Zeroaccess BSOD %hs missing

Discussion in 'Malware Help (A Specialist Will Reply)' started by magepker, Sep 11, 2012.

Thread Status:
Not open for further replies.
  1. magepker

    magepker Private E-2

    This is on my girlfriends laptop, been dealing with BSOD's that give me this error; "STOP: C0000135 Program can't start because %hs is missing. Try reinstalling the program." It apparently can be many things from AVG to a bad disc drive but i ran frst64 and apparently its ZeroAccess, i didn't run the fix just the scan and heres the log;
    take note that i cant boot into any mode just system recovery options.


    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-09-2012
    Ran by SYSTEM at 11-09-2012 10:13:12
    Running from G:\
    Windows 7 Home Premium (X64) OS Language: English(US)
    The current controlset is ControlSet001

    ==================== Registry (Whitelisted) ===================

    HKLM\...\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-21] (Alps Electric Co., Ltd.)
    HKLM\...\Run: [Acer ePower Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
    HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)
    HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-29] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252136 2011-05-04] (Sun Microsystems, Inc.)
    HKLM-x32\...\Run: [] [x]
    HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Gateway\Screensaver\run_Gateway.exe /default [162336 2009-07-21] ()
    HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Gateway\Screensaver\run_Gateway.exe /default [162336 2009-07-21] ()
    HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2009-07-13] (Microsoft Corporation)
    Tcpip\Parameters: [DhcpNameServer] 167.206.251.129 167.206.251.130
    SubSystems: [Windows] ATTENTION! ====> ZeroAccess

    ==================== Services ====================

    4 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)

    ==================== Drivers =================================

    0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-05-03] (Duplex Secure Ltd.)

