Windows Vista and A Virus? - Page 4

[khwhitaker]

Everything looks fine now, AVG is gone. The AVG files are AVG 8 and AVG 9 and they are in the AVG folder. The other one wasn't but it is no longer there.

[PhilliePhan]

Everything looks fine now, AVG is gone. The AVG files are AVG 8 and AVG 9 and they are in the AVG folder. The other one wasn't but it is no longer there.

You should be able to safely delete the AVG folder.
Try that - if there are any "scary" messages, then hold off.

If you no longer have a working AV, see if you are able to install Avira Anti-vir Personal - FREE

-- What browser(s) do you use? IE / Firefox / Opera (sorry - too busy to backtrack ATM - easier to ask)

PP :)

[khwhitaker]

that's fine, I.Explorer

[khwhitaker]

now it just says deleting may cause some programs not to work

[PhilliePhan]

that's fine, I.Explorer

OK - For diagnostic purposes, see if you can install Firefox Browser

Let us know if you run into the same problems as with IE.

I shall return Thursday evening (EST).

Cheers :)
PP

[khwhitaker]

yeah, it loaded firefox!checking now to see if my online issues are resolved.

[khwhitaker]

ok, firefox is allowing me to download, but it keeps shutting down and windows gives me this

What is Data Execution Prevention?

Data Execution Prevention (DEP) is a security feature that can help prevent damage to your computer from viruses and other security threats. Harmful programs can try to attack Windows by attempting to run (also known as execute) code from system memory locations reserved for Windows and other authorized programs. These types of attacks can harm your programs and files.

DEP can help protect your computer by monitoring your programs to make sure that they use system memory safely. If DEP notices a program on your computer using memory incorrectly, it closes the program and notifies you.

See also
Data Execution Prevention: frequently asked questions
Change Data Execution Prevention settings

I was able to download and save a pdf file to my documents but still cant get acrobat to reinstall. I am getting the same error code

Error Code 1402
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run\Optional Components\MSFS
need permission to change this key

I have reset the permissions, this was one of the first things either Adobe or Microsoft had me do. They gave me a link with directions to follow.

Firefox is running fine right now. The cursor thing seems to be better too. So yeah! Progress! :) Thank you! Now if I can just figure out what Acrobat's issue is... I'm going to have to go back and read my own posts to see if I am forgetting anything now. Wow, it is great to be able to type quickly again!

[PhilliePhan]

Firefox is running fine right now. The cursor thing seems to be better too. So yeah! Progress! :) Thank you! Now if I can just figure out what Acrobat's issue is... I'm going to have to go back and read my own posts to see if I am forgetting anything now. Wow, it is great to be able to type quickly again!

-- Are you still getting DEP warning?

-- Have you updated to the latest version Adobe? Did you completely uninstall previous version(s)? If need be, use REVO.
I can help you change permissions on that key, if need be.

-- Have you tried "rolling back" to a previous version of IE?
Firefox is great, but it is a workaround and not a solution. Though, if you take the time to configure Firefox to your liking with Add-ons (Themes / Plug-ins / Extensions), you'll never go back to IE . . ..

PP:)

[khwhitaker]

no haven't gotten the DEP warning all day, don't mind firefox at all, I think i like it and it is faster.No I haven't tried rolling back on IE, do I need to do this and if so how? My son says I should have been using firefox all along anyway. Adobe would not let me update or uninstall. Used Revo to get rid of it but it will not let me install the latest version or the one before that. I get the same warning every time. Other than the PDF thing it has worked well all day. The new anti spyware has run and hasn't found any problems.
I tried to open a pdf with acrobat pro and it still won't open at all, it did update finally last night, I think it was successful. But still won't open. If something tries to open outlook I get a strange warning that AVG has stopped it from working, then it opens anyway. I don't use outlook so I really don't know much about it. The only thing I ever do with it is take email addresses out of it and paste them in my hotmail account.
Don't seem to be having the cursor issue at all today which is great.

[PhilliePhan]

My son says I should have been using firefox all along anyway.

He is a smart man :)

-- What version of IE do you have?

