Windows Defender nowhere to be found and will not start

[dexterrules4]

I am unable to to turn on windows defender. When I hit start I get this message: the specified service does not exist as an installed service error code 0x80070424. I believe windows defender is the reason I am getting the error message:Cannot install the driver plugin error: failed to start service: The dependency service does not exist or has been marked for deletion (1075) when I am trying to install HitBliss. Windows Defender will not let me open tools. I have Avast for anti-virus and have turned it off and still get same error. I can not find windows defender in my registry. I have tried just about everything except reinstalling windows 7 and starting all over. The only place I can find windows defender as a program is under the control panel. Any ideas?? Also how can I reinstall windows 7 without a disk?? If I do a reboot what should I need to save other than pictures and music. I have Windows 7 Home Premium 64 bit.

Update: Just tried to download windows defender from Microsoft and it says Windows Defender is not compatable with my operating system?? It says I can download it for other OS?

 

[AddRAM]

Just install and run Microsoft Security Essentials, it should fix your problem.

Microsoft Security Essentials - Microsoft Windows

Uninstall Avast.

Have you run a system file check ?

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

You can`t install windows 7 without the dvd or by using a usb flash drive.

Also install and run Malwarebytes Antimalware.

http://www.malwarebytes.org/

 

[cottonball]

dexterrules4,


:info: First, please download the Farbar Recovery Scan Tool
Select the 64-bit version.

Save it to the Desktop.

• Double-click the downloaded file to run it.
• When the tool opens click Yes to disclaimer.
• Press the Scan button.
• FRST64 makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply. <<---


The first time the tool is run, it also makes another log: Addition.txt
Also post the Addition.txt in your reply. <<---



:info: Also, download Farbar Service Scanner

Save to the Desktop

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press: Scan
• FSS creates a log, FSS.txt, on the Desktop.

Please provide the FSS.txt in your reply. <<---


The info from these diagnostic tools will let us know if we can bring Windows Defender back.

 

[dexterrules4]

I downloaded Microsoft Security essentials and it won't let me update definitions because it says I have no internet connection? Obviously I have internet connection!! I am so frustrated!! I did uninstall Avast and restarted my computer twice.

 

[VistaKing]

dexterrules4

Don't worry about that . Did you do what was posted on Post 3 by cottonball

 

[dexterrules4]

FST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2013 02
Ran by alireep (administrator) on 01-07-2013 13:31:47
Running from C:\Users\alireep\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
() C:\Windows\PLFSetI.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\ElementsOrganizerSyncAgent.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Online Games Manager\ogmservice.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidFind.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
() C:\Users\alireep\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Siber Systems) C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\system32\sfc.exe
Registry
HKLM\...\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8060960 2009-08-05] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] C:\Windows\PLFSetI.exe [200704 2009-12-04] ()
HKLM\...\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation)
HKCU\...\Run: [ares] "C:\Program Files (x86)\Ares\Ares.exe" -h [x]
HKCU\...\Run: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements 9 Organizer\ElementsOrganizerSyncAgent.exe [1945536 2010-09-06] (Adobe Systems Incorporated)
HKCU\...\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1 [1653248 2009-12-29] (AWS Convergence Technologies, Inc.)
HKCU\...\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
HKCU\...\Run: [cdloader] "C:\Users\alireep\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK [50592 2012-02-01] (magicJack L.P.)
HKCU\...\Run: [AmazonMP3DownloaderHelper] C:\Users\alireep\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-04-05] ()
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] %SystemRoot%\system32\shell32.dll ATTENTION! ====> ZeroAccess?
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] %SystemRoot%\system32\shell32.dll ATTENTION! ====> ZeroAccess?
MountPoints2: {93edcef6-1e97-11e1-9bb0-00262d6c6414} - E:\DPFMate.exe
MountPoints2: {93edcefb-1e97-11e1-9bb0-00262d6c6414} - E:\DPFMate.exe
MountPoints2: {c9dfb66c-9ca5-11e1-a4fa-00262d6c6414} - E:\KODAK_Camera_Setup_App.exe
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [261888 2009-09-24] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-01] (Dritek System Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162336 2009-07-08] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162336 2009-07-08] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\AutorunsDisabled ()


==================== End Of Log ============================

 

[dexterrules4]

