47 replies to this topic

[lmacri]

Hi CatByte:

I have a correction regarding my last post. If I maximize the Command Prompt window after running reset.cmd, I can see an additional 78,366 errors reported when the file tries to change permissions in HKEY_CLASSES_ROOT related to RegSetKeySecurity (see attached .JPG).

I scrolled up to the top of the Command Prompt window and there are only a few hundred lines of messages, so I'll try to output the information to a file using the PRINT command and attach it in my next post.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 * MBAM v. 1.50.1.1100
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Attached Thumbnails

• 

[lmacri]

Hi CatByte:

The text file of the reset.cmd errors is too large to post (>800 MB!!), but the summary report in the Command Prompt is much easier to read and I was able to capture it in a single screen shot (see attached.jpg).

It looks like both the failures are occurring in HKLM\Software\Microsoft\Windows NT\Current Version\Perflib\009

Please forgive my previous brain fart about the PRINT command. It's been sooooo long since I tried piping output to a file.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 * MBAM v. 1.50.1.1100
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Attached Thumbnails

• 

[lmacri]

Hi CatByte:

Just a question about the link you provided for http://support.microsoft.com/kb/968003.

Is it possible that I'm not seeing the "Finished, press and key to continue" message when I run reset.cmd because the code you gave me doesn't include the @echo on/off and @pause messages?

Also, does this code work for Windows Vista/Server 2008? This support article refers to Windows XP/Server 2003.

I found a slightly different set of commands for Vista SP1 at http://blog.tiensivu.com/aaron/archives/14...sions!.html that includes a secedit command that might fix the security policy area errors.

If this looks helpful, there is a much more detailed explanation at http://social.msdn.m...2-00fdd33b8589/.

I'm guessing that all my problems can be traced back to a Vista SP1 update that was performed by HP at the factory. I have a persistent LanguagePackSetup error on my system at boot-up that disappears if I disable the LPRemove task in Task Scheduler (Task Scheduler Library | Microsoft | Windows | MUI | LPRemove) - it can't remove a French language pack MUI that probably shouldn't even be installed on a Vista Home Premium machine - and I traced this error all the way back to a date before I even purchased my laptop.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 * MBAM v. 1.50.1.1100
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Edited by lmacri, 17 February 2011 - 11:35 AM.

[CatByte]

Hi

Even though it says it's for XP, it should still be good for Vista

I need a bit of time to look into this some more, but that article you found looks like it may resolve the issue.

Yes it could very well be from a failed/corrupted update.

You may want to consider a repair install, then bringing things up to date the way it should be.

A repair install will not erase your installed documents or programs:


http://www.vistax64....tall-vista.html

[lmacri]

Hi CatByte:

I would actually prefer to do a repair install of Vista but that is problematic on my system for a few reason:

• My HP laptop did not come with a Windows Vista SP1 DVD. Instead I have a recovery partition on my hard drive (D: drive) and a set of 3 recovery CDs that I created just after I purchased my laptop in Aug 2008.
• I now have Vista SP2 installed on my PC, which would mean I would either have to create a Vista SP2 slipstream DVD (per the instructions on the link you gave me at http://www.vistax64....8236-repair-SP1, which looks way beyond my technical abilities) or uninstall SP2 and then repair SP1 from my recovery disks.
• The Vista SP1 files on my recovery disks might also be corrupted if the problem with my registry/folder permissions occurred during the factory install of SP1 prior to Aug 2008.

I called the store where I bought my laptop and asked if they could perform a Vista repair for me. The repair tech said that they would likely just wipe my entire hard drive and install a clean Vista SP2 OS.

I don't want to waste your time here, but if you think it's worthwhile I'd like to take another shot at fixing the registry/folder permissions with SubInACL.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 * MBAM v. 1.50.1.1100
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Edited by lmacri, 18 February 2011 - 07:35 AM.

[lmacri]

Hi CatByte:

Me again. I just found a MS Support article at http://support.micro...kb;en-us;313222 on restoring security settings that says in part:

"The use of “secedit /configure” to import the default security template, dfltbase.inf, is unsupported nor is it a viable method to restore default security permissions on Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2 computers.

Beginning with Windows Vista, the method to apply the security during operating system setup changed. Specifically, security settings consisted of settings defined in deftbase.inf augmented by settings applied by the operating installation process and server role installation. Because there is no supported process to replay the permissions made by the operating system setup, the use of the “secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose” command line is no longer capable of resetting all security defaults and may even result in the operating system becoming unstable."

Here's part of the Vista SP1 reset.cmd code from the link at http://blog.tiensivu.com/aaron/archives/14...sions!.html. I've highlighted the differences from the XP code we tried.

