What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] lost google / now "searchqu.com

44 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi WTT, Firstly, i am not an expert with computers, so please be patient with any directions etc, My OP system is win xp pro sp3 etc, My son without my knowledge or his realising!, downloaded i think some malware from a site called "Bandoo", shortly after he said to me that there was a new toolbar as well as a new search page "searchqu", I went into add/remove programmes and done the uninstall bit, as you can guess nothing has changed, still have the tool-bar, the new search page as well as this new "emocion" type message box in messanger/hotmail. Have done some checking on the Internet about "Bandoo" and i think i am infected with malware, Trojan, worm whatever, One thing i will add that my son said when the "AVG" Internet Security Box appeared asking for permission to join/link to the internet?, or is it a link to trusted sites/AVG firewall?, he doesn't remember, anyway he had the sense to click "Block" and so did not allow access to the web, so to date, things do not seem any differant and the system appears to be slow as usual !, Would you guy's at WTT try and help me remove this malware, I have done the save to Desk Top of the scan results, (from the message at the top of the scan result i am not sure if you want them added at this stage?,) also i did read somewhere that somthing needed disableing/unchecking before doing the scan, unfortunatly i do not know how to disable whatever it is that needs un checking?. so not sure if the scan i have done is what you need? Sure would beat a service charge at our local PC shop. Would be very glad to drop a donation to help in running the forum :thumbup:!,
Post #2
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
  • Please make sure to carefully read any instruction that I give you.
    Reading too lightly will cause you to miss important steps, which could have destructive effects.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days     failure to reply will result in the topic being closed!
  • Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 4 days) and you need an explanation. If that's the case, just send me a message on here. ;)
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
____________________________________________________


OTL Custom Scan
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /180

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.


NEXT:



Scanning with GMER

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    [external image: Posted Image]
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.
– If you encounter any problems, try running GMER in safe mode.
– If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.



NEXT:



Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The logs that were produced after running the OTL scans. (OTL.txt & Extras.txt)
3. The log that was produced after running GMER
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #3 last edited
Hi Sweettech, thankyou for helping out, just to add i run the Win security scan earlier and unfortunately it wouldn't let me cut and paste the results to show what the scan showed, apparently the scan from windows picked up a Trojan, ironically my paid version of the Avg Internet Security i have doesn't show anything and scans daily, (always makes one think what we are paying for, as the Trojan is old!) lastly what do you want me to disable or uncheck while i do what you need me do, or do i need to leave things enabled? i only know the very basics to do with computers and the terminology etc, so i must forewarn you to be patient!, i canot get back today with any results as i am just of to attend a wedding reception, will make a start tomorrow, with regards. m
Post #4
Hello, We will take things one step at a time. I'd like for you to download and run OTL as outlined in my last post to you. We will worry about the GMER scan in a little bit.
Post #5
Hi sweetech, if its ok can we make a start tomorrow? as i have to go and attend a wedding reception this evening, very kind of you to help, hope this is not an inconvenience to you, with regards, marc
Post #7 last edited
Hi SweetTech, Are you you online today? or busy helping someone else?. I am not sure if you want me to make a start and run OTL and not use the pc ?. also do i need to stop any real time Internet Security?. with regards marc
Post #8
Yes, I am online right now, but you can post the logs for me anytime, and when ever I see them and have a free moment i will analyze them and respond with further instructions for you.
Post #11
OTL Extras logfile created on: 5/30/2010 21:58:37 - Run 1
OTL by OldTimer - Version 3.2.5.1 Folder = C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 63.00% Memory free
9.00 Gb Paging File | 8.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 189.91 Gb Total Space | 156.15 Gb Free Space | 82.22% Space Free | Partition Type: NTFS
Drive D: | 298.09 Gb Total Space | 280.92 Gb Free Space | 94.24% Space Free | Partition Type: NTFS
Drive E: | 6.85 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NONE-5738F18114
Current User Name: Mark M
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.reg [@ = regfile] –