FST part 2

Internet
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Home - Welcome to Charter.net
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Search - Charter.net
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=PSI&o=15116&src=crm&q={searchTerms}&locale=&apn_ptnrs=L6&apn_dtid=YYYYYYURUS&apn_uid=ab42f9a3-d617-4e7f-afbd-56e1f1c46de0&apn_sauid=3DEDEA1C-472F-4D94-87D2-58C38BA4D87F
SearchScopes: HKCU - {9877B914-4D1A-432B-84F8-927F83FE5520} URL = http://www.mysearchresults.com/search?&c=4003&t=10&q={searchTerms}
BHO: avast! EasyPass Toolbar Helper - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~2\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL (ArcSoft, Inc.)
BHO-x32: ArcadeWeb - {3A509151-2B00-4190-9FC0-CC5E721CA8ED} - C:\Program Files (x86)\ArcadeWeb Games\ie.dll ()
BHO-x32: avast! EasyPass Toolbar Helper - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - avast! EasyPass Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (AVAST Software)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.3.25

FireFox:
========
FF ProfilePath: C:\Users\alireep\AppData\Roaming\Mozilla\Firefox\Profiles\djx3w9ar.default
FF user.js: detected! => C:\Users\alireep\AppData\Roaming\Mozilla\Firefox\Profiles\djx3w9ar.default\user.js
FF NewTab: about:blank
FF SearchEngine: Google
FF Homepage: https://www.swagbucks.com/
FF Keyword.URL: Bing
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\5\NP_wtapp.dll No File
FF Plugin-x32: @worldwinner.com/Launcher2,version=1.10.0.25 - C:\Program Files (x86)\WorldWinner.com, Inc\WorldWinner Games\npwwload.dll (WorldWinner.com, Inc.)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer - C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\alireep\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\alireep\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Extension: No Name - C:\Users\alireep\AppData\Roaming\Mozilla\Extensions\[email protected]
FF Extension: No Name - C:\Users\alireep\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\alireep\AppData\Roaming\Mozilla\Firefox\Profiles\djx3w9ar.default\Extensions\[email protected]
FF Extension: add-to-searchbox - C:\Users\alireep\AppData\Roaming\Mozilla\Firefox\Profiles\djx3w9ar.default\Extensions\[email protected]
FF Extension: No Name - C:\Users\alireep\AppData\Roaming\Mozilla\Firefox\Profiles\djx3w9ar.default\Extensions\{4324f4a6-3a89-477e-b388-6bca032df78b}.xpi
FF Extension: No Name - C:\Users\alireep\AppData\Roaming\Mozilla\Firefox\Profiles\djx3w9ar.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] C:\Program Files\Plazy\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}] C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
FF Extension: Internet Video Downloader - C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
FF HKLM-x32\...\Firefox\Extensions: [{121C6AF3-6778-4360-AFDB-57BD4E3E4343}] C:\Program Files\Plazy\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox
FF Extension: avast! EasyPass Toolbar for Firefox - C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox
FF HKCU\...\Firefox\Extensions: [[email protected]] C:\Program Files (x86)\ArcadeWeb Games\firefox.xpi
FF Extension: No Name - C:\Program Files (x86)\ArcadeWeb Games\firefox.xpi

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
R2 ogmservice; C:\Program Files (x86)\Online Games Manager\ogmservice.exe [559168 2013-03-12] (RealNetworks, Inc.)

