[Resolved] ARTEMIS Computer Help Needed

Answers to your tech questions

Computer forums for help with removing malicious software (malware) and improving computer security

Home Forums Contact

HijackThis Members

Welcome ( Log In | Register )

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

Closed Topic

Start new topic

[Resolved] ARTEMIS Computer Help Needed, Artemis trojan on Vista 64

tsrw View Member Profile	Oct 31 2009, 01:42 AM Post #1
New Member Group: Authentic Member Posts: 5 Joined: 30-October 09 Member No.: 88,595 Operating System: vista 64 bit	Please help me rid my system of this as well as anything you see that needs clean up. Running Vista 64bit. Many tools that would normally be run do not work with this so I'm listing what I do have. I do believe the logs didn't pick these up either. I'm very afraid because this is in my Operating system drive as well as the drive where all the programs are loaded to, etc; and it seems to be duplicating itself. All I have done so far is run ATF and Mbam and then Hijack this. I'm not as savy with navigating in Vista so please bear with me, I'll do the best I can. Here are the files that McAfee quarantined: Detection Name: File: Artemis!2C6D3AB05C25 D:\HP\APPS\APP29773\SRC\DATA1.CAB Artemis!2C6D3AB05C25 C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLAUDSPA.AX Artemis!E7432B24BC18 C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLDEMUXER.AX Artemis!2FB1100AACBD C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLM4SPLT.AX Artemis!43876B38E920 C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLSPLTER.AX Artemis!9FD2E2C5AD9E C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLSTREAM (MULTILIB).AX Artemis!F21FBA56B878 C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLSTREAM (PUSHMODE).AX Artemis!21E71B8ED146 C:\Program Files(x86)\Hewlett-Packard\TouchSmart\Media\Kernel\DMP\CLWMFDemux.ax Artemis!AB9D9DE189E3 C:\PROGRAM FILES (X86)\HEWLETT-PACKARD\TOUCHSMART\MEDIA\KERNEL\DMP\CLAUTS.AX Hijack Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:10:50 PM, on 10/30/2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18828) Boot mode: Normal Running processes: c:\PROGRA~2\mcafee.com\agent\mcagent.exe C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~2\mcafee\VIRUSS~1\scriptsn.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0552.0\msneshellx.dll O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0552.0\msneshellx.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe O4 - HKLM\..\Run: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [UpdateP2GoShortCut] "c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" O4 - HKLM\..\Run: [UpdateLBPShortCut] "c:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" O4 - HKLM\..\Run: [UpdatePDIRShortCut] "c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0" O4 - HKLM\..\Run: [UpdatePSTShortCut] "c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" O4 - HKLM\..\Run: [TSMAgent] "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" O4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" O4 - HKLM\..\Run: [DVDAgent] "c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" O4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Microsoft Default Manager] "c:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel PhotoDownloader.exe" -startup O4 - HKLM\..\Run: [UVS11 Preload] "C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: PictureMover.lnk = C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe O13 - Gopher Prefix: O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing) O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: HP Easy Backup Button Service (HPBtnSrv) - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Norton Internet Security - Unknown owner - C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\SysWOW64\PSIService.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 11092 bytes Mbam Log: Malwarebytes' Anti-Malware 1.41 Database version: 3063 Windows 6.0.6001 Service Pack 1 10/30/2009 5:04:48 PM mbam-log-2009-10-30 (17-04-33).txt Scan type: Quick Scan Objects scanned: 84039 Time elapsed: 2 minute(s), 48 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Tomk View Member Profile	Nov 3 2009, 07:59 PM Post #2
Forum God Group: Classroom Teacher Posts: 11,209 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	Hi tsrw, My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following: I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. Please go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply.

tsrw View Member Profile	Nov 5 2009, 07:20 PM Post #3
New Member Group: Authentic Member Posts: 5 Joined: 30-October 09 Member No.: 88,595 Operating System: vista 64 bit	Thanks for your assistance. I ran the procedures for Kaspersky as requested and no threats were found. I was not sure if it actually scanned drive D in the full scan because I didn't see it show up while running so I also ran a scan specific to drive D and it also came back with no threat found. I looked for all files listed initially in the locations stated manually on the C: drive and do not see these any longer. Possibly they are gone after initially running the Mbam? What is next?

Tomk View Member Profile	Nov 5 2009, 07:46 PM Post #4
Forum God Group: Classroom Teacher Posts: 11,209 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	tsrw, Let's get one more log. Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