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f

I've always thought it was odd that the SYSTEM group didn't have full permissions for my C:\Windows folders. The Vista SP1 code above might work if this is just a registry/folder permission problem, but if it fails like the XP code then this might indicate that I have a problem with my local security policy that could be blocking these registry permissions changes.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 * MBAM v. 1.50.1.1100
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[CatByte]

Hi,

I'm only comfortable up to a certain point with this and it's getting beyond my area of expertise, I wouldn't want to advise you and have something go wrong. I would feel better about this if you atarted a new thread in the Windows Forum and waited for one of our Tech Experts to answer:

Link then back to this thread so they can see what we have already accomplished, so they can advise you from here,

Thanks for your understanding:

I will leave this thread open, so we can wrap it up once the Techs have sorted the permissions issue.

[lmacri]

Hi CatByte:

Thanks for all your help to date. You've been absolutely brilliant. You were able to confirm that I don't have any malware on my system and my Windows Update is working again (bonus!!! ), and those were my two main concerns.

I've cross-posted in the WhatTheTech Windows forum at http://forums.whatth...howtopic=117221 as you suggested and I'll let you know if they can resolve the problem with the file/registry permissions. I suspect this is a long-standing problem on my PC and I just kept ahead of it by manually deleting orphaned files in my C:\Program Files folder and cleaning my registry with CCleaner every time I uninstalled software.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 * MBAM v. 1.50.1.1100 * HijackThis v. 2.0.4
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[CatByte]

OK, thanks come back when it's sorted and we'll clean up all our tools

[lmacri]

Hi CatByte:

Would you be able to provide me with the OTL code for rebuilding my Hosts file in C:\Windows\System32\drivers\etc\ that contains the following two default entries for Windows Vista:

127.0.0.1 localhost
::1 localhost

I wasn't able to make any progress in the WTT Windows forum here. The person trying to help me in the Windows forum doesn't seem to know how to fix the file/folder permissions in my C:\Windows folder using SubInACL (the link they suggested here was in French) and they finally recommended that I either uninstall all my Vista service packs or restore my laptop back to its factory settings.

I don't want to start fooling around with my OS when my SYSTEM and Administrator groups don't have full permissions for C:\Windows. I'm looking for a new job and need my computer to check electronic job boards, submit job applications and check my e-mail, so leaving my laptop at the repair shop for two weeks while they wipe my hard drive and re-install Vista OS SP2 isn't a great option for me at the moment.

The only obvious problems I'm having right now other than my C:\Windows file/folder permissions are:

• I have no Hosts file in C:\Windows\System32\drivers\etc\ (post # 26)
• I have a stray Biometric Authentication Service (DpHost) in Windows Services (currently disabled) that was not properly deleted when I uninstalled my DigitialPersona Personal fingerprint reader software (post # 16)
• Uninstalling other software sometimes leaves behind orphaned files and registry entries
• I've lost the ability to run some system diagnostics scans like the advanced networking test in Norton Utilities (NU) and the software patch scan at www.it.shavlik.com (Shavlik now warns that I need to install the .NET Framework 3.5 first).

I'm not sure if I'm having problems with my online diagnostics scans because I lost my Hosts file when I ran the MS Fixit tool (post # 26) or if I might have corrupted some .NET Framework files when I ran the Norton Removal Tool (post # 13), which removed both my NIS 2011 and Norton Utilities 14.5 (NU uses the .NET framework). No worries that NU was removed from my system - I'm familiar with the Norton Removal Tool and knew this would happen, and I've already done a clean NU re-install. I still haven't re-installed NIS 2011, though.

I've posted fresh OTL and Extras logs below. Let me know if there are any other scans you'd like me to run.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 NIS 2011 v. 18.5 * NU 14.5 *MBAM v. 1.50
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS
--------

OTL logfile created on: 22/02/2011 9:37:05 AM - Run 5
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Lori\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 70.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.82 Gb Total Space | 138.92 Gb Free Space | 62.91% Space Free | Partition Type: NTFS
Drive D: | 12.07 Gb Total Space | 1.73 Gb Free Space | 14.30% Space Free | Partition Type: NTFS

Computer Name: LORI-PC | User Name: Lori | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/13 15:10:16 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
PRC - [2010/12/20 18:08:58 | 000,363,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/12/20 18:08:56 | 000,443,728 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2009/10/26 14:46:54 | 001,458,176 | ---- | M] (Motorola Inc.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2009/06/09 09:25:54 | 007,539,232 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
PRC - [2009/04/11 00:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/12/04 12:00:26 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/12/04 12:00:20 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe


========== Modules (SafeList) ==========

MOD - [2011/02/13 15:10:16 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
MOD - [2010/08/31 09:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2010/05/04 13:13:07 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
MOD - [2009/09/24 20:10:10 | 000,974,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll
MOD - [2009/04/11 00:28:23 | 002,226,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\networkexplorer.dll
MOD - [2009/04/11 00:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLC.dll
MOD - [2009/04/11 00:28:19 | 000,114,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\EhStorShell.dll
MOD - [2009/04/11 00:28:18 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cscapi.dll
MOD - [2009/04/11 00:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rsaenh.dll
MOD - [2008/01/20 20:25:01 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\duser.dll
MOD - [2008/01/20 20:24:56 | 000,326,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\actxprxy.dll
MOD - [2008/01/20 20:23:50 | 000,080,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\thumbcache.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (DpHost)
SRV - [2011/01/20 07:44:03 | 000,797,184 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2011/01/05 11:59:50 | 000,037,664 | ---- | M] (Apple Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/12/20 18:08:58 | 000,363,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2008/12/04 12:00:26 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®
SRV - [2008/01/29 16:09:02 | 000,394,704 | ---- | M] (Symantec, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe -- (Symantec RemoteAssist)
SRV - [2008/01/20 20:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/05/27 21:32:58 | 000,245,936 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2009/10/26 15:09:06 | 001,095,936 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2009/10/03 05:02:06 | 009,905,096 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/06/09 09:13:42 | 002,366,752 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/12/04 11:34:52 | 000,328,728 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008/11/17 15:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel®
DRV - [2008/10/02 16:42:24 | 000,482,176 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)
DRV - [2008/01/24 23:46:40 | 000,106,496 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/01/20 20:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/20 20:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/20 20:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/20 20:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/20 20:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/20 20:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/20 20:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/20 20:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/20 20:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/20 20:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®
DRV - [2008/01/20 20:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/20 20:23:23 | 000,654,336 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTCNXT3.SYS -- (winachsf)
DRV - [2008/01/20 20:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/20 20:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/20 20:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/20 20:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/20 20:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/20 20:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/20 20:23:22 | 000,987,648 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (HSF_DPV)
DRV - [2008/01/20 20:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/20 20:23:22 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2008/01/20 20:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/20 20:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/20 20:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/20 20:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/20 20:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/20 20:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/20 20:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/12/12 13:12:38 | 000,080,936 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2007/12/12 13:12:38 | 000,080,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2007/12/12 13:12:38 | 000,016,168 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2007/09/26 12:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel®
DRV - [2007/08/28 16:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2007/08/08 19:42:08 | 000,045,568 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007/07/30 10:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/07/30 09:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007/07/11 11:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
DRV - [2007/06/18 18:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2006/11/02 03:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 03:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 03:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 03:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 03:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 03:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 03:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 03:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 03:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 03:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 03:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 02:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 02:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 02:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 02:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 02:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 02:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 01:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 01:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006/11/02 01:30:53 | 000,464,384 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XV)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...a...n&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/03 16:41:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/20 13:28:39 | 000,000,000 | ---D | M]

[2011/01/20 21:41:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Extensions
[2010/06/14 13:57:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Extensions\58282EC3-9AC0-4ab3-9BC3-6362BA4F2F5E
[2011/02/21 12:08:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\t8xvl799.default\extensions
[2011/02/03 16:41:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\t8xvl799.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/03 16:41:45 | 000,000,000 | ---D | M] (Mozilla Archive Format) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\t8xvl799.default\extensions\{7f57cf46-4467-4c2d-adfa-0cba7c507e54}
[2011/02/03 16:41:50 | 000,000,000 | ---D | M] (Bookmark Duplicate Detector) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\t8xvl799.default\extensions\{ba243cb0-b824-4a26-9418-73ee795d9b9d}
[2011/02/20 14:14:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/02/20 14:14:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/02/20 14:13:51 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

Hosts file not found
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\InfoDelivery present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Security present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\ZOOM present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: shavlik.com ([it] https in Local intranet)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...tDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} http://h20264.www2.h...osticsVista.cab (Reg Error: Value error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.101.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Lori\Pictures\1280_crabnebula.jpg
O24 - Desktop BackupWallPaper: C:\Users\Lori\Pictures\1280_crabnebula.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/25 15:49:36 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 09:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not found
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: wave6 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)

MsConfig - State: "startup" - 0
MsConfig - State: "services" - 0

SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfRd - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