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [open] –
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) – File not found
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) – File not found
"C:\Program Files\Kontiki\KService.exe" = C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service – (Kontiki Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – File not found
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – File not found
"C:\Program Files\AVG\AVG8\avgam.exe" = C:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe – File not found
"C:\Program Files\AVG\AVG8\avgdiag.exe" = C:\Program Files\AVG\AVG8\avgdiag.exe:*:Enabled:avgdiag.exe – File not found
"C:\Program Files\AVG\AVG8\avgdiagex.exe" = C:\Program Files\AVG\AVG8\avgdiagex.exe:*:Enabled:avgdiagex.exe – File not found
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – File not found
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\Logitech\Logitech Vid\Vid.exe" = C:\Program Files\Logitech\Logitech Vid\Vid.exe:*:Enabled:Logitech Vid – (Logitech Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{08498FF9-6C9B-4FC2-8DE1-BD98C89CC220}" = SiSRaidPackage
"{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}" = Symantec KB-DocID:2003093015493306
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}" = Scan
"{0FF18B53-CA57-40BB-B562-21A27B662005}" = 1600
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{14BEB6DF-A499-4A38-8E06-E173BCD5C087}" = ScannerCopy
"{17293791-C82E-476C-9997-9A0FF234A19B}" = HP Product Assistant
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{181821B7-82AA-44DA-9DAF-EF254CCB670A}" = Fax
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18F78B1A-964A-442C-BCE5-1FF4CBACAD90}" = ConstructionSkills
"{1967D67C-6F3F-4001-9644-BAC704F7EE84}" = Samsung PC Studio
"{1AD5F465-8282-4DAD-B957-E09C0B783D18}" = InstantShare
"{1B680FBA-E317-4E93-AF43-3B59798A4BE0}" = Copy
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}" = TrayApp
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{272EC8BA-5A08-4ea1-A189-684466A06B02}" = cp_dwShrek2Albums1
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2E8428AD-6CD2-4031-916A-3CF9BBF2DEC9}" = Unload
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{342C7C88-D335-4bc2-8CF1-281857629CE2}" = HP PSC & OfficeJet 4.7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3762DB2D-71BD-421F-9E55-C74DA7DF4D07}" = CueTour
"{391E18CE-7D3B-45E9-A8F0-34E77F14F47A}" = ProductContext
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3DB5FD00-BB93-4AF3-B925-77DAA0E4E2F4}" = eBay Toolbar
"{43DCF766-6838-4F9A-8C91-D92DA586DFA8}" = Microsoft Windows Journal Viewer
"{442BE28B-782B-4DC0-B490-E70A403B1C69}" = Readme
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{542068F1-9AAE-4E1B-8ACA-094FE03728BE}" = Carambis Driver Updater
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56918C0C-0D87-4CA6-92BF-4975A43AC719}" = KhalInstallWrapper
"{5C74694C-A687-E3EB-FF18-B018D4A76ECD}" = Adobe Media Player
"{5E8D588F-307C-4250-B622-26969027319A}" = PanoStandAlone
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{628C2C7D-8AD1-E614-E8E2-6EEAD8D5F2D0}" = Acrobat.com
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{644D04A2-C682-4FD5-977D-03B804C4B9C5}" = CreativeProjects
"{646A65DD-23FC-418E-B9F0-E0500FB42CB1}" = PhotoGallery
"{655CB07D-C944-40BE-B93F-55957CAC7625}" = AiO_Scan
"{684615B0-1472-4BCE-9369-C2E0DDDFFC91}_is1" = eBay Auction Typo Tool 1.01
"{68963635-14A4-48D9-B431-DF3A74D1AAE1}" = Destinations
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{700A6597-3CE6-49C1-AA75-846B24CDA66D}" = BufferChm
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{724517BD-1DE1-4986-BFCA-C1DFD379E3BC}" = cp_dwShrek2Cards1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{793A260C-CDBF-499C-ABBA-B51E8E076867}_is1" = Uniblue PowerSuite
"{7AD25C9F-9957-4D1C-95EF-9BCD09F6D31B}" = HPSystemDiagnostics
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84CDF5A8-1D57-4B69-BAB6-1F11D8923375}" = SkinsHP1
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{85CFD253-38AE-4DB1-ACB7-F0F4C791990D}" = AiOSoftware
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8B7443F5-E141-42A0-AB61-ED2331AAD606}" = 4oD
"{8BC3B99B-A6BE-4A0B-8535-B1B94BA4B1B1}" = DocProc
"{8C13BEE4-E7CE-4E46-BD13-8F41DAD00FEF}" = SweetIM Toolbar for Internet Explorer 3.4
"{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}" = CDDRV_Installer
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD 4
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5B9D22C-755A-4AC6-9904-875E80838BB6}" = CP_AtenaShokunin1Config
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{B911B811-BA3E-46D4-90F8-6F3338359651}" = Director
"{BD29EBAC-AD7D-4b27-B727-4CC6AC52D36B}" = MarketResearch
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BEA18030-8B42-1286-EF64-CDA6BD083888}" = BBC iPlayer Desktop
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C19FD5D9-475F-4BB8-99F6-9F5B680DE183}" = ABF Outlook Express Backup
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{C994D98C-293D-4825-958E-EB684B4D413F}" = MSN Toolbar
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB449D5A-7710-47aa-B9F5-352B877C90E6}" = 1600_Help
"{CDFCF124-115F-4976-8BF4-08C89187A146}" = WebReg
"{CE0C8CC5-E396-442B-A50E-D1D374A9E820}" = DocumentViewer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D466F3D9-510C-4729-B7D4-2E70490E4CDF}" = BBC iPlayer Download Manager
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver
"{DDC63227-BA06-4855-B002-BDB49E9F677E}" = Symantec Technical Support Web Controls
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster
"{EC87E256-B0A4-4A41-8682-AB57FF21196D}" = SweetIM for Messenger 2.7
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F4C6CC40-1142-49be-A28C-7BBD36F0B41A}" = 1600Trb
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FC22D020-3005-4715-8DF9-F3EDE81DEB3D}" = CreativeProjectsTemplates
"4oD" = 4oD
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"AVG9Uninstall" = AVG 9.0
"BBC iPlayer Download Manager" = BBC iPlayer Download Manager
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Google Chrome" = Google Chrome
"HP Photo & Imaging" = HP Image Zone 4.7
"HPExtendedCapabilities" = HP Extended Capabilities 4.7
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"Indeo® Software" = Indeo® Software
"InterActual Player" = InterActual Player
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Picasa 3" = Picasa 3
"PlayE4" = PlayE4
"RealPlayer 6.0" = RealPlayer
"Searchqu MediaBar" = Windows Searchqu Toolbar
"Shop for HP Supplies" = Shop for HP Supplies
"SiS VGA Driver" = SiS 651_661FX_741_760_760GX_M661FX_M661MX_M741_M760_M760GX
"SpywareBlaster_is1" = SpywareBlaster 4.3
"SystemRequirementsLab" = System Requirements Lab
"VirtualLab 5 Client_is1" = VirtualLab Professional Client
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Yahoo! Software Update" = Yahoo! Software Update

