[Closed] Computer freezes
#1
Posted 20 November 2009 - 07:27 PM
Register to Remove
#2
Posted 20 November 2009 - 08:01 PM
Proud Graduate of the WTT Classroom
#3
Posted 20 November 2009 - 08:31 PM
- I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for the issues on this machine.
- Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
- It's often worth reading through these instructions and printing them for ease of reference.
- If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
- Please reply to this thread. Do not start a new topic.
Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
- Double click on ComboFix.exe & follow the prompts.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
- Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
- Click on Yes, to continue scanning for malware.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Proud Graduate of the WTT Classroom
#4
Posted 20 November 2009 - 09:15 PM
ComboFix 09-11-20.02 - Desiree Meenan 11/20/2009 18:57.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.203 [GMT -8:00]
Running from: c:\documents and settings\Desiree Meenan\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\recycler\NPROTECT
c:\recycler\S-1-5-21-299502267-963894560-682003330-1003
c:\windows\patch.exe
.
((((((((((((((((((((((((( Files Created from 2009-10-21 to 2009-11-21 )))))))))))))))))))))))))))))))
.
2009-11-21 01:03 . 2009-11-21 01:03 -------- d-----w- c:\program files\ERUNT
2009-11-18 15:29 . 2009-11-18 15:29 -------- d-----w- c:\windows\system32\Adobe
2009-11-18 15:26 . 2009-11-18 15:26 -------- d-----w- c:\program files\Trend Micro
2009-11-02 01:36 . 2009-11-15 19:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-02 01:36 . 2009-11-02 02:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-21 03:05 . 2007-10-15 18:58 -------- d-----w- c:\program files\Greetings Workshop
2009-11-02 01:23 . 2009-07-11 02:25 -------- d-----w- c:\program files\Charter Security Suite
2009-11-02 01:15 . 2006-03-13 18:08 -------- d-----w- c:\program files\Google
2009-11-02 01:10 . 2007-06-03 02:59 -------- d-----w- c:\program files\The Learning Company
2009-10-28 23:09 . 2004-01-30 16:54 61840 -c--a-w- c:\documents and settings\Desiree Meenan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-28 23:04 . 2007-11-29 04:25 -------- d-----w- c:\program files\Best Buy Rhapsody
2009-10-28 23:01 . 2009-07-11 01:55 -------- d-----w- c:\documents and settings\All Users\Application Data\f-secure
2009-10-19 01:09 . 2009-10-19 01:09 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-09-11 14:18 . 2003-11-20 09:48 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2003-11-20 09:48 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2004-08-24 03:32 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2003-11-20 09:48 247326 ----a-w- c:\windows\system32\strmdll.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2003-11-20 77824]
"CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2003-06-03 496640]
c:\documents and settings\Desiree Meenan\Start Menu\Programs\Startup\
Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1997-9-3 50688]
PowerReg Scheduler.exe [2007-6-17 189952]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
D-Link AirPlus G Configuration Utility.lnk - c:\program files\D-Link AirPlus G\AirPlus.exe [2007-5-17 294912]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-9-7 724992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
2003-10-31 19:01 8704 ----a-w- c:\windows\system32\PCANotify.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\CA\\eTrust Antivirus\\InoNmSrv.exe"=
"c:\\Program Files\\Symantec\\pcAnywhere\\Winaw32.exe"=
"c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"=
"c:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 CA_LIC_CLNT;CA License Client;c:\program files\CA\SharedComponents\CA_LIC\lic98rmt.exe [7/11/2005 10:16 AM 126976]
R2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [7/11/2005 10:16 AM 53248]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [2/1/2005 8:10 AM 2944]
S3 brparimg;Brother Multi Function Parallel Image driver;c:\windows\system32\drivers\BrParImg.sys [1/11/2006 7:50 AM 3168]
S3 BrParWdm;Brother WDM Parallel Driver;c:\windows\system32\drivers\BrParwdm.sys [1/11/2006 7:50 AM 39552]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [3/13/2003 4:04 PM 61952]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\drivers\BrUsbMdm.sys [2/1/2005 8:10 AM 11008]
S3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\drivers\BrUsbScn.sys [2/1/2005 8:09 AM 10368]
S3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver;c:\windows\system32\drivers\m4301A.sys [12/27/2004 11:06 AM 83552]
--- Other Services/Drivers In Memory ---
*Deregistered* - IPVNMon
.
Contents of the 'Scheduled Tasks' folder
2009-11-17 c:\windows\Tasks\Duross Construction 1097526202.job
- c:\program files\Intuit\QuickBooks Premier - Contractor Edition\AutoBackupEXE.exe [2005-02-23 22:27]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fptb-msgr
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Search - ?p=ZJxdm025SHUS
Trusted Zone: musicmatch.com\online
TCP: {0A33B48B-3810-495E-B45D-EFDFA6C270B8} = 24.205.192.61
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CA11EB7C-1C85-4577-8A49-9E28EFB30184} - hxxp://www.umediaserver.net/bin/UMediaControl4.cab
.
- - - - ORPHANS REMOVED - - - -
BHO-{18597442-c73f-43b3-bf40-76ed057ede97} - (no file)
HKU-Default-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 19:05
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2976)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
.
**************************************************************************
.
Completion time: 2009-11-20 19:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-21 03:09
Pre-Run: 109,401,280,512 bytes free
Post-Run: 109,675,872,256 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - 4B2742901BB81C7D75BD98796F64D348
I'll now check and see if there is any difference in how it runs and report back. Thanks again.
#5
Posted 20 November 2009 - 09:35 PM
#6
Posted 20 November 2009 - 11:00 PM
SPYBOT TEATIMER
- Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
- On the left hand side, click on Tools, then click on the Resident Icon in the list.
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- Click on the "System Startup" icon in the List
- Uncheck the "TeaTimer" box and "OK" any prompts.
- If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
- Exit Spybot S&D when done.
- (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]
Flush DNS
- Now go to Start > Run > type: cmd
- Press OK or Hit Enter.
- At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between ..g /f it needs to be there)
- Hit Enter.
- You will get a confirmation that the flush was successful.
- Close the command box.
Scanning with MalwareBytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.
- Double-click mbam-setup.exe and follow the prompts to install the program.
- At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform quick scan, then click Scan.
- When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected.
- When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Re-Scanning with DDS
Please re-run DDS by sUBs.
Make sure to pay attention to the directions below:
- Disable any script blocking protection (How to Disable your Security Programs)
- Double click DDS icon to run the tool (may take up to 3 minutes to run)
- When done, DDS.txt will open.
- After a few moments, attach.txt will open in a second window.
- Save both reports to your desktop.
- Post the contents of the DDS.txt report in your next reply
- Attach the Attach.txt report to your post by doing the following:
- Under the reply panel is the Attachments Panel
- Browse for the attachment file you want to upload, then click the green Upload button
- Once it has uploaded, click the Manage Current Attachments drop down box
- Click on to insert the attachment into your post
1. The log that was produced after running MalwareBytes' Anti-Malware
2. The logs that were produced after running DDS.
Proud Graduate of the WTT Classroom
#7
Posted 20 November 2009 - 11:43 PM
Attached Files
#8
Posted 21 November 2009 - 06:37 PM
- Now go to Start > Run > type: cmd
- Press OK or Hit Enter.
- At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
- Hit Enter.
- You will get a confirmation that the flush was successful.
- Close the command box.
I'd like us to scan your machine with ESET OnlineScan
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
- Check
- Click the button.
- Accept any security warnings from your browser.
- Check
- Make sure that the option "Remove found threats" is Unchecked
- Push the Start button.
- ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time. - When the scan completes, push
- Push , and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply. - Push the button.
- Push
1. The log that was produced after running ESET Online Scanner.
2. An update on how your computer is currently running.
Proud Graduate of the WTT Classroom
#9
Posted 21 November 2009 - 11:09 PM
#10
Posted 22 November 2009 - 01:16 PM
Download OTS to your Desktop
- Double-click on OTS.exe to start the program. Make sure you close all other programs.
- Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
- When the scan is complete Notepad will open with the report file loaded in it.
- Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
- Click Add Reply
- Under the reply panel is the Attachments Panel
- Browse for the attachment file you want to upload, then click the green Upload button
- Once it has uploaded, click the Manage Current Attachments drop down box
- Click on to insert the attachment into your post
Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way.
Proud Graduate of the WTT Classroom
Register to Remove
#11
Posted 25 November 2009 - 02:06 PM
It's been several days since I last posted instructions for you to complete. Do you still require assistance in getting your computer cleaned up?
Thanks,
SweetTech.