========== Files/Folders - Created Within 30 Days ==========

[2011/02/20 14:14:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/02/20 14:14:10 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011/02/20 14:14:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011/02/20 14:14:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011/02/20 12:53:15 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2011/02/18 15:27:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Utilities 14
[2011/02/18 15:27:36 | 001,101,824 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBox210.ocx
[2011/02/18 15:27:36 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBox10.ocx
[2011/02/18 15:27:36 | 000,212,992 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBoxVB12.ocx
[2011/02/18 15:27:35 | 000,506,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml.dll
[2011/02/18 15:27:33 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Utilities 14
[2011/02/16 10:23:48 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\Microsoft_Corporation
[2011/02/16 09:45:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2011/02/14 07:54:21 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/02/13 15:10:16 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
[2011/02/13 07:02:47 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Lori\Desktop\TFC.exe
[2011/02/10 08:55:11 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/02/09 12:34:28 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\WindowsUpdate
[2011/02/09 12:18:49 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/02/09 12:15:25 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\temp
[2011/02/09 12:14:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/02/09 12:06:31 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/02/09 12:06:11 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/02/09 11:22:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/02/09 11:22:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/02/09 11:22:12 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/02/09 11:22:08 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/02/09 11:20:19 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/02/09 08:43:05 | 003,602,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011/02/09 08:43:04 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011/02/09 08:43:02 | 002,039,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011/02/09 08:42:55 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2011/02/09 08:42:55 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2011/02/09 08:42:55 | 000,979,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll
[2011/02/09 08:42:55 | 000,797,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2011/02/09 08:42:55 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2011/02/09 08:42:54 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2011/02/09 08:42:54 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011/02/09 08:42:54 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll
[2011/02/09 08:42:54 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll
[2011/02/09 08:42:54 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011/02/09 08:42:54 | 000,261,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2011/02/09 08:42:54 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2011/02/09 08:42:53 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2011/02/09 08:42:53 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2011/02/09 08:42:53 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2011/02/09 08:42:53 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2011/02/09 08:42:52 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2011/02/09 08:42:52 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2011/02/09 08:42:52 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2011/02/09 08:42:52 | 000,209,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll
[2011/02/09 08:42:52 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2011/02/09 08:42:52 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2011/02/09 08:42:50 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll
[2011/02/09 08:42:50 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2011/02/09 08:42:50 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2011/02/09 08:42:36 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011/02/09 08:42:36 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011/02/09 08:42:31 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011/02/09 08:42:31 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/02/09 08:42:30 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011/02/09 08:42:30 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/02/09 08:42:30 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011/02/09 08:42:30 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/02/09 08:42:30 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/02/09 08:42:30 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011/02/09 08:42:30 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/02/09 08:42:30 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011/02/09 08:42:30 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011/02/09 08:42:30 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011/02/09 08:42:30 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011/02/09 08:42:30 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011/02/09 08:42:30 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/02/09 08:42:30 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011/02/09 08:42:30 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011/02/07 22:25:11 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/02/03 08:54:03 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/02/03 08:54:03 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/02/03 08:25:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2(295)
[2011/02/03 08:25:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2011/02/01 14:54:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/02/01 14:53:57 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/02/01 14:53:54 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/02/01 10:37:39 | 000,000,000 | ---D | C] -- C:\$RECYCLE(6).BIN
[2011/01/27 13:35:02 | 000,000,000 | ---D | C] -- C:\Users\Lori\Documents\CyberLink CL Cleaner
[2011/01/26 09:46:12 | 000,000,000 | ---D | C] -- C:\288b594930c641eac4
[2009/07/31 20:02:20 | 003,063,561 | ---- | C] (Macromedia, Inc.) -- C:\ProgramData\MobileTV.exe
[2009/07/31 20:02:20 | 002,989,660 | ---- | C] (Macromedia, Inc.) -- C:\ProgramData\DVD.exe
[2009/07/31 20:02:20 | 002,864,396 | ---- | C] (Macromedia, Inc.) -- C:\ProgramData\MPV.exe
[2009/07/31 20:02:20 | 002,331,174 | ---- | C] (Macromedia, Inc.) -- C:\ProgramData\Karaoke.exe
[2009/07/31 20:02:19 | 002,231,606 | ---- | C] (Macromedia, Inc.) -- C:\ProgramData\Games.exe

========== Files - Modified Within 30 Days ==========

[2011/02/22 09:36:00 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8379694C-F8AF-4C5E-A380-BEA99E17B597}.job
[2011/02/22 08:27:37 | 000,048,992 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/02/22 08:27:37 | 000,048,992 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/02/22 08:27:18 | 000,003,344 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/22 08:27:18 | 000,003,344 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/22 08:27:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/21 22:41:57 | 000,681,856 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2011/02/21 22:41:57 | 000,609,196 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/02/21 22:41:57 | 000,130,648 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2011/02/21 22:41:57 | 000,108,672 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/02/20 14:13:50 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2011/02/20 14:13:50 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011/02/20 14:13:50 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011/02/20 14:13:50 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011/02/20 13:56:33 | 000,002,607 | ---- | M] () -- C:\Users\Lori\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Excel.lnk
[2011/02/20 12:53:15 | 000,001,057 | ---- | M] () -- C:\Users\Lori\Desktop\Revo Uninstaller.lnk
[2011/02/19 08:08:56 | 000,002,609 | ---- | M] () -- C:\Users\Lori\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2011/02/18 15:27:55 | 000,000,845 | ---- | M] () -- C:\Users\Public\Desktop\Norton Utilities.lnk
[2011/02/17 10:36:11 | 000,298,776 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/02/17 06:42:43 | 000,000,649 | ---- | M] () -- C:\Users\Lori\Desktop\drivers - Shortcut.lnk
[2011/02/16 19:27:03 | 000,000,474 | ---- | M] () -- C:\Users\Lori\Desktop\reset.cmd
[2011/02/16 10:38:10 | 000,002,521 | ---- | M] () -- C:\Users\Lori\Desktop\HiJackThis.lnk
[2011/02/15 06:25:10 | 000,000,021 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.old
[2011/02/14 08:06:09 | 000,296,448 | ---- | M] () -- C:\Users\Lori\Desktop\uk7ef113.exe
[2011/02/13 15:10:16 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
[2011/02/13 07:03:59 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\TFC.exe
[2011/02/11 09:34:44 | 000,033,117 | R--- | M] () -- C:\Users\Lori\Documents\Milk Prices as of 01 Feb 2011.PDF
[2011/02/09 12:29:35 | 000,624,128 | ---- | M] () -- C:\Users\Lori\Desktop\dds.com
[2011/02/09 09:20:18 | 004,265,880 | R--- | M] () -- C:\Users\Lori\Desktop\ComboFix.exe
[2011/02/03 17:00:53 | 000,001,664 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/02/01 14:26:03 | 000,001,702 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2011/01/31 10:14:00 | 000,001,236 | ---- | M] () -- C:\Users\Lori\Desktop\NIS 2011 NIS Protecting Computer From Local Network.lnk
[2011/01/29 12:17:00 | 000,000,372 | ---- | M] () -- C:\Users\Lori\Application Data\Microsoft\Internet Explorer\Quick Launch\Documents.lnk
[2011/01/25 14:01:56 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2011/02/20 12:53:15 | 000,001,057 | ---- | C] () -- C:\Users\Lori\Desktop\Revo Uninstaller.lnk
[2011/02/18 15:27:55 | 000,000,845 | ---- | C] () -- C:\Users\Public\Desktop\Norton Utilities.lnk
[2011/02/17 06:42:43 | 000,000,649 | ---- | C] () -- C:\Users\Lori\Desktop\drivers - Shortcut.lnk
[2011/02/16 19:27:03 | 000,000,474 | ---- | C] () -- C:\Users\Lori\Desktop\reset.cmd
[2011/02/14 08:04:58 | 000,296,448 | ---- | C] () -- C:\Users\Lori\Desktop\uk7ef113.exe
[2011/02/11 09:34:44 | 000,033,117 | R--- | C] () -- C:\Users\Lori\Documents\Milk Prices as of 01 Feb 2011.PDF
[2011/02/09 12:27:46 | 000,624,128 | ---- | C] () -- C:\Users\Lori\Desktop\dds.com
[2011/02/09 11:22:12 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/02/09 11:22:12 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/02/09 11:22:12 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/02/09 11:22:12 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/02/09 11:22:12 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/02/09 09:20:07 | 004,265,880 | R--- | C] () -- C:\Users\Lori\Desktop\ComboFix.exe
[2011/02/03 08:54:03 | 000,002,521 | ---- | C] () -- C:\Users\Lori\Desktop\HiJackThis.lnk
[2011/02/01 14:54:43 | 000,001,664 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/01/31 10:14:00 | 000,001,236 | ---- | C] () -- C:\Users\Lori\Desktop\NIS 2011 NIS Protecting Computer From Local Network.lnk
[2011/01/29 12:17:00 | 000,000,372 | ---- | C] () -- C:\Users\Lori\Application Data\Microsoft\Internet Explorer\Quick Launch\Documents.lnk
[2011/01/15 16:41:32 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2009/07/31 20:02:19 | 000,000,021 | ---- | C] () -- C:\ProgramData\hpqp.txt
[2009/07/31 20:01:36 | 000,000,255 | ---- | C] () -- C:\ProgramData\hpqp.ini
[2009/05/26 12:45:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2008/12/22 09:56:22 | 000,048,992 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008/12/22 09:56:22 | 000,048,992 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008/10/04 15:08:05 | 000,000,680 | ---- | C] () -- C:\Users\Lori\AppData\Local\d3d9caps.dat
[2008/09/11 17:42:44 | 000,000,000 | ---- | C] () -- C:\Users\Lori\AppData\Local\FnF4.txt
[2008/09/03 08:07:05 | 000,007,168 | ---- | C] () -- C:\Users\Lori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/19 07:42:22 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/08/19 06:28:38 | 000,000,314 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\wklnhst.dat
[2008/08/16 20:02:55 | 000,027,744 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\nvModes.001
[2008/08/16 19:47:36 | 000,027,744 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\nvModes.dat
[2008/08/10 14:46:22 | 000,000,000 | ---- | C] () -- C:\Users\Lori\AppData\Local\QSwitch.txt
[2008/08/10 14:46:22 | 000,000,000 | ---- | C] () -- C:\Users\Lori\AppData\Local\DSwitch.txt
[2008/08/10 14:46:22 | 000,000,000 | ---- | C] () -- C:\Users\Lori\AppData\Local\AtStart.txt
[2008/08/10 13:33:01 | 000,007,837 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2008/01/14 17:47:06 | 000,099,712 | ---- | C] () -- C:\Windows\HPBroker.dll
[2007/12/04 13:55:36 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006/11/02 06:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/03/09 03:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2001/11/14 12:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[1999/01/22 12:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 173 bytes -> C:\ProgramData\TEMP:D287FACF
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >
_________________________________________________________

OTL Extras logfile created on: 22/02/2011 9:37:05 AM - Run 5
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Lori\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 70.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.82 Gb Total Space | 138.92 Gb Free Space | 62.91% Space Free | Partition Type: NTFS
Drive D: | 12.07 Gb Total Space | 1.73 Gb Free Space | 14.30% Space Free | Partition Type: NTFS

Computer Name: LORI-PC | User Name: Lori | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.pif [@ = piffile] -- Reg Error: Key error. File not found
.vbs [@ = VBSFile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{216C95C4-59FF-4783-8983-3659C43CD5FA}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"{29A15DE1-D998-4317-89A7-90E463BA203F}" = protocol=6 | dir=in | app=c:\users\lori\appdata\local\temp\7zs9a3e.tmp\symnrt.exe |
"{4D30D9A4-5CE2-4233-BADF-8E1D62009D96}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{77BCA5BE-2C38-42E8-9A4A-46DD6363BDF2}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{94625C72-2D23-403C-B254-6192FAB20B25}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{F9272D77-2A16-4CAA-A993-8002462C52AD}" = protocol=17 | dir=in | app=c:\users\lori\appdata\local\temp\7zs9a3e.tmp\symnrt.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional
"{0054A0F6-00C9-4498-B821-B5C9578F433E}" = HP Help and Support
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{0295F89F-F698-4101-9A7D-49F407EC2D82}" = HP Active Support Library
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = HP Integrated Module with Bluetooth wireless technology 6.0.1.6000
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0EC7C406-B592-4686-BAC1-AD29A85EAE6A}" = HP Driver Diagnostics
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{20B30DC1-E423-4939-B51D-05C58B0F9BBB}" = HP Photosmart All-In-One Driver Software 10.0 Rel .2
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 24
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}" = HP QuickTouch 1.00 D2
"{340F521E-3576-4E1A-B75C-EB0ACF751379}" = HP Wireless Assistant
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 H2
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4D49757C-367A-4333-BDB3-68966162B14E}" = HP User Guides 0087
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc
"{6845255F-15CC-4DD1-94D5-D38F370118B3}_is1" = Auslogics Duplicate File Finder
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6B437F94-056F-4791-AF2C-0D10E2706AF0}" = PanoStandAlone
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{772997BF-C04E-4FD2-B04F-24D06D649C68}" = Windows Live Install Wizard
"{7F362F06-A9A3-440F-8B19-6A01A72723C4}" = AuthenTec Fingerprint Sensor Minimum Install
"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B3C1579F-C9BB-4479-B343-B22C5C283D47}" = Vista Services Optimizer
"{b9be267c-e096-4cce-a4fd-f24eec004938}" = PS_AIO_02_ProductContext
"{BD0E2B92-3814-46F0-893B-4612EA010C7E}" = HP Customer Experience Enhancements
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{c4549405-195f-4450-8865-6be9dc5ad136}" = PS_AIO_02_Software_Min
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C708333C-B1B9-43be-B797-49FEC7A8D15B}" = C5200
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software 1.10.13.1
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{cd0b9359-b716-4fd0-8e0a-09b3e312e8a4}" = PS_AIO_02_Software
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{cef78f86-19a8-4bbd-91fa-e9b6b2d37348}" = C5200_Help
"{D3EE034D-5B92-4A55-AA02-2E6D0A6A96EE}" = Windows Resource Kit Tools - SubInAcl.exe
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F42CD69D-E393-47c8-B2CD-B139C4ADA9A8}" = Copy
"5244-9769-3058-9401" = Moneydance 2010
"AceMoney Lite_is1" = AceMoney Lite
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Analyse-it for Excel" = Analyse-it for Microsoft Excel
"CCleaner" = CCleaner
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Defraggler" = Defraggler
"ESET Online Scanner" = ESET Online Scanner v3
"FileHippo.com" = FileHippo.com Update Checker
"Foxit Reader" = Foxit Reader
"Fund Manager" = Fund Manager
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPOCR" = OCR Software by I.R.I.S. 10.0
"InstallShield_{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Money2005b" = Microsoft Money 2005
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Norton Utilities_is1" = Norton Utilities
"NVIDIA Drivers" = NVIDIA Drivers
"Registry First Aid_is1" = Registry First Aid
"Revo Uninstaller" = Revo Uninstaller 1.91
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"WildTangent hp Master Uninstall" = My HP Games
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20/02/2011 9:13:06 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 9:13:06 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 9:13:09 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\MUSIC\ITUNES\ITUNES LIBRARY EXTRAS.ITDB-JOURNAL>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 9:13:21 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\MUSIC\ITUNES\ITUNES LIBRARY EXTRAS.ITDB-JOURNAL>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 9:13:24 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE.TRASH>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 9:13:24 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 9:13:24 AM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 2:22:25 PM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 2:22:25 PM | Computer Name = Lori-PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\USERS\LORI\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\T8XVL799.DEFAULT\CACHE>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 20/02/2011 3:55:52 PM | Computer Name = Lori-PC | Source = VSS | ID = 8194
Description = Volume Shadow Copy Service error: Unexpected error querying for the
IVssWriterCallback interface. hr = 0x80070005. This is often caused by incorrect
security settings in either the writer or requestor process. Operation: Gathering
Writer Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer Writer Instance ID: {89cc327d-3be8-4442-8b4f-2477ce126e4f}

[ System Events ]
Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17/02/2011 8:25:34 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 17/02/2011 8:36:24 AM | Computer Name = Lori-PC | Source = DCOM | ID = 10005
Description =

Error - 18/02/2011 6:43:56 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 19/02/2011 10:44:22 AM | Computer Name = Lori-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.


< End of report >

Edited by lmacri, 22 February 2011 - 10:27 AM.

[CatByte]

OK

It's probably wise advice,

one of the error logs gives me some concern

Error - 19/02/2011 10:44:22 AM | Computer Name = Lori-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

when you have the time, you should do a reinstall, it's something that you can do yourself, our techs here can step you through it.

In the mean time

here is a link specifically to reset Vista Permissions:

http://blogs.msdn.co.../04/739820.aspx

give that a good read over and see if you can apply to your situation.

I see you have Revo uninstaller on board, use that for uninstalling programs, it will remove the registry entries it needs to

don't worry about leftover registry entries, they cause no harm, nor do they slow down accessing any other branch/tree of the registry, they are simply entries that are ignored and never accessed again. No need to ever use a registry cleaner, they do more harm than good

You may need to uninstall then reinstall the NET framework

I will give the reset hosts command in the following OTL log, if for some reason that is not creating a new one as it should, I'll follow with the manual instructions:

Please do the following:

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :OTL
  SRV - File not found [Disabled | Stopped] -- -- (DpHost)
  
  :Commands
  [resethosts]
  [emptyflash]
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post the OTL log

To manually rebuild the hosts file:

Create a new default hosts file.

To do this, follow these steps:

Right-click an open space in the c:\windows\system32\drivers\etc folder

point to New, click Text Document, type hosts, and then press ENTER

Click Yes to confirm that the file name extension will not be txt

click on the newly created hosts file to open it > you will be asked what program to open it with > choose Notepad


Copy the following text to the file:


127.0.0.1 localhost
::1 localhost

Save the change and exit

reboot your computer

[lmacri]

Hi CatByte:

I have lots of news, most of it good.

A. OTL Fix for Resetting Hosts

Your code worked like a charm. I confirmed that the Hosts file was correctly re-created in C:\Windows\System32\drivers\etc\ and the orphaned Biometric Authentication Service (DpHost) from my DigitalPersona Personal uninstall no longer appears in Windows Services.

The OTL log for this fix is posted below.

B. Microsoft .NET Framework 3.5 SP1

I did a repair install of my .NET Framework 3.5 SP1 and confirmed that my IT.Shavlik.com online diagnostic tool is working normally again.

I was surprised to see that my Shavlik scan found 13 missing patches for my system that are not detected by Windows Update, including KB943729 (Group Policy preferences for Server 2008) and KB957579 (Post-installation behavior on client computers after you install the DNS update) (see attached .JPG). Only one of these missing patches - QJAVA60 - has ever shown up with past Shavlik scans. I haven't applied any of these patches yet - I'd like to confirm they are supported by Vista Home Premium first - but it's possible that installing a few of these missing patches might fix some incorrect group permissions.

C. SubInACL Fix for Registry / Folder Permissions (Vista Version)

Bravo for finding that link to the Vista code here on Aaron Stebner's blog. I've been searching for days and never came across that post.

Sadly, the Vista code also failed again with tons of errors, and the SYSTEM and Administrator groups still don't have full permissions for most of the C:\Windows subfolders. That's not good news, since I think I'm going to have continued problems purging my temp files, browser history, DNS cache, etc. until I get these permissions fixed.

However, one of the comments on Aaron Stebner's blog may have pointed me towards a possible solution. The comment was from a user named KenBanks who had a HP Pavilion computer running Vista Home Premium with multiple user accounts who couldn't get the SubInACL code to run. This sounds identical to my situation, because I have a similar HP Pavilion laptop and Vista OS and I created a second "backup" Administrator account shortly after I bought my laptop. I'm going to take a look at the advanced User Account Control (UAC) settings for both my Administrator accounts and I'll report back if I can figure out why having more than one user account might interfere with the SubInACL fix.
--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 NIS 2011 v. 18.5 * NU 14.5 * MBAM v. 1.50
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS
--------


All processes killed
========== OTL ==========
Service DpHost stopped successfully!
Service DpHost deleted successfully!
========== COMMANDS ==========
HOSTS file reset successfully

[EMPTYFLASH]

User: All Users

User: Backup Administrator

User: Default

User: Default User

User: Lori
->Flash cache emptied: 456 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: All Users

User: Backup Administrator
->Temp folder emptied: 31834 bytes
->Temporary Internet Files folder emptied: 58404 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Lori
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 82322 bytes
->Java cache emptied: 177764 bytes
->FireFox cache emptied: 44009017 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 115400427 bytes

Total Files Cleaned = 152.00 mb


OTL by OldTimer - Version 3.2.20.6 log created on 02232011_145212

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Edited by lmacri, 23 February 2011 - 10:29 PM.

[CatByte]

OK, good work, at least it's progress.

I don't run Vista myself so I really can't advise on the patches.

You may actually want to post in the Vista forums, you may get more useful help there as I really don't think I can be of any more use to you with this, sorry.
http://www.vistaheads.com/forums/

[lmacri]

Hi CatByte:

Great news. I was able to get SubInACL to run properly and my SYSTEM and Administrators groups now have full permissions again for all the subdirectories in C:\Windows.

There was one failure in the following registry key, which is the same key I mention back in post # 32 when we originally tried the old XP SubInACL commands:

HKLM\Software\Microsoft\Windows NT\Current Version\Perflib\009

I checked with regedit and the permissions actually looked okay to me (SYSTEM and Administrators have full permissions), but I'll go back through the SubInALC log and see if anything stands out.


I did two things differently this time:

1. Changed Vista UAC Tweak for Bypassing Passwords at Logon

When I first purchased my computer I tweaked the advanced settings of my Vista User Account Control (UAC) so that Vista Home Premium automatically logged me on with my "default" Administrator account whenever I booted up my system (see here for sample instructions). I doubt this actually caused any problems with SubInACL, but just to be on the safe side I reversed that tweak so that I log on normally again (i.e., with password entry required) at boot-up.

2. Created Reset.cmd from Within an Elevated Command Prompt

I created a new reset.cmd batch file exactly as described on Aaron Stebner's blog here by launching Notepad from within an elevated command prompt and then saving reset.cmd in C:\Windows\System32 (i.e., in the same directory as the command prompt executable cmd.exe).

In the past I always just opened Notepad from my Start menu and saved the reset.cmd file on my Desktop (C:\Users\Lori\Desktop) but running reset.cmd from within an elevated prompt apparently doesn't work if reset.cmd is saved on the Desktop.



I'll run a few more tests today but I think you've resolved all my problems. Let me know if there's any final scans you'd like me to post before we close this thread.

--------
Vista Home Premium 32-bit SP2 * IE 8 * Firefox 3.6.13 NIS 2011 v. 18.5 * NU 14.5 * MBAM v. 1.50
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS
--------

Edited by lmacri, 24 February 2011 - 09:52 AM.

[CatByte]

That's great news, glad it worked out well.

All we need to do is clean up the tools now as there is no remaining malware.

You might want to give the machine a defrag as well.


I'll give you my usual cleanup routine:


please do the following:



You can delete the DDS and GMER logs and programs from your desktop.


NEXT

Follow these steps to uninstall Combofix

• Make sure your security programs are totally disabled.
• Click START then RUN
• Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

NEXT


Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe.
  
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  
  
• Download TFC to your desktop
  
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
  It's normal after running TFC cleaner that the PC will be slower to boot the first time.
  
  
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
  PC Safety and Security--What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you