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/11/2010 11:32:36 | Computer Name = NONE-5738F18114 | Source = Bonjour Service | ID = 100
Description = 232: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 5/11/2010 11:32:36 | Computer Name = NONE-5738F18114 | Source = Bonjour Service | ID = 100
Description = 404: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 5/11/2010 11:32:36 | Computer Name = NONE-5738F18114 | Source = Bonjour Service | ID = 100
Description = 396: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 5/11/2010 11:32:36 | Computer Name = NONE-5738F18114 | Source = Bonjour Service | ID = 100
Description = 416: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 5/11/2010 20:34:17 | Computer Name = NONE-5738F18114 | Source = Google Update | ID = 20
Description =

Error - 5/13/2010 09:54:00 | Computer Name = NONE-5738F18114 | Source = Userenv | ID = 1508
Description = Windows was unable to load the registry. This is often caused by insufficient
memory or insufficient security rights. DETAIL - The process cannot access the
file because it is being used by another process. for C:\Documents and Settings\LocalService\Local
Settings\Application Data\Microsoft\Windows\\UsrClass.dat

Error - 5/13/2010 09:54:00 | Computer Name = NONE-5738F18114 | Source = Userenv | ID = 1500
Description = Windows cannot log you on because your profile cannot be loaded. Check
that you are connected to the network, or that your network is functioning correctly.
If this problem persists, contact your network administrator. DETAIL - The process
cannot access the file because it is being used by another process.

Error - 5/14/2010 05:53:33 | Computer Name = NONE-5738F18114 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established

Error - 5/16/2010 22:12:24 | Computer Name = NONE-5738F18114 | Source = Application Error | ID = 1000
Description = Faulting application pcfriend.exe, version 0.0.0.0, faulting module
mfc42.dll, version 6.2.4131.0, fault address 0x000011c7.

Error - 5/24/2010 05:28:27 | Computer Name = NONE-5738F18114 | Source = Application Error | ID = 1000
Description = Faulting application pcfriend.exe, version 0.0.0.0, faulting module
mfc42.dll, version 6.2.4131.0, fault address 0x000011c7.

[ System Events ]
Error - 5/30/2010 03:24:37 | Computer Name = NONE-5738F18114 | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 5/30/2010 03:26:46 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {8C9813D0-9FEA-4F37-AAF0-89D9C805B89F} did not register
with DCOM within the required timeout.

Error - 5/30/2010 03:28:46 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {83D70C88-12F2-4B69-B4E7-D2AF6DA1079B} did not register
with DCOM within the required timeout.

Error - 5/30/2010 03:30:46 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {8C9813D0-9FEA-4F37-AAF0-89D9C805B89F} did not register
with DCOM within the required timeout.

Error - 5/30/2010 03:32:46 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {83D70C88-12F2-4B69-B4E7-D2AF6DA1079B} did not register
with DCOM within the required timeout.

Error - 5/30/2010 12:04:02 | Computer Name = NONE-5738F18114 | Source = Service Control Manager | ID = 7022
Description = The KService service hung on starting.

Error - 5/30/2010 12:06:07 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {8C9813D0-9FEA-4F37-AAF0-89D9C805B89F} did not register
with DCOM within the required timeout.

Error - 5/30/2010 12:08:07 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {83D70C88-12F2-4B69-B4E7-D2AF6DA1079B} did not register
with DCOM within the required timeout.

Error - 5/30/2010 12:10:11 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {8C9813D0-9FEA-4F37-AAF0-89D9C805B89F} did not register
with DCOM within the required timeout.

Error - 5/30/2010 12:12:11 | Computer Name = NONE-5738F18114 | Source = DCOM | ID = 10010
Description = The server {83D70C88-12F2-4B69-B4E7-D2AF6DA1079B} did not register
with DCOM within the required timeout.


< End of report >
Post #12
OTL logfile created on: 5/30/2010 21:58:37 - Run 1
OTL by OldTimer - Version 3.2.5.1 Folder = C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 63.00% Memory free
9.00 Gb Paging File | 8.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 189.91 Gb Total Space | 156.15 Gb Free Space | 82.22% Space Free | Partition Type: NTFS
Drive D: | 298.09 Gb Total Space | 280.92 Gb Free Space | 94.24% Space Free | Partition Type: NTFS
Drive E: | 6.85 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NONE-5738F18114
Current User Name: Mark M
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe (iMesh, Inc)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Uniblue\PowerSuite\powersuite.exe (Uniblue Systems Limited)
PRC - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe ()
PRC - C:\Program Files\Uniblue\SpeedUpMyPC\sump.exe (Uniblue Systems Limited)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgfws9.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgam.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Logitech\Logitech Vid\Vid.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe (eBay Inc.)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Autodata Limited License Service) – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe ()
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgfws9) – C:\Program Files\AVG\AVG9\avgfws9.exe (AVG Technologies CZ, s.r.o.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (FilterService) – C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriverxpx) – C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilterxpx) – C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShimxpx) – C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSErHrxpx) – C:\WINDOWS\System32\Drivers\AVGIDSxx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgRkx86) – C:\WINDOWS\System32\Drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (LVUVC) Logitech Webcam 200(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (lvpopflt) – C:\WINDOWS\system32\drivers\lvpopflt.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (Intrchs) – C:\Program Files\PlayE4\bin\Intrchs.sys ()
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\eengine\eeCtrl.sys (Symantec Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech Inc.)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SISAGP) – C:\WINDOWS\system32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (W8100PCI) – C:\WINDOWS\system32\drivers\mrv8k51.sys (Marvell Semiconductor, Inc)
DRV - (SiSGbeXP) – C:\WINDOWS\system32\drivers\SiSGbeXP.sys (Silicon Integrated Systems Corp.)
DRV - (SiSRaid2) – C:\WINDOWS\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.bing.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/11/08 16:14:39 | 000,000,000 | —D | M]