==================== Drivers (Whitelisted) ====================

S2 hitbliss; C:\Windows\System32\drivers\hitbliss.sys [19928 2013-06-26] (Project Concord, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-11] (MCCI Corporation)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-01 13:31 - 2013-07-01 13:31 - 00000000 ____D C:\FRST
2013-07-01 13:28 - 2013-07-01 13:28 - 01933776 ____A (Farbar) C:\Users\alireep\Downloads\FRST64.exe
2013-07-01 12:57 - 2013-07-01 12:57 - 00001945 ____A C:\Windows\epplauncher.mif
2013-07-01 12:57 - 2013-07-01 12:57 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-01 12:57 - 2013-07-01 12:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-01 12:55 - 2013-07-01 12:56 - 13475464 ____A (Microsoft Corporation) C:\Users\alireep\Downloads\mseinstall.exe
2013-07-01 09:09 - 2013-07-01 13:06 - 00000112 ____A C:\Windows\setupact.log
2013-07-01 09:09 - 2013-07-01 09:09 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 21:28 - 2013-06-30 21:28 - 07308288 ____A C:\Users\alireep\Downloads\WindowsDefenderX64(1).msi
2013-06-30 21:26 - 2013-06-30 21:27 - 20034184 ____A (Microsoft Corporation) C:\Users\alireep\Downloads\Windows-KB890830-V5.1.exe
2013-06-30 20:24 - 2013-06-30 20:24 - 08927192 ____A (Project Concord, Inc.) C:\Users\alireep\Downloads\hitbliss-win-1.0.0.21364.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-30 13:26 - 2013-06-30 13:30 - 41404760 ____A (Apple Inc.) C:\Users\alireep\Downloads\QuickTimeInstaller(1).exe
2013-06-29 09:11 - 2013-06-29 09:11 - 00000175 ____A C:\Windows\System32\Drivers\aswVmm.sys.sum
2013-06-29 09:11 - 2013-06-29 09:11 - 00000175 ____A C:\Windows\System32\Drivers\aswSP.sys.sum
2013-06-29 09:11 - 2013-06-29 09:11 - 00000175 ____A C:\Windows\System32\Drivers\aswSnx.sys.sum
2013-06-26 11:43 - 2013-06-26 11:43 - 00019928 ____A (Project Concord, Inc.) C:\Windows\System32\Drivers\hitbliss.sys

==================== One Month Modified Files and Folders =======

2013-07-01 13:31 - 2013-07-01 13:31 - 00000000 ____D C:\FRST
2013-07-01 13:28 - 2013-07-01 13:28 - 01933776 ____A (Farbar) C:\Users\alireep\Downloads\FRST64.exe
2013-07-01 13:20 - 2009-12-04 15:22 - 01365384 ____A C:\Windows\WindowsUpdate.log
2013-07-01 13:14 - 2009-07-13 23:45 - 00017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-01 13:14 - 2009-07-13 23:45 - 00017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-01 13:06 - 2013-07-01 09:09 - 00000112 ____A C:\Windows\setupact.log
2013-07-01 13:06 - 2009-11-04 23:54 - 00847500 ____A C:\Windows\PFRO.log
2013-07-01 13:06 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-01 12:57 - 2013-07-01 12:57 - 00001945 ____A C:\Windows\epplauncher.mif
2013-07-01 12:57 - 2013-07-01 12:57 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-01 12:57 - 2013-07-01 12:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-01 12:57 - 2012-09-05 07:59 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-01 12:56 - 2013-07-01 12:55 - 13475464 ____A (Microsoft Corporation) C:\Users\alireep\Downloads\mseinstall.exe
2013-07-01 09:09 - 2013-07-01 09:09 - 00000000 ____A C:\Windows\setuperr.log
2013-07-01 09:09 - 2010-02-28 10:10 - 00000000 ____D C:\Users\alireep\AppData\Local\WeatherBug
2013-06-30 21:28 - 2013-06-30 21:28 - 07308288 ____A C:\Users\alireep\Downloads\WindowsDefenderX64(1).msi
2013-06-30 21:27 - 2013-06-30 21:26 - 20034184 ____A (Microsoft Corporation) C:\Users\alireep\Downloads\Windows-KB890830-V5.1.exe
2013-06-30 20:24 - 2013-06-30 20:24 - 08927192 ____A (Project Concord, Inc.) C:\Users\alireep\Downloads\hitbliss-win-1.0.0.21364.exe
2013-06-30 15:25 - 2012-09-02 18:24 - 00000000 ____D C:\Users\alireep\Desktop\Games
2013-06-30 13:32 - 2013-06-30 13:32 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-30 13:32 - 2013-06-30 13:32 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-30 13:32 - 2012-08-30 08:11 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-06-30 13:32 - 2010-11-10 16:48 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-30 13:30 - 2013-06-30 13:26 - 41404760 ____A (Apple Inc.) C:\Users\alireep\Downloads\QuickTimeInstaller(1).exe
2013-06-29 09:11 - 2013-06-29 09:11 - 00000175 ____A C:\Windows\System32\Drivers\aswVmm.sys.sum
2013-06-29 09:11 - 2013-06-29 09:11 - 00000175 ____A C:\Windows\System32\Drivers\aswSP.sys.sum
2013-06-29 09:11 - 2013-06-29 09:11 - 00000175 ____A C:\Windows\System32\Drivers\aswSnx.sys.sum
2013-06-26 11:43 - 2013-06-26 11:43 - 00019928 ____A (Project Concord, Inc.) C:\Windows\System32\Drivers\hitbliss.sys
2013-06-11 22:08 - 2012-09-05 07:59 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:08 - 2011-10-20 20:12 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-03 17:43 - 2011-07-23 00:29 - 73393752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MRT.exe

