Spyware / Malware / Virus Removal

"Windows cannot find "logon.exe" problem

12 min read

Looking for the outcome? Ask AI

ramsayross Topic Starter

Post #1July 6, 2010, 3:13 PM UTC

The computer is slow to start and I have problems shutting down, having to click shut down several times before anything happens.
A box appears everytime Windows XP starts up stating " Windows cannot find "logon.exe". Make sure you typed the name correctly and then try again.
I have read some of the posts and it appears to be a leftover from a virus that Norton cleared up. This has been happening for about a month now.

These are the system properties
Microsoft Windows XP, Home Edition, version 2002, Service pack 3
HP Pavillion Intel ®
Pentium ® D CPU 2.80GHz
2.80GHz, 1.00GB of RAM

I have downloaded Hijack This and have a log as follows.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:07:45, on 06/07/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
C:\Program Files\Gateway\EzTune\dtsslsrv.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Gateway\EzTune\dtsrvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\WinPortrait\wpctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Gateway\EzTune\dthtml.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinPortrait\floater.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\SQ1U2MI3\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
F2 - REG:system.ini: Shell=Explorer.exe logon.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\IPSBHO.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\WinPortrait\wpctrl.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZUxdm265YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {127CE7BA-AD89-4108-A913-C52EFC037C36} (OMN Player Support) - http://kdx.omn.org/securedelivery/omn/PlayerSupport.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.0.cab
O16 - DPF: {2776DDE9-D4B2-4BF7-9F98-ADC1A1B80AF5} (OMN Media Publisher) - http://kdx.omn.org/securedelivery/omn/MediaPublisher.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.4.5.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1256074191375
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.omn.org/securedelivery/omn/kdx.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game.zylom.com/activex/zylomgamesplayer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

–
End of file - 10021 bytes

Any assistance would be greatly appreciated
Ramsayross

Essexboy

Post #2July 6, 2010, 7:42 PM UTC

Hi lets have a quick look see

[external image: Posted Image] GMER Rootkit Scanner - Download - Homepage
[*]Download GMER

[*]Extract the contents of the zipped file to desktop.

[*]Double click GMER.exe.

[external image: Posted Image]
[*]If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..

[*]In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …

IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)

[external image: Posted Image]
Click the image to enlarge it
- Then click the Scan button & wait for it to finish.
- Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
- Save the log where you can easily find it, such as your desktop.
**Caution**Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

THEN

Download OTL to your Desktop
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Select Scan all users
- Under the Custom Scan box paste this in
  
  netsvcs
  drivers32 /all
  %SYSTEMDRIVE%\*.*
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
  %systemroot%\system32\*.wt
  %systemroot%\system32\*.ruy
  %systemroot%\Fonts\*.com
  %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\user32.dll /md5
  %systemroot%\system32\ws2_32.dll /md5
  %systemroot%\system32\ws2help.dll /md5
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Post both logs

ramsayross

Post #3July 7, 2010, 10:50 PM UTC

hi Essex so far I have downloaded the GMER rootkit scanner and run the scan as described. No problem, it took over eight hours, but when I go to save, the computer freezes on me and i have to turn it off manualy, as i have no other knowledge of what to do. This has happened twice now. i have now deleted GMER and am going to download it again and try one more time. I will post the scan if i can save it. thank for your help jules

ramsayross

Post #4July 8, 2010, 1:54 PM UTC

I have downloaded GMER scanner. It opens OK. however as soon as i press scan, the computer freezes. i .e the clock stops at the time i started the scan. The scan runs, the last one took 16hrs, and then i cannot do anything with it, i cannot save it, or copy or anything as the computer has been frozen. I have now done three scans all with the same result. I have also celeted the 1tsr GMER download, and downloaded another one, but it doea the same. i cannot seems to use GMER on this computer any ideas? I also dont know what else to do after the computer freezes. I have tried waiting for three hours, but nothing happens, so i turn it off at the mains to reboot.

Essexboy

Post #5July 8, 2010, 6:41 PM UTC

OK skip GMER then (I will revisit that later) and continue with the OTL scan

ramsayross

Post #6July 10, 2010, 11:03 AM UTC

sorry for the delay. Here are the two OTL logs:

OTL logfile created on: 10/07/2010 11:48:27 - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 500.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.02 Gb Total Space | 59.59 Gb Free Space | 41.67% Space Free | Partition Type: NTFS
Drive D: | 6.01 Gb Total Space | 0.54 Gb Free Space | 9.05% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RAMSAYROSS
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/10 11:46:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
PRC - [2009/08/22 08:28:17 | 000,117,640 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
PRC - [2009/04/02 12:47:04 | 000,234,888 | —- | M] () – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
PRC - [2009/04/02 12:47:02 | 000,464,264 | —- | M] () – C:\Program Files\AskBarDis\bar\bin\AskService.exe
PRC - [2009/02/16 21:54:57 | 000,039,408 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/02/06 17:07:48 | 000,027,512 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Live\Contacts\wlcomm.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/01/25 11:08:20 | 003,072,184 | —- | M] (Kontiki Inc.) – C:\Program Files\kontiki\KService.exe
PRC - [2006/06/07 17:05:38 | 000,553,021 | —- | M] (Broadcom Corporation.) – C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
PRC - [2006/06/07 16:57:46 | 000,266,295 | —- | M] (Broadcom Corporation.) – C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
PRC - [2006/06/01 18:08:52 | 000,180,269 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2005/08/18 13:56:26 | 000,114,688 | —- | M] () – C:\Program Files\Gateway\EzTune\dtsslsrv.exe
PRC - [2005/08/18 13:55:12 | 000,260,608 | —- | M] (Portrait Displays, Inc) – C:\Program Files\Gateway\EzTune\dthtml.exe
PRC - [2005/08/18 13:54:04 | 000,061,440 | —- | M] () – C:\Program Files\Gateway\EzTune\DTSRVC.exe
PRC - [2005/05/12 01:33:52 | 000,479,232 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
PRC - [2005/03/24 00:26:09 | 000,217,088 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft IntelliPoint\point32.exe
PRC - [2005/03/15 10:46:45 | 000,196,608 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft IntelliType Pro\type32.exe
PRC - [2005/01/26 12:57:18 | 000,755,448 | —- | M] () – C:\Program Files\WinPortrait\floater.exe
PRC - [2005/01/26 12:57:16 | 000,698,104 | —- | M] () – C:\Program Files\WinPortrait\wpctrl.exe
PRC - [2004/09/13 12:43:16 | 001,486,848 | —- | M] (Inventel) – C:\Program Files\Inventel\Gateway\WLANCFG.EXE

========== Modules (SafeList) ==========

MOD - [2010/07/10 11:46:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
MOD - [2009/08/22 08:28:14 | 000,419,696 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\asOEHook.dll
MOD - [2008/04/14 01:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx
MOD - [2005/01/26 12:56:18 | 000,237,568 | —- | M] () – C:\Program Files\WinPortrait\winphook.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – C:\WINDOWS\System32\appmgmts.dll – (AppMgmt)
SRV - [2009/08/22 08:28:17 | 000,117,640 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe – (Norton Internet Security)
SRV - [2009/04/02 12:47:04 | 000,234,888 | —- | M] () [Auto | Running] – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe – (ASKUpgrade)
SRV - [2009/04/02 12:47:02 | 000,464,264 | —- | M] () [Auto | Running] – C:\Program Files\AskBarDis\bar\bin\AskService.exe – (ASKService)
SRV - [2008/01/25 11:08:20 | 003,072,184 | —- | M] (Kontiki Inc.) [Auto | Running] – C:\Program Files\Kontiki\KService.exe – (KService)
SRV - [2007/08/09 08:27:52 | 000,073,728 | —- | M] (HP) [Auto | Stopped] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)
SRV - [2006/06/07 16:57:46 | 000,266,295 | —- | M] (Broadcom Corporation.) [Auto | Running] – C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe – (btwdins)
SRV - [2005/08/18 13:56:26 | 000,114,688 | —- | M] () [Auto | Running] – C:\Program Files\Gateway\EzTune\dtsslsrv.exe – (Asset Management Daemon)
SRV - [2005/08/18 13:54:04 | 000,061,440 | —- | M] () [Auto | Running] – C:\Program Files\Gateway\EzTune\DTSRVC.exe – (DTSRVC)
SRV - [2004/09/13 12:43:16 | 001,486,848 | —- | M] (Inventel) [Auto | Running] – C:\Program Files\Inventel\Gateway\wlancfg.exe – (Wlancfg)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\NIS\1002000.007\SYMREDRV.SYS – (SYMREDRV)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\NIS\1002000.007\SYMDNS.SYS – (SYMDNS)
DRV - File not found [Kernel | On_Demand | Stopped] – E:\NTGLM7X.sys – (SetupNTGLM7X)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\PCAMPR5.SYS – (PCAMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] – E:\NTACCESS.sys – (NTACCESS)
DRV - File not found [Kernel | On_Demand | Stopped] – E:\INSTALL\GMSIPCI.SYS – (GMSIPCI)
DRV - File not found [Kernel | Boot | Stopped] – C:\WINDOWS\System32\DRIVERS\ftsata2.sys – (ftsata2)
DRV - [2010/05/28 20:33:19 | 000,331,640 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100709.001\IDSXpx86.sys – (IDSxpx86)
DRV - [2010/05/26 09:00:00 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/05/26 09:00:00 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/05/10 09:00:00 | 001,347,504 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100709.040\NAVEX15.SYS – (NAVEX15)
DRV - [2010/05/10 09:00:00 | 000,085,552 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100709.040\NAVENG.SYS – (NAVENG)
DRV - [2010/02/02 08:30:15 | 000,482,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\ccHPx86.sys – (ccHP)
DRV - [2009/08/22 08:28:17 | 000,310,320 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\NIS\1008000.029\SYMEFA.SYS – (SymEFA)
DRV - [2009/08/22 08:28:17 | 000,308,272 | —- | M] (Symantec Corporation) [File_System | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SRTSP.SYS – (SRTSP)
DRV - [2009/08/22 08:28:17 | 000,259,632 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\BHDrvx86.sys – (BHDrvx86)
DRV - [2009/08/22 08:28:17 | 000,217,136 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMTDI.SYS – (SYMTDI)
DRV - [2009/08/22 08:28:17 | 000,089,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMFW.SYS – (SYMFW)
DRV - [2009/08/22 08:28:17 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NIS\1008000.029\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2009/08/22 08:28:17 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMNDIS.SYS – (SYMNDIS)
DRV - [2009/08/22 08:28:17 | 000,033,072 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMIDS.SYS – (SYMIDS)
DRV - [2009/08/20 10:38:33 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2009/08/18 20:11:17 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2009/08/18 20:11:17 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2009/05/09 01:14:20 | 000,014,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nuidfltr.sys – (NuidFltr)
DRV - [2008/04/13 19:45:12 | 000,060,032 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbaudio.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 17:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2007/07/12 06:03:53 | 000,016,432 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btwrchid.sys – (btwrchid)
DRV - [2007/07/12 06:01:13 | 000,081,200 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btwavdt.sys – (btwavdt)
DRV - [2006/10/31 14:35:00 | 003,964,256 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2006/09/23 14:22:35 | 000,017,134 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\PCANDIS5.sys – (PCANDIS5)
DRV - [2006/06/07 22:06:58 | 000,329,901 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\btaudio.sys – (btaudio)
DRV - [2006/06/07 16:33:34 | 000,855,018 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\btkrnl.sys – (BTKRNL)
DRV - [2006/06/07 16:29:10 | 000,030,459 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btport.sys – (BTDriver)
DRV - [2006/06/07 16:28:40 | 000,030,285 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btwmodem.sys – (btwmodem)
DRV - [2006/06/07 16:28:20 | 000,149,028 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btwdndis.sys – (BTWDNDIS)
DRV - [2006/06/07 16:26:52 | 000,067,384 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btwusb.sys – (BTWUSB)
DRV - [2006/06/07 16:23:20 | 000,047,811 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\btwhid.sys – (btwhid)
DRV - [2006/06/01 18:31:00 | 000,010,344 | —- | M] (Symantec Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\symlcbrd.sys – (symlcbrd)
DRV - [2006/03/08 14:27:12 | 004,246,016 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/01/25 17:24:30 | 001,149,888 | —- | M] (Agere Systems) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2006/01/18 19:41:58 | 000,080,512 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2005/12/12 17:27:00 | 000,019,072 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PS2.sys – (Ps2)
DRV - [2005/09/23 23:18:32 | 000,171,520 | —- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\MarvinBus.sys – (MarvinBus)
DRV - [2005/08/18 13:56:30 | 000,011,776 | —- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pdiddcci.sys – (pdiddcci)
DRV - [2005/08/18 13:53:28 | 000,009,600 | —- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PdiPorts.sys – (PdiPorts)
DRV - [2005/06/17 07:33:40 | 000,872,064 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iaStor.sys – (iaStor)
DRV - [2005/01/26 12:55:24 | 000,009,260 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\pivotmou.sys – (pivotmou)
DRV - [2005/01/26 12:55:20 | 000,016,425 | —- | M] (Windows ® 2000 DDK provider) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\pivot.sys – (pivot)
DRV - [2004/08/03 15:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/03/30 18:29:48 | 000,374,816 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PRISMA02.sys – (PRISM_A02)
DRV - [2003/09/19 15:45:48 | 000,021,248 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pfc.sys – (pfc)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Ask"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=10607&gct;=&gc;=1&q;="

FF - HKLM\software\mozilla\Firefox\extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/04/26 08:17:04 | 000,000,000 | —D | M]

[2009/12/08 14:18:05 | 000,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions
[2009/11/26 21:34:00 | 000,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions\[removed]
[2009/12/08 14:18:05 | 000,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions\[removed]
[2009/09/14 22:06:46 | 000,000,000 | —D | M] – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\agzz2kot.default\extensions
[2009/09/14 22:06:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\agzz2kot.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2009/09/19 11:16:54 | 000,000,687 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\agzz2kot.default\searchplugins\ask.xml

O1 HOSTS File: ([2008/08/14 17:49:53 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Wanadoo) - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\Program Files\Wanadoo\WSBar\WSBar.dll ()
O3 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\..\Toolbar\ShellBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
O3 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.)
O3 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [ftutil2] C:\WINDOWS\System32\ftutil2.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\point32.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files\WinPortrait\wpctrl.exe ()
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [type32] C:\Program Files\Microsoft IntelliType Pro\type32.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\Belkin\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EzTune.lnk = C:\Program Files\Gateway\EzTune\dthtml.exe (Portrait Displays, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {127CE7BA-AD89-4108-A913-C52EFC037C36} http://kdx.omn.org/securedelivery/omn/PlayerSupport.cab (PlayerSupport Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f…etup1.0.1.0.cab (Reg Error: Key error.)
O16 - DPF: {2776DDE9-D4B2-4BF7-9F98-ADC1A1B80AF5} http://kdx.omn.org/securedelivery/omn/MediaPublisher.cab (PublicationCtrl Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.4.5.cab (DLM Control)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1256074191375 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} http://kdx.omn.org/securedelivery/omn/kdx.cab (Secure Delivery)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (logon.exe) - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/05 17:32:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\{96e53915-5039-11de-94eb-000b6b6d2121}\Shell - "" = AutoRun
O33 - MountPoints2\{96e53915-5039-11de-94eb-000b6b6d2121}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{96e53915-5039-11de-94eb-000b6b6d2121}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: VIDC.MP42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MP43 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.VP70 - C:\WINDOWS\System32\vp7vfw.dll (On2.com)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave5 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave6 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/10 11:46:16 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2010/07/06 17:29:22 | 000,000,000 | -HSD | C] – C:\found.000
[2010/07/06 13:37:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/06 13:37:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/07/03 08:29:56 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\My Documents\Bus Timetables
[2010/06/21 15:09:07 | 000,000,000 | —D | C] – C:\Program Files\DreamQuest
[2010/05/22 18:57:09 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\My Documents\silk painting
[2010/05/22 15:23:56 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\My Documents\reclining man phot
[2010/04/21 11:48:52 | 000,140,800 | —- | C] (The Duck Corporation) – C:\WINDOWS\System32\tm20dec.ax
[2010/04/21 11:47:32 | 000,024,576 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\TTIC32.dll
[2010/04/21 11:47:27 | 000,024,576 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\TTI32.dll
[2010/04/21 11:47:21 | 000,024,576 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\STRING32.dll
[2010/04/21 11:47:10 | 000,057,344 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLTPO32.dll
[2010/04/21 11:47:05 | 000,155,648 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLRES32.dll
[2010/04/21 11:47:00 | 000,036,864 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLRD32.dll
[2010/04/21 11:46:55 | 000,061,440 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLPTL32.dll
[2010/04/21 11:46:49 | 000,053,248 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLPRJ32.dll
[2010/04/21 11:46:44 | 000,045,056 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLPRF32.dll
[2010/04/21 11:46:39 | 000,036,864 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLPNT32.dll
[2010/04/21 11:46:33 | 000,032,768 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLMSC32.dll
[2010/04/21 11:46:28 | 000,024,576 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLIX.dll
[2010/04/21 11:46:23 | 000,028,672 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLISO32.dll
[2010/04/21 11:46:17 | 000,045,056 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLIO32.dll
[2010/04/21 11:46:12 | 000,040,960 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLIMG32.dll
[2010/04/21 11:46:07 | 000,094,208 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLDRV32.dll
[2010/04/21 11:46:02 | 000,032,768 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLDIR32.dll
[2010/04/21 11:45:56 | 000,126,976 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLDEV32.dll
[2010/04/21 11:45:51 | 000,081,920 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLCPY32.dll
[2010/04/21 11:45:46 | 000,061,440 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLCDF32.dll
[2010/04/21 11:45:40 | 000,106,496 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLCDA32.dll
[2010/04/21 11:45:35 | 000,192,512 | —- | C] (PoINT Software & Systems GmbH) – C:\WINDOWS\System32\DLLAV32.dll
[2010/04/21 11:36:43 | 000,000,000 | —D | C] – C:\MAGIX
[2010/04/21 11:35:49 | 000,151,552 | —- | C] (MAGIX AG) – C:\WINDOWS\System32\mgxoschk.dll
[2010/04/15 12:29:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\DivX
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/07/10 11:46:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\Desktop\OTL.exe
[2010/07/10 11:46:15 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/10 11:27:14 | 000,000,428 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{5A4F6BF7-7625-46ED-82D5-062806B68B0B}.job
[2010/07/10 07:48:50 | 001,337,296 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/07/10 07:48:50 | 000,540,480 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/07/10 07:48:50 | 000,316,374 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/10 07:44:45 | 000,080,872 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/10 07:42:46 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/10 07:42:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/10 07:42:20 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2010/07/10 01:16:00 | 009,961,472 | —- | M] () – C:\Documents and Settings\HP_Owner\ntuser.dat
[2010/07/10 01:15:49 | 000,000,012 | —- | M] () – C:\WINDOWS\bthservsdp.dat
[2010/07/10 01:15:42 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\HP_Owner\ntuser.ini
[2010/07/09 14:44:35 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/06 15:38:02 | 000,000,759 | —- | M] () – C:\WINDOWS\win.ini
[2010/07/06 15:38:02 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/07/06 15:38:02 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/06 13:25:42 | 000,071,064 | —- | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/06 13:24:02 | 000,243,920 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/07/06 13:00:20 | 000,000,050 | —- | M] () – C:\WINDOWS\TLTitleData.ini
[2010/07/06 08:19:25 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/05 00:23:49 | 000,146,432 | —- | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/01 03:46:43 | 001,637,810 | -H– | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\IconCache.db
[2010/06/28 20:00:00 | 000,000,628 | —- | M] () – C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - HP_Owner.job
[2010/06/25 08:52:26 | 000,012,666 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\ASSEMBLY OPERATIVES.docx
[2010/06/23 18:02:00 | 000,049,664 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\Chiltern Open Air Museum Art Weekend Booking Form[1].doc
[2010/06/21 15:09:14 | 000,000,849 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Play Free Chess.lnk
[2010/06/20 17:41:58 | 001,425,988 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\royal academy of arts entry 2010 - January.pdf
[2010/06/12 07:59:45 | 007,916,623 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\Oils price list Cornelissen.pdf
[2010/06/10 20:15:12 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/18 17:55:40 | 000,002,265 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/05/11 20:23:29 | 000,012,332 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\paper return letter.docx
[2010/05/05 14:50:02 | 000,000,168 | —- | M] () – C:\WINDOWS\muma2003.INI
[2010/04/29 08:16:22 | 000,010,418 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\Call centre in India.docx
[2010/04/28 08:26:17 | 000,000,409 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\WRITING.lnk
[2010/04/21 15:07:42 | 000,000,304 | —- | M] () – C:\WINDOWS\sampler.INI
[2010/04/21 15:07:39 | 000,000,304 | —- | M] () – C:\WINDOWS\beatbox.INI
[2010/04/21 11:48:40 | 000,000,811 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/04/21 11:48:36 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2010/04/21 11:48:35 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2010/04/21 11:38:17 | 000,000,000 | —- | M] () – C:\WINDOWS\videodeLuxe.INI
[2010/04/21 11:23:55 | 000,001,409 | —- | M] () – C:\WINDOWS\System32\tmpDAD7F.FOT
[2010/04/21 11:23:55 | 000,001,409 | —- | M] () – C:\WINDOWS\System32\tmp78E7F.FOT
[2010/04/21 11:23:55 | 000,001,409 | —- | M] () – C:\WINDOWS\System32\tmp3AC7F.FOT
[2010/04/21 11:23:54 | 000,001,409 | —- | M] () – C:\WINDOWS\System32\tmpC2B7F.FOT
[2010/04/15 13:07:18 | 000,001,545 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2010/04/15 13:07:18 | 000,001,545 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Vuze.lnk
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/06 15:37:51 | 000,001,819 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/07/06 15:37:51 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EzTune.lnk
[2010/07/06 15:37:51 | 000,001,547 | —- | C] () – C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010/07/06 15:37:51 | 000,000,901 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2010/07/06 15:37:51 | 000,000,809 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
[2010/07/06 15:37:51 | 000,000,633 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
[2010/07/06 15:37:50 | 000,000,958 | —- | C] () – C:\Documents and Settings\HP_Owner\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/06/25 08:52:26 | 000,012,666 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\ASSEMBLY OPERATIVES.docx
[2010/06/23 18:02:00 | 000,049,664 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\Chiltern Open Air Museum Art Weekend Booking Form[1].doc
[2010/06/21 15:09:14 | 000,000,849 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Play Free Chess.lnk
[2010/06/20 17:41:58 | 001,425,988 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\royal academy of arts entry 2010 - January.pdf
[2010/06/20 01:21:00 | 000,006,200 | —- | C] () – C:\WINDOWS\System32\INT13EXT.VXD
[2010/06/12 07:59:44 | 007,916,623 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\Oils price list Cornelissen.pdf
[2010/05/11 20:18:40 | 000,012,332 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\paper return letter.docx
[2010/04/29 08:16:22 | 000,010,418 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\Call centre in India.docx
[2010/04/28 08:26:17 | 000,000,409 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\WRITING.lnk
[2010/04/21 15:43:11 | 000,000,168 | —- | C] () – C:\WINDOWS\muma2003.INI
[2010/04/21 15:07:41 | 000,000,304 | —- | C] () – C:\WINDOWS\sampler.INI
[2010/04/21 15:07:38 | 000,000,304 | —- | C] () – C:\WINDOWS\beatbox.INI
[2010/04/21 11:48:27 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2010/04/21 11:48:27 | 000,005,672 | —- | C] () – C:\WINDOWS\System32\quartz.vxd
[2010/04/21 11:38:17 | 000,000,000 | —- | C] () – C:\WINDOWS\videodeLuxe.INI
[2010/04/21 11:35:50 | 000,000,603 | —- | C] () – C:\WINDOWS\mgxoschk.ini
[2010/04/21 11:23:55 | 000,001,409 | —- | C] () – C:\WINDOWS\System32\tmpDAD7F.FOT
[2010/04/21 11:23:55 | 000,001,409 | —- | C] () – C:\WINDOWS\System32\tmp78E7F.FOT
[2010/04/21 11:23:55 | 000,001,409 | —- | C] () – C:\WINDOWS\System32\tmp3AC7F.FOT
[2010/04/21 11:23:54 | 000,001,409 | —- | C] () – C:\WINDOWS\System32\tmpC2B7F.FOT
[2010/03/10 09:29:22 | 000,000,000 | —- | C] () – C:\WINDOWS\pcfriend.INI
[2008/08/15 20:07:36 | 000,004,893 | —- | C] () – C:\WINDOWS\VRQCleanup.ini
[2008/05/31 16:59:16 | 000,110,080 | —- | C] () – C:\WINDOWS\System32\nLame.dll
[2008/05/31 16:59:16 | 000,023,040 | —- | C] () – C:\WINDOWS\System32\auth.dll
[2008/02/04 18:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2008/01/04 18:49:51 | 000,000,050 | —- | C] () – C:\WINDOWS\TLTitleData.ini
[2007/06/16 22:03:03 | 000,000,050 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/04/30 22:52:32 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2007/03/02 14:20:19 | 000,126,464 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2007/03/02 13:58:56 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/11/27 17:47:21 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/10/01 10:18:34 | 000,000,227 | —- | C] () – C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2006/09/27 09:09:38 | 000,016,384 | —- | C] () – C:\WINDOWS\System32\WINKRNME.DLL
[2006/09/27 08:50:37 | 000,150,576 | —- | C] () – C:\WINDOWS\System32\drivers\MLTCAP.sys
[2006/09/23 21:53:11 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/06/07 16:52:08 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2006/06/01 18:42:44 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/01 18:21:43 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/06/01 18:18:17 | 000,013,561 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/06/01 18:18:10 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/06/01 18:12:48 | 000,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2006/06/01 18:10:05 | 000,000,102 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/06/01 17:53:43 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/06/01 17:50:58 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 17:50:58 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/06/01 17:50:57 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/01 17:50:57 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/06/01 17:50:57 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/06/01 17:36:23 | 000,000,886 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/06/01 17:32:44 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/03/17 18:23:44 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/03/22 05:48:00 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2005/02/17 12:41:32 | 000,000,603 | —- | C] () – C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 12:41:30 | 000,000,593 | —- | C] () – C:\WINDOWS\System32\btcss.dll.manifest
[2004/06/24 13:10:06 | 000,000,567 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2001/11/14 13:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001/07/06 15:30:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1998/10/11 01:07:38 | 000,088,576 | —- | C] () – C:\WINDOWS\System32\Iticheck.dll

========== LOP Check ==========

[2009/09/14 22:07:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2006/11/28 09:15:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Documents
[2010/07/10 11:51:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2008/10/20 14:47:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/03/03 17:59:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle
[2010/02/10 19:49:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle Studio Ultimate
[2007/11/18 01:31:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Prism
[2007/07/10 21:21:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Transparent
[2009/12/13 21:11:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUpMedia
[2009/11/11 17:09:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2009/11/13 13:31:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2009/07/30 08:48:42 | 000,000,000 | -HSD | M] – C:\Documents and Settings\LocalService\Application Data\twain_32
[2010/07/10 11:27:14 | 000,000,428 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{5A4F6BF7-7625-46ED-82D5-062806B68B0B}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2005/12/05 17:32:08 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2006/09/22 20:25:54 | 000,000,211 | RHS- | M] () – C:\BOOT.BAK
[2010/07/06 15:38:02 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/04 05:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2005/12/05 17:32:08 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/10/24 15:40:31 | 000,003,532 | —- | M] () – C:\drmHeader.bin
[2010/07/10 07:42:20 | 1073,139,712 | -HS- | M] () – C:\hiberfil.sys
[2005/12/05 17:32:08 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2006/12/25 14:40:10 | 000,000,363 | -H– | M] () – C:\IPH.PH
[2005/12/05 17:32:08 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/08/14 17:49:53 | 000,000,548 | —- | M] () – C:\MSN Virus Removal Log 14_08_2008 17_49_53.txt
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/09/25 08:27:27 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/07/10 07:42:18 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2009/07/06 14:45:56 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2009/07/26 14:15:12 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2009/07/26 17:58:53 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2009/07/27 10:43:19 | 000,000,232 | -H– | M] () – C:\sqmdata03.sqm
[2009/07/27 10:52:30 | 000,000,232 | -H– | M] () – C:\sqmdata04.sqm
[2009/07/27 16:59:44 | 000,000,232 | -H– | M] () – C:\sqmdata05.sqm
[2009/07/28 12:20:37 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2009/07/28 21:40:29 | 000,000,232 | -H– | M] () – C:\sqmdata07.sqm
[2009/07/28 22:58:17 | 000,000,232 | -H– | M] () – C:\sqmdata08.sqm
[2009/07/28 23:00:42 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2009/07/28 23:01:07 | 000,000,232 | -H– | M] () – C:\sqmdata10.sqm
[2009/07/28 23:15:08 | 000,000,232 | -H– | M] () – C:\sqmdata11.sqm
[2009/07/28 23:19:54 | 000,000,232 | -H– | M] () – C:\sqmdata12.sqm
[2009/07/04 17:26:52 | 000,000,232 | -H– | M] () – C:\sqmdata13.sqm
[2009/07/05 20:48:44 | 000,000,232 | -H– | M] () – C:\sqmdata14.sqm
[2009/07/06 12:42:57 | 000,000,232 | -H– | M] () – C:\sqmdata15.sqm
[2009/07/06 14:11:43 | 000,000,232 | -H– | M] () – C:\sqmdata16.sqm
[2009/07/06 14:20:37 | 000,000,232 | -H– | M] () – C:\sqmdata17.sqm
[2009/07/06 14:44:08 | 000,000,232 | -H– | M] () – C:\sqmdata18.sqm
[2009/07/06 14:45:07 | 000,000,232 | -H– | M] () – C:\sqmdata19.sqm
[2009/07/06 14:45:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2009/07/26 14:15:12 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2009/07/26 17:58:53 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2009/07/27 10:43:19 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2009/07/27 10:52:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2009/07/27 16:59:44 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2009/07/28 12:20:37 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2009/07/28 21:40:29 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/07/28 22:58:17 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/07/28 23:00:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/07/28 23:01:07 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/07/28 23:15:08 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/07/28 23:19:54 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/07/04 17:26:52 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2009/07/05 20:48:44 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2009/07/06 12:42:57 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2009/07/06 14:11:43 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2009/07/06 14:20:37 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2009/07/06 14:44:08 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2009/07/06 14:45:07 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2005/10/31 16:56:00 | 000,700,416 | —- | M] (LimeWire) – C:\StubInstaller.exe
[2008/08/15 20:25:33 | 000,376,209 | —- | M] () – C:\vrq.log

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/05/05 09:48:54 | 000,067,072 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll
[2005/10/14 22:41:46 | 000,072,192 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp43a.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2005/12/05 17:23:36 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2005/12/05 17:23:36 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 01:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 01:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 01:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-10 19:15:33

< >
< End of report >

OTL Extras logfile created on: 10/07/2010 11:48:27 - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\HP_Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 500.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.02 Gb Total Space | 59.59 Gb Free Space | 41.67% Space Free | Partition Type: NTFS
Drive D: | 6.01 Gb Total Space | 0.54 Gb Free Space | 9.05% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RAMSAYROSS
Current User Name: HP_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_USERS\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) – File not found
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe – File not found
"C:\Program Files\CyberLink\PowerCinema\PowerCinema.exe" = C:\Program Files\CyberLink\PowerCinema\PowerCinema.exe:*:Enabled:CyberLink PowerCinema – File not found
"C:\Program Files\CyberLink\PowerCinema\PCMService.exe" = C:\Program Files\CyberLink\PowerCinema\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program – File not found
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL – File not found
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) – File not found
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\Program Files\kontiki\KService.exe" = C:\Program Files\kontiki\KService.exe:*:Enabled:Delivery Manager Service – (Kontiki Inc.)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe – ()
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe – ( )
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager – File not found
"C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi – File not found
"C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin – File not found
"C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager – File not found
"C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio – File not found
"C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi – File not found
"C:\Program Files\Azureus\Azureus.exe" = C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus / Vuze – (Vuze Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{029F5E98-6E5D-42E9-BCC7-2A6433AB99EF}" = 3100
"{03B1B42B-F6DE-41d9-8CFF-DC44E895C7A7}" = PhotoGallery
"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0DFB3DE8-65B9-44FF-AA0A-3BECC5A2BFD1}" = Adobe Flash Player 10 Plugin
"{1330F885-F8E4-4c36-9B88-E19F82042C06}" = 3100_3200_3300trb
"{1341D838-719C-4A05-B50F-49420CA1B4BB}" = HP Boot Optimizer
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{172975EB-9465-4861-95B5-C7BB6D3DE62A}" = DocumentViewer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A3E23D7-7A1E-43EC-B35D-EB8A31BED943}" = FinalBurner Free v1.12.0.84
"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21DB3D90-D816-4092-A260-CA3F6B55A6DD}" = Sonic_PrimoSDK
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23A7B376-BBEC-4e76-BBD7-0F155E70D74B}" = CP_Panorama1Config
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}" = HP Deskjet Printer Preload
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{32BDCCB8-9DC8-496d-9DB1-F77510775BDB}" = InstantShareDevices
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{352F5013-07DC-446D-8DB6-38F339086C60}" = LightScribe 1.4.84.1
"{36E47DA1-10E1-45d9-8B19-14D19607CDCF}" = CP_CalendarTemplates1
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E386744-10FA-44b2-98C9-DF7A270DECB3}" = HP PSC & OfficeJet 5.3.A
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = Belkin Bluetooth Software
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{44734179-8A79-4DEE-BB08-73037F065543}" = Apple Mobile Device Support
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 2.1
"{48B82226-75E3-4E90-92CC-D30F79EA6380}" = Norton Security Scan
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BE53DB2-C1F2-44D1-A9AB-1630BA7F2AF1}" = SolutionCenter
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{50E7BB78-02B4-469a-9D8B-B2F42835F90E}" = ProductContextNPI
"{53C398FE-CD56-412E-B3C7-B27F4B8B07D1}" = Microsoft IntelliType Pro 5.3
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{54E3707F-808E-4fd4-95C9-15D1AB077E5D}" = NewCopy
"{567C23E1-7580-4185-B8C2-30805677297C}" = NewCopy_CDA
"{56EE8B17-8274-418d-89AC-C057C5DB251E}" = RandMap
"{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}" = iTunes
"{5A01C58E-B0EC-49b9-AD71-7C0468688087}" = CP_Package_Basic1
"{5B39603F-2A77-40E6-950D-ED7B8307933D}" = Microsoft IntelliPoint 5.3
"{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}" = HP PSC & OfficeJet 5.3.B
"{5CFD7508-7774-48FE-8280-7A3C0AE71755}" = Internet Services
"{5D61626A-BD55-4e42-82EE-4AE89D8FD050}" = HP Photosmart Cameras 6.0
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image 2006 Standard Edition Editor
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F26311C-B135-4F7F-B11E-8E650F83651E}" = DeviceFunctionQFolder
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{66BA8C26-AFE4-4408-807B-43E76B57EF53}" = SkinsHP1
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image 2006 Standard Edition Library
"{6A118C80-B382-41c0-8907-CDD0BF5EFE6E}" = CameraDrivers
"{729DF902-05F9-4C00-9E6D-411119824E5F}" = hpiCamDrvQFolder
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78225D0F-D12C-09E4-5D6D-A64D763E8982}" = BBC iPlayer Desktop
"{7850A6D2-CBEA-4728-9877-F1BEDEA9F619}" = AiOSoftware
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{7E27304E-BAA2-4d90-A34E-76641FAFABB4}" = CP_AtenaShokunin1Config
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84288B51-B162-47FB-A74E-25C6D67E44BB}" = EzTune
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{923A7F5A-1E8C-4FBE-8DF6-85940A60A79F}" = Readme
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{976EA7B1-7562-483D-88DA-4323D263B7CD}" = DiMAGE Viewer
"{99E67091-D392-4031-AD2A-E9547F3615F8}" = KONICA_MINOLTA DiMAGE remote camera driver
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A195B13E-A5E3-4BAF-A995-7F70F445CD06}" = ScannerCopy
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5BB5365-EFB4-44c3-A7E2-EB59B7EFD23D}" = CueTour
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B276997E-4367-4b1b-A39C-4CAE7464337A}" = AiO_Scan_CDA
"{B4D279F1-4309-49cc-A4B5-3A0D2E59C7B5}" = PanoStandAlone
"{B60E7826-F117-4d26-8165-D2DC5A494AB0}" = Fax_CDA
"{B64E3AFC-59EF-4f18-BF11-E751462450D3}" = AiOSoftwareNPI
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{B9DD2DE0-27BE-4e6b-AAD8-0D960ABF87FD}" = CameraUserGuides
"{BD3DCAB0-3FE5-44FB-90DA-EFB0A2CD1387}" = Works Synchronization
"{BF4E9ED0-EF26-4A4C-A123-6A6A1ABEE411}" = DocProc
"{BFF9454C-0E07-4E4B-9C37-D7A36D5BB2D3}" = OMN
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = Fax
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DD0DDC9E-2ED4-44DD-B461-0EFC126813A0}" = On2 VP7 Personal Edition
"{DEBB2986-15B0-4D28-95FA-5C966A396589}" = HPProductAssistant
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{EC2715CE-C182-483C-84CC-81D7D914CF14}" = WebReg
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1931CAB-C7DD-4825-8A58-BC5278805200}" = 3100_3200_3300_Help
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FAF7F1D7-C0E7-47EA-8AAA-84E4F9EA3C94}" = Works Suite OS Pack
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe SVG Viewer" = Adobe SVG Viewer
"Agere Systems Soft Modem" = Agere Systems PCI-SV92PP Soft Modem
"Alive DVD Ripper_is1" = Alive DVD Ripper (version 2.3.2.2)
"Ask Toolbar_is1" = Vuze Toolbar
"Azureus" = Azureus
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"FreeChess" = 100% Free Chess 7.30
"Google Updater" = Google Updater
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Document Viewer" = HP Document Viewer 5.3
"HP Imaging Device Functions" = HP Imaging Device Functions 5.3
"HP Photo & Imaging" = HP Image Zone 5.3
"HP Solution Center & Imaging Support Tools" = HP Solution Center and Imaging Support Tools 6.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"InstallShield_{5CFD7508-7774-48FE-8280-7A3C0AE71755}" = Internet Services
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"LimeWire" = LimeWire 5.3.6
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"NIS" = Norton Internet Security
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PCFriendly" = PCFriendly
"PictureItPrem_v11" = Microsoft Digital Image 2006 Standard Edition
"Prism" = Prism Video Converter
"RealPlayer 6.0" = RealPlayer
"TuneUpMedia" = TuneUp Companion 1.6.4
"VLC media player" = VLC media player 0.9.8a
"Wanadoo" = Wanadoo Search Toolbar
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ OSession Events ]
Error - 25/06/2008 16:26:02 | Computer Name = RAMSAYROSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6308.5000, Microsoft Office Version: 12.0.4518.1014. This session lasted 71
seconds with 60 seconds of active time. This session ended with a crash.

Error - 21/01/2009 10:31:33 | Computer Name = RAMSAYROSS | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 116 seconds with 60 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 10/07/2010 02:46:40 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:41 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:42 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:42 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:43 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:44 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:44 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:45 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:45 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

Error - 10/07/2010 02:46:46 | Computer Name = RAMSAYROSS | Source = Service Control Manager | ID = 7000
Description = The PCAMPR5 NDIS Protocol Driver service failed to start due to the
following error: %%2

< End of report >

Essexboy

Post #7July 10, 2010, 11:41 AM UTC

On completion of this let me know what problems remain

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O7 - HKU\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (logon.exe) - File not found

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

[external image: Posted Image] Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

ramsayross

Post #8July 12, 2010, 12:09 PM UTC

No problems remain. The computer now starts up normally, without the "logon.exe" box appearing. . All other programmes seem to be working fine and load at a normal rate, the computer starts up fine and shuts down now on the first attempt. Thank you so much for your assistance, its a different world out there and am I am only just beggining to see its depths. Have you guys really got brains the size of houses and have ot live in aircraft hangers, or is that just an urban myth? Please let me know if there is anything I need to do now. As far as I can tell all the issues have been resovled, so once again , thank you. . Here is the OTL log that appeared after the reboot: All processes killed ========== OTL ========== Registry value HKEY_USERS\S-1-5-21-1146567539-973233565-1305245305-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:logon.exe deleted successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: Administrator ->Temp folder emptied: 30169 bytes ->Temporary Internet Files folder emptied: 321965 bytes User: All Users User: Default User ->Temp folder emptied: 30169 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Flash cache emptied: 41661 bytes User: HP_Owner ->Temp folder emptied: 7258764790 bytes ->Temporary Internet Files folder emptied: 75371596 bytes ->Java cache emptied: 99803348 bytes ->FireFox cache emptied: 28023923 bytes ->Google Chrome cache emptied: 5857290 bytes ->Apple Safari cache emptied: 1230297 bytes ->Flash cache emptied: 202054 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 3120356 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1196155914 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 72570913 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 2181116295 bytes Total Files Cleaned = 10,417.00 mb [EMPTYFLASH] User: Administrator User: All Users User: Default User ->Flash cache emptied: 0 bytes User: HP_Owner ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.8.1 log created on 07122010_124300 Files\Folders moved on Reboot… File\Folder C:\WINDOWS\temp\JETF2A3.tmp not found! File\Folder C:\WINDOWS\temp\Perflib_Perfdata_128.dat not found! Registry entries deleted on Reboot…

Essexboy

Post #9July 12, 2010, 7:31 PM UTC

Have you guys really got brains the size of houses and have ot live in aircraft hangers, or is that just an urban myth?

Actually I find a hangar a bit small

Could you post the malwarebytes log please so I can make a decision as to whether you are clean or not

ramsayross

Post #10July 12, 2010, 10:29 PM UTC

my apologies, I missed the malware log bit on your previous post, so here it is. my thanks again, hope all is well. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4306 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 12/07/2010 23:22:39 mbam-log-2010-07-12 (23-22-39).txt Scan type: Quick scan Objects scanned: 141811 Time elapsed: 13 minute(s), 30 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 37 Registry Values Infected: 8 Registry Data Items Infected: 2 Folders Infected: 2 Files Infected: 9 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1ab53a71-2ab1-4289-9dc7-ec30eef8b35c} (Password.Stealer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1ab53a71-2ab1-4289-9dc7-ec30eef8b35c} (Password.Stealer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{343ce214-9998-4b21-a151-ffe970167297} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MSN\bn (Trojan.Ambler) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MSN\d1 (Trojan.Ambler) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MSN\d2 (Trojan.Ambler) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MSN\d3 (Trojan.Ambler) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MSN\gd (Trojan.Ambler) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MSN\pr (Trojan.Ambler) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\LocalService\Application Data\twain_32 (Trojan.Zbot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\twain_32 (Backdoor.Bot) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\LocalService\Application Data\twain_32\user.ds (Trojan.Zbot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\twain_32\local.ds (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\twain_32\user.ds (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\c2d.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\idm.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\inform.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nk.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\q1.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xd.dat (Malware.Trace) -> Quarantined and deleted successfully.

Essexboy

Post #11July 13, 2010, 7:01 PM UTC

Do you have any further problems ?

ramsayross

Post #12July 13, 2010, 8:27 PM UTC

yeah, my shoulder aches and it hurts when i laugh.

No more problems on the computer though. One more thing ,Can I run the Malware programme and carry out a scan myself, and then click "remove selected"? And I have been using Norton Internet Security and paying around £30 a year subscription since 2002. lots of people tell me Norton is no good but apart from the last hiccup I have never had a noticable problem with anything. any advice regarding security would be appreciated

Essexboy

Post #13July 13, 2010, 10:25 PM UTC

For sure I would recommend that you keep MBAM and use it weekly. Antivirus programmes are as far as I am concerned a personal choice, it is the one you are happy with

I will remove my tools now and give some recommendations, but I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day —– Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS] 
[Reboot]

[*]Then click the Run Fix button at the top

[*]Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

[external image: Posted Image] Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 21.
Click the "Download" button to the right.
Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-6u21-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u21-windows-i586-p.exe and select "Run as an Administrator.")

SPRING CLEAN

Download and run Puran Disc Defragmenter

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

SpywareBlaster to help prevent spyware from installing in the first place.
[external image: Posted Image] Malwarebytes. Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

P.S. Can't do anything about the shoulder I'm afraid

ramsayross

Post #14July 14, 2010, 10:42 AM UTC

Ok, I have done all that you recommended and everything works fine. Thanks once again for your help, it has been fascinating, and it would be interesting to delve a little deeper into the workings of computers, but for now I think I will stay this side of the window, as it all looks to complex for me on the other side. oopps! mind your head on that aircraft hanger door now!

regards ramsayross

Essexboy

Post #15July 14, 2010, 7:27 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

"Windows cannot find "logon.exe" problem

✨ Ask AI

Ask AI