Solve : Getting my logs to you?

1.	Solve : Getting my logs to you?
Answer» I see it running in the Service but I don't see it in the Processes, and it should be. Two logs will be produced with this scan. Please post (copy/paste) both of them. You might need two posts to get all of the text in. Download random's system information tool (RSIT) by random/random from and save it to your Desktop. Double click on RSIT.exe to run. Click Continue at the disclaimer screen. Once it has finished, two logs will open. log.txt <will be maximized and info.txt <will be minimized Please post the contents of both logs in the next reply. I'm sorry, I had to stop yesterday, my grandmother was put in the hospital-had to go to Ga. I just tried the Hijack stuff you said and an error message came up. I am going to try to copy and paste it to you. After the message-it connected me with a site with questions and answers-I didn't even know my question. I'm SENDING you the error message now. I know it's early where you are-I'm sorry- but you don't know how much I REALLY THANK-YOU FOR ALL YOUR HELP AND PATIENCE!!!!!!!!!! DonnaIt's me again, I just went back to Hijack this and the things (only a couple were on there in the first place that you told me to check-well they are not on there now, so I am sending you what is on there now. Do I go ahead and do the next stuff you said to do or wait until I hear from you? I'll wait. Donna I can't send it to you-it won't let me highlight it.;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584] R3 GEARAspiWDM;GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168] R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2007-11-22 79304] R3 mfebopk;McAfee Inc. mfebopk; C:\Windows\system32\drivers\mfebopk.sys [2007-11-22 35240] R3 mfesmfk;McAfee Inc. mfesmfk; C:\Windows\system32\drivers\mfesmfk.sys [2007-12-02 40488] R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2006-12-14 6144] R3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2007-01-15 9728] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-06-19 7468128] R3 Point32;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point32k.sys [2006-11-08 24064] R3 rt61x86;Linksys Wireless-G PCI ADAPTER Driver; C:\Windows\system32\DRIVERS\WMP54Gv41x86.sys [2007-03-12 286208] R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496] S1 DTC328X;DTC328X; C:\Windows\System32\drivers\DTC328X.SYS [] S1 EPPSCSIx;EPPSCSIx; C:\Windows\System32\drivers\EPPSCSI.SYS [] S3 BEFCMU10V4XP;Linksys BEFCMU10 ver. 4 Cable Modem; C:\Windows\system32\DRIVERS\BEFCMU10V4XP.sys [2004-07-05 14336] S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632] S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [] S3 mferkdk;McAfee Inc. mferkdk; C:\Windows\system32\drivers\mferkdk.sys [2007-11-22 33832] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192] S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888] S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016] S3 UNDPX2A;UNDPX2A; \??\C:\Windows\system32\drivers\UNDPX2A.SYS [] S3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:\Windows\system32\DRIVERS\Sacm2A.sys [2004-06-09 15429] S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592] R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376] R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2006-12-08 45056] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440] R2 lxdc_device;lxdc_device; C:\Windows\system32\lxdccoms.exe [2007-05-25 537520] R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976] R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-01-25 2458128] R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248] R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704] R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-06-19 118784] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104] R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-12-05 695624] S2 lxdcCATSCustConnectService;lxdcCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdcserv.exe [2007-05-25 99248] S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184] -----------------EOF----------------- xt LOGFILE of random's system information tool 1.05 2008-12-23 09:03:48 ======Uninstall list====== -->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks\|RealPlayer\|6.0 -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER AC3Filter (remove only)-->C:\Program Files\AC3Filter\uninstall.exe Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E} Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Media Player-->msiexec /qb /x {1EBB57D4-63FF-87CC-A0F0-D73982CF6008} Adobe Media Player-->MsiExec.exe /I{1EBB57D4-63FF-87CC-A0F0-D73982CF6008} Adobe Reader 8.1.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003} Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3} Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN ebgcInfra-->MsiExec.exe /X{39B1BD87-561E-4762-AED9-7C5213B06C24} ebgcRes-->MsiExec.exe /X{5380B111-5047-413D-A6E5-70D69391D08E} ebgcSDK-->MsiExec.exe /X{13AD768A-9E04-499D-AE80-967A65DCCBA5} Graboid Video 1.3-->C:\Program Files\Graboid\uninst.exe HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall iTunes-->MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF} Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} Lexmark 1300 Series-->C:\Program Files\Lexmark 1300 Series\Install\x86\Uninst.exe Linksys Wireless-G PCI Adapter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4DDC3BED-CC68-44AA-B435-D727B620CA5B}\setup.exe" -l0x9 Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Mozilla ActiveX Control v1.7.12-->C:\Program Files\Mozilla ActiveX Control v1.7.12\uninst.exe MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" -uninstall QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175} RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks\|RealPlayer\|6.0 