O1 HOSTS File: ([2004/08/04 13:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (eBay Toolbar Helper) - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O3 - HKLM\..\Toolbar: (eBay Toolbar) - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DataMngr] C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe (iMesh, Inc)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\Vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [PowerSuite] C:\Program Files\Uniblue\PowerSuite\launcher.exe (Uniblue Systems Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: eBay Search - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll (Google Inc.)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plu…Detection32.cab (Device Detection)
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab (MSN Games – Matchmaking)
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} http://support.asus.com/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (Reg Error: Key error.)
O16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} http://us.dl1.yimg.com/download.yahoo.com/…_1/yregucfg.cab (RegUserCfgUI Class)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab (MSN Games – Game Chat)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab58570.cab (ZPA_HRTZ Object)
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab (ZPA_SHVL Object)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…k.cab102118.cab (MSN Games - Installer)
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} http://zone.msn.com/binframework/v10/StProxy.cab55579.cab (MSN Games – Game Communicator)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.com/webgames/popcaploader_v10.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} http://zone.msn.com/bingame/zpagames/ZPA_B…on.cab64162.cab (MSN Games – Backgammon)
O16 - DPF: CabBuilder http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~1\wi9130~1\datamngr\datamngr.dll) - c:\Program Files\Windows Searchqu Toolbar\DataMngr\datamngr.dll (iMesh, Inc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Mark M.NONE-5738F18114\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mark M.NONE-5738F18114\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/07/24 09:48:16 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/01/30 19:33:49 | 000,000,090 | —- | M] () - C:\AUTORUN.INF – [ NTFS ]
O32 - AutoRun File - [2008/12/30 17:43:01 | 000,000,000 | —- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2003/02/21 18:35:56 | 000,000,073 | R— | M] () - E:\AUTORUN.INF – [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/06/30 16:01:28 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: MIDI1 - C:\WINDOWS\System32\Syncor11.dll (SoundMAX)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Ligos Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll (Ligos Corporation)
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll (Ligos Corporation)
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Ligos Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Ligos Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: VIDC.MP42 - C:\WINDOWS\System32\MPG4C32.DLL (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\MPG4C32.DLL (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/05/30 21:38:28 | 000,571,392 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\OTL.exe
[2010/05/30 20:13:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\ieSpell
[2010/05/29 07:38:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb
[2010/05/29 07:38:45 | 000,000,000 | —D | C] – C:\Program Files\Windows Searchqu Toolbar
[2010/05/29 07:37:33 | 000,000,000 | —D | C] – C:\Program Files\Bandoo
[2010/05/28 05:11:48 | 000,000,000 | —D | C] – C:\Program Files\ieSpell
[2010/05/24 10:31:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Unused Desktop Shortcuts
[2010/05/23 03:40:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\Carambis
[2010/05/23 03:37:44 | 000,000,000 | —D | C] – C:\Program Files\Carambis
[2010/05/22 20:19:07 | 000,000,000 | —D | C] – C:\WINDOWS\Performance
[2010/05/22 20:18:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Local Settings\Application Data\Microsoft Corporation
[2010/05/22 20:18:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Windows 7 Upgrade Advisor
[2010/05/20 07:40:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\dumps
[2010/05/14 19:27:09 | 000,199,192 | —- | C] (Logitech Inc.) – C:\WINDOWS\System32\lvci12101110.dll
[2010/05/13 16:40:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\SightSpeed Recordings
[2010/05/12 19:19:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2010/05/12 19:18:53 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2010/05/12 19:17:57 | 000,061,440 | —- | C] (Khronos Group) – C:\WINDOWS\System32\OpenCL.dll
[2010/05/12 19:17:56 | 002,646,632 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuvenc.dll
[2010/05/12 19:17:55 | 011,647,592 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcompiler.dll
[2010/05/12 19:08:46 | 000,000,000 | —D | C] – C:\Program Files\SystemRequirementsLab
[2010/05/04 18:23:33 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/05/04 18:23:31 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/05/04 18:23:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/05/04 18:20:30 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/05/04 18:18:08 | 003,003,680 | —- | C] (Apple, Inc.) – C:\WINDOWS\System32\usbaaplrc.dll
[2010/05/04 18:17:51 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/05/02 20:00:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\Sun