Proud Graduate of the WTT Classroom
#13
Posted 25 November 2009 - 11:11 PM
OTS logfile created on: 11/25/2009 8:13:50 PM - Run 1 OTS by OldTimer - Version 3.1.7.0 Folder = C:\Documents and Settings\Desiree Meenan\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 447.48 Mb Total Physical Memory | 264.13 Mb Available Physical Memory | 59.02% Memory free 1.03 Gb Paging File | 0.78 Gb Available in Paging File | 75.58% Paging File free Paging file location(s): C:\pagefile.sys 672 1344 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 111.79 Gb Total Space | 101.29 Gb Free Space | 90.61% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PATTYM Current User Name: Desiree Meenan Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days [Processes - Safe List] ots.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\OTS.exe -> [2009/11/25 20:13:01 | 00,526,848 | ---- | M] (OldTimer Tools) ashdisp.exe -> C:\Program Files\Alwil Software\Avast4\ashDisp.exe -> [2009/09/15 03:56:48 | 00,081,000 | ---- | M] (ALWIL Software) ashserv.exe -> C:\Program Files\Alwil Software\Avast4\ashServ.exe -> [2009/09/15 03:56:43 | 00,138,680 | ---- | M] (ALWIL Software) ashmaisv.exe -> C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -> [2009/09/15 03:56:28 | 00,254,040 | ---- | M] (ALWIL Software) ashwebsv.exe -> C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -> [2009/09/15 03:54:13 | 00,352,920 | ---- | M] (ALWIL Software) aswupdsv.exe -> C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -> [2009/09/15 03:49:40 | 00,018,752 | ---- | M] (ALWIL Software) wmiprvse.exe -> C:\WINDOWS\system32\wbem\wmiprvse.exe -> [2009/02/06 02:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 16:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) lic98rmt.exe -> C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe -> [2005/07/11 10:16:00 | 00,126,976 | ---- | M] (Computer Associates International Inc.) logwatnt.exe -> C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe -> [2005/07/11 10:16:00 | 00,053,248 | ---- | M] (Computer Associates) airplus.exe -> C:\Program Files\D-Link AirPlus G\AIRPLUS.exe -> [2004/01/06 20:19:38 | 00,294,912 | ---- | M] (D-Link) qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> [2003/11/20 03:29:37 | 00,077,824 | ---- | M] (Apple Computer, Inc.) acsd.exe -> C:\Program Files\Common Files\AOL\ACS\acsd.exe -> [2003/08/06 16:58:26 | 01,376,360 | ---- | M] (America Online, Inc.) zhotkey.exe -> C:\WINDOWS\zHotkey.exe -> [2003/06/03 11:01:32 | 00,496,640 | ---- | M] (Chicony) slserv.exe -> C:\WINDOWS\system32\slserv.exe -> [2003/01/17 01:02:00 | 00,045,056 | ---- | M] ( ) wanmpsvc.exe -> C:\WINDOWS\wanmpsvc.exe -> [2003/01/10 17:13:04 | 00,065,536 | ---- | M] (America Online, Inc.) gwremind.exe -> C:\Program Files\Greetings Workshop\GWREMIND.EXE -> [1997/09/03 23:00:00 | 00,050,688 | ---- | M] (Microsoft Corporation) [Modules - Safe List] ots.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\OTS.exe -> [2009/11/25 20:13:01 | 00,526,848 | ---- | M] (OldTimer Tools) comctl32.dll -> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll -> [2008/04/13 16:12:51 | 01,054,208 | ---- | M] (Microsoft Corporation) framedyn.dll -> C:\WINDOWS\system32\wbem\framedyn.dll -> [2008/04/13 16:11:53 | 00,185,344 | ---- | M] (Microsoft Corporation) serwvdrv.dll -> C:\WINDOWS\system32\serwvdrv.dll -> [2003/03/31 04:00:00 | 00,014,848 | ---- | M] (Microsoft Corporation) umdmxfrm.dll -> C:\WINDOWS\system32\umdmxfrm.dll -> [2003/03/31 04:00:00 | 00,013,312 | ---- | M] (Microsoft Corporation) [Win32 Services - Safe List] (avast! Antivirus) avast! Antivirus [Auto | Running] -> C:\Program Files\Alwil Software\Avast4\ashServ.exe -> [2009/09/15 03:56:43 | 00,138,680 | ---- | M] (ALWIL Software) (avast! Mail Scanner) avast! Mail Scanner [On_Demand | Running] -> C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -> [2009/09/15 03:56:28 | 00,254,040 | ---- | M] (ALWIL Software) (avast! Web Scanner) avast! Web Scanner [On_Demand | Running] -> C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -> [2009/09/15 03:54:13 | 00,352,920 | ---- | M] (ALWIL Software) (aswUpdSv) avast! iAVS4 Control Service [Auto | Running] -> C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -> [2009/09/15 03:49:40 | 00,018,752 | ---- | M] (ALWIL Software) (helpsvc) Help and Support [Auto | Running] -> C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2008/04/13 16:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) (WMPNetworkSvc) Windows Media Player Network Sharing Service [On_Demand | Stopped] -> C:\Program Files\Windows Media Player\WMPNetwk.exe -> [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) (CA_LIC_CLNT) CA License Client [Auto | Running] -> C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe -> [2005/07/11 10:16:00 | 00,126,976 | ---- | M] (Computer Associates International Inc.) (LogWatch) Event Log Watch [Auto | Running] -> C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe -> [2005/07/11 10:16:00 | 00,053,248 | ---- | M] (Computer Associates) (Pml Driver HPZ12) Pml Driver HPZ12 [On_Demand | Stopped] -> C:\WINDOWS\system32\HPZipm12.exe -> [2004/09/29 12:14:36 | 00,069,632 | ---- | M] (HP) (aspnet_state) ASP.NET State Service [On_Demand | Stopped] -> C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -> [2004/07/15 00:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) (awhost32) pcAnywhere Host Service [On_Demand | Stopped] -> C:\Program Files\Symantec\pcAnywhere\awhost32.exe -> [2003/10/31 11:01:00 | 00,106,496 | ---- | M] (Symantec Corporation) (AOL ACS) AOL Connectivity Service [Auto | Running] -> C:\Program Files\Common Files\AOL\ACS\acsd.exe -> [2003/08/06 16:58:26 | 01,376,360 | ---- | M] (America Online, Inc.) (SLService) SmartLinkService [Auto | Running] -> C:\WINDOWS\System32\slserv.exe -> [2003/01/17 01:02:00 | 00,045,056 | ---- | M] ( ) (WANMiniportService) WAN Miniport (ATW) Service [Auto | Running] -> C:\WINDOWS\wanmpsvc.exe -> [2003/01/10 17:13:04 | 00,065,536 | ---- | M] (America Online, Inc.) [Driver Services - Safe List] (aswMon2) avast! Standard Shield Support [File_System | Auto | Running] -> C:\WINDOWS\system32\drivers\aswmon2.sys -> [2009/09/15 03:56:14 | 00,094,160 | ---- | M] (ALWIL Software) (aswSP) avast! Self Protection [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\aswSP.sys -> [2009/09/15 03:55:30 | 00,114,768 | ---- | M] (ALWIL Software) (aswFsBlk) aswFsBlk [File_System | Auto | Running] -> C:\WINDOWS\system32\drivers\aswFsBlk.sys -> [2009/09/15 03:55:19 | 00,020,560 | ---- | M] (ALWIL Software) (aswTdi) avast! Network Shield Support [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\aswTdi.sys -> [2009/09/15 03:54:30 | 00,052,368 | ---- | M] (ALWIL Software) (aswRdr) aswRdr [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\aswRdr.sys -> [2009/09/15 03:54:21 | 00,023,152 | ---- | M] (ALWIL Software) (Aavmker4) avast! Asynchronous Virus Monitor [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\aavmker4.sys -> [2009/09/15 03:53:24 | 00,027,408 | ---- | M] (ALWIL Software) (mf) mf [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\mf.sys -> [2008/04/13 10:36:41 | 00,063,744 | ---- | M] (Microsoft Corporation) (MCSTRM) MCSTRM [Kernel | Auto | Running] -> C:\WINDOWS\system32\drivers\mcstrm.sys -> [2007/11/28 20:35:26 | 00,008,413 | ---- | M] (RealNetworks, Inc.) (Secdrv) Secdrv [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\secdrv.sys -> [2007/11/13 02:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) (SymEvent) SymEvent [Kernel | On_Demand | Stopped] -> C:\Program Files\Symantec\SYMEVENT.SYS -> [2005/05/13 18:50:10 | 00,123,488 | ---- | M] (Symantec Corporation) (HPZius12) USB to IEEE-1284.4 Translation Driver HPZius12 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\HPZius12.sys -> [2004/10/04 15:26:08 | 00,021,744 | R--- | M] (HP) (HPZipr12) Print Class Driver for IEEE-1284.4 HPZipr12 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\HPZipr12.sys -> [2004/10/04 15:26:04 | 00,016,496 | R--- | M] (HP) (HPZid412) IEEE-1284.4 Driver HPZid412 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\HPZid412.sys -> [2004/10/04 15:26:03 | 00,051,120 | R--- | M] (HP) (RecAgent) RecAgent [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\recagent.sys -> [2004/08/03 22:41:40 | 00,013,776 | ---- | M] (Smart Link) (W8100PCI) D-Link AirPlus G Wireless Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\MRV8K51.sys -> [2004/01/08 19:46:18 | 00,297,984 | R--- | M] (Marvell Semiconductor, Inc) (AW_HOST) AW_HOST [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\AW_HOST5.sys -> [2003/10/24 09:53:08 | 00,016,984 | ---- | M] (Symantec Corporation) (viagfx) viagfx [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\vtmini.sys -> [2003/10/16 15:19:40 | 00,117,760 | ---- | M] (Copyright (C) VIA/S3 Graphics, Inc.) (FETNDISB) VIA Rhine Family Fast Ethernet Adapter Driver Service [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\fetnd5b.sys -> [2003/09/04 10:37:04 | 00,041,984 | ---- | M] (VIA Technologies, Inc. ) (ALCXWDM) Service for Realtek AC97 Audio (WDM) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\ALCXWDM.SYS -> [2003/08/21 16:31:52 | 00,462,940 | ---- | M] (Realtek Semiconductor Corp.) (ALCXSENS) Service for WDM 3D Audio Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\ALCXSENS.SYS -> [2003/08/14 23:16:38 | 00,404,736 | ---- | M] (Sensaura Ltd) (m4301a) Linksys Wireless-B USB Network Adapter v4.0 Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\m4301A.sys -> [2003/08/04 23:07:00 | 00,083,552 | R--- | M] (ALinx Corporation) (viaagp1) VIA AGP Filter [Kernel | Boot | Running] -> C:\WINDOWS\System32\DRIVERS\viaagp1.sys -> [2003/07/02 04:42:00 | 00,027,904 | ---- | M] (VIA Technologies, Inc.) (FVNETusb) Linksys Wireless-B USB Network Adapter v2.8 Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\vnet558x.sys -> [2003/06/12 01:56:44 | 00,098,304 | R--- | M] (ATMEL) (Gernuwa) Gernuwa [Kernel | Boot | Running] -> C:\WINDOWS\system32\drivers\GERNUWA.sys -> [2003/04/21 13:00:32 | 00,013,898 | R--- | M] (Symantec Corporation) (Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\ptilink.sys -> [2003/03/31 04:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) (ROOTMODEM) Microsoft Legacy Modem Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\rootmdm.sys -> [2003/03/31 04:00:00 | 00,005,888 | ---- | M] (Microsoft Corporation) (BrSerWDM) Brother WDM Serial driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\BrSerWdm.sys -> [2003/03/13 16:04:20 | 00,061,952 | ---- | M] (Brother Industries Ltd.) (Mtlstrm) Mtlstrm [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\mtlstrm.sys -> [2003/02/16 16:33:00 | 01,293,192 | ---- | M] ( ) (SlNtHal) SlNtHal [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\slnthal.sys -> [2003/02/16 15:12:00 | 00,085,520 | ---- | M] ( ) (Slntamr) SmartLink AMR_PCI Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\slntamr.sys -> [2003/02/16 15:11:00 | 00,516,616 | ---- | M] ( ) (Mtlmnt5) Mtlmnt5 [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\mtlmnt5.sys -> [2003/02/16 15:08:00 | 00,210,128 | ---- | M] ( ) (NtMtlFax) NtMtlFax [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\ntmtlfax.sys -> [2003/02/05 16:25:00 | 00,162,136 | ---- | M] ( ) (SlWdmSup) SlWdmSup [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\slwdmsup.sys -> [2003/01/17 00:19:00 | 00,039,348 | ---- | M] (Vireo Software) (wanatw) WAN Miniport (ATW) [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\wanatw4.sys -> [2003/01/10 17:13:04 | 00,033,588 | ---- | M] (America Online, Inc.) (StillCam) Still Serial Digital Camera Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\serscan.sys -> [2001/08/17 13:53:32 | 00,006,784 | ---- | M] (Microsoft Corporation) (brparimg) Brother Multi Function Parallel Image driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\BrParImg.sys -> [2001/08/17 13:12:24 | 00,003,168 | ---- | M] (Brother Industries Ltd.) (BrUsbScn) Brother MFC USB Scanner driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\BrUsbScn.sys -> [2001/08/17 13:12:22 | 00,010,368 | ---- | M] (Brother Industries Ltd.) (BrUsbMdm) Brother MFC USB Fax Only Modem [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\BrUsbMdm.sys -> [2001/08/17 13:12:20 | 00,011,008 | ---- | M] (Brother Industries Ltd.) (BrParWdm) Brother WDM Parallel Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\BrParwdm.sys -> [2001/08/17 13:12:18 | 00,039,552 | ---- | M] (Brother Industries Ltd.) (brfilt) Brother MFC Filter Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\system32\drivers\BrFilt.sys -> [2001/08/17 13:12:12 | 00,002,944 | ---- | M] (Brother Industries Ltd.) (MODEMCSA) Unimodem Streaming Filter Device [Kernel | On_Demand | Running] -> C:\WINDOWS\system32\drivers\MODEMCSA.sys -> [2001/08/17 05:57:38 | 00,016,128 | ---- | M] (Microsoft Corporation) [Registry - Safe List] < Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" -> [binary data] -> HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> HKEY_LOCAL_MACHINE\: Search\\"CustomSearch" -> http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html -> HKEY_LOCAL_MACHINE\: Search\\"Default_Search_URL" -> http://www.google.com/ie -> HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm -> < Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> HKEY_CURRENT_USER\: Main\\"Search Page" -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> HKEY_CURRENT_USER\: Main\\"SearchMigratedDefaultName" -> Google -> HKEY_CURRENT_USER\: Main\\"SearchMigratedDefaultURL" -> http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 -> HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.yahoo.com/?fr=fptb-msgr -> HKEY_CURRENT_USER\: SearchURL\\"" -> http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com -> HKEY_CURRENT_USER\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/07/28 02:47:40 | 00,882,416 | ---- | M] (Yahoo! Inc.) HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> HKEY_CURRENT_USER\: "ProxyOverride" -> 127.0.0.1 -> < FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla HKLM\software\mozilla\CompuServe 7.0\Extensions -> -> HKLM\software\mozilla\CompuServe 7.0\Extensions\\ -> -> HKLM\software\mozilla\CompuServe 7.0\Extensions\\Components -> C:\Program Files\Common Files\csshare\plugins0942 [C:\PROGRAM FILES\COMMON FILES\CSSHARE\PLUGINS0942] -> [2009/11/18 07:29:57 | 00,000,000 | ---D | M] HKLM\software\mozilla\CompuServe 7.0\Extensions\\Plugins -> C:\Program Files\Common Files\csshare\plugins0942 [C:\PROGRAM FILES\COMMON FILES\CSSHARE\PLUGINS0942] -> [2009/11/18 07:29:57 | 00,000,000 | ---D | M] HKLM\software\mozilla\Firefox\Extensions -> -> < FireFox Extensions [User Folders] > -> < HOSTS File > (27 bytes and 1 lines) -> C:\WINDOWS\system32\drivers\etc\hosts -> Reset Hosts 127.0.0.1 localhost < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> {02478D38-C3F9-4efb-9B51-7695ECA05670} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [&Yahoo! Toolbar Helper] -> [2008/07/28 02:47:40 | 00,882,416 | ---- | M] (Yahoo! Inc.) {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] -> [2006/01/12 19:38:22 | 00,063,128 | ---- | M] (Adobe Systems Incorporated) {18597442-c73f-43b3-bf40-76ed057ede97} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found {35E78239-811E-4c3f-B37D-F339AC16C2C0} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found {53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2009/01/26 15:31:02 | 01,879,896 | ---- | M] (Safer Networking Limited) {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [SingleInstance Class] -> [2008/07/28 02:47:42 | 00,160,496 | ---- | M] (Yahoo! Inc) {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found < Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/07/28 02:47:40 | 00,882,416 | ---- | M] (Yahoo! Inc.) < Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> ShellBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found WebBrowser\\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2008/07/28 02:47:40 | 00,882,416 | ---- | M] (Yahoo! Inc.) WebBrowser\\"{FE6BC4EF-5676-484B-88AE-883323913256}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found < Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "avast!" -> C:\Program Files\Alwil Software\Avast4\ashDisp.exe [C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] -> [2009/09/15 03:56:48 | 00,081,000 | ---- | M] (ALWIL Software) "CHotkey" -> C:\WINDOWS\zHotkey.exe [zHotkey.exe] -> [2003/06/03 