tsrw View Member Profile	Nov 6 2009, 09:31 AM Post #5
New Member Group: Authentic Member Posts: 5 Joined: 30-October 09 Member No.: 88,595 Operating System: vista 64 bit	Hello, here they are. I will post as two separate to make easier for you to read. OTL.txt OTL logfile created on: 11/6/2009 7:21:21 AM - Run 1 OTL by OldTimer - Version 3.1.4.0 Folder = C:\Users\Schree\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18828) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 4.00 Gb Total Physical Memory \| 4.00 Gb Available Physical Memory \| 100.00% Memory free 4.00 Gb Paging File \| 4.00 Gb Available in Paging File \| 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files (x86) Drive C: \| 684.64 Gb Total Space \| 514.74 Gb Free Space \| 75.18% Space Free \| Partition Type: NTFS Drive D: \| 14.00 Gb Total Space \| 2.20 Gb Free Space \| 15.70% Space Free \| Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SCHREE-PC Current User Name: Schree Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2009/11/06 07:17:19 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Schree\Desktop\OTL.exe PRC - [2009/11/04 18:21:08 \| 00,149,280 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre6\bin\jusched.exe PRC - [2009/11/04 18:21:08 \| 00,149,280 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre6\bin\jusched.exe PRC - [2009/11/04 18:21:08 \| 00,149,280 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre6\bin\jusched.exe PRC - [2009/11/04 18:21:08 \| 00,149,280 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre6\bin\jusched.exe PRC - [2009/11/04 18:21:08 \| 00,149,280 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Java\jre6\bin\jusched.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/17 13:29:04 \| 00,645,328 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe PRC - [2009/09/16 08:28:38 \| 00,606,736 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\VirusScan\mcsysmon.exe PRC - [2009/09/16 08:28:38 \| 00,606,736 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\VirusScan\mcsysmon.exe PRC - [2009/09/15 09:23:54 \| 00,894,136 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MPF\MpfSrv.exe PRC - [2009/09/15 09:23:54 \| 00,894,136 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MPF\MpfSrv.exe PRC - [2009/08/05 10:27:00 \| 01,644,088 \| ---- \| M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe PRC - [2009/07/09 23:26:20 \| 00,865,832 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe PRC - [2009/07/09 23:26:20 \| 00,865,832 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe PRC - [2009/07/08 10:54:34 \| 00,359,952 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe PRC - [2009/07/08 10:54:34 \| 00,359,952 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe PRC - [2009/07/07 18:10:02 \| 02,482,848 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe PRC - [2009/07/07 18:10:02 \| 02,482,848 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe PRC - [2009/04/09 22:26:02 \| 01,328,424 \| ---- \| M] (CyberLink Corp.) -- C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe PRC - [2009/04/09 22:22:06 \| 00,185,640 \| ---- \| M] (CyberLink) -- C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe PRC - [2009/03/19 09:54:52 \| 01,148,200 \| ---- \| M] (CyberLink Corp.) -- C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe PRC - [2009/03/17 12:25:40 \| 00,073,728 \| ---- \| M] (Hewlett-Packard Company) -- c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe PRC - [2008/12/08 14:34:24 \| 00,054,576 \| ---- \| M] (Hewlett-Packard) -- C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe PRC - [2008/11/20 09:47:28 \| 00,062,768 \| ---- \| M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe PRC - [2008/09/30 16:59:26 \| 00,192,512 \| ---- \| M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe PRC - [2008/09/16 11:03:18 \| 00,169,312 \| ---- \| M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe PRC - [2007/10/30 18:52:34 \| 00,016,200 \| ---- \| M] () -- C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe PRC - [2007/10/30 16:52:32 \| 00,531,784 \| ---- \| M] (Corel, Inc.) -- C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe PRC - [2007/10/30 16:52:32 \| 00,531,784 \| ---- \| M] (Corel, Inc.) -- C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe PRC - [2007/06/05 12:20:32 \| 00,177,704 \| ---- \| M] () -- C:\Windows\SysWOW64\PSIService.exe PRC - [2007/06/05 12:20:32 \| 00,177,704 \| ---- \| M] () -- C:\Windows\SysWOW64\PSIService.exe PRC - [2007/06/05 12:20:32 \| 00,177,704 \| ---- \| M] () -- C:\Windows\SysWOW64\PSIService.exe PRC - [2007/06/05 12:20:32 \| 00,177,704 \| ---- \| M] () -- C:\Windows\SysWOW64\PSIService.exe PRC - [2007/06/05 12:20:32 \| 00,177,704 \| ---- \| M] () -- C:\Windows\SysWOW64\PSIService.exe PRC - [2007/03/06 09:35:02 \| 00,198,168 \| ---- \| M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe ========== Modules (SafeList) ========== MOD - [2009/11/06 07:17:19 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Schree\Desktop\OTL.exe MOD - [2009/07/17 06:35:11 \| 00,071,680 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\atl.dll MOD - [2009/05/23 00:17:03 \| 00,040,960 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\srclient.dll MOD - [2008/01/20 18:52:09 \| 00,142,336 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\spp.dll MOD - [2008/01/20 18:50:01 \| 00,183,296 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\xmllite.dll MOD - [2008/01/20 18:49:43 \| 01,076,224 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\vssapi.dll MOD - [2008/01/20 18:49:43 \| 00,069,120 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\vsstrace.dll MOD - [2008/01/20 18:49:32 \| 00,079,360 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWOW64\authz.dll MOD - [2008/01/20 18:48:06 \| 01,684,480 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009/09/16 10:23:32 \| 00,696,848 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS) SRV:64bit: - [2009/09/16 09:15:32 \| 00,155,456 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield) SRV:64bit: - [2009/04/29 01:21:26 \| 00,949,248 \| ---- \| M] () -- C:\Windows\SysNative\Ati2evxx.exe -- (Ati External Event Utility) SRV:64bit: - [2008/01/20 18:52:15 \| 01,216,000 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV:64bit: - [2008/01/20 18:47:32 \| 00,383,544 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009/09/16 08:28:38 \| 00,606,736 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\VirusScan\mcsysmon.exe -- (McSysmon) SRV - [2009/09/15 09:23:54 \| 00,894,136 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2009/08/27 20:19:17 \| 00,651,720 \| ---- \| M] (Macrovision Europe Ltd.) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009/08/27 16:27:25 \| 00,182,768 \| ---- \| M] (Google) -- C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2009/07/09 23:26:20 \| 00,865,832 \| ---- \| M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2009/07/08 10:54:34 \| 00,359,952 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy) SRV - [2009/07/07 18:10:02 \| 02,482,848 \| ---- \| M] (McAfee, Inc.) -- c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2009/03/17 12:25:40 \| 00,073,728 \| ---- \| M] (Hewlett-Packard Company) -- c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2008/12/08 18:51:08 \| 00,242,424 \| ---- \| M] (WildTangent, Inc.) -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService) SRV - [2008/12/04 07:12:10 \| 00,094,208 \| ---- \| M] (Hewlett-Packard) -- c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe -- (HP Health Check Service) SRV - [2008/09/30 16:59:26 \| 00,192,512 \| ---- \| M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe -- (HPBtnSrv) SRV - [2008/09/16 11:03:18 \| 00,169,312 \| ---- \| M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0) SRV - [2008/07/27 10:03:13 \| 00,069,632 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008/07/27 10:01:49 \| 00,093,184 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64) SRV - [2008/06/19 17:17:12 \| 00,046,104 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0) SRV - [2008/06/19 17:16:53 \| 00,859,648 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc) SRV - [2008/01/20 18:51:36 \| 00,344,064 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe -- (ehRecvr) SRV - [2008/01/20 18:51:36 \| 00,153,600 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched) SRV - [2007/06/05 12:20:32 \| 00,177,704 \| ---- \| M] () -- C:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing) SRV - [2007/03/06 09:35:02 \| 00,198,168 \| ---- \| M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service) SRV - [2006/11/02 07:03:48 \| 00,015,360 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart) SRV - [2006/11/02 05:34:14 \| 00,000,000 \| ---D \| M] -- C:\Windows\SysWOW64\Msdtc -- (MSDTC) SRV - [2006/11/01 22:35:15 \| 00,060,994 \| ---- \| M] () -- C:\Windows\SysWOW64\wbem\vds.mof -- (vds) SRV - [2006/11/01 22:35:15 \| 00,055,846 \| ---- \| M] () -- C:\Windows\SysWOW64\wbem\vss.mof -- (VSS) ========== Driver Services (SafeList) ========== DRV:64bit: - [2009/09/16 09:22:40 \| 00,308,296 \| ---- \| M] () -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk) DRV:64bit: - [2009/09/16 09:22:40 \| 00,102,472 \| ---- \| M] () -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk) DRV:64bit: - [2009/09/16 09:22:40 \| 00,049,480 \| ---- \| M] () -- C:\Windows\SysNative\drivers\mfesmfk.sys -- (mfesmfk) DRV:64bit: - [2009/09/16 09:15:38 \| 00,040,904 \| ---- \| M] () -- C:\Windows\SysNative\drivers\mferkdk.sys -- (mferkdk) DRV:64bit: - [2009/08/27 20:15:05 \| 00,052,856 \| ---- \| M] () -- C:\Windows\SysNative\Drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2009/07/16 11:32:26 \| 00,176,144 \| ---- \| M] () -- C:\Windows\SysNative\Drivers\Mpfp.sys -- (MPFP) DRV:64bit: - [2009/04/29 05:19:18 \| 05,171,712 \| ---- \| M] () -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009/02/02 10:59:18 \| 00,023,536 \| ---- \| M] (PC-Doctor, Inc.) -- c:\Program Files\PC-Doctor for Windows\pcdsrvc_x64.pkms -- (PCDSRVC{F36B3A4C-F95654BD-06000000}_0) DRV:64bit: - [2009/01/20 06:49:48 \| 00,195,584 \| ---- \| M] () -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2008/09/18 09:39:50 \| 01,168,384 \| ---- \| M] () -- C:\Windows\SysNative\DRIVERS\athrx.sys -- (athr) DRV:64bit: - [2006/11/01 21:28:10 \| 00,273,920 \| ---- \| M] () -- C:\Windows\SysNative\drivers\HdAudio.sys -- (HdAudAddService) DRV - [2006/09/18 13:36:40 \| 00,003,066 \| ---- \| M] () -- C:\Windows\SysWOW64\wbem\tcpip.mof -- (Tcpip) DRV - [2006/09/18 13:35:23 \| 00,001,088 \| ---- \| M] () -- C:\Windows\SysWOW64\wbem\mpsdrv.mof -- (mpsdrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cndt IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/29 02:00:51 \| 00,000,000 \| ---D \| M] O1 HOSTS File: (761 bytes) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4:64bit: - HKLM..\Run: [Corel Photo Downloader] C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Corel, Inc.) O4:64bit: - HKLM..\Run: [HP Remote Software] C:\Program Files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe () O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard) O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [Corel File Shell Monitor] C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe () O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel PhotoDownloader.exe File not found O4 - HKLM..\Run: [DVDAgent] c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard) O4 - HKLM..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard) O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [Microsoft Default Manager] c:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.) O4 - HKLM..\Run: [StartCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TSMAgent] c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateLBPShortCut] c:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UVS11 Preload] C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe (InterVideo Digital Technology Corporation) O4 - HKCU..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe (Hewlett-Packard) O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{9d6bfe0f-938f-11de-bb94-00261870a11c}\Shell\AutoRun\command - "" = K:\CodySafe\Launcher.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\SysWow64\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found 64bit:* O35 - comfile [open] -- "%1" %* File not found 64bit: O35 - exefile [open] -- "%1" %* File not found O35 - comfile [open] -- "%1" %* File not found O35 - exefile [open] -- "%1" %* File not found ========== Files/Folders - Created Within 30 Days ========== [2009/11/06 07:17:12 \| 00,528,896 \| ---- \| C] (OldTimer Tools) -- C:\Users\Schree\Desktop\OTL.exe [2009/11/04 18:21:25 \| 00,411,368 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deploytk.dll [2009/11/04 18:21:25 \| 00,149,280 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2009/11/04 18:21:25 \| 00,145,184 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2009/11/04 18:21:25 \| 00,145,184 \| ---- \| C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2009/11/04 18:21:03 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Java [2009/11/03 12:23:57 \| 00,575,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapi.dll [2009/11/03 12:23:57 \| 00,087,552 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wudriver.dll [2009/11/03 12:23:57 \| 00,035,552 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wups.dll [2009/11/03 12:23:48 \| 00,171,608 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuwebv.dll [2009/11/03 12:23:48 \| 00,033,792 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapp.exe [2009/11/02 17:53:07 \| 05,939,712 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtml.dll [2009/11/02 17:53:05 \| 01,638,912 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtml.tlb [2009/11/02 08:58:13 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Roaming\EPSON [2009/10/31 14:30:41 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Local\Adobe [2009/10/30 17:10:42 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Trend Micro [2009/10/30 15:58:33 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Roaming\Malwarebytes [2009/10/30 15:58:30 \| 00,038,224 \| ---- \| C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2009/10/30 15:58:29 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Malwarebytes [2009/10/30 15:58:29 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Malwarebytes [2009/10/30 15:58:28 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2009/10/30 15:56:45 \| 04,045,536 \| ---- \| C] (Malwarebytes Corporation ) -- C:\Users\Schree\Desktop\mbam-setup.exe [2009/10/30 15:25:50 \| 00,000,000 \| ---D \| C] -- C:\Windows\ERDNT [2009/10/30 15:24:46 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\ERUNT [2009/10/30 15:21:27 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\Documents\Tech Stuff [2009/10/28 01:48:15 \| 00,310,784 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\unregmp2.exe [2009/10/28 01:48:13 \| 10,624,000 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll [2009/10/28 01:48:09 \| 08,147,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL [2009/10/23 07:36:44 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Roaming\Ulead Systems [2009/10/22 16:53:40 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\InterVideo [2009/10/22 16:53:36 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\InterVideo [2009/10/22 16:53:36 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\InterVideo [2009/10/22 16:52:59 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Windows Media Components [2009/10/22 16:51:22 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Ulead Systems [2009/10/22 16:51:22 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Ulead Systems [2009/10/22 16:51:21 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Ulead Systems [2009/10/22 16:51:21 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Ulead Systems [2009/10/22 15:28:52 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\Documents\My Corel Shows [2009/10/22 15:28:52 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Local\Corel [2009/10/22 15:28:25 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\Documents\My PSP Files [2009/10/22 15:28:25 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Roaming\Corel [2009/10/22 15:28:18 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Corel [2009/10/22 15:28:18 \| 00,000,000 \| ---D \| C] -- C:\ProgramData\Corel [2009/10/22 15:26:16 \| 00,000,000 \| ---D \| C] -- C:\Windows\SysWow64\Spool [2009/10/22 15:25:31 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Corel [2009/10/22 15:25:31 \| 00,000,000 \| ---D \| C] -- C:\Program Files (x86)\Common Files\Corel [2009/10/22 11:22:48 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\Documents\Corel PSP Photo X2 [2009/10/16 01:51:05 \| 00,428,544 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll [2009/10/16 01:51:04 \| 00,217,088 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax [2009/10/16 01:51:03 \| 00,293,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll [2009/10/16 01:51:03 \| 00,177,664 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax [2009/10/16 01:51:03 \| 00,080,896 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2009/10/16 01:50:53 \| 00,604,672 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMSPDMOD.DLL [2009/10/16 01:50:47 \| 11,069,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieframe.dll [2009/10/16 01:50:46 \| 01,985,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\iertutil.dll [2009/10/16 01:50:46 \| 01,208,832 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\urlmon.dll [2009/10/16 01:50:46 \| 00,916,480 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\wininet.dll [2009/10/16 01:50:45 \| 00,594,432 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2009/10/16 01:50:45 \| 00,387,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\iedkcs32.dll [2009/10/16 01:50:45 \| 00,206,848 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll [2009/10/16 01:50:44 \| 01,469,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2009/10/16 01:50:44 \| 00,184,320 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2009/10/16 01:50:44 \| 00,164,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2009/10/16 01:50:44 \| 00,133,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2009/10/16 01:50:43 \| 00,109,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2009/10/16 01:50:43 \| 00,055,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedsbs.dll [2009/10/16 01:50:42 \| 00,173,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\ie4uinit.exe [2009/10/16 01:50:42 \| 00,025,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsproxy.dll [2009/10/16 01:50:41 \| 00,071,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2009/10/16 01:50:41 \| 00,055,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2009/10/16 01:50:41 \| 00,013,312 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2009/10/16 01:50:13 \| 00,213,504 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\msv1_0.dll [2009/10/16 01:50:08 \| 00,061,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\SysWow64\msasn1.dll [2009/10/10 21:06:22 \| 00,000,000 \| ---D \| C] -- C:\Users\Schree\AppData\Roaming\WinBatch ========== Files - Modified Within 30 Days ========== [2009/11/06 07:21:36 \| 01,835,008 \| -HS- \| M] () -- C:\Users\Schree\NTUSER.DAT [2009/11/06 07:17:19 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Users\Schree\Desktop\OTL.exe [2009/11/06 07:11:43 \| 00,013,835 \| ---- \| M] () -- C:\Windows\SysNative\Config.MPF [2009/11/06 07:11:16 \| 00,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2009/11/06 04:48:23 \| 00,003,616 \| -H-- \| M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/11/06 04:48:23 \| 00,003,616 \| -H-- \| M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/11/05 03:42:54 \| 00,000,952 \| -HS- \| M] () -- C:\Windows\SysWow64\KGyGaAvL.sys [2009/11/05 00:50:20 \| 00,690,960 \| ---- \| M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2009/11/05 00:50:20 \| 00,595,446 \| ---- \| M] () -- C:\Windows\SysNative\perfh009.dat [2009/11/05 00:50:20 \| 00,101,144 \| ---- \| M] () -- C:\Windows\SysNative\perfc009.dat [2009/11/05 00:46:17 \| 00,006,836 \| ---- \| M] () -- C:\Users\Schree\AppData\Local\d3d9caps.dat [2009/11/05 00:46:03 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\tasks\SA.DAT [2009/11/05 00:44:59 \| 00,524,288 \| -HS- \| M] () -- C:\Users\Schree\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms [2009/11/05 00:44:59 \| 00,065,536 \| -HS- \| M] () -- C:\Users\Schree\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf [2009/11/05 00:44:56 \| 02,705,436 \| -H-- \| M] () -- C:\Users\Schree\AppData\Local\IconCache.db [2009/11/04 18:21:08 \| 00,149,280 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2009/11/04 18:21:07 \| 00,411,368 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deploytk.dll [2009/11/04 18:21:07 \| 00,145,184 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2009/11/04 18:21:07 \| 00,145,184 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2009/11/03 03:17:33 \| 00,373,976 \| ---- \| M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2009/11/02 15:31:01 \| 00,117,608 \| ---- \| M] () -- C:\Users\Schree\AppData\Local\GDIPFONTCACHEV1.DAT [2009/11/01 00:00:02 \| 00,000,320 \| ---- \| M] () -- C:\Windows\tasks\McQcTask.job [2009/10/31 10:04:53 \| 00,000,552 \| ---- \| M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job [2009/10/30 17:10:42 \| 00,001,930 \| ---- \| M] () -- C:\Users\Schree\Desktop\HijackThis.lnk [2009/10/30 15:58:32 \| 00,000,850 \| ---- \| M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/10/30 15:56:57 \| 04,045,536 \| ---- \| M] (Malwarebytes Corporation ) -- C:\Users\Schree\Desktop\mbam-setup.exe [2009/10/27 14:30:38 \| 00,001,919 \| ---- \| M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2009/10/27 14:28:28 \| 00,002,241 \| ---- \| M] () -- C:\Users\Public\Desktop\Corel Paint Shop Pro Photo X2.lnk [2009/10/25 20:42:16 \| 00,131,268 \| ---- \| M] () -- C:\Users\Schree\Documents\Hathaway 102009.pdf [2009/10/25 17:56:15 \| 00,011,264 \| ---- \| M] () -- C:\Users\Schree\Documents\Karina Resume Oct2009.wps [2009/10/25 17:56:15 \| 00,001,070 \| ---- \| M] () -- C:\Users\Schree\AppData\Roaming\wklnhst.dat [2009/10/22 16:53:16 \| 00,002,017 \| ---- \| M] () -- C:\Users\Public\Desktop\Ulead VideoStudio 11.lnk [2009/10/21 18:14:52 \| 09,236,480 \| ---- \| M] () -- C:\Windows\SysNative\mshtml.dll [2009/10/21 14:36:56 \| 01,638,912 \| ---- \| M] () -- C:\Windows\SysNative\mshtml.tlb [2009/10/21 02:40:08 \| 05,939,712 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtml.dll [2009/10/21 00:19:16 \| 01,638,912 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtml.tlb [2009/10/19 07:25:25 \| 00,013,312 \| ---- \| M] () -- C:\Users\Schree\Documents\CDS 101609check.wps [2009/10/19 02:03:43 \| 01,738,787 \| ---- \| M] () -- C:\Users\Schree\Documents\ClothAlbum[1].pdf [2009/10/17 13:19:16 \| 00,011,776 \| ---- \| M] () -- C:\Users\Schree\Documents\retirement loss calc.xlr [2009/10/15 00:02:54 \| 00,000,342 \| ---- \| M] () -- C:\Windows\tasks\McDefragTask.job ========== Files Created - No Company Name ========== [2009/11/03 12:24:23 \| 02,621,440 \| ---- \| C] () -- C:\Windows\SysNative\wucltux.dll [2009/11/03 12:24:23 \| 02,424,024 \| ---- \| C] () -- C:\Windows\SysNative\wuaueng.dll [2009/11/03 12:24:23 \| 00,057,560 \| ---- \| C] () -- C:\Windows\SysNative\wuauclt.exe [2009/11/03 12:24:23 \| 00,043,744 \| ---- \| C] () -- C:\Windows\SysNative\wups2.dll [2009/11/03 12:23:57 \| 00,700,640 \| ---- \| C] () -- C:\Windows\SysNative\wuapi.dll [2009/11/03 12:23:57 \| 00,098,816 \| ---- \| C] () -- C:\Windows\SysNative\wudriver.dll [2009/11/03 12:23:57 \| 00,038,112 \| ---- \| C] () -- C:\Windows\SysNative\wups.dll [2009/11/03 12:23:48 \| 00,185,416 \| ---- \| C] () -- C:\Windows\SysNative\wuwebv.dll [2009/11/03 12:23:48 \| 00,036,864 \| ---- \| C] () -- C:\Windows\SysNative\wuapp.exe [2009/11/02 17:53:06 \| 09,236,480 \| ---- \| C] () -- C:\Windows\SysNative\mshtml.dll [2009/11/02 17:53:05 \| 01,638,912 \| ---- \| C] () -- C:\Windows\SysNative\mshtml.tlb [2009/10/30 17:10:42 \| 00,001,930 \| ---- \| C] () -- C:\Users\Schree\Desktop\HijackThis.lnk [2009/10/30 17:06:49 \| 00,006,836 \| ---- \| C] () -- C:\Users\Schree\AppData\Local\d3d9caps.dat [2009/10/30 15:58:32 \| 00,000,850 \| ---- \| C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/10/30 15:58:28 \| 00,022,104 \| ---- \| C] () -- C:\Windows\SysNative\drivers\mbam.sys [2009/10/28 01:48:15 \| 13,426,176 \| ---- \| C] () -- C:\Windows\SysNative\wmp.dll [2009/10/28 01:48:15 \| 00,372,736 \| ---- \| C] () -- C:\Windows\SysNative\unregmp2.exe [2009/10/28 01:48:09 \| 08,147,968 \| ---- \| C] () -- C:\Windows\SysNative\wmploc.DLL [2009/10/27 14:30:38 \| 00,001,919 \| ---- \| C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2009/10/25 20:42:16 \| 00,131,268 \| ---- \| C] () -- C:\Users\Schree\Documents\Hathaway 102009.pdf [2009/10/25 16:47:42 \| 00,011,264 \| ---- \| C] () -- C:\Users\Schree\Documents\Karina Resume Oct2009.wps [2009/10/22 16:53:35 \| 00,210,456 \| ---- \| C] () -- C:\Windows\SysWow64\IVIresizeW7.dll [2009/10/22 16:53:35 \| 00,206,360 \| ---- \| C] () -- C:\Windows\SysWow64\IVIresizeA6.dll [2009/10/22 16:53:35 \| 00,198,168 \| ---- \| C] () -- C:\Windows\SysWow64\IVIresizeP6.dll [2009/10/22 16:53:35 \| 00,198,168 \| ---- \| C] () -- C:\Windows\SysWow64\IVIresizeM6.dll [2009/10/22 16:53:35 \| 00,194,072 \| ---- \| C] () -- C:\Windows\SysWow64\IVIresizePX.dll [2009/10/22 16:53:35 \| 00,026,136 \| ---- \| C] () -- C:\Windows\SysWow64\IVIresize.dll [2009/10/22 16:53:16 \| 00,002,017 \| ---- \| C] () -- C:\Users\Public\Desktop\Ulead VideoStudio 11.lnk [2009/10/22 15:28:46 \| 00,000,952 \| -HS- \| C] () -- C:\Windows\SysWow64\KGyGaAvL.sys [2009/10/22 15:26:52 \| 00,002,241 \| ---- \| C] () -- C:\Users\Public\Desktop\Corel Paint Shop Pro Photo X2.lnk [2009/10/19 07:19:13 \| 00,013,312 \| ---- \| C] () -- C:\Users\Schree\Documents\CDS 101609check.wps [2009/10/19 02:03:43 \| 01,738,787 \| ---- \| C] () -- C:\Users\Schree\Documents\ClothAlbum[1].pdf [2009/10/17 11:38:29 \| 00,011,776 \| ---- \| C] () -- C:\Users\Schree\Documents\retirement loss calc.xlr [2009/10/16 01:51:16 \| 04,691,016 \| ---- \| C] () -- C:\Windows\SysNative\ntoskrnl.exe [2009/10/16 01:51:05 \| 00,558,592 \| ---- \| C] () -- C:\Windows\SysNative\EncDec.dll [2009/10/16 01:51:05 \| 00,289,792 \| ---- \| C] () -- C:\Windows\SysNative\psisrndr.ax [2009/10/16 01:51:04 \| 00,375,808 \| ---- \| C] () -- C:\Windows\SysNative\psisdecd.dll [2009/10/16 01:51:03 \| 00,227,328 \| ---- \| C] () -- C:\Windows\SysNative\mpg2splt.ax [2009/10/16 01:51:03 \| 00,101,376 \| ---- \| C] () -- C:\Windows\SysNative\MSNP.ax [2009/10/16 01:50:53 \| 00,818,688 \| ---- \| C] () -- C:\Windows\SysNative\WMSPDMOD.DLL [2009/10/16 01:50:48 \| 12,461,568 \| ---- \| C] () -- C:\Windows\SysNative\ieframe.dll [2009/10/16 01:50:46 \| 02,334,208 \| ---- \| C] () -- C:\Windows\SysNative\iertutil.dll [2009/10/16 01:50:46 \| 01,484,288 \| ---- \| C] () -- C:\Windows\SysNative\urlmon.dll [2009/10/16 01:50:46 \| 01,147,904 \| ---- \| C] () -- C:\Windows\SysNative\wininet.dll [2009/10/16 01:50:45 \| 00,700,928 \| ---- \| C] () -- C:\Windows\SysNative\msfeeds.dll [2009/10/16 01:50:45 \| 00,459,776 \| ---- \| C] () -- C:\Windows\SysNative\iedkcs32.dll [2009/10/16 01:50:45 \| 00,243,712 \| ---- \| C] () -- C:\Windows\SysNative\occache.dll [2009/10/16 01:50:44 \| 01,538,560 \| ---- \| C] () -- C:\Windows\SysNative\inetcpl.cpl [2009/10/16 01:50:44 \| 00,162,816 \| ---- \| C] () -- C:\Windows\SysNative\ieUnatt.exe [2009/10/16 01:50:43 \| 00,252,416 \| ---- \| C] () -- C:\Windows\SysNative\iepeers.dll [2009/10/16 01:50:43 \| 00,132,096 \| ---- \| C] () -- C:\Windows\SysNative\iesysprep.dll [2009/10/16 01:50:43 \| 00,071,680 \| ---- \| C] () -- C:\Windows\SysNative\msfeedsbs.dll [2009/10/16 01:50:43 \| 00,070,656 \| ---- \| C] () -- C:\Windows\SysNative\ie4uinit.exe [2009/10/16 01:50:42 \| 00,012,288 \| ---- \| C] () -- C:\Windows\SysNative\msfeedssync.exe [2009/10/16 01:50:41 \| 00,219,136 \| ---- \| C] () -- C:\Windows\SysNative\ieui.dll [2009/10/16 01:50:41 \| 00,077,312 \| ---- \| C] () -- C:\Windows\SysNative\iesetup.dll [2009/10/16 01:50:41 \| 00,072,192 \| ---- \| C] () -- C:\Windows\SysNative\iernonce.dll [2009/10/16 01:50:41 \| 00,031,744 \| ---- \| C] () -- C:\Windows\SysNative\jsproxy.dll [2009/10/16 01:50:13 \| 00,268,800 \| ---- \| C] () -- C:\Windows\SysNative\msv1_0.dll [2009/10/16 01:50:09 \| 00,174,592 \| ---- \| C] () -- C:\Windows\SysNative\drivers\srv2.sys [2009/10/16 01:50:08 \| 00,082,944 \| ---- \| C] () -- C:\Windows\SysNative\msasn1.dll [2009/09/14 13:25:09 \| 00,001,070 \| ---- \| C] () -- C:\Users\Schree\AppData\Roaming\wklnhst.dat [2009/09/01 09:51:07 \| 00,000,022 \| ---- \| C] () -- C:\Windows\SysWow64\PICSDK.ini [2009/09/01 09:44:58 \| 00,096,768 \| ---- \| C] () -- C:\Windows\SlantAdj.dll [2009/09/01 09:44:58 \| 00,000,072 \| ---- \| C] () -- C:\Windows\SysWow64\epDPE.ini [2009/08/27 20:54:41 \| 00,003,584 \| ---- \| C] () -- C:\Users\Schree\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/08/27 15:03:58 \| 02,705,436 \| -H-- \| C] () -- C:\Users\Schree\AppData\Local\IconCache.db [2009/08/27 14:42:32 \| 00,117,608 \| ---- \| C] () -- C:\Users\Schree\AppData\Local\GDIPFONTCACHEV1.DAT [2009/05/22 23:29:26 \| 00,354,816 \| ---- \| C] () -- C:\Windows\SysWow64\pythoncom26.dll [2009/05/22 23:29:26 \| 00,108,032 \| ---- \| C] () -- C:\Windows\SysWow64\pywintypes26.dll [2008/01/20 18:50:05 \| 00,060,124 \| ---- \| C] () -- C:\Windows\SysWow64\tcpmon.ini [2008/01/20 18:49:49 \| 00,368,640 \| ---- \| C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2006/11/02 07:25:49 \| 00,000,174 \| -HS- \| C] () -- C:\Program Files (x86)\desktop.ini [2006/11/02 07:07:25 \| 00,030,808 \| ---- \| C] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont [2006/11/02 07:07:25 \| 00,029,779 \| ---- \| C] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont [2006/11/02 07:07:25 \| 00,026,489 \| ---- \| C] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont [2006/11/02 07:07:25 \| 00,026,040 \| ---- \| C] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont [2006/11/02 04:34:27 \| 00,000,219 \| ---- \| C] () -- C:\Windows\system.ini [2006/11/02 04:34:27 \| 00,000,175 \| ---- \| C] () -- C:\Windows\win.ini ========== LOP Check ========== [2009/08/27 14:45:27 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\ATI [2009/10/22 15:28:46 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\Corel [2009/11/02 08:58:13 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\EPSON [2009/09/01 09:53:04 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\Leadertech [2009/08/27 14:45:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\PictureMover [2009/09/14 13:25:10 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\Template [2009/10/23 07:36:44 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\Ulead Systems [2009/10/10 21:06:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Schree\AppData\Roaming\WinBatch [2009/10/15 00:02:54 \| 00,000,342 \| ---- \| M] () -- C:\Windows\Tasks\McDefragTask.job [2009/11/01 00:00:02 \| 00,000,320 \| ---- \| M] () -- C:\Windows\Tasks\McQcTask.job [2009/10/31 10:04:53 \| 00,000,552 \| ---- \| M] () -- C:\Windows\Tasks\PCDRScheduledMaintenance.job [2009/11/05 00:46:03 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\Tasks\SA.DAT [2009/11/05 00:45:05 \| 00,017,616 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report >

tsrw View Member Profile	Nov 6 2009, 09:32 AM Post #6
New Member Group: Authentic Member Posts: 5 Joined: 30-October 09 Member No.: 88,595 Operating System: vista 64 bit	Extras.txt OTL Extras logfile created on: 11/6/2009 7:21:21 AM - Run 1 OTL by OldTimer - Version 3.1.4.0 Folder = C:\Users\Schree\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18828) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 4.00 Gb Total Physical Memory \| 4.00 Gb Available Physical Memory \| 100.00% Memory free 4.00 Gb Paging File \| 4.00 Gb Available in Paging File \| 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files (x86) Drive C: \| 684.64 Gb Total Space \| 514.74 Gb Free Space \| 75.18% Space Free \| Partition Type: NTFS Drive D: \| 14.00 Gb Total Space \| 2.20 Gb Free Space \| 15.70% Space Free \| Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SCHREE-PC Current User Name: Schree Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Include 64bit Scans Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .chm [@ = chm.file] -- "%SystemRoot%\hh.exe" %1 .cpl[@ = cplfile] -- C:\Windows\SysNative\control.exe () .hlp[@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html[@ = htmlfile] -- C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) .inf[@ = inffile] -- C:\Windows\SysNative\NOTEPAD.EXE () .ini[@ = inifile] -- C:\Windows\SysNative\NOTEPAD.EXE () .url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation) .js[@ = JSFile] -- C:\Windows\SysNative\WScript.exe () .jse[@ = JSEFile] -- C:\Windows\SysNative\WScript.exe () .txt[@ = txtfile] -- C:\Windows\SysNative\NOTEPAD.EXE () .vbe[@ = VBEFile] -- C:\Windows\SysNative\WScript.exe () .vbs[@ = VBSFile] -- C:\Windows\SysNative\WScript.exe () .wsf[@ = WSFFile] -- C:\Windows\SysNative\WScript.exe () .wsh[@ = WSHFile] -- C:\Windows\SysNative\WScript.exe () [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .chm [@ = chm.file] -- "%SystemRoot%\hh.exe" %1 .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) .reg [@ = regfile] -- C:\Windows\SysWow64\regedit.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 () batfile [open] -- "%1" %* File not found batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 () chm.file [open] -- "%SystemRoot%\hh.exe" %1 File not found cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 () cmdfile [open] -- "%1" %* File not found cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 () comfile [open] -- "%1" %* File not found cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* () exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" () inffile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 () inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 () inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 () inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 () InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 () jsfile [open] -- C:\Windows\System32\WScript.exe "%1" %* () jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 () jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 () jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* () jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 () piffile [open] -- "%1" %* File not found regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" () regfile [merge] -- Reg Error: Key error. regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" () scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l () scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 () txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 () txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" () vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 () vbefile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* () vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 () vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 () vbsfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* () vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 () wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 () wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* () wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 () wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* () Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [cmd] -- cmd.exe /s /k pushd "%V" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found chm.file [open] -- "%SystemRoot%\hh.exe" %1 File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [open] -- regedit.exe "%1" (Microsoft Corporation) regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "oobe_av" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0CD1ECF8-5565-4D95-AA64-802AE456429F}" = dir=in \| app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe \| "{5E254310-43CC-43DA-BFCF-45424A88A631}" = dir=in \| app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe \| "{7811DFA2-210D-4535-AFE2-79BC225EF233}" = dir=in \| app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe \| "{7B3CF44F-C759-4D08-8A1E-57810EA4EC0F}" = dir=in \| app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe \| "{7E8EA85E-3F85-4869-A32F-6734EFF2A4A6}" = dir=in \| app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe \| "{890A7D1F-937F-4456-AE3E-4E1743806C61}" = dir=in \| app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe \| "{9FE73CE5-1100-4DC5-A765-CC552C7ECD4A}" = dir=in \| app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe \| "{A5C1F325-C656-400C-B5DA-366F10BE41D4}" = dir=in \| app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe \| "{ABAF20A2-3733-459F-B597-63BCDC32339C}" = dir=in \| app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe \| "{B5FC741B-5649-4B06-9B20-8BEBED191D83}" = dir=in \| app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe \| "{BC2E1ED0-6939-4848-BAB6-AEB56C42D0B2}" = dir=in \| app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe \| "{D626F6E5-F726-42C3-864C-0BC224C7F83E}" = dir=in \| app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe \| "{F3E1D802-F524-46BF-9151-44255020CE2C}" = dir=in \| app=c:\program files (x86)\common files\mcafee\mna\mcnasvc.exe \| ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64) "{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 "{3E597AC0-C805-7F2C-FF91-6D2EA9368D37}" = ccc-utility64 "{4FFA2088-8317-3B14-93CD-4C699DB37843}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 "{5F240DB8-0D74-4F13-86C3-929760392A8D}" = HP Remote Software "{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64) "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D2E8F543-D23A-4A38-AFFC-4BDEBFBA6FDA}" = HP MediaSmart SmartMenu "{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 "{F7FF5EB8-E7C8-8096-0C33-A5B30CD2EA4C}" = ATI Catalyst Install Manager "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "OfficeTrial" = Microsoft Office Home and Student 60 day trial "PC-Doctor for Windows" = Hardware Diagnostic Tools [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{0295F89F-F698-4101-9A7D-49F407EC2D82}" = HP Active Support Library "{10133E8F-56BA-9679-B1C9-BDD2A737524D}" = Catalyst Control Center Graphics Light "{1116E59F-AC01-B06D-024C-95E13490DE43}" = CCC Help Korean "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1896E712-2B3D-45eb-BCE9-542742A51032}" = PictureMover "{1CC069FA-1A86-402E-9787-3F04E652C67A}" = HP Support Information "{1F96599E-619C-1EBD-8BE6-F39A5029D344}" = CCC Help Finnish "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library "{25AEC278-A3E1-13C4-5BE3-95920A6AACB3}" = CCC Help Italian "{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17 "{290CA856-3737-4874-864B-BA142F4823C8}_is1" = HP MediaSmart Demo "{2F2D50D7-C7A4-FAEC-4141-51B3D1DD543D}" = CCC Help Russian "{30B2C06D-4E04-108F-84E4-DBDB3B7D9340}" = ccc-core-static "{362C65F7-571F-8396-DF58-A6A8D63444D2}" = CCC Help Swedish "{365B9E8A-5044-F17C-ABF1-815DF62F4B51}" = CCC Help Spanish "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go "{444DB7A0-BB94-9942-7215-EF8165F3053B}" = Catalyst Control Center Graphics Full New "{47F36D92-E58E-456D-B73C-3382737E4C42}" = HP Update "{4D80B6CD-B297-FDE8-985B-05540F73ACDF}" = CCC Help German "{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}" = InterVideo DeviceService "{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In "{5A9AB192-3A8F-6386-6CE2-80DC9CF9DCBA}" = Catalyst Control Center Graphics Previews Vista "{5E39F0CC-4255-66B2-F8D1-FB76C5504C47}" = Catalyst Control Center Graphics Full Existing "{64E72FB1-2343-4977-B4A8-262CD53D0BD3}" = Corel Paint Shop Pro Photo X2 "{66206F6F-A212-4FAC-837D-3415AA5698DC}" = Catalyst Control Center - Branding "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library "{67431FA8-4B89-42DD-A68E-30D77F6C8D99}_is1" = HP Easy Backup "{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3 "{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel "{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com "{6DD2B3B5-FE09-E821-A930-C154DA7F70C0}" = CCC Help Polish "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{72CEB52D-E5B8-B94F-0DB1-2E26F68F0394}" = Catalyst Control Center Core Implementation "{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{784BEA84-FA66-4B19-BB80-7B545F248AC6}" = HP Total Care Setup "{7F10292C-A190-4176-A665-A1ED3478DF86}" = LightScribe System Software "{88104ACD-31BA-B16E-F151-5F295D215E75}" = CCC Help Danish "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8C3DC8C3-E569-3A75-753F-C04904776AEA}" = Catalyst Control Center Graphics Previews Common "{8C657345-C0C0-42F0-2107-43F3F223C99E}" = CCC Help Turkish "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English) "{9A02FA6E-01D8-451A-F373-767C2F906F21}" = CCC Help Czech "{9CC89170-000B-457D-91F1-53691F85B223}" = Python 2.6.1 "{9F8E53F8-2B04-1CBE-80D2-722D8016BFAC}" = CCC Help French "{A002C1C4-C17B-6269-66FA-CC113FFE4E89}" = CCC Help Japanese "{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{AC49682F-CE9E-43D3-1556-95F4C19DCAFC}" = CCC Help Portuguese "{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2 "{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9 "{AE469025-08BA-4B2A-915D-CC7765132419}" = Default Manager "{AFBBF30D-ADA9-4313-464E-14458B6BE034}" = PhotoshopdotcomInspirationBrowser "{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video "{B84739A3-F943-47E4-95D8-96381EF5AC48}" = HP Customer Experience Enhancements "{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer "{BC07934A-69FF-A886-E4F1-480EA39C43C3}" = CCC Help Dutch "{BE380C5D-BE4C-08C5-8123-79AC369A8029}" = CCC Help Norwegian "{C03897FD-8FE2-A7A6-FA75-B0840CB949E0}" = CCC Help Greek "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint "{C79BF5BB-5671-41C0-A028-E9A2097D1AAD}" = Microsoft Live Search Toolbar "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector "{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0 "{CF3C3096-003A-9FC9-4715-9FC8962E35F3}" = Catalyst Control Center InstallProxy "{D07A3080-A281-C40D-2E1E-699F98B4F3F7}" = CCC Help Chinese Traditional "{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD "{DECD11E6-42D5-3416-AD6B-60A9093CE0CE}" = CCC Help Hungarian "{DEF45232-204B-12BA-BCAC-105DCF05A399}" = CCC Help English "{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar "{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004) "{EA36F8FF-81C8-2832-F023-3CEB2283E3EB}" = CCC Help Thai "{EADFF891-1161-6EC4-6F0A-7FF1E30F4C57}" = CCC Help Chinese Standard "{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F2E05527-16B4-5855-E3FD-D27A7EE477B4}" = Catalyst Control Center Localization All "{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}" = VideoStudio "{FB8E2BF3-74B7-75D5-941D-FBF10395D002}" = Skins "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0 "EPSON Scanner" = EPSON Scan "ERUNT_is1" = ERUNT 1.1j "HijackThis" = HijackThis 2.0.2 "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go "InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video "InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector "InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD "InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}" = Ulead VideoStudio 11 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "MSC" = McAfee SecurityCenter "PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25. 1" = Adobe Photoshop.com Inspiration Browser "pywin32-py2.6" = Python 2.6 pywin32-212 "WildTangent hp Master Uninstall" = HP Games ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 10/15/2009 4:01:20 PM \| Computer Name = Schree-PC \| Source = Application Hang \| ID = 1002 Description = The program Explorer.EXE version 6.0.6001.18164 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 734 Start Time: 01ca4dce304ec71d Termination Time: 0 Error - 10/16/2009 6:12:35 AM \| Computer Name = Schree-PC \| Source = WinMgmt \| ID = 10 Description = Error - 10/16/2009 3:16:21 PM \| Computer Name = Schree-PC \| Source = WinMgmt \| ID = 10 Description = Error - 10/21/2009 7:05:09 AM \| Computer Name = Schree-PC \| Source = WinMgmt \| ID = 10 Description = Error - 10/21/2009 8:49:56 AM \| Computer Name = Schree-PC \| Source = Application Error \| ID = 1000 Description = Faulting application iexplore.exe, version 8.0.6001.18828, time stamp 0x4a9600c9, faulting module Flash10c.ocx, version 10.0.32.18, time stamp 0x4a613d79, exception code 0xc0000005, fault offset 0x000bcbe7, process id 0x13cc, application start time 0x01ca52468e5c0a00. Error - 10/22/2009 12:28:36 AM \| Computer Name = Schree-PC \| Source = Application Hang \| ID = 1002 Description = The program iexplore.exe version 8.0.6001.18828 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: ed0 Start Time: 01ca52c871651820 Termination Time: 0 Error - 10/22/2009 1:20:56 AM \| Computer Name = Schree-PC \| Source = EventSystem \| ID = 4621 Description = Error - 10/22/2009 1:23:20 AM \| Computer Name = Schree-PC \| Source = WinMgmt \| ID = 10 Description = Error - 10/23/2009 11:35:15 AM \| Computer Name = Schree-PC \| Source = EventSystem \| ID = 4621 Description = Error - 10/23/2009 11:37:37 AM \| Computer Name = Schree-PC \| Source = WinMgmt \| ID = 10 Description = [ System Events ] Error - 10/27/2009 6:30:23 PM \| Computer Name = Schree-PC \| Source = DCOM \| ID = 10005 Description = Error - 10/27/2009 6:30:23 PM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7009 Description = Error - 10/27/2009 6:30:23 PM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7000 Description = Error - 10/27/2009 6:32:13 PM \| Computer Name = Schree-PC \| Source = HTTP \| ID = 15016 Description = Error - 10/27/2009 6:33:54 PM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7000 Description = Error - 10/27/2009 6:33:54 PM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7026 Description = Error - 10/30/2009 11:39:15 AM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7000 Description = Error - 10/30/2009 9:06:35 PM \| Computer Name = Schree-PC \| Source = HTTP \| ID = 15016 Description = Error - 10/30/2009 9:08:01 PM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7000 Description = Error - 10/30/2009 9:08:01 PM \| Computer Name = Schree-PC \| Source = Service Control Manager \| ID = 7026 Description = < End of report >

Tomk View Member Profile	Nov 6 2009, 11:25 AM Post #7
Forum God Group: Classroom Teacher Posts: 11,209 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	tsrw, Log looks good You need to create a new Clean restore point: Download SysRestorePoint to your desktop and unzip it to it's own folder. Double click SysRestorePoint.exe so that we can make a new system restore point. A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program. Remove all previous Restore Points Click Start Menu > Run > copy and paste cleanmgr You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up... button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit. Double-click My Computer. Click the Tools menu, and then click Folder Options. Click the View tab. Check "Hide file extensions for known file types." Under the "Hidden files" folder, Uncheck "Show hidden files and folders." Check "Hide protected operating system files." Click Apply, and then click OK. Double click on OTL to run it. Click on CleanUp! When done, you will be prompted to restart your computer. Please restart your computer. The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing. Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein. I would also suggest you read this: So how did I get infected in the first place? by Tony Klein Also: "How to prevent malware" by miekiemoes Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

tsrw View Member Profile	Nov 6 2009, 10:03 PM Post #8
New Member Group: Authentic Member Posts: 5 Joined: 30-October 09 Member No.: 88,595 Operating System: vista 64 bit	I completely understand...don't want the dang things back. lol. Thank you so much for your assistance.

Tomk View Member Profile	Nov 6 2009, 10:04 PM Post #9
Forum God Group: Classroom Teacher Posts: 11,209 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	tsrw, You are very welcome. Good luck and be well.

Tomk View Member Profile	Nov 6 2009, 10:05 PM Post #10
Forum God Group: Classroom Teacher Posts: 11,209 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

« Next Oldest · Infections Removal · Next Newest »

Closed Topic

Start new topic

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Similar Topics

Similar Topics

Similar Topics

		Topic Title	Replies	Topic Starter	Views	Last Action
		Infections Removal Computer freezes	4	renobruce	0	18 minutes ago Last post by: renobruce
		General Hardware Turning External HDD On/Off with Computer	1	shbrooks	20	Today, 06:55 PM Last post by: jephree
		Microsoft Windows™ Computer keeps shutting down - possible display driver problem?	4	whoopie	61	Today, 05:33 PM Last post by: whoopie
		Browsers, Internet and email IE8, C-MOTECH RDEVCHG & Computer Crashes	11	Selina	109	Today, 03:49 PM Last post by: Doug

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Time is now: 20th November 2009 - 09:54 PM

Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk.
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy

Powered By IP.Board © 2009 IPS, Inc.