Files to move or delete:
====================
C:\Users\alireep\GoToAssistDownloadHelper.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-23 12:26

 

[dexterrules4]

Additional: part 1

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-07-2013 02
Ran by alireep at 2013-07-01 13:34:06
Running from C:\Users\alireep\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Update for Microsoft Office 2007 (KB2508958) (x32)
64 Bit HP CIO Components Installer (Version: 6.2.1)
Acer Arcade Deluxe (x32 Version: 3.0.7006)
Acer Assist (x32)
Acer Backup Manager (x32 Version: 2.0.0.29)
Acer Crystal Eye webcam Ver:1.1.124.1120 (x32 Version: 1.1.124.1120)
Acer ePower Management (x32 Version: 4.05.3004)
Acer eRecovery Management (x32 Version: 4.05.3005)
Acer Games (x32 Version: 1.0.0.71)
Acer GridVista (x32 Version: 3.01.0730)
Acer Registration (x32 Version: 1.02.3006)
Acer ScreenSaver (x32 Version: 1.7.0715)
Acer Updater (x32 Version: 1.01.3017)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 3.6.0.6090)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Photoshop Elements 9 (x32 Version: 9.0)
Adobe Photoshop.com Inspiration Browser (x32 Version: 3.07)
Adobe Premiere Elements 9 (x32 Version: 9.0)
Adobe Premiere Elements 9 (x32 Version: 9.0.1)
Adobe Reader XI (11.0.03) (x32 Version: 11.0.03)
ALPS Touch Pad Driver (Version: 7.105.2015.1103)
Amazon MP3 Downloader 1.0.18 (HKCU Version: 1.0.18)
Amazon MP3 Uploader (x32 Version: 1.0.8)
Apple Application Support (x32 Version: 2.3)
Apple Mobile Device Support (Version: 3.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
ArcadeWeb (x32 Version: 1.0.0)
avast! EasyPass (x32 Version: 7-7-8-128)
Backup Manager Basic (x32 Version: 2.0.0.29)
Ballad of Solar (x32)
Big Fish Games: Game Manager (x32 Version: 3.0.1.60)
Bonjour (Version: 2.0.1.2)
Broadcom Gigabit NetLink Controller (Version: 12.26.02)
Charter Browser Updater (HKCU)
Click Cutter 2.4 (x32)
Club Control (x32)
Coupon Printer for Windows (x32 Version: 5.0.0.1)
D3DX10 (x32 Version: 15.4.2368.0902)
Delicious - Emily's Double Pack (x32)
DivX Plus Web Player (x32 Version: 2.0.0)
EA Download Manager (x32 Version: 7.2.0.32)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
eSobi v2 (x32 Version: 2.0.4.000274)
Fairy Godmother Tycoon (x32)
Farm Tribe 2 (x32)
Fiction Fixers - The Curse of Oz (x32)
Food Masters 10-in-1 Bundle (x32)
GamesUnite (x32)
GoGear VIBE Device Manager (x32 Version: 01.06)
Google Chrome (x32 Version: 27.0.1453.116)
Google Update Helper (x32 Version: 1.3.21.145)
Haunted Domains (x32)
HP Photosmart C4600 All-In-One Driver 14.0 Rel. 5 (Version: 14.0)
Identity Card (x32 Version: 1.00.3002)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2202)
Intel® Matrix Storage Manager
iTunes (Version: 9.1.1.12)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Launch Manager (x32 Version: 3.0.06)
LeapFrog Connect (x32 Version: 3.2.19.13664)
LeapFrog LeapPad Explorer Plugin (x32 Version: 3.2.22.13714)
Logitech Vid HD (x32 Version: 7.2 (7240))
LSI HDA Modem (Version: 2.1.94)
magicJack (HKCU Version: 2.0.6073.4413)
Mama Farm (x32)
Media Converter for Philips (x32 Version: 2.5.2.223)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Works (x32 Version: 9.7.0621)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Midnight Mysteries Triple Bundle (x32)
Mozilla Firefox 20.0.1 (x86 en-US) (x32 Version: 20.0.1)
Mozilla Maintenance Service (x32 Version: 20.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0)
MyWinLocker (x32 Version: 3.1.76.0)
NTI Backup Now 5 (x32 Version: 5.1.2.627)
NTI Backup Now Standard (x32 Version: 5.1.2.627)
NTI Media Maker 8 (x32 Version: 8.0.12.6623)
Octoshape add-in for Adobe Flash Player (HKCU)
oDesk Team (HKCU)
OLYMPUS Master 2 (x32 Version: 1.0.11)
Online Games Manager v1.20 (x32 Version: 1.20.13)
OverDrive Media Console (x32 Version: 3.2.20)
Plants vs. Zombies(TM) (x32)
PS_AIO_05_C4600_Software_Min (x32 Version: 140.0.690.000)
QuickTime (x32 Version: 7.73.80.64)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5911)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7100.30093)
Scan (x32 Version: 140.0.80.000)
Sid Meier's Civilization 4 Complete (x32 Version: 1.74)
Sid Meier's Civilization IV Colonization (x32 Version: 1.00)
SimCity 4 Deluxe (x32)
SimCity™ Societies (x32 Version: 1.0.0.0)
SimCity™ Societies Destinations (x32 Version: 1.0.0.1)
Skype Click to Call (x32 Version: 5.8.8855)
Skype™ 5.10 (x32 Version: 5.10.116)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090)
Spotify (HKCU Version: 0.8.8.450.gd9413516)
The Sims™ 3 (x32 Version: 1.18.9)
The Sims™ 3 Late Night (x32 Version: 6.1.11)
Toolbox (x32 Version: 140.0.428.000)
TV Farm (x32)
Unity Web Player (HKCU Version: )
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32)
Update for Microsoft Office OneNote 2007 Help (KB963670) (x32)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update for Microsoft Office Script Editor Help (KB963671) (x32)
Update for Microsoft Office Word 2007 Help (KB963665) (x32)
Use the entry named LeapFrog Connect to uninstall (LeapFrog LeapPad Explorer Plugin) (x32)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0)
VLC media player 1.0.1 (x32 Version: 1.0.1)
WeatherBug (x32 Version: 7.0.0.3)
Web Games Player Plugin (x32)
Welcome Center (x32 Version: 1.00.3008)
Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) (Version: 09/10/2009 02.03.05.012)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3502.0922)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Sync (x32 Version: 14.0.8117.416)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Women's Murder Club - Triple Crime Pack (x32)
WorldWinner Games (x32 Version: 1.10.0.25)
Yahoo! Messenger (x32)
Yahoo! Software Update (x32)

==================== Restore Points =========================

27-05-2013 19:59:59 Scheduled Checkpoint
07-06-2013 16:50:57 Scheduled Checkpoint
19-06-2013 17:21:03 Scheduled Checkpoint
30-06-2013 18:31:10 Installed Java 7 Update 25
01-07-2013 17:59:20 avast! Internet Security Setup
01-07-2013 18:19:42 Windows Update

==================== Scheduled Tasks (whitelisted) =============

Task: {099C9C5B-E0AD-4FAE-A80C-E58891D0AAB2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-14] (Google Inc.)
Task: {207C8D08-E87E-4399-B5EB-89D939BD1CB6} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-01-27] (Microsoft Corporation)
Task: {3B9B6C8E-4F9B-4DAE-81A5-02EDC65598B6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {44AB7438-B826-40EB-9327-4C20C405DF4A} - System32\Tasks\AdobeAAMUpdater-1.0-alireep-PC-alireep => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {4ECB1EEA-0420-483F-A0BC-B710918DA216} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-01-27] (Microsoft Corporation)
Task: {5913081F-DE2E-4A37-948D-C87437025F9D} - System32\Tasks\Microsoft\Windows\Defrag\Defrag => C:\Windows\System32\Defrag.exe [2009-07-13] (Microsoft Corp.)
Task: {66C79264-A773-4A58-86D1-2D894C0DF1D3} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {77CE3F69-E9D8-4047-B08A-114D6BCC4A82} - System32\Tasks\Run RoboForm TaskBar Icon => C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2013-03-05] (Siber Systems)
Task: {8CF54E33-366A-401A-99D0-6FD63C13C0FE} - System32\Tasks\YourFile DownloaderUpdate => C:\Program Files (x86)\YourFileDownloader\YourFileUpdater.exe [2012-12-24] (Welcome to YourFile Downloader!)
Task: {A8B3A95C-DEF7-480E-96B8-3EBD564BA981} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {AFFD1166-83B9-4F09-9A44-9F46FAC99EC6} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {D0516BC1-D0F6-407D-9E27-94DDEAC731C2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-02-14] (Google Inc.)
Task: {F69DD296-2B15-4478-ACDD-06DF3E6A5F91} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated)
Task: {FFEC2708-4807-46A5-9BF6-E7B6B612D1F1} - System32\Tasks\{78CE16A8-83C1-4B87-B16D-A54A5643B62E} => C:\program files (x86)\mozilla firefox\firefox.exe [2013-04-16] (Mozilla Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: Broadcom NetLink (TM) Gigabit Ethernet - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: WAN Miniport (IP) - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: WAN Miniport (Network Monitor) - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: WAN Miniport (IPv6) - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: Leapfrog USB LAN Adapter - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: Microsoft Virtual WiFi Miniport Adapter - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: Atheros AR5B93 Wireless Network Adapter - avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

 

[dexterrules4]

Additional: Part 2

==================== Event log errors: =========================

Application errors:
==================
Error: (07/01/2013 00:58:08 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/30/2013 09:28:56 PM) (Source: MsiInstaller) (User: alireep-PC)
Description: Product: Windows Defender -- You do not need to install this software because Windows Defender is included in Windows Vista. You can access Windows Defender from the Security section of the Windows Control Panel.

Error: (06/30/2013 09:24:32 PM) (Source: MsiInstaller) (User: alireep-PC)
Description: Product: Windows Defender -- You do not need to install this software because Windows Defender is included in Windows Vista. You can access Windows Defender from the Security section of the Windows Control Panel.

Error: (06/30/2013 08:41:36 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/30/2013 07:38:42 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/30/2013 04:36:20 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/30/2013 03:25:05 PM) (Source: Application Hang) (User: )
Description: The program Weather.exe version 6.8.0.6 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 98c

Start Time: 01ce75cfb4822512

Termination Time: 16

Application Path: C:\Program Files (x86)\AWS\WeatherBug\Weather.exe

Report Id: 23e8ef2d-e1c3-11e2-9110-00262d6c6414

Error: (06/30/2013 03:21:44 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (06/30/2013 03:21:44 PM) (Source: Application Hang) (User: )
Description: The program firefox.exe version 20.0.1.4847 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1290

Start Time: 01ce75cf1ccde70b

Termination Time: 125

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: a7011943-e1c2-11e2-9c41-00262d6c6414

Error: (06/30/2013 03:19:19 PM) (Source: Application Hang) (User: )
Description: The program Weather.exe version 6.8.0.6 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 824

Start Time: 01ce75be85b17cab

Termination Time: 16

Application Path: C:\Program Files (x86)\AWS\WeatherBug\Weather.exe

Report Id:


System errors:
=============
Error: (07/01/2013 01:20:32 PM) (Source: Microsoft Antimalware) (User: )
Description: %alireep-PC60 has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 0.0.0.0

Update Source: %alireep-PC51

Update Stage: 4.2.0223.00

Source Path: 4.2.0223.01

Signature Type: %alireep-PC602

Update Type: %alireep-PC604

User: alireep-PC\alireep

Current Engine Version: %alireep-PC605

Previous Engine Version: %alireep-PC606

Error code: %alireep-PC607

Error description: %alireep-PC608

Error: (07/01/2013 01:20:28 PM) (Source: Service Control Manager) (User: )
Description: The Microsoft Network Inspection service depends on the Microsoft Network Inspection System service which failed to start because of the following error:
%%1075

Error: (07/01/2013 01:20:28 PM) (Source: Service Control Manager) (User: )
Description: The Microsoft Network Inspection System service depends the following service: bfe. This service might not be installed.

Error: (07/01/2013 01:20:29 PM) (Source: Microsoft Antimalware) (User: )
Description: %alireep-PC60 has encountered an error trying to update the engine.

New Engine Version:

Previous Engine Version:

Engine Type: %alireep-PC604

User: alireep-PC\alireep

Error Code: %alireep-PC601

Error description: %alireep-PC602

Error: (07/01/2013 01:20:29 PM) (Source: Microsoft Antimalware) (User: )
Description: %alireep-PC60 has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version:

Update Source: %alireep-PC15

Update Stage: 4.2.0223.00

Source Path: 4.2.0223.01

Signature Type: %alireep-PC602

Update Type: %alireep-PC604

User: alireep-PC\alireep

Current Engine Version: %alireep-PC605

Previous Engine Version: %alireep-PC606

Error code: %alireep-PC607

Error description: %alireep-PC608

Error: (07/01/2013 01:07:45 PM) (Source: Service Control Manager) (User: )
Description: The HomeGroup Listener service terminated with service-specific error %%-2147023143.

Error: (07/01/2013 01:07:26 PM) (Source: Service Control Manager) (User: )
Description: The IPsec Policy Agent service depends the following service: bfe. This service might not be installed.

Error: (07/01/2013 01:07:14 PM) (Source: Service Control Manager) (User: )
Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: bfe. This service might not be installed.

Error: (07/01/2013 01:07:14 PM) (Source: Service Control Manager) (User: )
Description: The HitBliss WFP driver service depends the following service: bfe. This service might not be installed.

Error: (07/01/2013 01:07:06 PM) (Source: Service Control Manager) (User: )
Description: The Computer Browser service terminated with the following error:
%%1060


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 50%
Total physical RAM: 3000.93 MB
Available physical RAM: 1472.96 MB
Total Pagefile: 6000.04 MB
Available Pagefile: 4197.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:286.27 GB) (Free:183.75 GB) NTFS (Disk=0 Partition=3)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 9C439C43)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=286 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

[dexterrules4]

Did SFC and says no integrity problems found. http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
Going to to do malware next

 

[dexterrules4]

FSS

Farbar Service Scanner Version: 27-06-2013
Ran by alireep (administrator) on 01-07-2013 at 14:06:37
Running from "C:\Users\alireep\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to retrieve start type of MpsSvc. The value does not exist.
Checking ImagePath: ATTENTION!=====> Unable to retrieve ImagePath of MpsSvc. The value does not exist.
Unable to retrieve ServiceDll of MpsSvc. The value does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.


Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Action Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A} key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.


Other Services:
==============
Checking Start type of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ImagePath of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ServiceDll of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[dexterrules4]

I think with all these registry errors I should do a reinstall of windows 7?? The help and support says I can make my own install CD. What do u think?

 

[VistaKing]

Open Notepad . Inside notepad paste the highlighted text below



start
HKLM\...\Run: [PLFSetI] C:\Windows\PLFSetI.exe [200704 2009-12-04] ()
HKCU\...\Run: [ares] "C:\Program Files (x86)\Ares\Ares.exe" -h [x]
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] %SystemRoot%\system32\shell32.dll ATTENTION! ====> ZeroAccess?
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] %SystemRoot%\system32\shell32.dll ATTENTION! ====> ZeroAccess?
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=PSI&o=15116&src=crm&q={searchTerms}&locale=&apn_ptnrs=L6&apn_dtid=YYYYYYURUS&a pn_uid=ab42f9a3-d617-4e7f-afbd-56e1f1c46de0&apn_sauid=3DEDEA1C-472F-4D94-87D2-58C38BA4D87F
SearchScopes: HKCU - {9877B914-4D1A-432B-84F8-927F83FE5520} URL = http://www.mysearchresults.com/search?&c=4003&t=10&q={searchTerms}
BHO-x32: ArcadeWeb - {3A509151-2B00-4190-9FC0-CC5E721CA8ED} - C:\Program Files (x86)\ArcadeWeb Games\ie.dll ()
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - avast! EasyPass Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (AVAST Software)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
C:\Users\alireep\GoToAssistDownloadHelper.exe
end



Save the file as fixlist.txt and save it to the Desktop . Drag the FRST64.exe from the Downloads folder to the Desktop .

Open up the FRST64.exe and click on the [FIX] button . Once its done it will create a file called Fixlog.txt . Upload the Fixlog.txt on your next reply .

Restart the PC

:ar: FSS.exe fixes

MpsSvc.reg

BFE.reg

wscsvc.reg

WinDefend.reg

iphlpsvc.reg

Save all of the .reg files to your Desktop . Right click on each file and click on Merge and click on OK to confirm . After you have merged all of the .reg files restart and rerun the FSS.exe bit delete the old FSS.txt file first before you rerun FSS.exe

 

[dexterrules4]

Here is Fix Log:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-07-2013 02
Ran by alireep at 2013-07-01 17:28:57 Run:1
Running from C:\Users\alireep\Downloads
Boot Mode: Normal
==============================================

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\PLFSetI => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ares => Value deleted successfully.
HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} => Key not found.
HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key deleted successfully.
HKCR\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9877B914-4D1A-432B-84F8-927F83FE5520} => Key deleted successfully.
HKCR\CLSID\{9877B914-4D1A-432B-84F8-927F83FE5520} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A509151-2B00-4190-9FC0-CC5E721CA8ED} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{3A509151-2B00-4190-9FC0-CC5E721CA8ED} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{724d43a0-0d85-11d4-9908-00400523e39a} => Value deleted successfully.
HKCR\CLSID\{724d43a0-0d85-11d4-9908-00400523e39a} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{724d43a0-0d85-11d4-9908-00400523e39a} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{724d43a0-0d85-11d4-9908-00400523e39a} => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} => Value deleted successfully.
HKCR\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{724D43A0-0D85-11D4-9908-00400523E39A} => Value deleted successfully.
HKCR\CLSID\{724D43A0-0D85-11D4-9908-00400523E39A} => Key not found.
HKCR\PROTOCOLS\Handler\skype-ie-addon-data => Key deleted successfully.
HKCR\CLSID\{91774881-D725-4E58-B298-07617B9B86A8} => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\gopher => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{79eac9e4-baf9-11ce-8c82-00aa004ba90b} => Key not found.
C:\Users\alireep\GoToAssistDownloadHelper.exe => Moved successfully.

==== End of Fixlog ====

 

[VistaKing]

Open Notepad . Inside notepad paste the highlighted text below


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}]
"AutoStart"=""


Save the file as ActionCenterIcon.reg and save it to your Desktop .
Right click the ActionCenterIcon.reg file and Select Merge and then reboot your machine



Open up an Elevated Command Prompt. Click on rb: in

type CMD . Right click on CMD under Programs (1) choose

. On the User Access Control window click on the Yes button . Command Prompt opens up to C:\Windows\System32>_

Type the command below and press <ENTER>

regsvr32 ActionCenter.dll

 

[dexterrules4]

Open Notepad . Inside notepad paste the highlighted text below




:ar: FSS.exe fixes

MpsSvc.reg

BFE.reg

wscsvc.reg

WinDefend.reg

iphlpsvc.reg

Save all of the .reg files to your Desktop . Right click on each file and click on Merge and click on OK to confirm . After you have merged all of the .reg files restart and rerun the FSS.exe bit delete the old FSS.txt file first before you rerun FSS.exe

Says it could not merge all data for windefend.reg because some keys are open or being used?? All others I was able to merge.

 

[VistaKing]

Restart the PC and then retry merging WinDefend.reg again and restart .

 

[dexterrules4]

New FSS report

Farbar Service Scanner Version: 27-06-2013
Ran by alireep (administrator) on 01-07-2013 at 17:43:13
Running from "C:\Users\alireep\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.

bfe Service is not running. Checking service configuration:
The start type of bfe service is OK.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.


Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

Action Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A} key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to retrieve start type of WinDefend. The value does not exist.
Checking ImagePath: ATTENTION!=====> Unable to retrieve ImagePath of WinDefend. The value does not exist.
Unable to retrieve ServiceDll of WinDefend. The value does not exist.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[dexterrules4]

Restart the PC and then retry merging WinDefend.reg again and restart .

Restarted twice and still saying some keys are in use or open.

 

[dexterrules4]

Open Notepad . Inside notepad paste the highlighted text below


Open up an Elevated Command Prompt. Click on rb: in

type CMD . Right click on CMD under Programs (1) choose

. On the User Access Control window click on the Yes button . Command Prompt opens up to C:\Windows\System32>_

Type the command below and press <ENTER>

regsvr32 ActionCenter.dll

Got the following message when I did CMD The module Action Center.dll was loaded but the entry point diiregisterserver was not found. Make sure actioncenter.dll is a valid dll or ocx file and try again.