11:01:32 | 00,496,640 | ---- | M] (Chicony) "QuickTime Task" -> C:\Program Files\QuickTime\qttask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> [2003/11/20 03:29:37 | 00,077,824 | ---- | M] (Apple Computer, Inc.) < Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "Messenger (Yahoo!)" -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe ["C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet] -> [2009/03/18 17:50:30 | 04,363,504 | ---- | M] (Yahoo! Inc.) < All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk -> C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe -> [2005/09/23 21:05:26 | 00,029,696 | ---- | M] (Adobe Systems Incorporated) C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus G Configuration Utility.lnk -> C:\Program Files\D-Link AirPlus G\AIRPLUS.exe -> [2004/01/06 20:19:38 | 00,294,912 | ---- | M] (D-Link) C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE -> [1999/02/17 12:05:56 | 00,065,588 | ---- | M] (Microsoft Corporation) C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk -> C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe -> [2005/02/15 15:26:20 | 00,724,992 | ---- | M] (Intuit, Inc.) < Desiree Meenan Startup Folder > -> C:\Documents and Settings\Desiree Meenan\Start Menu\Programs\Startup -> C:\Documents and Settings\Desiree Meenan\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk -> C:\Program Files\Greetings Workshop\GWREMIND.EXE -> [1997/09/03 23:00:00 | 00,050,688 | ---- | M] (Microsoft Corporation) -> C:\Documents and Settings\Desiree Meenan\Start Menu\Programs\Startup\PowerReg Scheduler.exe -> [2007/06/17 22:33:46 | 00,189,952 | ---- | M] () < Software Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer -> < CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"HonorAutoRunSetting" -> [1] -> File not found \\"NoDriveAutoRun" -> [67108863] -> File not found \\"NoDriveTypeAutoRun" -> [323] -> File not found \\"NoDrives" -> [0] -> File not found < CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System \\"dontdisplaylastusername" -> [0] -> File not found \\"legalnoticecaption" -> [] -> File not found \\"legalnoticetext" -> [] -> File not found \\"shutdownwithoutlogon" -> [1] -> File not found \\"undockwithoutlogon" -> [1] -> File not found \\"DisableRegistryTools" -> [0] -> File not found < CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer \\"NoDriveTypeAutoRun" -> [323] -> File not found \\"NoDriveAutoRun" -> [67108863] -> File not found \\"NoDrives" -> [0] -> File not found < CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> < Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> &Search -> [?p=ZJxdm025SHUS] -> File not found < Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search & Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | ---- | M] (Safer Networking Limited) {e2e2dd38-d088-4134-82b7-f2ba38496583}:Exec [HKLM] -> C:\WINDOWS\network diagnostic\xpnetdiag.exe [Menu: @xpsp3res.dll,-20001] -> [2008/04/13 10:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2008/04/13 16:12:28 | 01,695,232 | -HS- | M] (Microsoft Corporation) {FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2008/04/13 16:12:28 | 01,695,232 | -HS- | M] (Microsoft Corporation) < Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> CmdMapping\\"{2499216C-4BA5-11D5-BD9C-000103C116D5}" [HKLM] -> [Reg Error: Key error.] -> File not found CmdMapping\\"{4528BBE0-4E08-11D5-AD55-00010333D0AD}" [HKLM] -> [Reg Error: Key error.] -> File not found CmdMapping\\"{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}" [HKLM] -> [Reg Error: Value error.] -> File not found CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2008/04/13 16:12:28 | 01,695,232 | -HS- | M] (Microsoft Corporation) < Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> < Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix "" -> http:// < Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 2 domain(s) found. -> online_musicmatch.com [https] -> Trusted sites -> 2 domain(s) and sub-domain(s) not assigned to a zone. < Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> .[msn] -> My Computer -> < Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} [HKLM] -> http://www.musicnotes.com/download/mnviewer.cab [Musicnotes Viewer] -> {166B1BCA-3F9C-11CF-8075-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Shockwave ActiveX Control] -> {17492023-C23A-453E-A040-C7C580BBF700} [HKLM] -> http://go.microsoft.com/fwlink/?linkid=39204 [Windows Genuine Advantage Validation Tool] -> {3DCEC959-378A-4922-AD7E-FD5C925D927F} [HKLM] -> http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab [Disney Online Games ActiveX Control] -> {7530BFB8-7293-4D34-9923-61A11451AFC5} [HKLM] -> http://download.eset.com/special/eos/OnlineScanner.cab [Reg Error: Key error.] -> {A4639D2F-774E-11D3-A490-00C04F6843FB} [HKLM] -> http://download.microsoft.com/download/PowerPoint2002/Install/10.0.2609/WIN98MeXP/EN-US/msorun.cab [IEAnimBehaviorFactory Class] -> {CA11EB7C-1C85-4577-8A49-9E28EFB30184} [HKLM] -> http://www.umediaserver.net/bin/UMediaControl4.cab [UMediaPlayer Class] -> {D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> Microsoft XML Parser for Java [HKLM] -> file://C:\WINDOWS\Java\classes\xmldso.cab [Reg Error: Key error.] -> < Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> DhcpNameServer -> 192.168.0.1 -> < Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> {0A33B48B-3810-495E-B45D-EFDFA6C270B8}\\NameServer -> 24.205.192.61 (Linksys Wireless-B USB Network Adapter v2.8) -> {0D4950E0-2622-4F3A-97C7-70D0110EA63E}\\DhcpNameServer -> 192.168.0.1 (D-Link AirPlus G DWL-G510 Wireless PCI Card) -> < Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> *Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> Explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 16:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) *MultiFile Done* -> -> < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> PCANotify -> C:\WINDOWS\System32\PCANotify.dll -> [2003/10/31 11:01:00 | 00,008,704 | ---- | M] (Symantec Corporation) < Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> "%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\network diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> [2008/04/13 10:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) "%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2008/04/13 16:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation) "C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0] -> File not found < Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> "%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\network diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000] -> [2008/04/13 10:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation) "%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2008/04/13 16:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation) "C:\Program Files\CA\eTrust Antivirus\InoNmSrv.exe" -> C:\Program Files\CA\eTrust Antivirus\InoNmSrv.exe [C:\Program Files\CA\eTrust Antivirus\InoNmSrv.exe:*:Enabled:eTrust Antivirus - Admin Server] -> [2004/09/16 10:42:54 | 00,356,624 | ---- | M] (Computer Associates International, Inc.) "C:\Program Files\Messenger\msmsgs.exe" -> C:\Program Files\Messenger\msmsgs.exe [C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> [2008/04/13 16:12:28 | 01,695,232 | -HS- | M] (Microsoft Corporation) "C:\Program Files\Symantec\pcAnywhere\awhost32.exe" -> C:\Program Files\Symantec\pcAnywhere\awhost32.exe [C:\Program Files\Symantec\pcAnywhere\awhost32.exe:*:Enabled:pcAnywhere Host Service] -> [2003/10/31 11:01:00 | 00,106,496 | ---- | M] (Symantec Corporation) "C:\Program Files\Symantec\pcAnywhere\awrem32.exe" -> C:\Program Files\Symantec\pcAnywhere\awrem32.exe [C:\Program Files\Symantec\pcAnywhere\awrem32.exe:*:Enabled:pcAnywhere Remote Service] -> [2003/05/29 11:00:00 | 00,114,688 | ---- | M] (Symantec Corporation) "C:\Program Files\Symantec\pcAnywhere\Winaw32.exe" -> C:\Program Files\Symantec\pcAnywhere\Winaw32.exe [C:\Program Files\Symantec\pcAnywhere\Winaw32.exe:*:Enabled:pcAnywhere Main Executable] -> [2003/10/31 11:01:00 | 00,704,512 | ---- | M] (Symantec Corporation) "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger] -> [2009/03/18 17:50:30 | 04,363,504 | ---- | M] (Yahoo! Inc.) < SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> "AlternateShell" -> cmd.exe -> < CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom -> "AutoRun" -> 1 -> "DisplayName" -> CD-ROM Driver -> "ImagePath" -> [System32\DRIVERS\cdrom.sys] -> File not found < Drives with AutoRun files > -> -> C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2003/11/20 03:00:28 | 00,000,000 | ---- | M] () < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> < Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> comfile [open] -> "%1" %* -> exefile [open] -> "%1" %* -> [Files/Folders - Created Within 30 Days] OTS.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\OTS.exe -> [2009/11/25 20:12:58 | 00,526,848 | ---- | C] (OldTimer Tools) aswRdr.sys -> C:\WINDOWS\System32\drivers\aswRdr.sys -> [2009/11/22 10:34:11 | 00,023,152 | ---- | C] (ALWIL Software) aswTdi.sys -> C:\WINDOWS\System32\drivers\aswTdi.sys -> [2009/11/22 10:34:10 | 00,052,368 | ---- | C] (ALWIL Software) aavmker4.sys -> C:\WINDOWS\System32\drivers\aavmker4.sys -> [2009/11/22 10:34:10 | 00,027,408 | ---- | C] (ALWIL Software) AvastSS.scr -> C:\WINDOWS\System32\AvastSS.scr -> [2009/11/22 10:34:08 | 00,097,480 | ---- | C] (ALWIL Software) aswSP.sys -> C:\WINDOWS\System32\drivers\aswSP.sys -> [2009/11/22 10:34:07 | 00,114,768 | ---- | C] (ALWIL Software) aswmon2.sys -> C:\WINDOWS\System32\drivers\aswmon2.sys -> [2009/11/22 10:34:07 | 00,094,160 | ---- | C] (ALWIL Software) aswmon.sys -> C:\WINDOWS\System32\drivers\aswmon.sys -> [2009/11/22 10:34:07 | 00,093,424 | ---- | C] (ALWIL Software) aswFsBlk.sys -> C:\WINDOWS\System32\drivers\aswFsBlk.sys -> [2009/11/22 10:34:07 | 00,020,560 | ---- | C] (ALWIL Software) aswBoot.exe -> C:\WINDOWS\System32\aswBoot.exe -> [2009/11/22 10:33:48 | 01,279,968 | ---- | C] (ALWIL Software) MFC71.dll -> C:\WINDOWS\System32\MFC71.dll -> [2009/11/22 10:33:48 | 01,060,864 | ---- | C] (Microsoft Corporation) Alwil Software -> C:\Program Files\Alwil Software -> [2009/11/22 10:33:46 | 00,000,000 | ---D | C] avast_home_setup.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\avast_home_setup.exe -> [2009/11/22 10:28:32 | 00,308,160 | ---- | C] (ALWIL Software) Malwarebytes -> C:\Documents and Settings\Desiree Meenan\Application Data\Malwarebytes -> [2009/11/20 21:29:39 | 00,000,000 | ---D | C] mbamswissarmy.sys -> C:\WINDOWS\System32\drivers\mbamswissarmy.sys -> [2009/11/20 21:29:33 | 00,038,224 | ---- | C] (Malwarebytes Corporation) mbam.sys -> C:\WINDOWS\System32\drivers\mbam.sys -> [2009/11/20 21:29:32 | 00,019,160 | ---- | C] (Malwarebytes Corporation) Malwarebytes -> C:\Documents and Settings\All Users\Application Data\Malwarebytes -> [2009/11/20 21:29:32 | 00,000,000 | ---D | C] Malwarebytes' Anti-Malware -> C:\Program Files\Malwarebytes' Anti-Malware -> [2009/11/20 21:29:31 | 00,000,000 | ---D | C] mbam-setup.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\mbam-setup.exe -> [2009/11/20 21:26:54 | 04,045,528 | ---- | C] (Malwarebytes Corporation ) cmdcons -> C:\cmdcons -> [2009/11/20 18:56:30 | 00,000,000 | RHSD | C] SWXCACLS.exe -> C:\WINDOWS\SWXCACLS.exe -> [2009/11/20 18:55:14 | 00,212,480 | ---- | C] (SteelWerX) SWREG.exe -> C:\WINDOWS\SWREG.exe -> [2009/11/20 18:55:14 | 00,161,792 | ---- | C] (SteelWerX) SWSC.exe -> C:\WINDOWS\SWSC.exe -> [2009/11/20 18:55:14 | 00,136,704 | ---- | C] (SteelWerX) NIRCMD.exe -> C:\WINDOWS\NIRCMD.exe -> [2009/11/20 18:55:14 | 00,031,232 | ---- | C] (NirSoft) Qoobox -> C:\Qoobox -> [2009/11/20 18:54:36 | 00,000,000 | ---D | C] RootRepeal.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\RootRepeal.exe -> [2009/11/20 17:11:11 | 00,472,064 | ---- | C] ( ) ERDNT -> C:\WINDOWS\ERDNT -> [2009/11/20 17:04:38 | 00,000,000 | ---D | C] ERUNT -> C:\Program Files\ERUNT -> [2009/11/20 17:03:52 | 00,000,000 | ---D | C] Adobe -> C:\WINDOWS\System32\Adobe -> [2009/11/18 07:29:35 | 00,000,000 | ---D | C] Trend Micro -> C:\Program Files\Trend Micro -> [2009/11/18 07:26:41 | 00,000,000 | ---D | C] Spybot - Search & Destroy -> C:\Program Files\Spybot - Search & Destroy -> [2009/11/01 17:36:17 | 00,000,000 | ---D | C] Spybot - Search & Destroy -> C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy -> [2009/11/01 17:36:17 | 00,000,000 | ---D | C] pss -> C:\WINDOWS\pss -> [2009/11/01 17:23:26 | 00,000,000 | ---D | C] slntamr.sys -> C:\WINDOWS\System32\drivers\slntamr.sys -> [2003/11/20 01:49:11 | 00,516,616 | ---- | C] ( ) slnthal.sys -> C:\WINDOWS\System32\drivers\slnthal.sys -> [2003/11/20 01:49:11 | 00,085,520 | ---- | C] ( ) mtlstrm.sys -> C:\WINDOWS\System32\drivers\mtlstrm.sys -> [2003/11/20 01:49:10 | 01,293,192 | ---- | C] ( ) mtlmnt5.sys -> C:\WINDOWS\System32\drivers\mtlmnt5.sys -> [2003/11/20 01:49:10 | 00,210,128 | ---- | C] ( ) ntmtlfax.sys -> C:\WINDOWS\System32\drivers\ntmtlfax.sys -> [2003/11/20 01:49:10 | 00,162,136 | ---- | C] ( ) winddx.sys -> C:\WINDOWS\System32\drivers\winddx.sys -> [2003/11/19 18:54:50 | 00,014,976 | ---- | C] ( ) 2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> [Files/Folders - Modified Within 30 Days] OTS.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\OTS.exe -> [2009/11/25 20:13:01 | 00,526,848 | ---- | M] (OldTimer Tools) wpa.dbl -> C:\WINDOWS\System32\wpa.dbl -> [2009/11/25 03:18:33 | 00,001,158 | ---- | M] () QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [2009/11/25 03:18:32 | 00,054,156 | -H-- | M] () SA.DAT -> C:\WINDOWS\tasks\SA.DAT -> [2009/11/25 03:18:14 | 00,000,006 | -H-- | M] () hiberfil.sys -> C:\hiberfil.sys -> [2009/11/25 03:18:00 | 46,929,1008 | -HS- | M] () bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2009/11/25 03:18:00 | 00,002,048 | --S- | M] () NTUSER.DAT -> C:\Documents and Settings\Desiree Meenan\NTUSER.DAT -> [2009/11/25 03:17:06 | 04,456,448 | -H-- | M] () ntuser.ini -> C:\Documents and Settings\Desiree Meenan\ntuser.ini -> [2009/11/25 03:17:06 | 00,000,278 | -HS- | M] () imsins.BAK -> C:\WINDOWS\imsins.BAK -> [2009/11/25 03:01:50 | 00,001,393 | ---- | M] () Duross Construction 1097526202.job -> C:\WINDOWS\tasks\Duross Construction 1097526202.job -> [2009/11/23 16:00:00 | 00,000,548 | -H-- | M] () Microsoft Word.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\Microsoft Word.lnk -> [2009/11/22 20:45:24 | 00,002,473 | ---- | M] () QTFont.for -> C:\WINDOWS\QTFont.for -> [2009/11/22 15:30:37 | 00,001,409 | ---- | M] () avast! Antivirus.lnk -> C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk -> [2009/11/22 10:34:11 | 00,001,743 | ---- | M] () CONFIG.NT -> C:\WINDOWS\System32\CONFIG.NT -> [2009/11/22 10:34:07 | 00,002,626 | ---- | M] () avast_home_setup.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\avast_home_setup.exe -> [2009/11/22 10:28:33 | 00,308,160 | ---- | M] (ALWIL Software) Tips for being cooler.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\Tips for being cooler.doc -> [2009/11/21 17:59:20 | 00,020,480 | ---- | M] () Malwarebytes' Anti-Malware.lnk -> C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/11/20 21:29:36 | 00,000,730 | ---- | M] () mbam-setup.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\mbam-setup.exe -> [2009/11/20 21:26:54 | 04,045,528 | ---- | M] (Malwarebytes Corporation ) system.ini -> C:\WINDOWS\system.ini -> [2009/11/20 19:05:10 | 00,000,271 | ---- | M] () hosts -> C:\WINDOWS\System32\drivers\etc\hosts -> [2009/11/20 19:05:03 | 00,000,027 | ---- | M] () boot.ini -> C:\boot.ini -> [2009/11/20 18:56:37 | 00,000,281 | RHS- | M] () ComboFix.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\ComboFix.exe -> [2009/11/20 18:54:11 | 03,570,958 | R--- | M] () settings.dat -> C:\Documents and Settings\Desiree Meenan\Desktop\settings.dat -> [2009/11/20 17:11:25 | 00,000,000 | ---- | M] () RootRepeal.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\RootRepeal.exe -> [2009/11/20 17:11:14 | 00,472,064 | ---- | M] ( ) dds.scr -> C:\Documents and Settings\Desiree Meenan\Desktop\dds.scr -> [2009/11/20 17:05:36 | 00,359,929 | ---- | M] () NTREGOPT.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\NTREGOPT.lnk -> [2009/11/20 17:03:53 | 00,000,645 | ---- | M] () ERUNT.