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/30 21:38:30 | 000,571,392 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\OTL.exe
[2010/05/30 21:31:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/30 21:29:33 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{169FDE4B-E2F9-4890-879E-D1A096EA74F2}.job
[2010/05/30 20:55:22 | 000,000,317 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\lost google - now searchqu.com.url
[2010/05/30 20:49:36 | 000,000,635 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Sign In.url
[2010/05/30 20:47:25 | 000,000,220 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\TV Guide UK TV Listings - UK's No 1 TV Listing site for Freeview, Sky, Virgin Media, Freesat & Tiscali TV.url
[2010/05/30 19:00:08 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/05/30 18:17:02 | 004,980,736 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\NTUSER.DAT
[2010/05/30 18:15:24 | 000,021,505 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\a-boozer.html
[2010/05/30 18:04:48 | 000,000,281 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\THAI BART RATE CONVERTER.url
[2010/05/30 17:06:53 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/30 17:04:04 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/05/30 17:02:07 | 000,276,202 | —- | M] () – C:\WINDOWS\System32\NvApps.xml
[2010/05/30 17:01:13 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/30 17:00:56 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/05/30 17:00:50 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/05/30 12:56:24 | 060,540,981 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/05/29 22:00:37 | 000,000,244 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\youtube.com-gl=GB&hl=en-GB.url
[2010/05/29 18:39:33 | 000,000,249 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\home page Take a Break Bingo.url
[2010/05/29 09:23:56 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/05/29 09:23:55 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2010/05/29 07:45:28 | 000,000,000 | —- | M] () – C:\WINDOWS\iPlayer.INI
[2010/05/29 07:39:42 | 000,026,616 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/05/29 04:32:24 | 000,000,792 | —- | M] () – C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk
[2010/05/28 18:27:18 | 000,000,394 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\CATCH-UP.url
[2010/05/28 11:42:05 | 000,147,608 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/05/28 05:34:24 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\ntuser.ini
[2010/05/28 03:44:57 | 000,000,317 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Thai for Lovers.url
[2010/05/28 03:25:08 | 000,000,210 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Manee and Friends.url
[2010/05/27 17:52:54 | 000,023,832 | —- | M] (Logitech Inc.) – C:\WINDOWS\System32\drivers\lvuvcflt.sys
[2010/05/27 17:52:23 | 000,888,832 | —- | M] (NVIDIA Corporation) – C:\WINDOWS\System32\fdco1ins.dll
[2010/05/27 17:52:23 | 000,888,832 | —- | M] (NVIDIA Corporation) – C:\WINDOWS\System32\fdco1.dll
[2010/05/27 17:52:23 | 000,067,328 | —- | M] (NVIDIA Corporation) – C:\WINDOWS\System32\drivers\NVENETFD.sys
[2010/05/27 04:04:22 | 000,000,211 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\eBay - The UK's Online Marketplace.url
[2010/05/27 01:06:45 | 000,591,188 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\iavifw.avm
[2010/05/26 04:51:24 | 000,000,238 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Mazda RX-8 Owners Club UK.url
[2010/05/25 17:55:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/25 09:26:40 | 000,000,259 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Nationwide Building Society Mortgages, Savings, Current Accounts, Banking, Insurance, Credit Cards, Loans, Investments.url
[2010/05/25 04:16:39 | 000,000,665 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\UK Credit Cards Capital One.url
[2010/05/25 03:46:55 | 000,000,316 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\allfreegames.eu-free-online-games-play-Crash+Bandicoot-45e8beb2f472b5b11031a1f9171bab8b.html.url
[2010/05/25 02:27:07 | 000,029,696 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\Basildon Magistrates Court.doc
[2010/05/24 11:09:51 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/05/24 04:47:27 | 000,000,224 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\BBC iPlayer - Home.url
[2010/05/23 23:02:00 | 000,000,302 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware 2007.job
[2010/05/23 17:18:33 | 000,000,580 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\My Account - PayPal.url
[2010/05/23 03:40:00 | 000,005,007 | —- | M] () – C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe
[2010/05/22 21:44:32 | 000,084,197 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\win 7 report compatability.mht
[2010/05/22 20:29:42 | 000,001,928 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/22 09:25:32 | 000,000,243 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\oilcareers.com-worldwide-.url
[2010/05/21 22:28:37 | 000,000,248 | —- | M] () – C:\Short Term Car Insurance One Day Car Insurance 1 Day Insurance.url
[2010/05/20 10:30:13 | 000,000,158 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\AVForums.com Home.url
[2010/05/16 04:05:41 | 000,000,660 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\ClipExtractor-YouTube-Clip-ExtractorFlvConverterDefaultSettings.xml
[2010/05/16 00:27:14 | 000,000,186 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\My Lifetracks - Lifetracks.com.url
[2010/05/14 19:26:10 | 000,001,863 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Logitech Webcam Software.lnk
[2010/05/13 16:40:01 | 000,000,803 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Logitech Vid.lnk
[2010/05/12 17:52:58 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/12 11:21:16 | 000,221,568 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/05/08 05:21:32 | 000,577,660 | —- | M] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\RX8_Stereo_Removal.pdf
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/30 18:15:19 | 000,021,505 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\a-boozer.html
[2010/05/29 11:48:27 | 000,000,317 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\lost google - now searchqu.com.url
[2010/05/29 07:45:28 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2010/05/29 04:32:24 | 000,000,792 | —- | C] () – C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk
[2010/05/28 03:44:57 | 000,000,317 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Thai for Lovers.url
[2010/05/28 03:25:08 | 000,000,210 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Manee and Friends.url
[2010/05/25 04:16:10 | 000,000,665 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\UK Credit Cards Capital One.url
[2010/05/25 03:46:55 | 000,000,316 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\allfreegames.eu-free-online-games-play-Crash+Bandicoot-45e8beb2f472b5b11031a1f9171bab8b.html.url
[2010/05/25 02:27:07 | 000,029,696 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\Basildon Magistrates Court.doc
[2010/05/24 19:02:46 | 000,000,220 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\TV Guide UK TV Listings - UK's No 1 TV Listing site for Freeview, Sky, Virgin Media, Freesat & Tiscali TV.url
[2010/05/24 19:00:48 | 000,000,259 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\Nationwide Building Society Mortgages, Savings, Current Accounts, Banking, Insurance, Credit Cards, Loans, Investments.url
[2010/05/23 03:40:00 | 000,005,007 | —- | C] () – C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe
[2010/05/22 21:44:32 | 000,084,197 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\win 7 report compatability.mht
[2010/05/22 20:29:42 | 000,001,928 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/20 10:30:13 | 000,000,158 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\AVForums.com Home.url
[2010/05/16 19:22:15 | 000,000,211 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\eBay - The UK's Online Marketplace.url
[2010/05/16 00:27:14 | 000,000,186 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\My Lifetracks - Lifetracks.com.url
[2010/05/14 23:08:09 | 000,000,243 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\Desktop\oilcareers.com-worldwide-.url
[2010/05/14 19:26:10 | 000,001,863 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Logitech Webcam Software.lnk
[2010/05/13 16:40:01 | 000,000,803 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Logitech Vid.lnk
[2010/05/12 19:17:57 | 000,009,046 | —- | C] () – C:\WINDOWS\System32\nvinfo.pb
[2010/05/12 19:17:55 | 002,183,470 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2010/05/08 05:21:25 | 000,577,660 | —- | C] () – C:\Documents and Settings\Mark M.NONE-5738F18114\My Documents\RX8_Stereo_Removal.pdf
[2010/05/04 18:24:26 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/02/04 19:57:03 | 000,000,000 | —- | C] () – C:\WINDOWS\PCFriend.INI
[2009/10/24 18:38:41 | 000,056,320 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll
[2009/10/07 01:46:36 | 000,025,752 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/10/07 01:23:08 | 000,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2009/09/20 22:16:35 | 000,082,289 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/19 07:22:30 | 000,000,045 | —- | C] () – C:\WINDOWS\System32\RPVersion.ini
[2007/11/15 04:12:23 | 000,000,125 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/11/13 02:38:13 | 002,729,472 | —- | C] () – C:\WINDOWS\System32\fun_avcodec.dll
[2006/12/08 03:14:52 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2006/12/04 07:51:01 | 000,060,672 | —- | C] () – C:\WINDOWS\PSCMN25.DLL
[2006/12/04 07:51:01 | 000,035,264 | —- | C] () – C:\WINDOWS\PSIMGJ1.DLL
[2006/11/25 11:34:25 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/11/02 07:31:40 | 000,000,068 | —- | C] () – C:\WINDOWS\IDMan.INI
[2006/08/27 03:01:37 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/08/18 06:57:06 | 000,000,464 | —- | C] () – C:\WINDOWS\iScreensaver.ini
[2006/07/29 10:43:33 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/07/26 18:07:34 | 000,106,346 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2006/07/26 18:07:14 | 000,171,122 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2006/07/26 16:42:12 | 000,032,768 | —- | C] () – C:\WINDOWS\SIS_LIB.DLL
[2006/07/26 16:33:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/07/26 16:33:12 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2006/07/26 16:32:08 | 000,000,000 | —- | C] () – C:\WINDOWS\NSREX.INI
[2006/07/26 16:24:50 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2001/11/19 20:05:18 | 000,003,972 | —- | C] () – C:\WINDOWS\System32\drivers\PciBus.sys
[2001/03/30 22:58:36 | 000,135,168 | —- | C] () – C:\WINDOWS\System32\property.dll
[1999/01/23 03:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/10/11 01:07:38 | 000,088,576 | —- | C] () – C:\WINDOWS\System32\Iticheck.dll
[1998/07/15 22:44:30 | 000,134,656 | —- | C] () – C:\WINDOWS\System32\itijpg2.dll

========== LOP Check ==========

[2010/03/14 12:36:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Autodata Limited
[2009/07/30 19:16:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/10/23 01:18:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/01/21 11:26:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Babylon
[2007/09/07 20:19:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Channel4
[2007/04/25 18:47:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Documents
[2009/07/30 18:53:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2007/11/03 11:32:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\eBay
[2010/05/30 22:00:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2009/07/05 05:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/07/05 20:57:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2010/05/24 04:43:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2008/11/16 19:12:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WholeSecurity
[2010/05/04 18:24:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/02/16 19:29:08 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2009/09/11 06:33:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/07/21 03:53:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/10/18 18:21:14 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2010/01/21 11:26:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\Babylon
[2009/08/04 00:12:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2010/05/23 03:40:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\Carambis
[2009/12/06 02:44:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/06/30 16:22:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\eBay
[2010/05/30 20:13:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\ieSpell
[2009/09/12 17:32:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\InterVideo
[2009/07/06 10:21:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\iScreensaver
[2009/09/20 22:17:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\Leadertech
[2010/05/29 07:45:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb
[2010/03/28 22:01:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\Uniblue
[2009/06/30 18:58:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\WholeSecurity
[2010/05/23 23:02:00 | 000,000,302 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware 2007.job
[2010/05/30 17:06:53 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/05/30 19:00:08 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/05/30 21:29:33 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{169FDE4B-E2F9-4890-879E-D1A096EA74F2}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/05/30 17:00:40 | 000,131,071 | —- | M] () – C:\aaw7boot.log
[2009/01/26 10:17:51 | 000,001,736 | —- | M] () – C:\Adobe Acrobat 9 Pro.lnk
[2009/12/06 00:10:53 | 000,001,742 | —- | M] () – C:\Adobe Reader 9.lnk
[2006/07/24 09:48:16 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/01/30 19:33:49 | 000,000,090 | —- | M] () – C:\AUTORUN.INF
[2009/06/30 17:15:03 | 000,000,321 | -HS- | M] () – C:\boot.ini
[2006/07/24 09:48:16 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2008/09/09 06:02:58 | 000,000,000 | —- | M] () – C:\conmgr.log
[2006/12/30 14:47:10 | 000,000,093 | —- | M] () – C:\DownloadLog.txt
[2009/07/16 19:10:39 | 000,005,037 | —- | M] () – C:\I hope you are well in England_.eml
[2006/07/24 09:48:16 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/09/20 22:18:25 | 000,000,803 | —- | M] () – C:\Logitech Vid.lnk
[2009/09/20 22:13:41 | 000,001,863 | —- | M] () – C:\Logitech Webcam Software.lnk
[2006/07/24 09:48:16 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 13:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/09/03 00:01:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/05/30 17:00:46 | 3219,128,320 | -HS- | M] () – C:\pagefile.sys
[2009/07/16 18:40:08 | 000,008,427 | —- | M] () – C:\RE_ Dream to u.eml
[2009/07/16 18:40:53 | 000,024,714 | —- | M] () – C:\RE_ Miss u.eml
[2009/07/16 18:40:35 | 000,015,004 | —- | M] () – C:\RE_ Take care yourself.eml
[2009/07/16 18:41:22 | 000,033,647 | —- | M] () – C:\RE_ Think of my family.eml
[2008/04/14 06:42:42 | 000,028,672 | —- | M] (Microsoft Corporation) – C:\setupSNK.exe
[2010/05/21 22:28:37 | 000,000,248 | —- | M] () – C:\Short Term Car Insurance One Day Car Insurance 1 Day Insurance.url
[2009/09/07 12:25:28 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2009/09/07 19:57:30 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2009/09/08 06:53:15 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2009/09/08 08:07:38 | 000,000,232 | -H– | M] () – C:\sqmdata03.sqm
[2009/09/08 14:58:43 | 000,000,232 | -H– | M] () – C:\sqmdata04.sqm
[2009/09/08 16:33:01 | 000,000,232 | -H– | M] () – C:\sqmdata05.sqm
[2009/09/08 20:20:57 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2009/09/08 20:25:15 | 000,000,232 | -H– | M] () – C:\sqmdata07.sqm
[2009/08/09 07:40:27 | 000,000,232 | -H– | M] () – C:\sqmdata08.sqm
[2009/08/09 09:45:21 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2009/08/09 10:48:42 | 000,000,232 | -H– | M] () – C:\sqmdata10.sqm
[2009/08/09 11:42:16 | 000,000,232 | -H– | M] () – C:\sqmdata11.sqm
[2009/08/15 20:43:06 | 000,000,232 | -H– | M] () – C:\sqmdata12.sqm
[2009/09/04 15:47:12 | 000,000,232 | -H– | M] () – C:\sqmdata13.sqm
[2009/09/05 04:11:07 | 000,000,232 | -H– | M] () – C:\sqmdata14.sqm
[2009/09/05 05:42:42 | 000,000,232 | -H– | M] () – C:\sqmdata15.sqm
[2009/09/05 14:32:52 | 000,000,232 | -H– | M] () – C:\sqmdata16.sqm
[2009/09/06 05:42:21 | 000,000,268 | -H– | M] () – C:\sqmdata17.sqm
[2009/09/06 18:01:40 | 000,000,232 | -H– | M] () – C:\sqmdata18.sqm
[2009/09/07 03:29:30 | 000,000,232 | -H– | M] () – C:\sqmdata19.sqm
[2009/09/07 12:25:28 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2009/09/07 19:57:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2009/09/08 06:53:15 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2009/09/08 08:07:38 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2009/09/08 14:58:43 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2009/09/08 16:33:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2009/09/08 20:20:57 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2009/09/08 20:25:15 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/08/09 07:40:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/08/09 09:45:21 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/08/09 10:48:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/08/09 11:42:16 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/08/15 20:43:06 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/09/04 15:47:11 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2009/09/05 04:11:07 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2009/09/05 05:42:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2009/09/05 14:32:52 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2009/09/06 05:42:21 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2009/09/06 18:01:40 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2009/09/07 03:29:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2006/07/26 18:06:10 | 016,683,166 | —- | M] () – C:\W2kXPV361.zip
[2 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[9 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/06/30 15:41:50 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/11/16 19:41:57 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2009/06/30 15:41:50 | 030,670,848 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/06/30 15:41:50 | 009,437,184 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /180 >
[2010/03/05 03:03:57 | 000,025,096 | —- | M] (AVG Technologies CZ, s.r.o. ) – C:\WINDOWS\system32\drivers\AVGIDSxx.sys
[2010/03/05 03:03:53 | 000,216,200 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgldx86.sys
[2010/03/05 03:04:03 | 000,029,512 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgmfx86.sys
[2010/03/05 03:03:51 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgrkx86.sys
[2010/04/19 18:22:08 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgtdix.sys
[2010/02/04 16:53:02 | 000,064,288 | —- | M] (Lavasoft AB) – C:\WINDOWS\system32\drivers\Lbd.sys
[2010/05/27 17:52:54 | 000,023,832 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\drivers\lvuvcflt.sys
[2010/02/24 14:11:07 | 000,455,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mrxsmb.sys
[2010/04/03 23:55:31 | 010,232,128 | —- | M] (NVIDIA Corporation) – C:\WINDOWS\system32\drivers\nv4_mini.sys
[2010/05/27 17:52:23 | 000,067,328 | —- | M] (NVIDIA Corporation) – C:\WINDOWS\system32\drivers\NVENETFD.sys
[2010/02/16 19:30:44 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\system32\drivers\SBREDrv.sys
[2010/02/03 05:05:35 | 000,163,644 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) – C:\WINDOWS\system32\drivers\secdrv.sys
[2009/12/31 17:50:03 | 000,353,792 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\srv.sys
[2010/02/11 13:02:15 | 000,226,880 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\tcpip6.sys
[2010/04/16 08:33:36 | 000,041,472 | —- | M] (Apple, Inc.) – C:\WINDOWS\system32\drivers\usbaapl.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0F8F5844
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:58CF2C8C
< End of report >
Post #14
Hello,

OTL Fix

We need to run an OTL Fix
  • Please reopen [external image: Posted Image] on your desktop.
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    :Services
:OTL
PRC - C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe (iMesh, Inc)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [DataMngr] C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe (iMesh, Inc)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - Reg Error: Value error. File not found
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (Reg Error: Key error.)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: CabBuilder http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab (Reg Error: Key error.)
[2010/05/29 07:38:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb
[2010/05/29 07:38:45 | 000,000,000 | —D | C] – C:\Program Files\Windows Searchqu Toolbar
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2010/05/29 09:23:56 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/05/29 09:23:55 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2010/05/23 03:40:00 | 000,005,007 | —- | M] () – C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[11 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2010/05/29 07:45:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb
[9 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0F8F5844
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:58CF2C8C
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]
  • Push [external image: Posted Image]
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click [external image: Posted Image].
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now
Post #15 last edited
Hi SweetTech, Have done as you asked, But, After the reboot there was a box that appeared called "The System Con-fig Utility Box", says you have used the system con-fig utility to make changes to how windows starts, The system con-fig utility is currently in diagnostic mode or select start mode, choose the normal start up mode on Gen Tab etc, i clicked OK, and another box has appeared, i am not sure which to Tick/Click, there are three options, 1,Normal start-up load all drivers and services (unticked), 2, Diagnostic-load all drivers and services only (unticked), or 3, (which is ticked) Selective start-up, NB, under the later there are 3 or 4 little tick boxes, of which all seem to be ticked, i have not altered anything as i am not sure what you want done here?. i have left the "System Con-fig Utility Box" open, (as i said i am a complete novice re computers) In the mean time i will leave the PC running as i wouldn't know how to enable it if i closed it, i await further instructions, I have noticed since the last scan that the "searchqu toolbar" has now gone and my google default browser has returned !, Just to add you asked me in an earlier message to report any changes on how the PC was running, well earlier yesterday it was loading content and pictures on to web sites (like eBay) very slowly as well as freezing momentarily,, [below is the second OTL scan results you wanted.] All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== No active process named DataMngrUI.exe was found! HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\SearchDefaultBranded| /E : value set successfully! HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7FF99715-3016-4381-84CE-E4E4C9673020}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ deleted successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FF99715-3016-4381-84CE-E4E4C9673020} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found. File C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DataMngr deleted successfully. C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found. Starting removal of ActiveX control {0E5F0222-96B9-11D3-8997-00104BD12D94} C:\WINDOWS\Downloaded Program Files\PCPitstop.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0E5F0222-96B9-11D3-8997-00104BD12D94}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5F0222-96B9-11D3-8997-00104BD12D94}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0E5F0222-96B9-11D3-8997-00104BD12D94}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5F0222-96B9-11D3-8997-00104BD12D94}\ not found. Starting removal of ActiveX control {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.1.1.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}\ not found. Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} C:\WINDOWS\Downloaded Program Files\erma.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\WINDOWS\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Starting removal of ActiveX control CabBuilder Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\CabBuilder\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\CabBuilder\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\CabBuilder\ not found. C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb\widgets_cache folder moved successfully. C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb\weather folder moved successfully. C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb\games folder moved successfully. C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\components folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\searchbar folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\options folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\uwa folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\radio\images folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\radio\css folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\radio folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\panels\images folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\panels\css folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\panels folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217 folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1257 folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1255 folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227 folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\modules folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\lib folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\data\search folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\data folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\ToolBar folder moved successfully. C:\Program Files\Windows Searchqu Toolbar\DataMngr folder moved successfully. C:\Program Files\Windows Searchqu Toolbar folder moved successfully. C:\WINDOWS\System32\CONFIG.TMP deleted successfully. C:\WINDOWS\System32\SET49.tmp deleted successfully. C:\WINDOWS\System32\SET4B.tmp deleted successfully. C:\WINDOWS\System32\SET52.tmp deleted successfully. C:\WINDOWS\System32\SET5B.tmp deleted successfully. C:\WINDOWS\System32\SET7B.tmp deleted successfully. C:\WINDOWS\System32\SET7D.tmp deleted successfully. C:\WINDOWS\System32\SET8C.tmp deleted successfully. C:\WINDOWS\System32\SET97.tmp deleted successfully. C:\RCX40.tmp deleted successfully. C:\RCX41.tmp deleted successfully. C:\WINDOWS\003240_.tmp deleted successfully. C:\WINDOWS\003418_.tmp deleted successfully. C:\WINDOWS\msdownld.tmp folder deleted successfully. C:\WINDOWS\SET3.tmp deleted successfully. C:\WINDOWS\SET4.tmp deleted successfully. C:\WINDOWS\SET8.tmp deleted successfully. C:\WINDOWS\SET9F.tmp deleted successfully. C:\WINDOWS\SETA2.tmp deleted successfully. C:\WINDOWS\SETAE.tmp deleted successfully. C:\WINDOWS\system.tmp deleted successfully. C:\WINDOWS\win.tmp deleted successfully. C:\WINDOWS\system32\drivers\lvuvc.hs moved successfully. C:\WINDOWS\system32\drivers\logiflt.iad moved successfully. C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe moved successfully. Folder C:\Documents and Settings\Mark M.NONE-5738F18114\Application Data\searchqutb\ not found. ADS C:\Documents and Settings\All Users\Application Data\TEMP:0F8F5844 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:58CF2C8C deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41620 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 11029911 bytes User: Mark M User: Mark M.NONE-5738F18114 ->Temp folder emptied: 193449613 bytes ->Temporary Internet Files folder emptied: 104354766 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 122918 bytes User: MARKM~1~NON User: NetworkService ->Temp folder emptied: 1530190 bytes ->Temporary Internet Files folder emptied: 696572 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 213841 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23915738 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 394 bytes Total Files Cleaned = 320.00 mb [EMPTYFLASH] User: All Users User: Default User ->Flash cache emptied: 0 bytes User: LocalService User: Mark M User: Mark M.NONE-5738F18114 ->Flash cache emptied: 0 bytes User: MARKM~1~NON User: NetworkService Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.5.1 log created on 05312010_020944 Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI