23:20:16   91424   ----a-w-   c:\windows\system32\dnssd.dll
    2011-04-06 23:20:16   197920   ----a-w-   c:\windows\system32\dnssdX.dll
    2011-04-06 23:20:16   107808   ----a-w-   c:\windows\system32\dns-sd.exe
    2009-11-04 02:34:41   1005578   ----a-w-   c:\program files\F5D7234-4_WW_3.00.03.bin
    .
    ============= FINISH: 17:55:07.26 ===============
    -------------------------------------------------------------------------
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-12.02)
    .
    Microsoft® Windows Vista™ Ultimate
    Boot Device: \Device\HarddiskVolume3
    Install Date: 10/16/2008 1:29:20 AM
    System Uptime: 6/12/2011 5:31:56 PM (0 hours ago)
    .
    Motherboard: Dell Inc. |  | 0F756F
    Processor: Intel(R) Core(TM)2 Duo CPU     E4500  @ 2.20GHz | CPU 1 | 2194/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 218 GiB total, 69.04 GiB free.
    D: is FIXED (NTFS) - 15 GiB total, 3.522 GiB free.
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {36fc9e60-c465-11cf-8056-444553540000}
    Description: eHome Infrared Receiver (USBCIR)
    Device ID: USB\VID_0471&PID_060F\@CLC
    Manufacturer: Microsoft
    Name: eHome Infrared Receiver (USBCIR)
    PNP Device ID: USB\VID_0471&PID_060F\@CLC
    Service: usbcir
    .
    Class GUID: {4d36e97d-e325-11ce-bfc1-08002be10318}
    Description: Consumer IR Devices
    Device ID: ROOT\SYSTEM\0001
    Manufacturer: Microsoft
    Name: Consumer IR Devices
    PNP Device ID: ROOT\SYSTEM\0001
    Service: circlass
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    Adobe Acrobat 8 Professional
    Adobe Acrobat 8.1.5 - CPSID_49013
    Adobe Acrobat 8.1.5 Professional
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Common File Installer
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe Elements Studio Launcher
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Help Viewer CS3
    Adobe PDF Library Files
    Adobe Photoshop 7.0
    Adobe Photoshop Elements 6.0
    Adobe Premiere Elements 4.0
    Adobe Premiere Elements 4.0 Templates
    Adobe Reader 8.1.5
    Adobe Setup
    Adobe Soundbooth CS3
    Adobe Soundbooth CS3 Codecs
    Adobe Soundbooth CS3 Scores
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe XMP DVA Panels CS3
    Adobe XMP Panels CS3
    Advanced Audio FX Engine
    Advanced Video FX Engine
    AppCore
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AutoCAD LT 2009 - English
    Autodesk Architectural Desktop 2006
    Autodesk DWF Viewer
    AV
    AVerMedia MiniCard Hybrid TV
    Banctec Service Agreement
    bodybugg® Software
    Bonjour
    Browser Address Error Redirector
    ccCommon
    CDDRV_Installer
    Complete Care Business Service Agreement
    Complete Care Consumer Service Agreement
    Dell DataSafe Online
    Dell Home Systems Service Agreement
    Dell PC Fax
    Dell Photo AIO Printer 926
    Dell Support Center
    Dell System Customization Wizard
    Dell Webcam Center
    Dell Webcam Manager
    DellSupport
    Dropbox
    DWGeditor
    EDocs
    Facebook Plug-In
    Google Desktop
    Google Toolbar for Internet Explorer
    Google Update Helper
    Google Updater
    Handbrake 0.9.4
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Integrated Webcam Driver (1.00.01.0720)  
    Intel(R) PRO Network Connections 12.1.12.0
    Intel(R) Viiv(TM) Software
    Invoices
    iTunes
    Java(TM) SE Runtime Environment 6
    KB408682
    KhalInstallWrapper
    Live! Cam Avatar Creator
    Live! Cam Avatar v1.0
    LiveUpdate 3.2 (Symantec Corporation)
    LiveUpdate Notice (Symantec Corporation)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Money 2004
    Microsoft Money 2004 System Pack
    Microsoft Office 2003 Web Components
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office Live Add-in 1.5
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual Studio 2005 Tools for Applications - ENU
    MobileMe Control Panel
    Move Networks Media Player for Internet Explorer
    Mozilla Firefox (3.0.6)
    MSRedist
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Music, Photos & Videos Launcher
    Norton AntiVirus
    Norton Confidential Browser Component
    Norton Confidential Web Protection Component
    Norton Internet Security
    Norton Internet Security (Symantec Corporation)
    Norton Protection Center
    OGA Notifier 2.0.0048.0
    Product Documentation Launcher
    QualXServ Service Agreement
    QuickTime
    Realtek High Definition Audio Driver
    RON Tool Offersfortoday
    Roxio Activation Module
    Roxio Creator Audio
    Roxio Creator BDAV Plugin
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio MyDVD DE
    Roxio Update Manager
    Safari
    Search Assistant Searchersmart
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB2466156)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft Office Excel 2007 (KB2464583)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    SetPoint
    SimCity 4
    Skype™ 5.0
    SolidWorks 2009 SP03
    SolidWorks eDrawings 2009
    Sonic CinePlayer Decoder Pack
    SPBBC 32bit
    Spybot - Search & Destroy
    Symantec Real Time Storage Protection Component
    SymNet
    Tour your new XPS One
    TWC Customer Controls
    Ultimate Extras sounds from Microsoft® Tinker™
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    VBA (2627.01)
    WIDCOMM Bluetooth Software 6.0.1.5900
    Windows Live ID Sign-in Assistant
    Windows Sound Schemes
    Yahoo! BrowserPlus 2.9.8
    .
    ==== Event Viewer Messages From Past Week ========
    .
    6/8/2011 11:18:59 PM, Error: Microsoft-Windows-SharedAccess_NAT [31004]  - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
    6/12/2011 5:52:49 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    6/12/2011 5:33:56 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  eeCtrl SPBBCDrv spldr SRTSP SRTSPX SYMTDI Wanarpv6
    6/12/2011 5:33:56 PM, Error: Service Control Manager [7001]  - The Computer Browser service depends on the Server service which failed to start because of the following error:  The dependency service or group failed to start.
    6/12/2011 5:33:07 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    6/12/2011 5:33:06 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    6/12/2011 5:33:05 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000]  - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv.dll Error Code: 21
    6/12/2011 5:33:02 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    6/12/2011 5:32:59 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    6/12/2011 5:32:53 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    6/12/2011 1:29:33 AM, Error: Microsoft-Windows-WLAN-AutoConfig [10003]  - WLAN Extensibility Module has stopped unexpectedly. Module Path: C:\Windows\System32\bcmihvsrv.dll
    6/12/2011 1:29:32 AM, Error: Service Control Manager [7043]  - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
    6/12/2011 1:29:01 AM, Error: Service Control Manager [7000]  - The SupportSoft Sprocket Service (dellsupportcenter) service failed to start due to the following error:  The system cannot find the file specified.
    6/12/2011 1:27:16 AM, Error: SRTSP [5]  - Error loading Symantec real time Anti-Virus driver.
    6/12/2011 1:27:16 AM, Error: SRTSP [4]  - Error loading virus definitions.
    6/11/2011 9:46:13 PM, Error: Service Control Manager [7031]  - The Bluetooth Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
    6/11/2011 9:46:13 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device service to connect.
    6/11/2011 9:46:13 PM, Error: Service Control Manager [7000]  - The Apple Mobile Device service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The Windows Live ID Sign-in Assistant service terminated unexpectedly.  It has done this 3 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The Roxio Hard Drive Watcher 9 service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The iPod Service service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The Intel(R) Application Tracker service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The Intel(R) Alert Service service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The DQLWinService service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7034]  - The dlcx_device service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Windows Live ID Sign-in Assistant service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Windows Live ID Sign-in Assistant service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Print Spooler service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 3 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7031]  - The Apple Mobile Device service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  SRTSP
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Software Services Manager service to connect.
    6/11/2011 9:45:54 PM, Error: Service Control Manager [7000]  - The Intel(R) Software Services Manager service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
    6/11/2011 9:13:39 PM, Error: Service Control Manager [7034]  - The Print Spooler service terminated unexpectedly.  It has done this 3 time(s).
    6/11/2011 9:12:16 PM, Error: Service Control Manager [7024]  - The KtmRm for Distributed Transaction Coordinator service terminated with service-specific error 2147942438 (0x80070026).
    6/11/2011 9:12:14 PM, Error: Service Control Manager [7031]  - The Google Software Updater service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 900000 milliseconds: Restart the service.
    6/11/2011 9:12:14 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate1c9a44f9c7c1900) service to connect.
    6/11/2011 9:12:14 PM, Error: Service Control Manager [7000]  - The Google Update Service (gupdate1c9a44f9c7c1900) service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
    6/11/2011 9:12:11 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
    6/11/2011 9:12:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 27 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:59 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 26 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:53 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 25 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:48 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 24 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:47 PM, Error: Service Control Manager [7031]  - The Print Spooler service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
    6/11/2011 9:11:42 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 23 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:37 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 22 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:31 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 21 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:25 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 20 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:21 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 19 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:20 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 18 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:16 PM, Error: Service Control Manager [7031]  - The Apple Mobile Device service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
    6/11/2011 9:11:16 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Bluetooth Service service to connect.
    6/11/2011 9:11:16 PM, Error: Service Control Manager [7000]  - The Bluetooth Service service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
    6/11/2011 9:11:15 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 17 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:15 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 16 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:10 PM, Error: Service Control Manager [7032]  - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Intel(R) Software Services Manager service, but this action failed with the following error:  An instance of the service is already running.
    6/11/2011 9:11:10 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 15 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:09 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 14 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 9 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 8 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 7 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 6 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 5 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 4 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 12 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 11 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:11:04 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 10 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:07:54 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 32 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:07:49 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 31 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:07:44 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 30 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:07:39 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 29 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:07:34 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 28 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:06:17 PM, Error: Service Control Manager [7031]  - The Intel(R) Software Services Manager service terminated unexpectedly.  It has done this 13 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/11/2011 9:05:22 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Windows Live ID Sign-in Assistant service to connect.
    6/11/2011 9:05:22 PM, Error: Service Control Manager [7000]  - The Windows Live ID Sign-in Assistant service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
    6/11/2011 9:05:13 PM, Error: Service Control Manager [7034]  - The Autodesk Licensing Service service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 9:05:09 PM, Error: Service Control Manager [7034]  - The Adobe Active File Monitor V6 service terminated unexpectedly.  It has done this 1 time(s).
    6/11/2011 4:14:59 PM, Error: iaStor [9]  - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
    6/11/2011 11:57:35 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B68-F52A-11D8-B9A5-505054503030}
    6/11/2011 11:15:21 PM, Error: Service Control Manager [7001]  - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD CSC DfsC eeCtrl NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb SPBBCDrv spldr SRTSP SRTSPX SYMTDI tdx Wanarpv6
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error:  A device attached to the system is not functioning.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error:  A device attached to the system is not functioning.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error:  A device attached to the system is not functioning.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error:  A device attached to the system is not functioning.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error:  The dependency service or group failed to start.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error:  A device attached to the system is not functioning.
    6/11/2011 10:44:27 PM, Error: Service Control Manager [7001]  - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error:  A device attached to the system is not functioning.
    6/11/2011 10:43:31 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    6/11/2011 10:43:31 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    .
    ==== End Of File ===========================

    Please Help!








Corrine

#1
June 13, 2011, 01:52:46 AM
Hi, Sebstian.  Welcome to LandzDown Forum.

We will do our best to assist you.  However, in order to do so, please follow all instructions provided in the sequence given.  Do not install/re-install any programs or run any fixes or scanners that you have not been instructed to use.  This may cause conflicts with the tools being used in the cleanup process.  

If you have questions regarding any of the instructions or problems running any tools, please let us know.

This rogue is often bundled with the TDSS rootkit infection.  If you are unable to download TDSSKiller in normal mode, please try safe mode with networking:

To restart your computer in Safe Mode with Networking, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard. Using the arrow keys on your keyboard, select Safe Mode with Networking and press Enter on your keyboard. Windows will now boot into safe mode with networking and prompt you to login as a user.  

Please download the TDSSKiller.exe by Kaspersky... save it to your Desktop. <-Important!!!
  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista - W7 users: Right-click and select "Run As Administrator".
    If TDSSKiller does not run... rename it. Right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. ektfhtw.com).
    If you don't see file extensions, please see:  How to change the file extension.
  • Click the Start Scan button.  Do not use the computer during the scan!
  • If the scan completes with nothing found, click Close to exit.
  • If malicious objects are found, they will show in the "Scan results - Select action for found objects[/b]" and offer 3 options.

    • Ensure Cure (default) is selected... then click Continue > Reboot now to finish the cleaning process.
  • A log file named TDSSKiller_version_dd.mm.yyyy_hh.mm.ss_log.txt will be created and saved to the root directory. (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.
Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    Update Malwarebytes' Anti-Malware and
    Launch Malwarebytes' Anti-Malware
  • Click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, be sure Quick scan is selected, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, EXCEPT items in System Restore as shown in this sample:
  • Click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See the Note below)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Please post contents of that file in your next reply.

** Note **

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Note:  If you are unable to run MBAM, download rkill from one of the following links and save to your Desktop:

One, Two,Three or Four


  • Double-click rkill to run.
  • A command window will open then disappear upon completion, this is normal.
  • Please leave rkill on the Desktop until otherwise advised.
  • Do NOT restart your computer after running rkill as the malware program(s) will start again.
Notes:

If you you receive security warnings about rkill, please ignore and allow the download to continue.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Sebstian

#2
June 13, 2011, 02:27:14 AM
I am able to log on normally and so far it seems to be back to normal. Here is the MBAM Log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6845

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.19048

6/12/2011 7:20:33 PM
mbam-log-2011-06-12 (19-20-33).txt

Scan type: Quick scan
Objects scanned: 191318
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4758CBF-B916-ECFB-EC7C-2C0428BC62D6} (Adware.AdRotator) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security Protection (Trojan.FakeAlert) -> Value: Security Protection -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\Zango 10.3.79.0 (Adware.Zango) -> Value: Zango 10.3.79.0 -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\defender.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\0.6944212985124077.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\plugins\npclntax_zangosa.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
c:\Users\the garcia\AppData\Local\Temp\8145.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\the garcia\AppData\Local\Temp\8BEF.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\the garcia\AppData\Local\Temp\jar_cache25663.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\the garcia\AppData\Local\Temp\jar_cache25665.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\System32\ljbhupyrssbncgygj.dll-uninst.exe (Adware.AdRotator) -> Quarantined and deleted successfully.

Corrine

#3
June 13, 2011, 03:11:05 PM
Hi, Sebstian.

Did you run TDSSKiller?

Note that the trojan on your computer is a backdoor, password stealer.  I strongly advise you to change passwords, particularly for online banking and similar sites.

Why do you have UAC disabled?   

SecurityCheck indicated that the Windows Security Center service may not be running.  Are you able to get security updates via Windows Update?

You have outdated, vulnerable versions of Java and Adobe products on your computer. 

Please go to add/remove programs and uninstall Java(TM) SE Runtime Environment 6.  Please download JavaRa and unzip it to your desktop.


  • Double-click on JavaRa.exe to start the program.  (Windows Vista users Right-click JavaRa.exe > Select Run as Administrator)
  • Click on Remove Older Versions to remove older versions of Java.
  • A logfile will pop up. Please save it to a convenient location.
Then download and install Java SE Runtime Environment 6u26.

Note:  UNCHECK any pre-checked toolbar and/or software options presented with the update.  They are not part of the software update and are completely optional.   

Adobe Flash Player needs to be updated for both IE and alternate browsers.

Direct download for IE:  http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe
Direct Download for non-IE (Opera, Firefox etc): http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe

After install, verify Flash Player version for each browser installed at About Flash Player page.

Update Adobe Reader to the current version, http://get.adobe.com/reader/

You indicated in your initial post that you had updated Firefox.   However, the version shown in your log is Mozilla Firefox 3.0.6 which is severely out of date.  If you no longer use Firefox, I suggest you uninstall it.  Otherwise, update to the current version.

Please let me know if you have any questions.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Sebstian

#4
June 15, 2011, 02:12:48 AM
I did run TDSSKiller and it came up empty.
I am in the process of changing all of my passwords now.
I am not sure why or how UAC was dissable. I have enabled now.
I checked the Windows Security Center in my control panel and it was on and I was receiving security updates. I went ahead an updated them what it was suggesting to update.
I updated everything you suggested in the previous post. My computer is running 1000% better. Is there anything else I can do?

Also, what do you feel about spybot? Is there another spyware program I should be running?

Thank you so much for all the help you provided. I was really nervous I screwed up my computer pretty bad!

Corrine

#5
June 15, 2011, 02:50:10 PM
Hi, Sebstian.

Thank you for answering my questions.  I suspect that the malware disabled UAC and am glad all is well now.  Although I don't personally use Spybot, it is a good program. 

My additional recommendations --

To check if your system is missing security updates or has insecure applications, install Secunia Personal Software Inspector or, alternatively, visit http://secunia.com/software_inspector/ .  The Secunia Software Inspector runs through your browser with no installation or download required and does the following:

  • Detects insecure versions of applications installed
  • Verifies that all Microsoft patches are applied
  • Assists you in updating your system and applications
Install and update SpywareBlaster to prevent the installation of spyware and other potentially unwanted software: http://www.javacoolsoftware.com/spywareblaster.html

My favorite security software is WinPatrol which includes the features described at http://www.winpatrol.com/features.html

Please let me know if you have any questions.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Sebstian

#6
June 18, 2011, 05:09:21 AM
Corrine,

I will download those program you suggested. Thank you! So far so good. However, I got on my machine tonight and opened the task manager and my CPU usage is hovering at 50% which seems high to me. I will run scans with the programs you suggested and see what happened.

Now you previously mentioned there should only by only one security software. Should I have SpywareBlaster and WinPatrol on my system. And should I run the Anti-Malware program you had me download on a consistent basis. I was not being proactive in preventing these attacks and I would like to be now.

Thanks you for helping and putting up with my questions.

Corrine

#7
June 18, 2011, 06:44:11 PM
Good questions, Sebstian.  The one security program I was referring to is only one antivirus software, one software firewall and and one "real-time" protection program. Having two of any of the above can result in not only high system usage but, more importantly, system conflicts.

It wouldn't hurt to update and scan with MBAM at least weekly.

Spyware Blaster and WinPatrol perform different functions.  Spyware Blaster needs to be updated periodically.  I would advise checking for updates at least every few weeks.  The program will help do the following:

--    Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
--    Block spying / tracking via cookies.
--    Restrict the actions of potentially unwanted or dangerous web sites.

WinPatrol, on the other hand, will provide an alert if a program attempts to add itself to start-up.  In addition to using WinPatrol for removing programs from start-up, you can also add programs to "delayed start" so your computer will be usable faster after starting.  It has many other features as well, included int he link provided above.

Should you have additional questions about WinPatrol, we just launched the WinPatrol Help & Information forum here at LandzDown.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Sebstian

#8
June 19, 2011, 02:27:48 AM
Last questions!  :D

So the Spyware Blaster would be considered my real time protection service, right? I would this instead of Spybot?

Regarding Firewalls. I have the firewall enables on Microsoft Security. I also have a firewall on my wireless router. Is there one I should choose over the other or are all firewalls the same? As long as you have one enabled.

Corrine

#9
June 19, 2011, 01:28:06 PM
Hi, Sebstian.  Spyware Blaster would be considered a supplement to Spybot. 

Real-time protection would be if you used Windows Defender with the Norton Security Suite's real-time protection.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.
Print
Go Up Pages1
User actions