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\ERUNT.lnk -> [2009/11/20 17:03:53 | 00,000,626 | ---- | M] () My eBay.url -> C:\Documents and Settings\Desiree Meenan\Desktop\My eBay.url -> [2009/11/18 17:06:07 | 00,000,826 | ---- | M] () IconCache.db -> C:\Documents and Settings\Desiree Meenan\Local Settings\Application Data\IconCache.db -> [2009/11/18 16:51:48 | 03,081,934 | -H-- | M] () Yahoo!.url -> C:\Documents and Settings\Desiree Meenan\Desktop\Yahoo!.url -> [2009/11/18 15:41:21 | 00,000,240 | ---- | M] () HijackThis.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\HijackThis.lnk -> [2009/11/18 07:26:42 | 00,001,768 | ---- | M] () PEV.exe -> C:\WINDOWS\PEV.exe -> [2009/11/14 01:47:57 | 00,260,608 | ---- | M] () yahoo answers.url -> C:\Documents and Settings\Desiree Meenan\Desktop\yahoo answers.url -> [2009/11/11 20:46:37 | 00,000,479 | ---- | M] () YouTube.url -> C:\Documents and Settings\Desiree Meenan\Desktop\YouTube.url -> [2009/11/11 19:45:07 | 00,001,062 | ---- | M] () FNTCACHE.DAT -> C:\WINDOWS\System32\FNTCACHE.DAT -> [2009/11/11 03:19:04 | 00,239,144 | ---- | M] () revolutionary war poster.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\revolutionary war poster.doc -> [2009/11/05 17:32:14 | 00,110,080 | ---- | M] () MRT.exe -> C:\WINDOWS\System32\MRT.exe -> [2009/11/05 09:36:21 | 26,768,832 | ---- | M] (Microsoft Corporation) SCARY STORY ROUGH DRAFT.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\SCARY STORY ROUGH DRAFT.doc -> [2009/11/01 22:04:54 | 00,064,000 | ---- | M] () wininit.ini -> C:\WINDOWS\wininit.ini -> [2009/11/01 18:22:59 | 00,000,405 | ---- | M] () hosts.20091101-182251.backup -> C:\WINDOWS\System32\drivers\etc\hosts.20091101-182251.backup -> [2009/11/01 18:22:51 | 00,001,231 | R--- | M] () Spybot - Search & Destroy.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\Spybot - Search & Destroy.lnk -> [2009/11/01 17:36:22 | 00,000,967 | ---- | M] () win.ini -> C:\WINDOWS\win.ini -> [2009/11/01 17:25:13 | 00,001,004 | ---- | M] () Boot.bak -> C:\Boot.bak -> [2009/11/01 17:25:13 | 00,000,211 | ---- | M] () PerfStringBackup.INI -> C:\WINDOWS\System32\PerfStringBackup.INI -> [2009/11/01 17:09:20 | 00,443,286 | ---- | M] () perfh009.dat -> C:\WINDOWS\System32\perfh009.dat -> [2009/11/01 17:09:20 | 00,382,966 | ---- | M] () perfc009.dat -> C:\WINDOWS\System32\perfc009.dat -> [2009/11/01 17:09:20 | 00,053,978 | ---- | M] () GDIPFONTCACHEV1.DAT -> C:\Documents and Settings\Desiree Meenan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT -> [2009/10/28 15:09:10 | 00,061,840 | ---- | M] () tzchange.exe -> C:\WINDOWS\System32\tzchange.exe -> [2009/10/28 07:07:15 | 00,046,080 | ---- | M] (Microsoft Corporation) ABC book.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\ABC book.doc -> [2009/10/28 04:47:42 | 00,147,456 | ---- | M] () 80 C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\*.tmp -> 2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> [Files - No Company Name] QTFont.qfn -> C:\WINDOWS\QTFont.qfn -> [2009/11/22 15:30:37 | 00,054,156 | -H-- | C] () QTFont.for -> C:\WINDOWS\QTFont.for -> [2009/11/22 15:30:37 | 00,001,409 | ---- | C] () avast! Antivirus.lnk -> C:\Documents and Settings\All Users\Desktop\avast! Antivirus.lnk -> [2009/11/22 10:34:11 | 00,001,743 | ---- | C] () actskin4.ocx -> C:\WINDOWS\System32\actskin4.ocx -> [2009/11/22 10:33:48 | 00,380,928 | ---- | C] () Tips for being cooler.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\Tips for being cooler.doc -> [2009/11/21 17:59:19 | 00,020,480 | ---- | C] () Malwarebytes' Anti-Malware.lnk -> C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/11/20 21:29:36 | 00,000,730 | ---- | C] () Boot.bak -> C:\Boot.bak -> [2009/11/20 18:56:37 | 00,000,211 | ---- | C] () cmldr -> C:\cmldr -> [2009/11/20 18:56:33 | 00,260,272 | ---- | C] () PEV.exe -> C:\WINDOWS\PEV.exe -> [2009/11/20 18:55:14 | 00,260,608 | ---- | C] () sed.exe -> C:\WINDOWS\sed.exe -> [2009/11/20 18:55:14 | 00,098,816 | ---- | C] () grep.exe -> C:\WINDOWS\grep.exe -> [2009/11/20 18:55:14 | 00,080,412 | ---- | C] () MBR.exe -> C:\WINDOWS\MBR.exe -> [2009/11/20 18:55:14 | 00,077,312 | ---- | C] () zip.exe -> C:\WINDOWS\zip.exe -> [2009/11/20 18:55:14 | 00,068,096 | ---- | C] () ComboFix.exe -> C:\Documents and Settings\Desiree Meenan\Desktop\ComboFix.exe -> [2009/11/20 18:54:11 | 03,570,958 | R--- | C] () settings.dat -> C:\Documents and Settings\Desiree Meenan\Desktop\settings.dat -> [2009/11/20 17:11:25 | 00,000,000 | ---- | C] () dds.scr -> C:\Documents and Settings\Desiree Meenan\Desktop\dds.scr -> [2009/11/20 17:05:33 | 00,359,929 | ---- | C] () NTREGOPT.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\NTREGOPT.lnk -> [2009/11/20 17:03:53 | 00,000,645 | ---- | C] () ERUNT.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\ERUNT.lnk -> [2009/11/20 17:03:53 | 00,000,626 | ---- | C] () HijackThis.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\HijackThis.lnk -> [2009/11/18 07:26:42 | 00,001,768 | ---- | C] () revolutionary war poster.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\revolutionary war poster.doc -> [2009/11/05 17:32:13 | 00,110,080 | ---- | C] () wininit.ini -> C:\WINDOWS\wininit.ini -> [2009/11/01 18:22:58 | 00,000,405 | ---- | C] () Spybot - Search & Destroy.lnk -> C:\Documents and Settings\Desiree Meenan\Desktop\Spybot - Search & Destroy.lnk -> [2009/11/01 17:36:22 | 00,000,967 | ---- | C] () SCARY STORY ROUGH DRAFT.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\SCARY STORY ROUGH DRAFT.doc -> [2009/10/28 16:15:49 | 00,064,000 | ---- | C] () ABC book.doc -> C:\Documents and Settings\Desiree Meenan\My Documents\ABC book.doc -> [2009/10/27 17:38:02 | 00,147,456 | ---- | C] () iyvu9_32.dll -> C:\WINDOWS\System32\iyvu9_32.dll -> [2008/03/14 11:47:45 | 00,056,832 | ---- | C] () QTW.INI -> C:\WINDOWS\QTW.INI -> [2007/07/18 12:11:38 | 00,000,305 | ---- | C] () TLCAPPS.INI -> C:\WINDOWS\TLCAPPS.INI -> [2007/06/02 18:59:13 | 00,000,229 | ---- | C] () SETUP32.INI -> C:\WINDOWS\SETUP32.INI -> [2007/06/02 18:58:54 | 00,000,000 | ---- | C] () cdplayer.ini -> C:\WINDOWS\cdplayer.ini -> [2006/07/28 09:23:23 | 00,000,879 | ---- | C] () HPGdiPlus.ini -> C:\WINDOWS\HPGdiPlus.ini -> [2006/06/26 06:15:48 | 00,000,206 | ---- | C] () liveup.ini -> C:\WINDOWS\liveup.ini -> [2006/03/17 13:21:42 | 00,000,044 | ---- | C] () hptcpmon.ini -> C:\WINDOWS\System32\hptcpmon.ini -> [2006/01/19 08:34:26 | 00,003,399 | R--- | C] () AddPort.ini -> C:\WINDOWS\System32\AddPort.ini -> [2006/01/19 08:34:26 | 00,000,136 | ---- | C] () hpntwksetup.ini -> C:\WINDOWS\hpntwksetup.ini -> [2006/01/19 08:34:13 | 00,000,700 | ---- | C] () Install.ini -> C:\WINDOWS\Install.ini -> [2005/09/14 10:53:06 | 00,000,028 | ---- | C] () BrmfBidi.ini -> C:\WINDOWS\BrmfBidi.ini -> [2005/02/01 08:10:08 | 00,002,183 | ---- | C] () YCRWin32.dll -> C:\WINDOWS\System32\YCRWin32.dll -> [2004/12/27 11:39:56 | 00,065,536 | ---- | C] () hpqEmlSz.INI -> C:\WINDOWS\hpqEmlSz.INI -> [2004/11/08 10:19:57 | 00,000,000 | ---- | C] () ODBC.INI -> C:\WINDOWS\ODBC.INI -> [2004/10/14 07:44:25 | 00,000,376 | ---- | C] () A6W.INI -> C:\WINDOWS\A6W.INI -> [2004/09/30 09:37:08 | 00,000,035 | ---- | C] () WORDPAD.INI -> C:\WINDOWS\WORDPAD.INI -> [2004/09/27 07:32:20 | 00,000,754 | ---- | C] () tx32.dll -> C:\WINDOWS\System32\tx32.dll -> [2004/09/07 08:20:04 | 00,375,296 | ---- | C] () Ic32.ini -> C:\WINDOWS\System32\Ic32.ini -> [2004/09/07 08:20:04 | 00,000,202 | ---- | C] () ntio412.sys -> C:\WINDOWS\System32\ntio412.sys -> [2004/05/17 14:43:09 | 00,035,424 | ---- | C] () ntio404.sys -> C:\WINDOWS\System32\ntio404.sys -> [2004/05/17 14:43:07 | 00,034,560 | ---- | C] () ntio804.sys -> C:\WINDOWS\System32\ntio804.sys -> [2004/05/17 14:43:06 | 00,034,560 | ---- | C] () ntio411.sys -> C:\WINDOWS\System32\ntio411.sys -> [2004/05/17 14:43:04 | 00,035,648 | ---- | C] () ntio.sys -> C:\WINDOWS\System32\ntio.sys -> [2004/05/17 14:43:02 | 00,033,840 | ---- | C] () smscfg.ini -> C:\WINDOWS\smscfg.ini -> [2003/11/20 04:00:12 | 00,000,061 | ---- | C] () psisdecd.dll -> C:\WINDOWS\System32\psisdecd.dll -> [2003/11/20 03:37:40 | 00,363,520 | ---- | C] () winamp.ini -> C:\WINDOWS\winamp.ini -> [2003/11/20 03:27:40 | 00,000,132 | ---- | C] () net2fone.ini -> C:\WINDOWS\net2fone.ini -> [2003/11/20 03:27:07 | 00,000,310 | ---- | C] () PIC.dll -> C:\WINDOWS\PIC.dll -> [2003/11/20 03:09:53 | 00,532,544 | ---- | C] () HKNTDLL.dll -> C:\WINDOWS\HKNTDLL.dll -> [2003/11/20 03:09:53 | 00,024,576 | ---- | C] () avrack.ini -> C:\WINDOWS\avrack.ini -> [2003/11/20 03:08:07 | 00,000,164 | ---- | C] () control.ini -> C:\WINDOWS\control.ini -> [2003/11/20 03:00:28 | 00,000,000 | ---- | C] () vbaddin.ini -> C:\WINDOWS\vbaddin.ini -> [2003/11/20 02:58:05 | 00,000,059 | ---- | C] () vb.ini -> C:\WINDOWS\vb.ini -> [2003/11/20 02:58:05 | 00,000,036 | ---- | C] () tslabels.ini -> C:\WINDOWS\System32\tslabels.ini -> [2003/11/20 02:57:18 | 00,013,223 | ---- | C] () msdtcprf.ini -> C:\WINDOWS\System32\msdtcprf.ini -> [2003/11/20 02:57:17 | 00,001,931 | ---- | C] () slextspk.dll -> C:\WINDOWS\System32\slextspk.dll -> [2003/11/20 01:49:11 | 00,188,416 | ---- | C] () SLGen.dll -> C:\WINDOWS\System32\SLGen.dll -> [2003/11/20 01:49:11 | 00,159,744 | ---- | C] () coinst.dll -> C:\WINDOWS\System32\coinst.dll -> [2003/11/20 01:49:10 | 00,049,152 | ---- | C] () oeminfo.ini -> C:\WINDOWS\System32\oeminfo.ini -> [2003/11/20 01:49:04 | 00,001,094 | ---- | C] () emver.ini -> C:\WINDOWS\System32\emver.ini -> [2003/11/20 01:49:04 | 00,000,468 | ---- | C] () win87em.dll -> C:\WINDOWS\System32\win87em.dll -> [2003/11/20 01:48:40 | 00,013,312 | ---- | C] () win.ini -> C:\WINDOWS\win.ini -> [2003/11/20 01:48:40 | 00,001,004 | ---- | C] () tcpmon.ini -> C:\WINDOWS\System32\tcpmon.ini -> [2003/11/20 01:48:37 | 00,053,478 | ---- | C] () tsd32.dll -> C:\WINDOWS\System32\tsd32.dll -> [2003/11/20 01:48:37 | 00,015,360 | ---- | C] () system.ini -> C:\WINDOWS\system.ini -> [2003/11/20 01:48:36 | 00,000,271 | ---- | C] () sbe.dll -> C:\WINDOWS\System32\sbe.dll -> [2003/11/20 01:48:31 | 00,270,848 | ---- | C] () rsvp.ini -> C:\WINDOWS\System32\rsvp.ini -> [2003/11/20 01:48:30 | 00,012,082 | ---- | C] () dxmasf.dll -> C:\WINDOWS\System32\dxmasf.dll -> [2003/11/20 01:48:29 | 00,498,742 | ---- | C] () rasctrs.ini -> C:\WINDOWS\System32\rasctrs.ini -> [2003/11/20 01:48:29 | 00,003,458 | ---- | C] () pschdprf.ini -> C:\WINDOWS\System32\pschdprf.ini -> [2003/11/20 01:48:28 | 00,006,877 | ---- | C] () perfci.ini -> C:\WINDOWS\System32\perfci.ini -> [2003/11/20 01:48:28 | 00,002,891 | ---- | C] () perfwci.ini -> C:\WINDOWS\System32\perfwci.ini -> [2003/11/20 01:48:28 | 00,002,732 | ---- | C] () perffilt.ini -> C:\WINDOWS\System32\perffilt.ini -> [2003/11/20 01:48:28 | 00,001,152 | ---- | C] () prodspec.ini -> C:\WINDOWS\System32\prodspec.ini -> [2003/11/20 01:48:28 | 00,000,343 | ---- | C] () ntdos411.sys -> C:\WINDOWS\System32\ntdos411.sys -> [2003/11/20 01:48:22 | 00,029,370 | ---- | C] () ntdos412.sys -> C:\WINDOWS\System32\ntdos412.sys -> [2003/11/20 01:48:22 | 00,029,274 | ---- | C] () ntdos804.sys -> C:\WINDOWS\System32\ntdos804.sys -> [2003/11/20 01:48:22 | 00,029,146 | ---- | C] () ntdos404.sys -> C:\WINDOWS\System32\ntdos404.sys -> [2003/11/20 01:48:22 | 00,029,146 | ---- | C] () ntdos.sys -> C:\WINDOWS\System32\ntdos.sys -> [2003/11/20 01:48:22 | 00,027,866 | ---- | C] () msencode.dll -> C:\WINDOWS\System32\msencode.dll -> [2003/11/20 01:48:16 | 00,094,282 | ---- | C] () msdxmlc.dll -> C:\WINDOWS\System32\msdxmlc.dll -> [2003/11/20 01:48:16 | 00,004,126 | ---- | C] () msdfmap.ini -> C:\WINDOWS\msdfmap.ini -> [2003/11/20 01:48:16 | 00,001,405 | ---- | C] () key01.sys -> C:\WINDOWS\System32\key01.sys -> [2003/11/20 01:48:09 | 00,042,809 | ---- | C] () keyboard.sys -> C:\WINDOWS\System32\keyboard.sys -> [2003/11/20 01:48:09 | 00,042,537 | ---- | C] () ir32_32.dll -> C:\WINDOWS\System32\ir32_32.dll -> [2003/11/20 01:48:08 | 00,199,168 | ---- | C] () himem.sys -> C:\WINDOWS\System32\himem.sys -> [2003/11/20 01:48:04 | 00,004,768 | ---- | C] () esentprf.ini -> C:\WINDOWS\System32\esentprf.ini -> [2003/11/20 01:48:01 | 01,015,477 | ---- | C] () encdec.dll -> C:\WINDOWS\System32\encdec.dll -> [2003/11/20 01:48:00 | 00,186,880 | ---- | C] () compatui.dll -> C:\WINDOWS\System32\compatui.dll -> [2003/11/20 01:47:46 | 00,252,928 | ---- | C] () country.sys -> C:\WINDOWS\System32\country.sys -> [2003/11/20 01:47:46 | 00,027,097 | ---- | C] () msjetoledb40.dll -> C:\WINDOWS\System32\msjetoledb40.dll -> [2003/11/20 01:47:44 | 00,355,112 | ---- | C] () ansi.sys -> C:\WINDOWS\System32\ansi.sys -> [2003/11/20 01:47:40 | 00,009,029 | ---- | C] () SLLights.dll -> C:\WINDOWS\System32\SLLights.dll -> [2003/11/19 18:54:50 | 00,466,944 | ---- | C] () amr_cpl.dll -> C:\WINDOWS\System32\amr_cpl.dll -> [2003/11/19 18:54:50 | 00,151,552 | ---- | C] () PerfStringBackup.INI -> C:\WINDOWS\System32\PerfStringBackup.INI -> [2003/11/19 18:53:39 | 00,443,286 | ---- | C] () ODBCINST.INI -> C:\WINDOWS\ODBCINST.INI -> [2003/11/19 18:53:38 | 00,004,161 | ---- | C] () patchw32.dll -> C:\WINDOWS\patchw32.dll -> [2003/07/14 11:30:28 | 00,197,120 | ---- | C] () quartz.dll -> C:\WINDOWS\System32\quartz.dll -> [2003/05/30 09:00:02 | 01,291,264 | ---- | C] () qdvd.dll -> C:\WINDOWS\System32\qdvd.dll -> [2003/05/30 09:00:02 | 00,386,048 | ---- | C] () devenum.dll -> C:\WINDOWS\System32\devenum.dll -> [2003/05/30 09:00:02 | 00,059,904 | ---- | C] () qedwipes.dll -> C:\WINDOWS\System32\qedwipes.dll -> [2002/12/12 00:14:32 | 00,733,696 | ---- | C] () qedit.dll -> C:\WINDOWS\System32\qedit.dll -> [2002/12/12 00:14:32 | 00,562,176 | ---- | C] () qdv.dll -> C:\WINDOWS\System32\qdv.dll -> [2002/12/12 00:14:32 | 00,279,040 | ---- | C] () qcap.dll -> C:\WINDOWS\System32\qcap.dll -> [2002/12/12 00:14:32 | 00,192,512 | ---- | C] () amstream.dll -> C:\WINDOWS\System32\amstream.dll -> [2002/12/12 00:14:32 | 00,070,656 | ---- | C] () mciqtz32.dll -> C:\WINDOWS\System32\mciqtz32.dll -> [2002/12/12 00:14:32 | 00,035,328 | ---- | C] () msdmo.dll -> C:\WINDOWS\System32\msdmo.dll -> [2002/12/12 00:14:32 | 00,014,336 | ---- | C] () paqsp.dll -> C:\WINDOWS\System32\paqsp.dll -> [2001/08/17 14:36:28 | 00,157,696 | ---- | C] () MSRTEDIT.DLL -> C:\WINDOWS\System32\MSRTEDIT.DLL -> [1999/01/22 10:46:58 | 00,065,536 | ---- | C] () [Alternate Data Streams] @Alternate Data Stream - 2628 bytes -> C:\WINDOWS\System32\OEMLOGO.BMP:Q30lsldxJoudresxAaaqpcawXc < End of report >
#14
Posted 26 November 2009 - 12:27 AM
Start OTS Copy/Paste the information inside the codebox below into the panel where it says "Paste fix here" and then click the Run Fix button.
[Kill All Processes] [Unregister Dlls] [Registry - Safe List] < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ YN -> {18597442-c73f-43b3-bf40-76ed057ede97} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> {35E78239-811E-4c3f-B37D-F339AC16C2C0} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] < Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ YN -> ShellBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> WebBrowser\\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> WebBrowser\\"{FE6BC4EF-5676-484B-88AE-883323913256}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] < Desiree Meenan Startup Folder > -> C:\Documents and Settings\Desiree Meenan\Start Menu\Programs\Startup YY -> ~EmptyValue -> C:\Documents and Settings\Desiree Meenan\Start Menu\Programs\Startup\PowerReg Scheduler.exe < Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ YN -> &Search -> [?p=ZJxdm025SHUS] < Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ YN -> CmdMapping\\"{2499216C-4BA5-11D5-BD9C-000103C116D5}" [HKLM] -> [Reg Error: Key error.] YN -> CmdMapping\\"{4528BBE0-4E08-11D5-AD55-00010333D0AD}" [HKLM] -> [Reg Error: Key error.] YN -> CmdMapping\\"{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}" [HKLM] -> [Reg Error: Value error.] < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ YN -> Microsoft XML Parser for Java [HKLM] -> file://C:\WINDOWS\Java\classes\xmldso.cab [Reg Error: Key error.] [Files/Folders - Created Within 30 Days] NY -> 2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp NY -> 14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp [Files/Folders - Modified Within 30 Days] NY -> 80 C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\*.tmp NY -> 2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp NY -> 14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp [Empty Temp Folders] [CreateRestorePoint] [Start Explorer]
The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.
If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.
Please make sure that you provide the log that was produced after running OTS as well as an update on how your computer is currently running.
Proud Graduate of the WTT Classroom
#15
Posted 26 November 2009 - 04:17 PM
Running OTS Fix
Well, so far it hasn't froze up! Here is the log:
All Processes Killed
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18597442-c73f-43b3-bf40-76ed057ede97}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18597442-c73f-43b3-bf40-76ed057ede97}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35E78239-811E-4c3f-B37D-F339AC16C2C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35E78239-811E-4c3f-B37D-F339AC16C2C0}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{FE6BC4EF-5676-484B-88AE-883323913256} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE6BC4EF-5676-484B-88AE-883323913256}\ not found.
C:\Documents and Settings\Desiree Meenan\Start Menu\Programs\Startup\PowerReg Scheduler.exe moved successfully.
File ~EmptyValue not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Search\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{2499216C-4BA5-11D5-BD9C-000103C116D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2499216C-4BA5-11D5-BD9C-000103C116D5}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{4528BBE0-4E08-11D5-AD55-00010333D0AD} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4528BBE0-4E08-11D5-AD55-00010333D0AD}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}\ not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\Contains\Files\ not found.
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\Microsoft XML Parser for Java\ not found.
[Files/Folders - Created Within 30 Days]
C:\WINDOWS\002242_.tmp deleted successfully.
C:\WINDOWS\005431_.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET11E.tmp deleted successfully.
C:\WINDOWS\System32\SET11F.tmp deleted successfully.
C:\WINDOWS\System32\SET120.tmp deleted successfully.
C:\WINDOWS\System32\SET121.tmp deleted successfully.
C:\WINDOWS\System32\SET122.tmp deleted successfully.
C:\WINDOWS\System32\SET125.tmp deleted successfully.
C:\WINDOWS\System32\SET126.tmp deleted successfully.
C:\WINDOWS\System32\SET127.tmp deleted successfully.
C:\WINDOWS\System32\SET128.tmp deleted successfully.
C:\WINDOWS\System32\SET129.tmp deleted successfully.
C:\WINDOWS\System32\SET12D.tmp deleted successfully.
C:\WINDOWS\System32\SET12F.tmp deleted successfully.
C:\WINDOWS\System32\setb11.tmp deleted successfully.
[Files/Folders - Modified Within 30 Days]
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\fla13.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF19BE.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF2AEB.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF3244.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF3251.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF32AB.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF32B8.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF3C0D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF4261.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF42C9.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF46F6.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF473D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF4E28.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF50AE.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF50BB.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF5149.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF514B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF5158.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF5DE2.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF5ED5.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF626B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF6300.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF630D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF6367.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF6374.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF6563.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF6572.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF67FA.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF6807.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF7137.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF73F0.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF788.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF7E8D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF81B4.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF8296.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF82E2.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF82F6.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF8357.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF836B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF8D41.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF9304.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF9313.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF936D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF937B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DF9FF8.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFA005.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFA05F.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFA06C.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFA295.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFA786.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFA802.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFB6B7.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFBA2D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFBED6.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFC1F1.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFC9C4.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCBAF.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCBB9.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCBBC.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCBCD.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCC16.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCC23.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCC35.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCC5F.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFCFA0.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFD4D6.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFDB3B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFDB48.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFDB7B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFDBA2.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFDBAF.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE1B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE42B.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE5B2.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE8B8.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE8CC.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE959.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFE96D.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFF628.tmp deleted successfully.
C:\Documents and Settings\Desiree Meenan\Local Settings\Temp\~DFFE67.tmp deleted successfully.
[Empty Temp Folders]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
User: Desiree Meenan
->Temp folder emptied: 41083776 bytes
->Temporary Internet Files folder emptied: 710370367 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 242898 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Owner
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 279192 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 1883459 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 719.00 mb
Restore point Set: OTL Restore Point (64424509440)
< End of fix log >
OTS by OldTimer - Version 3.1.7.0 fix logfile created on 11262009_070154
Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_608.dat moved successfully.
Registry entries deleted on Reboot...
So what did you find? Why was it freezing up? Is there anything I can do to keep it from happening again?I sure appreciate your help on this.
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users