I will put together a little "one click" tool to try to deal with that registry key this evening and post it for you then.

Cheers :)
PP

[khwhitaker]

He's only 14 but knows a lot about computers, well games, and Maya and such. He says "this issue" is not his thing though, he doesn't like Vista. Anyway, I am running IE 8.0. And a one click tool would be wonderful, thank you so much for taking the time to do it. :)
I really appreciate everything you and Crunchie have done to help me.

[PhilliePhan]

He says "this issue" is not his thing though, he doesn't like Vista.

I have yet to meet somebody who likes Vista. . . . .

Anyway, I am running IE 8.0.

Try rolling back to IE7 and see if issues remain:
http://support.microsoft.com/kb/957700

And a one click tool would be wonderful, thank you so much for taking the time to do it. :)

Actually, the more I look at this, it looks to be an Adobe issue rather than a Windows problem.
Have you tried installing "as administrator?"
RightClick and run the Adobe installer "as administrator."

Before we mess with the supposed problem key, let's have a look at it:
Please download PeekKey.zip and extract the PeekKey Folder from the ZIP to your Desktop.
-- In the folder, you'll find RunThis.bat.
-- DoubleClick on it to run it and please post me the log that pops up.

I really appreciate everything you and Crunchie have done to help me.

We are happy to try to help . . . though I suspect we are a couple of old dogs in a young dog's world.... :)

PP

[crunchie]

aaaaaaaaaaaaaaaoooooooooooooooooooh :)

[khwhitaker]

Before we mess with the supposed problem key, let's have a look at it:
Please download PeekKey.zip*

Microsoft Windows [Version 6.0.6002]
Fri 11/13/2009
08:18 AM

******************************************************************************
Registrykey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS

Object does not exist or user doesn't have enough permissions

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\\Windows\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\Windows\\system32\\hkcmd.exe"
"Persistence"="C:\\Windows\\system32\\igfxpers.exe"
"Acrobat Assistant 7.0"="\"C:\\Program Files\\Adobe\\Adobe Acrobat 7.0\\Distillr\\Acrotray.exe\""
"Malwarebytes Anti-Malware (reboot)"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe\" /runcleanupscript"
@=""
"avgnt"="\"C:\\Program Files\\Avira\\AntiVir Desktop\\avgnt.exe\" /min"

Actually, the more I look at this, it looks to be an Adobe issue rather than a Windows problem.
Have you tried installing "as administrator?"
RightClick and run the Adobe installer "as administrator."

this is what I had suspected also, but nothing we tried worked, I thought it had something to do with IE 8 and compatibility, but I just tried again running IE 7, as an Admin. and it still gave me the same error code.

We are happy to try to help . . . though I suspect we are a couple of old dogs in a young dog's world....

that may be so, but the scales are balanced with patience and wisdom...

and as I tell my son when he feels superior, I lack the advantage of having had a computer since I was 4 years old... :)

[PhilliePhan]

that may be so, but the scales are balanced with patience and wisdom...
and as I tell my son when he feels superior, I lack the advantage of having had a computer since I was 4 years old... :)

So very true :)

This problem is vexing me....

-- So you're positive everything is being done "as Administrator?" Uggh - I hate Vista! LOL!

-- Can you link me to the version of Adobe you are installing?

-- What happened with AVG anti-virus? Remove? Reinstall? Go with Avira?
(That's the trouble with long threads - and forums in general - hard to keep updated. Much easier if I am sitting in front of the machine. I apologize for any redundancy ;) )

A couple things:
We should make sure the key exists. Did any of previous help have you check?
Are you comfortable navigating the registry? - You can really screw up a machine if not careful.

See if you can run Windows Installer CleanUp Utility
-- Run it Only for Adobe!

Let me know how you fare with that and my other questions.

Also, please do this before doing the above:
-- Please back up your registry with ERUNT
-- Here are the instructions.

Since you are using Vista, you'll need to Turn User Account Control Off before using ERUNT.

Go ahead and leave UAC off for now - you can re-enable it after we get this sorted out.

Cheers :)
PP

[khwhitaker]

Since you are using Vista, you'll need to Turn User Account Control Off before using ERUNT.

still had this off from trying to work with microsoft and adobe

Also, please do this before doing the above:
-- Please back up your registry with ERUNT
-- Here are the instructions.

did this

So you're positive everything is being done "as Administrator?" Uggh - I hate Vista! LOL!

I believe so, I am the only user, have myself as admin, and did the "run as an admin" when starting it

I too really dislike Vista! It has not been good to me!

A couple things:
We should make sure the key exists. Did any of previous help have you check?

I don't think so, but someone did have me look at the registry and maybe copy and paste, I just don't remember, too many things have been done now, sorry... :(

Are you comfortable navigating the registry? - You can really screw up a machine if not careful.

if you can tell me what to do, I'm clueless about it

See if you can run Windows Installer CleanUp Utility
-- Run it Only for Adobe!

will do this now

-

- What happened with AVG anti-virus? Remove? Reinstall? Go with Avira?
(That's the trouble with long threads - and forums in general - hard to keep updated. Much easier if I am sitting in front of the machine. I apologize for any redundancy )

I don't mind, this is way to long to read to go back through it. Got rid of AVG, using AVIRA, seems to be working fine. Ok, so now I'll do the Adobe thing and get back to you.

[khwhitaker]

Someone has already had me do this for something because it is already downloaded and Acrobat Reader is not there. My Acrobat.com is there and my acrobat professional is but not Adobe Acrobat Reader.

[PhilliePhan]

I think it might be a good idea to Uninstall All things Adobe for the time being.

I don't mind, this is way to long to read to go back through it. Got rid of AVG, using AVIRA, seems to be working fine. Ok, so now I'll do the Adobe thing and get back to you.

The reason I asked about AVG is because in Post 99 you mentioned:
The new anti spyware has run and hasn't found any problems.
I tried to open a pdf with acrobat pro and it still won't open at all, it did update finally last night, I think it was successful. But still won't open. If something tries to open outlook I get a strange warning that AVG has stopped it from working, then it opens anyway.

So I was confused . . . .

-- Have you tried installing Adobe offline?

I'd like two new logs for updated reference:

-- Download DDS by sUBs and save it to your Desktop
-- If your AV has a script blocker, please disable it
-- DoubleClick on dds.scr to run the tool

* A command box will open, displaying added information for your reading pleasure while DDS completes its scan.
* Upon completion, a Dialog Box should open instructing you to save and post the TWO resulting logs (DDS.txt & Attach.txt).

- Copy&Paste the DDS.txt into your next post.
- Please post Attach.txt as an attachment to your post - there is no need to Zip it. If you don’t know how to post an attachment, please Copy&Paste it along with the DDS.txt scanlog.

Will be here on and off over the weekend - I'll post the instructions for registry then.

PP :)

[khwhitaker]

The new anti spyware has run and hasn't found any problems.
I tried to open a pdf with acrobat pro and it still won't open at all, it did update finally last night, I think it was successful. But still won't open. If something tries to open outlook I get a strange warning that AVG has stopped it from working, then it opens anyway.

sorry, the new anti spyware is the Avira, AVG is supposedly gone, which is why I thought that the message was really strange, considering it isn't supposed to be there anymore.

I think it might be a good idea to Uninstall All things Adobe for the time being.

I was trying not to do this because of my licensing issues, I have to turn them off, then on again and my license # for acrobat pro 7 has gone missing along with the installation disk,but it's not working anyway. I have a newer version but no license because the previous graphic artist took it home and put it on all her computers and you only get 3. I can't get her to turn it off as she was let go and wasn't happy about it. Acrobat.com has my book dummy on it which is linked to agents and publishers. So my only question is, if I remove it will it effect this. I also run Adobe CS2 suite, 6 programs in that and a separate license. This was also my reason for not wanting to just reinstall windows vista to begin with. But if I have to then of course I will. It will just take some time. Sorry to be hesitant, just let me know if it is really necessary and if so does it need to be everything or just the acrobat related programs. My CS programs seem to be running fine most of the time. I have had a issue or two with Photoshop shutting down because of acrobat needing to update, but otherwise I use it daily. Thanks for your patience. :)

-- Have you tried installing Adobe offline?

I tried downloading it to a disk and installing, then again by downloading from firefox, then again today from the desktop after rolling back IE 8 to 7

-- If your AV has a script blocker, please disable it

where do I find this?

[PhilliePhan]

sorry, the new anti spyware is the Avira, AVG is supposedly gone, which is why I thought that the message was really strange, considering it isn't supposed to be there anymore.

Yup - we'll probably need to do more digging there - low priority right now.

I was trying not to do this because of my licensing issues, ......

Then, probably best to leave it alone. Don't want to mess up any licensing.

Frankly, I'd be expressing some displeasure to Adobe support regarding this issue... :)

where do I find this?

Don't worry about that - it's my standard "canned speech." You should not have any problems.

PP :)

[khwhitaker]

DDS (Ver_09-10-26.01) - NTFSx86
Run by Auberey at 19:00:05.52 on Fri 11/13/2009
Internet Explorer: 7.0.6002.18005
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.1037 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Auberey\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\adobe acrobat 7.0\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: {744ec540-7cac-4b6a-8581-cbd7cc81024b} - c:\windows\system32\jkkKeCtS.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0983.0\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0983.0\msneshellx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; GTB6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; Tablet PC 2.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)" -"http://www.mofunzone.com/popups/downhill_jam.shtml"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\adobe acrobat 7.0\distillr\Acrotray.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [<NO NAME>]
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\users\auberey\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Convert link target to Adobe PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\adobe acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} - hxxp://apps.corel.com/nos_dl_manager/plugin/IEGetPlugin.cab
DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} - hxxp://www.srtest.com/srl_bin/sysreqlab_ind.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1255708832175
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} - hxxp://support.microsoft.com/mats/DiagWebControl.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
AppInit_DLLs: c:\windows\system32\avgrsstx.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\auberey\appdata\roaming\mozilla\firefox\profiles\kqw78h9r.default\
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\auberey\appdata\roaming\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\auberey\appdata\roaming\move networks\plugins\npqmp071505000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-9-3 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-9-3 74480]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2008-10-2 93544]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-11-11 108289]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-5-7 1153368]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-12-31 1373480]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2008-9-16 227328]
S2 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;c:\cfusionmx7\runtime\bin\jrunsvc.exe [2008-10-20 61440]
S2 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;c:\cfusionmx7\verity\k2\_nti40\bin\k2admin.exe [2008-10-20 2711312]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-18 21504]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-9-5 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 getPlus(R) Installer;getPlus(R) Installer;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-8-16 59552]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2008-9-18 21504]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-9-3 7408]

=============== Created Last 30 ================

2009-11-13 21:49:19 0 d-----w- c:\program files\Windows Portable Devices
2009-11-13 21:49:08 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-13 21:48:46 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-13 21:13:38 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2009-11-13 21:13:38 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2009-11-13 21:13:38 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2009-11-13 21:10:33 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-11-13 21:10:33 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-11-13 21:10:33 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-11-13 17:00:24 834048 ----a-w- c:\windows\system32\wininet.dll
2009-11-13 17:00:20 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-11-12 01:21:31 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-12 01:21:29 0 d-----w- c:\programdata\Avira
2009-11-12 01:21:29 0 d-----w- c:\program files\Avira
2009-11-11 21:49:06 0 d-----w- c:\program files\VS Revo Group
2009-11-11 02:24:32 2036736 ----a-w- c:\windows\system32\win32k.sys
2009-11-11 02:23:23 355328 ----a-w- c:\windows\system32\WSDApi.dll
2009-11-09 20:48:49 95616 ----a-w- c:\windows\junction.exe
2009-11-09 20:46:56 69632 ----a-w- c:\windows\FileFind.exe
2009-11-06 00:39:14 293148167 ----a-w- c:\windows\MEMORY.DMP
2009-11-06 00:05:25 98816 ----a-w- c:\windows\sed.exe
2009-11-06 00:05:25 77312 ----a-w- c:\windows\MBR.exe
2009-11-06 00:05:25 267264 ----a-w- c:\windows\PEV.exe
2009-11-06 00:05:25 161792 ----a-w- c:\windows\SWREG.exe
2009-11-05 22:36:21 0 d-----w- c:\program files\Trend Micro
2009-11-05 21:19:51 0 d-----w- c:\users\auberey\appdata\roaming\Malwarebytes
2009-11-05 21:19:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-05 21:19:45 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-05 21:19:45 0 d-----w- c:\programdata\Malwarebytes
2009-11-05 21:19:45 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-05 02:52:16 0 d-----w- c:\program files\ESET
2009-11-05 00:07:36 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-11-05 00:07:33 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-11-04 23:47:32 524288 --sha-w- c:\users\auberey\ntuser.dat{349012c1-c98a-11de-b1f6-0013a985fd3a}.TMContainer00000000000000000002.regtrans-ms
2009-11-04 23:47:32 524288 --sha-w- c:\users\auberey\ntuser.dat{349012c1-c98a-11de-b1f6-0013a985fd3a}.TMContainer00000000000000000001.regtrans-ms
2009-11-04 23:47:31 65536 --sha-w- c:\users\auberey\ntuser.dat{349012c1-c98a-11de-b1f6-0013a985fd3a}.TM.blf
2009-11-04 18:40:53 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-11-04 18:40:36 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-11-04 18:40:20 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-11-04 18:40:20 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-11-01 01:53:23 0 d-----w- c:\programdata\avg9
2009-10-21 11:37:58 0 d-----w- c:\windows\system32\eu-ES
2009-10-21 11:37:58 0 d-----w- c:\windows\system32\ca-ES
2009-10-21 11:37:55 0 d-----w- c:\windows\system32\vi-VN
2009-10-21 11:35:20 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-10-21 11:15:46 0 d-----w- c:\windows\system32\EventProviders
2009-10-20 17:22:42 1056768 ----a-w- c:\windows\system32\defltbase.sdb
2009-10-20 17:12:59 99680 ----a-w- c:\windows\system32\infocardapi.dll
2009-10-20 17:11:59 83456 ----a-w- c:\windows\system32\wlgpclnt.dll
2009-10-20 17:10:45 247808 ----a-w- c:\windows\system32\drvstore.dll
2009-10-20 16:39:05 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-20 16:39:02 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-20 16:39:02 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-20 16:33:06 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-20 16:32:46 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-20 16:30:40 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-20 16:23:46 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-20 15:47:23 0 d-----w- c:\program files\Windows Installer Clean Up
2009-10-20 15:47:00 0 d-----w- c:\program files\MSECACHE

==================== Find3M ====================

2009-11-13 21:49:16 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-13 21:49:16 51200 ----a-w- c:\windows\inf\infpub.dat
2009-11-13 21:49:15 86016 ----a-w- c:\windows\inf\infstor.dat
2009-11-13 21:49:15 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-10-21 11:28:26 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-10-05 23:32:14 3766 --sha-w- c:\programdata\KGyGaAvL.sys
2009-10-05 23:32:01 168 --sha-r- c:\programdata\46F4CA0B28.sys
2009-10-01 01:02:17 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02:05 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02:04 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02:02 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02:00 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01:59 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01:59 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01:56 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01:56 350208 ----a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01:56 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01:56 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01:54 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-10-01 01:01:54 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys
2009-10-01 01:01:50 226816 ----a-w- c:\windows\system32\WpdMtp.dll
2009-10-01 01:01:49 61952 ----a-w- c:\windows\system32\WpdMtpUS.dll
2009-10-01 01:01:49 33280 ----a-w- c:\windows\system32\WpdConns.dll
2009-09-25 02:10:10 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07:08 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04:32 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49:22 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48:08 351232 ----a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38:29 847360 ----a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36:13 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35:31 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33:25 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33:15 829440 ----a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33:01 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32:59 252928 ----a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31:53 519680 ----a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31:26 486912 ----a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31:21 161280 ----a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31:19 218112 ----a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31:16 1030144 ----a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31:15 828928 ----a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30:23 481792 ----a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30:23 190464 ----a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27:25 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27:04 793088 ----a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27:04 37888 ----a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27:04 1064448 ----a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54:55 258048 ----a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54:53 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54:52 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-09-18 03:47:05 45 ----a-w- c:\users\auberey\jagex_runescape_preferences2.dat
2009-09-18 03:47:05 37 ----a-w- c:\users\auberey\jagex_runescape_preferences.dat
2009-09-07 20:27:29 174 --sha-w- c:\program files\desktop.ini
2009-09-07 19:53:36 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-09-07 19:53:33 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-08-29 00:27:49 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-18 03:33:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-01-13 20:56:45 88 --sh--w- c:\windows\system32\46F4CA0B28.sys
2009-01-13 20:59:34 952 --sha-w- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 19:01:46.92 ===============

[khwhitaker]

Frankly, I'd be expressing some displeasure to Adobe support regarding this issue... :)
PP :)

yeah, unfortunately this is the price I pay for purchasing at an educational discount,which is substantial, no support supplied, unless you pay for it that is, I can call and it is some crazy amount from what I remember. Did it once for Illustrator Issues and ended up just having to completely uninstall and reinstall with special permission to reuse the license. I'll research the site again and see if I see anything now that some of the other issues are cleared up.

I'm sorry you asked about a link for the Adobe: http://www.adobe.com/support/

for the Acrobat download it is: http://get.adobe.com/reader/

if it was something else you were asking for please let me know, I'm a little slow sometimes:)

[khwhitaker]

ok, this is what we did before to try to reset permissions
http://kb2.adobe.com/cps/329/329137.html, it did not work, tried it again just now and it still did not work, I get an error message saying unable to set permissions for this key

[PhilliePhan]

if it was something else you were asking for please let me know, I'm a little slow sometimes:)

No worries :)

I've been volunteering in Forums for a long time and one thing I've learned to do is ask, ask and ask again. It's a wonder people put up with me!

Anyhoo, the next step I'd like to take gets us back to hacking ( or monkeying with, in layman's terms) the registry.
While I expect no problems, I'd like to be available to help, if need be.
So, I might not post those until Monday - weekend is going to be hectic and I imagine the same for you.

Cheers :)
PP

[PhilliePhan]

Anyhoo, the next step I'd like to take gets us back to hacking ( or monkeying with, in layman's terms) the registry.
While I expect no problems, I'd like to be available to help, if need be.
So, I might not post those until Monday - weekend is going to be hectic and I imagine the same for you.

Sorry I couldn't get back sooner - Let's see if we can deal with that problem key.
-- I did not see it in previous log, so I'd like to check if it exists at all.

Click START > RUN > type Regedit and hit OK to open the Registry Editor

Please "drill down" through the subkeys to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If you need clarification, let me know. I imagine your son could do this with his eyes closed (though I don't recommend that :) )

Under the Run Key, let me know if you can drill down further to "OptionalComponents" Key and then to "MSFS" key.

Are they there?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS

PP :)

[khwhitaker]

ok, got all the to the end but there is no MSFS

[PhilliePhan]

ok, got all the to the end but there is no MSFS

That's what I suspected since it did not show in previous log.

You do have the "OptionalComponents" Key? Or no?
I don't remember seeing that either....

PP:)

[khwhitaker]

the only thing in that folder says default, Reg_SZ, (value not set), so I'm assuming that means no

[PhilliePhan]

the only thing in that folder says default, Reg_SZ, (value not set), so I'm assuming that means no

OK - Let's do this:

Download the attached FixIt.ZIP and Extract FixIt.reg from the ZIP to the Desktop
-- DoubleClick on FixIt.reg and Allow it to merge into the registry.

Just to be certain, open registry editor again and drill down and make sure the MSFS key is there.

If it is there, try installing Adobe again and let me know how you fare.

PP:)

[khwhitaker]

I may be doing something wrong, it says error, cannot access the registry