Rhapsody Player Engine-->MsiExec.exe /I{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} Scientific-Atlanta WebSTAR 2000 series Cable Modem-->UNDPX2A.EXE Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003} System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe VeohTV BETA-->C:\Program Files\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409 VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe Windows Vista Upgrade Advisor-->MsiExec.exe /I{C6AA3FB7-804F-4808-AD91-B62D6ED9B788} Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\common\unyt.exe YOU DON'T KNOW JACK Volume 3-->c:\windows\ydkjv3\unwise.exe c:\windows\ydkjv3\jack3.log =====HijackThis Backups===== R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O4 - HKUS\.DEFAULT\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O4 - HKUS\.DEFAULT\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) ======Security center information====== AS: Windows Defender System event log Computer Name: Bruce Event Code: 7036 Message: The TPM Base Services service entered the stopped state. Record Number: 284478 Source Name: Service Control Manager Time Written: 20081223135150.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 537 Message: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer. TBS could not be started. Record Number: 284479 Source Name: Microsoft-Windows-TBS Time Written: 20081223135150.174147-000 Event Type: Information User: NT AUTHORITY\LOCAL SERVICE Computer Name: Bruce Event Code: 7036 Message: The Security Center service entered the running state. Record Number: 284480 Source Name: Service Control Manager Time Written: 20081223135204.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 7036 Message: The Windows Update service entered the running state. Record Number: 284481 Source Name: Service Control Manager Time Written: 20081223135259.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 18 Message: Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on ?Wednesday, ?December ?24, ?2008 at 3:00 AM: - Security Update for Internet Explorer 7 in Windows Vista (KB960714) Record Number: 284482 Source Name: Microsoft-Windows-WindowsUpdateClient Time Written: 20081223135346.148147-000 Event Type: Information User: NT AUTHORITY\SYSTEM Application event log Computer Name: Bruce Event Code: 302 Message: Windows (2388) Windows: The database engine has successfully completed recovery steps. Record Number: 110490 Source Name: ESENT Time Written: 20081223134958.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 0 Message: Record Number: 110491 Source Name: iPod Service Time Written: 20081223135003.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 1003 Message: The Windows Search Service started. Record Number: 110492 Source Name: Microsoft-Windows-Search Time Written: 20081223135113.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 1 Message: The Windows Security Center Service has started. Record Number: 110493 Source Name: SecurityCenter Time Written: 20081223135209.000000-000 Event Type: Information User: Computer Name: Bruce Event Code: 5 Message: Unsupported service control request (see data below) Record Number: 110494 Source Name: LightScribeService Time Written: 20081223140344.000000-000 Event Type: Information User: Security event log Computer Name: Bruce Event Code: 5038 Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 87849 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081223140334.462147-000 Event Type: Audit Failure User: Computer Name: Bruce Event Code: 5038 Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 87850 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081223140334.561147-000 Event Type: Audit Failure User: Computer Name: Bruce Event Code: 5038 Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 87851 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081223140334.639147-000 Event Type: Audit Failure User: Computer Name: Bruce Event Code: 5038 Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 87852 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081223140334.719147-000 Event Type: Audit Failure User: Computer Name: Bruce Event Code: 5038 Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 87853 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081223140334.782147-000 Event Type: Audit Failure User: ======Environment VARIABLES====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=15 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 95 Stepping 2, AuthenticAMD "PROCESSOR_REVISION"=5f02 "NUMBER_OF_PROCESSORS"=1 "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip -----------------EOF----------------- DID I DO IT RIGHT?? DonnaHello----Did I do it right? I'm sorry I could not do it right away-but my grandmother was put in the hospital. So I did it today. Is that O.K.?? DonnaYour Java is out of date. Older versions have vulnerabilities that MALICIOUS sites can use to infect your system. First install the new Sun Java Runtime Environment Be sure to close all browser windows before beginning the install. Remove the old version(s) Download JavaRa Unzip the file and open the JavaRa.exe Click Remove Older Versions JavaRa will search for and remove any outdated version of Java and remove any that are found. Click Additional Tasks Place a check next to Remove Useless JRE Files and click Go Exit JavaRa Delete the JavaRa files from the Desktop ---------- I don't think that McAfee is installed right. It's not showing in the Security Center. Do you have a disk so you can re-install it?don't have a disk to re-install McAfee. Like I said it came with comcast and I just downloaded it from the web-site as best as I can remember. Thank-you. Now what? DonnaIf it's provided by your ISP then I would contact them. They will either send a disk or let you know how to re-install it.

Answer»

I see it running in the Service but I don't see it in the Processes, and it should be.

Two logs will be produced with this scan. Please post (copy/paste) both of them. You might need two posts to get all of the text in.

Download random's system information tool (RSIT) by random/random from and save it to your Desktop.

Double click on RSIT.exe to run.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open.
log.txt <will be maximized and info.txt <will be minimized
Please post the contents of both logs in the next reply.

I'm sorry, I had to stop yesterday, my grandmother was put in the hospital-had to go to Ga. I just tried the Hijack stuff you said and an error message came up. I am going to try to copy and paste it to you. After the message-it connected me with a site with questions and answers-I didn't even know my question. I'm SENDING you the error message now. I know it's early where you are-I'm sorry- but you don't know how much I REALLY THANK-YOU FOR ALL YOUR HELP AND PATIENCE!!!!!!!!!!
DonnaIt's me again, I just went back to Hijack this and the things (only a couple were on there in the first place that you told me to check-well they are not on there now, so I am sending you what is on there now. Do I go ahead and do the next stuff you said to do or wait until I hear from you? I'll wait.
Donna
I can't send it to you-it won't let me highlight it.;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R3 GEARAspiWDM;GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2007-11-22 79304]
R3 mfebopk;McAfee Inc. mfebopk; C:\Windows\system32\drivers\mfebopk.sys [2007-11-22 35240]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\Windows\system32\drivers\mfesmfk.sys [2007-12-02 40488]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2006-12-14 6144]
R3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2007-01-15 9728]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-06-19 7468128]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point32k.sys [2006-11-08 24064]
R3 rt61x86;Linksys Wireless-G PCI ADAPTER Driver; C:\Windows\system32\DRIVERS\WMP54Gv41x86.sys [2007-03-12 286208]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496]
S1 DTC328X;DTC328X; C:\Windows\System32\drivers\DTC328X.SYS []
S1 EPPSCSIx;EPPSCSIx; C:\Windows\System32\drivers\EPPSCSI.SYS []
S3 BEFCMU10V4XP;Linksys BEFCMU10 ver. 4 Cable Modem; C:\Windows\system32\DRIVERS\BEFCMU10V4XP.sys [2004-07-05 14336]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys []
S3 mferkdk;McAfee Inc. mferkdk; C:\Windows\system32\drivers\mferkdk.sys [2007-11-22 33832]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 UNDPX2A;UNDPX2A; \??\C:\Windows\system32\drivers\UNDPX2A.SYS []
S3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:\Windows\system32\DRIVERS\Sacm2A.sys [2004-06-09 15429]
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2006-12-08 45056]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440]
R2 lxdc_device;lxdc_device; C:\Windows\system32\lxdccoms.exe [2007-05-25 537520]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-06-19 118784]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-12-05 695624]
S2 lxdcCATSCustConnectService;lxdcCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdcserv.exe [2007-05-25 99248]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184]

-----------------EOF-----------------
xt LOGFILE of random's system information tool 1.05 2008-12-23 09:03:48

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
AC3Filter (remove only)-->C:\Program Files\AC3Filter\uninstall.exe
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Media Player-->msiexec /qb /x {1EBB57D4-63FF-87CC-A0F0-D73982CF6008}
Adobe Media Player-->MsiExec.exe /I{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}
Adobe Reader 8.1.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
ebgcInfra-->MsiExec.exe /X{39B1BD87-561E-4762-AED9-7C5213B06C24}
ebgcRes-->MsiExec.exe /X{5380B111-5047-413D-A6E5-70D69391D08E}
ebgcSDK-->MsiExec.exe /X{13AD768A-9E04-499D-AE80-967A65DCCBA5}
Graboid Video 1.3-->C:\Program Files\Graboid\uninst.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
iTunes-->MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lexmark 1300 Series-->C:\Program Files\Lexmark 1300 Series\Install\x86\Uninst.exe
Linksys Wireless-G PCI Adapter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4DDC3BED-CC68-44AA-B435-D727B620CA5B}\setup.exe" -l0x9
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Mozilla ActiveX Control v1.7.12-->C:\Program Files\Mozilla ActiveX Control v1.7.12\uninst.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" -uninstall
QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Rhapsody Player Engine-->MsiExec.exe /I{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
Scientific-Atlanta WebSTAR 2000 series Cable Modem-->UNDPX2A.EXE
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
VeohTV BETA-->C:\Program Files\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Vista Upgrade Advisor-->MsiExec.exe /I{C6AA3FB7-804F-4808-AD91-B62D6ED9B788}
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\common\unyt.exe
YOU DON'T KNOW JACK Volume 3-->c:\windows\ydkjv3\unwise.exe c:\windows\ydkjv3\jack3.log

=====HijackThis Backups=====

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKUS\.DEFAULT\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A
O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKUS\.DEFAULT\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A
O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\Donna\AppData\Local\Temp\Low\~DFF343.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFF22A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF156E.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF12A2.tmp C:\Users\Donna\AppData\Local\Temp\HSPERF~1.SH! C:\Users\Donna\AppData\Local\Temp\Low\~DFBD71.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFBD5A.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFADDA.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFAD2C.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF5B68.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF28F8.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF2789.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DFD81.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF6E8F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF63B0.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C7F.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF4C72.tmp C:\Users\Donna\AppData\Local\Temp\Low\~DF3A
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

======Security center information======

AS: Windows Defender

System event log

Computer Name: Bruce
Event Code: 7036
Message: The TPM Base Services service entered the stopped state.
Record Number: 284478
Source Name: Service Control Manager
Time Written: 20081223135150.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 537
Message: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer. TBS could not be started.
Record Number: 284479
Source Name: Microsoft-Windows-TBS
Time Written: 20081223135150.174147-000
Event Type: Information
User: NT AUTHORITY\LOCAL SERVICE

Computer Name: Bruce
Event Code: 7036
Message: The Security Center service entered the running state.
Record Number: 284480
Source Name: Service Control Manager
Time Written: 20081223135204.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 7036
Message: The Windows Update service entered the running state.
Record Number: 284481
Source Name: Service Control Manager
Time Written: 20081223135259.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 18
Message: Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on ?Wednesday, ?December ?24, ?2008 at 3:00 AM:
- Security Update for Internet Explorer 7 in Windows Vista (KB960714)
Record Number: 284482
Source Name: Microsoft-Windows-WindowsUpdateClient
Time Written: 20081223135346.148147-000
Event Type: Information
User: NT AUTHORITY\SYSTEM

Application event log

Computer Name: Bruce
Event Code: 302
Message: Windows (2388) Windows: The database engine has successfully completed recovery steps.
Record Number: 110490
Source Name: ESENT
Time Written: 20081223134958.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 0
Message:
Record Number: 110491
Source Name: iPod Service
Time Written: 20081223135003.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 1003
Message: The Windows Search Service started.

Record Number: 110492
Source Name: Microsoft-Windows-Search
Time Written: 20081223135113.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 1
Message: The Windows Security Center Service has started.
Record Number: 110493
Source Name: SecurityCenter
Time Written: 20081223135209.000000-000
Event Type: Information
User:

Computer Name: Bruce
Event Code: 5
Message: Unsupported service control request (see data below)
Record Number: 110494
Source Name: LightScribeService
Time Written: 20081223140344.000000-000
Event Type: Information
User:

Security event log

Computer Name: Bruce
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 87849
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081223140334.462147-000
Event Type: Audit Failure
User:

Computer Name: Bruce
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 87850
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081223140334.561147-000
Event Type: Audit Failure
User:

Computer Name: Bruce
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 87851
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081223140334.639147-000
Event Type: Audit Failure
User:

Computer Name: Bruce
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 87852
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081223140334.719147-000
Event Type: Audit Failure
User:

Computer Name: Bruce
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 87853
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081223140334.782147-000
Event Type: Audit Failure
User:

======Environment VARIABLES======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 95 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=5f02
"NUMBER_OF_PROCESSORS"=1
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

-----------------EOF-----------------
DID I DO IT RIGHT??
DonnaHello----Did I do it right? I'm sorry I could not do it right away-but my grandmother was put in the hospital. So I did it today. Is that O.K.??
DonnaYour Java is out of date.

Older versions have vulnerabilities that MALICIOUS sites can use to infect your system.

First install the new Sun Java Runtime Environment

Be sure to close all browser windows before beginning the install.

Remove the old version(s)

Download JavaRa

Unzip the file and open the JavaRa.exe
Click Remove Older Versions
JavaRa will search for and remove any outdated version of Java and remove any that are found.
Click Additional Tasks
Place a check next to Remove Useless JRE Files and click Go
Exit JavaRa
Delete the JavaRa files from the Desktop

----------

I don't think that McAfee is installed right. It's not showing in the Security Center. Do you have a disk so you can re-install it?don't have a disk to re-install McAfee. Like I said it came with comcast and I just downloaded it from the web-site as best as I can remember.
Thank-you.
Now what?
DonnaIf it's provided by your ISP then I would contact them. They will either send a disk or let you know how to re-install it.

Solve : Getting my logs to you?

Discussion

No Comment Found

Related InterviewSolutions

Reply to Comment