    ==================== NetSvcs (Whitelisted) =================


    ==================== One Month Created Files and Folders ======================

    2012-09-11 08:57 - 2012-09-11 08:57 - 00000000 ____D C:\FRST
    2012-09-10 21:43 - 2012-09-10 21:44 - 00000000 ____A C:\Recovery.txt
    2012-09-10 07:37 - 2012-09-10 07:37 - 00000000 ____D C:\TDSSKiller_Quarantine
    2012-09-10 07:12 - 2012-09-10 22:01 - 00000000 ____D C:\Windows\System32\SPReview
    2012-09-10 07:11 - 2012-09-10 22:01 - 00000000 ____D C:\89be4b07bc537ee8ffbe
    2012-09-10 06:17 - 2012-09-10 06:17 - 00000000 ____D C:\Windows\CheckSur
    2012-09-10 05:21 - 2012-09-10 05:21 - 00000840 ____A C:\Users\Public\Desktop\Xtend.lnk
    2012-09-10 05:21 - 2012-09-10 05:21 - 00000000 ____D C:\Program Files (x86)\Xtend
    2012-09-10 05:21 - 2012-09-10 05:20 - 07364436 ____A C:\Users\Gateway\Documents\Xtend2-21.air
    2012-09-10 05:14 - 2012-09-10 05:14 - 00001084 ____A C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
    2012-09-10 05:14 - 2012-09-10 05:14 - 00000000 ____D C:\Users\Gateway\AppData\Local\VS Revo Group
    2012-09-10 05:14 - 2012-09-10 05:14 - 00000000 ____D C:\Program Files\VS Revo Group
    2012-09-10 05:14 - 2009-12-30 07:21 - 00031800 ____A (VS Revo Group) C:\Windows\System32\Drivers\revoflt.sys
    2012-09-10 05:13 - 2012-09-10 05:13 - 07902008 ____A (VS Revo Group ) C:\Users\Gateway\Downloads\RevoUninProSetup.exe
    2012-09-10 05:10 - 2012-09-10 05:10 - 02322184 ____A (ESET) C:\Users\Gateway\Downloads\esetsmartinstaller_enu.exe
    2012-09-10 05:04 - 2012-09-10 05:04 - 00000000 ____D C:\Users\Gateway\AppData\Local\{1090A125-97EF-4EDA-996F-89471C3E3F45}
    2012-09-08 18:11 - 2012-09-08 18:16 - 337787962 ____A C:\Users\Gateway\Downloads\[HorribleSubs] Sword Art Online - 10 [720p].mkv
    2012-09-08 18:11 - 2012-09-08 18:15 - 295257996 ____A C:\Users\Gateway\Downloads\[Hadena] Hagure Yuusha no Estetica - 10 [720p][Uncensored][55965CB0].mkv
    2012-09-08 18:10 - 2012-09-08 18:10 - 00000000 ____D C:\Users\Gateway\AppData\Local\{69A559FE-23FB-4B66-B084-5348EDC992A6}
    2012-09-06 16:40 - 2012-09-06 16:40 - 00000000 ____D C:\Users\Gateway\AppData\Local\{15602A35-F040-4F81-9290-2A40AE54A0C9}
    2012-09-02 13:30 - 2012-09-02 13:30 - 00000000 ____D C:\Users\Gateway\AppData\Local\{04834082-DAC0-46A0-B711-9D4EEA393AF0}
    2012-09-01 10:59 - 2012-09-01 10:59 - 00000000 ____D C:\Users\Gateway\AppData\Local\{C3531C33-C97D-4705-8B6A-8FA828C0B287}
    2012-08-30 11:32 - 2012-08-30 11:32 - 00000000 ____D C:\Users\Gateway\AppData\Local\{D2CB5DF9-4240-47DD-B52E-9B005B723291}
    2012-08-27 13:33 - 2012-08-27 13:33 - 00000000 ____D C:\Users\Gateway\AppData\Local\{C80745CF-DC89-4320-86B6-3B50FDAE1A47}
    2012-08-25 22:30 - 2012-08-25 22:30 - 00000000 ____D C:\Users\Gateway\AppData\Local\{5D9BC553-FDDC-41D0-9DDC-3266D05758D6}
    2012-08-24 18:32 - 2012-08-24 18:33 - 00000000 ____D C:\Users\Gateway\AppData\Local\{BB91F8B2-50DC-4A80-913B-E0552D78FB6A}
    2012-08-20 10:08 - 2012-06-28 20:55 - 17809920 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-08-20 10:08 - 2012-06-28 20:09 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-08-20 10:08 - 2012-06-28 19:56 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-08-20 10:08 - 2012-06-28 19:49 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-08-20 10:08 - 2012-06-28 19:49 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-08-20 10:08 - 2012-06-28 19:48 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-08-20 10:08 - 2012-06-28 19:47 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-08-20 10:08 - 2012-06-28 19:45 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-08-20 10:08 - 2012-06-28 19:44 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-08-20 10:08 - 2012-06-28 19:43 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-08-20 10:08 - 2012-06-28 19:42 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-08-20 10:08 - 2012-06-28 19:40 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-08-20 10:08 - 2012-06-28 19:39 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-08-20 10:08 - 2012-06-28 19:35 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-08-20 10:08 - 2012-06-28 16:52 - 12317184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2012-08-20 10:08 - 2012-06-28 16:27 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2012-08-20 10:08 - 2012-06-28 16:16 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2012-08-20 10:08 - 2012-06-28 16:09 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2012-08-20 10:08 - 2012-06-28 16:09 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2012-08-20 10:08 - 2012-06-28 16:08 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2012-08-20 10:08 - 2012-06-28 16:07 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2012-08-20 10:08 - 2012-06-28 16:06 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2012-08-20 10:08 - 2012-06-28 16:04 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2012-08-20 10:08 - 2012-06-28 16:04 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2012-08-20 10:08 - 2012-06-28 16:01 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2012-08-20 10:08 - 2012-06-28 16:01 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2012-08-20 10:08 - 2012-06-28 16:00 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2012-08-20 10:08 - 2012-06-28 15:57 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2012-08-20 10:01 - 2012-08-20 10:01 - 00000000 ____D C:\Users\Gateway\AppData\Local\{A40D1A54-1260-4C53-9CEB-BD40C0650249}
    2012-08-15 14:29 - 2012-06-08 21:30 - 14165504 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
    2012-08-15 14:29 - 2012-06-08 20:46 - 12868608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2012-08-15 14:29 - 2012-06-05 21:50 - 02003968 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
    2012-08-15 14:29 - 2012-06-05 21:50 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
    2012-08-15 14:29 - 2012-06-05 21:09 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
    2012-08-15 14:29 - 2012-06-05 21:09 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
    2012-08-15 14:28 - 2012-07-18 09:31 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-08-15 14:28 - 2012-07-04 14:04 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
    2012-08-15 14:28 - 2012-07-04 14:01 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll
    2012-08-15 14:28 - 2012-07-04 14:01 - 00058880 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll
    2012-08-15 14:28 - 2012-07-04 13:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
    2012-08-15 14:28 - 2012-07-04 13:23 - 00041472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
    2012-08-15 14:28 - 2012-06-01 21:38 - 00152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
    2012-08-15 14:28 - 2012-06-01 21:38 - 00095088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
    2012-08-15 14:28 - 2012-06-01 21:37 - 00459216 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
    2012-08-15 14:28 - 2012-06-01 21:27 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
    2012-08-15 14:28 - 2012-06-01 21:27 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
    2012-08-15 14:28 - 2012-06-01 20:48 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2012-08-15 14:28 - 2012-06-01 20:48 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2012-08-15 14:28 - 2012-06-01 20:47 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2012-08-15 14:28 - 2012-06-01 20:42 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2012-08-15 14:28 - 2012-05-13 21:20 - 00956416 ____A (Microsoft Corporation) C:\Windows\System32\localspl.dll
    2012-08-15 14:28 - 2012-05-05 00:30 - 00503808 ____A (Microsoft Corporation) C:\Windows\System32\srcore.dll
    2012-08-15 14:28 - 2012-05-04 23:44 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2012-08-15 14:28 - 2012-02-10 22:36 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
    2012-08-15 14:28 - 2012-02-10 22:29 - 00559104 ____A (Microsoft Corporation) C:\Windows\System32\spoolsv.exe
    2012-08-15 14:28 - 2012-02-10 22:29 - 00067584 ____A (Microsoft Corporation) C:\Windows\splwow64.exe
    2012-08-15 14:28 - 2012-02-10 21:44 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
    2012-08-15 14:22 - 2012-08-15 14:22 - 00000000 ____D C:\Users\Gateway\AppData\Local\{226A762D-8208-4227-8AB2-61C734BA9759}
    2012-08-15 14:21 - 2012-08-15 14:22 - 00000000 ____D C:\Users\Gateway\AppData\Local\{D05D5D9B-10FE-41C1-8910-731723245960}
    2012-08-15 14:20 - 2012-08-15 14:20 - 228723537 ____A C:\Windows\MEMORY.DMP
    2012-08-15 14:20 - 2012-08-15 14:20 - 00000000 ____D C:\Windows\Minidump
    2012-08-14 14:39 - 2012-08-14 14:39 - 00000000 ____D C:\Users\Gateway\AppData\Local\{2B445136-693B-4501-B644-F021F6EB5EFE}
    2012-08-14 14:38 - 2012-08-14 14:39 - 00000000 ____D C:\Users\Gateway\AppData\Local\{9D4D102C-ACC0-4545-ADA2-C1CD5340276A}

    ==================== 3 Months Modified Files ================================

    2012-09-10 21:44 - 2012-09-10 21:43 - 00000000 ____A C:\Recovery.txt
    2012-09-10 07:10 - 2011-07-22 15:08 - 01951704 ____A C:\Windows\WindowsUpdate.log
    2012-09-10 07:08 - 2011-08-30 11:16 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2012-09-10 06:27 - 2011-09-08 15:53 - 00000916 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2932873273-3173577582-1014796609-1000UA.job
    2012-09-10 06:16 - 2012-04-14 11:28 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
    2012-09-10 06:04 - 2009-07-13 20:45 - 00017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2012-09-10 06:04 - 2009-07-13 20:45 - 00017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2012-09-10 05:21 - 2012-09-10 05:21 - 00000840 ____A C:\Users\Public\Desktop\Xtend.lnk
    2012-09-10 05:20 - 2012-09-10 05:21 - 07364436 ____A C:\Users\Gateway\Documents\Xtend2-21.air
    2012-09-10 05:14 - 2012-09-10 05:14 - 00001084 ____A C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
    2012-09-10 05:13 - 2012-09-10 05:13 - 07902008 ____A (VS Revo Group ) C:\Users\Gateway\Downloads\RevoUninProSetup.exe
    2012-09-10 05:10 - 2012-09-10 05:10 - 02322184 ____A (ESET) C:\Users\Gateway\Downloads\esetsmartinstaller_enu.exe
    2012-09-10 05:08 - 2009-07-13 20:51 - 00081377 ____A C:\Windows\setupact.log
    2012-09-10 05:04 - 2011-08-30 11:16 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2012-09-10 05:03 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2012-09-08 19:23 - 2011-09-17 16:13 - 00000936 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2932873273-3173577582-1014796609-1000UA.job
    2012-09-08 18:16 - 2012-09-08 18:11 - 337787962 ____A C:\Users\Gateway\Downloads\[HorribleSubs] Sword Art Online - 10 [720p].mkv
    2012-09-08 18:15 - 2012-09-08 18:11 - 295257996 ____A C:\Users\Gateway\Downloads\[Hadena] Hagure Yuusha no Estetica - 10 [720p][Uncensored][55965CB0].mkv
    2012-09-06 17:29 - 2011-09-08 15:53 - 00002432 ____A C:\Users\Gateway\Desktop\Google Chrome.lnk
    2012-09-02 15:40 - 2011-09-08 15:53 - 00000864 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2932873273-3173577582-1014796609-1000Core.job
    2012-09-01 10:58 - 2009-10-29 12:25 - 00188620 ____A C:\Windows\PFRO.log
    2012-08-24 18:30 - 2009-07-13 20:45 - 00343608 ____A C:\Windows\System32\FNTCACHE.DAT
    2012-08-20 10:16 - 2012-04-14 11:28 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2012-08-20 10:16 - 2011-09-08 15:54 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2012-08-15 14:20 - 2012-08-15 14:20 - 228723537 ____A C:\Windows\MEMORY.DMP
    2012-08-03 00:27 - 2011-09-08 15:53 - 62134624 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
    2012-07-31 07:20 - 2012-07-31 07:20 - 00000374 ____A C:\Users\Gateway\AppData\Roaming\Xtend2_state.xml
    2012-07-18 09:31 - 2012-08-15 14:28 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-07-11 14:24 - 2011-09-17 16:13 - 00000914 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2932873273-3173577582-1014796609-1000Core.job
    2012-07-04 14:04 - 2012-08-15 14:28 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
    2012-07-04 14:01 - 2012-08-15 14:28 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll
    2012-07-04 14:01 - 2012-08-15 14:28 - 00058880 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll
    2012-07-04 13:26 - 2012-08-15 14:28 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
    2012-07-04 13:23 - 2012-08-15 14:28 - 00041472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
    2012-06-28 20:55 - 2012-08-20 10:08 - 17809920 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-06-28 20:09 - 2012-08-20 10:08 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-06-28 19:56 - 2012-08-20 10:08 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-06-28 19:49 - 2012-08-20 10:08 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-06-28 19:49 - 2012-08-20 10:08 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-06-28 19:48 - 2012-08-20 10:08 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-06-28 19:47 - 2012-08-20 10:08 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-06-28 19:45 - 2012-08-20 10:08 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-06-28 19:44 - 2012-08-20 10:08 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-06-28 19:43 - 2012-08-20 10:08 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-06-28 19:42 - 2012-08-20 10:08 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-06-28 19:40 - 2012-08-20 10:08 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-06-28 19:39 - 2012-08-20 10:08 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-06-28 19:35 - 2012-08-20 10:08 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-06-28 16:52 - 2012-08-20 10:08 - 12317184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2012-06-28 16:27 - 2012-08-20 10:08 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2012-06-28 16:16 - 2012-08-20 10:08 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2012-06-28 16:09 - 2012-08-20 10:08 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2012-06-28 16:09 - 2012-08-20 10:08 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2012-06-28 16:08 - 2012-08-20 10:08 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2012-06-28 16:07 - 2012-08-20 10:08 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2012-06-28 16:06 - 2012-08-20 10:08 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2012-06-28 16:04 - 2012-08-20 10:08 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2012-06-28 16:04 - 2012-08-20 10:08 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2012-06-28 16:01 - 2012-08-20 10:08 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2012-06-28 16:01 - 2012-08-20 10:08 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2012-06-28 16:00 - 2012-08-20 10:08 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2012-06-28 15:57 - 2012-08-20 10:08 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2012-06-23 06:50 - 2011-07-22 12:43 - 00042011 ____A C:\Windows\DirectX.log
    2012-06-16 08:31 - 2009-07-13 21:13 - 00740374 ____A C:\Windows\System32\PerfStringBackup.INI


    ==================== Known DLLs (Whitelisted) =================


    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ==================== Restore Points =========================


    ==================== Memory info ===========================

    Percentage of memory in use: 17%
    Total physical RAM: 3838.36 MB
    Available physical RAM: 3171.88 MB
    Total Pagefile: 3836.51 MB
    Available Pagefile: 3159.66 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.91 MB

    ==================== Partitions ============================

    1 Drive c: (Gateway) (Fixed) (Total:453.94 GB) (Free:386.95 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
    2 Drive d: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    3 Drive e: (PQSERVICE) (Fixed) (Total:11.72 GB) (Free:4.22 GB) NTFS
    4 Drive f: (GRMCPRXFRER_EN_DVD) (CDROM) (Total:3 GB) (Free:0 GB) UDF
    5 Drive g: () (Removable) (Total:1.89 GB) (Free:1.73 GB) FAT32
    6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

    Disk ### Status Size Free Dyn Gpt
    -------- ------------- ------- ------- --- ---
    Disk 0 Online 465 GB 0 B
    Disk 1 Online 1937 MB 0 B

    Partitions of Disk 0:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Recovery 11 GB 1024 KB
    Partition 2 Primary 100 MB 11 GB
    Partition 3 Primary 453 GB 11 GB

    ==================================================================================

    Disk: 0
    Partition 1
    Type : 27
    Hidden: Yes
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 E PQSERVICE NTFS Partition 11 GB Healthy Hidden

    ==================================================================================

    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 D SYSTEM RESE NTFS Partition 100 MB Healthy

    ==================================================================================

    Disk: 0
    Partition 3
    Type : 07
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 C Gateway NTFS Partition 453 GB Healthy

    ==================================================================================

    Partitions of Disk 1:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 1936 MB 64 KB

    ==================================================================================

    Disk: 1
    Partition 1
    Type : 0B
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 G FAT32 Removable 1936 MB Healthy

    ==================================================================================

    Last Boot: 2012-08-07 17:59

    ==================== End Of Log =============================









    any help would be greatly appreciated.
     
    Last edited by a moderator: Sep 11, 2012
    magepker, Sep 11, 2012
    #1
Thread Status:
Not open for further replies.

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds