What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer Slow even locks up. DDS attached.

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
My computer recently started running slow when applications are opened. I had HP replace the hard drive since it was still under warranty. The laptop is one year old. The physical memory is zero when the computer lags. It suddenly freezes, then completes the action. I've enclosed a DDS.

Attachments:

Post #2
Hi

You have posted the Attach.txt

we need the DDS log, plus I need you to run GMER as well,

I'll give the full instructions for both

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT




Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


NEXT

Please run the following as well.

Please download MBRCheck.exe to your desktop.
  • Double click MBRCheck.exe to run it
  • right click on the top title bar (where program name and path is written)
  • From the drop down menu chose Edit then Select All
  • Click the Enter key on the keyboard > this will copy the selected text to the clipboard
  • In your reply > right click in the reply window and paste the copied text
Post #3
Thank you so much for helping me! I tried 3 times to zip the attach.txt file but it wouldn't zip so i just attached the attach.txt instead. I hope this is okay. DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 19:11:34.67 on Wed 07/14/2010 Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_20 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3002.1020 [GMT -7:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Program Files\CA\CA Internet Security Suite\ccEvtMgr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\System32\igfxpers.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\CA\CA Internet Security Suite\casc.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\SMINST\BLService.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\WINDOWS\System32\mdmcls32.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.62087633\Light\CAGlobalLight.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\wsqmcons.exe C:\Program Files\BitTorrent\BitTorrent.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Windows\system32\UI0Detect.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Byron\Downloads\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: CA Toolbar Helper: {fbf2401b-7447-4727-be5d-c19b2075ca84} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.62087633\toolbar\CallingIDIE.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll TB: CA Toolbar: {10134636-e7af-4ac5-a1dc-c7c44bb97d81} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.62087633\toolbar\CallingIDIE.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe" mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5" mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter" mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0" mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0" mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [cctray] "c:\program files\ca\ca internet security suite\casc.exe" mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll LSP: c:\windows\system32\winsflt.dll LSP: c:\windows\system32\VetRedir.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Handler: callingid - {086D03BA-57AC-4C8E-A33D-0BAABF742411} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.62087633\toolbar\CallingIDToolbar.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: igfxcui - igfxdev.dll Notify: PFW - UmxWnp.Dll AppInit_DLLs: UmxSbxExw.dll SEH: ShellHook Class: {1869181a-9f50-4fcf-8bff-1b8588ecb85c} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.62087633\linkadvisor\CIDLinkAdvisor.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ================= FIREFOX =================== FF - ProfilePath - c:\users\byron\appdata\roaming\mozilla\firefox\profiles\g0fqu48y.default\ FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.62087633\linkadvisor\firefox\components\CallingIDLinkAdvisorGecko.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\users\byron\appdata\roaming\move networks\plugins\npqmp071701000002.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 KmxAMRT;KmxAMRT;c:\windows\system32\drivers\KmxAMRT.sys [2009-12-23 132088] R0 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [2009-8-7 107512] R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2009-12-23 78840] R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [2009-9-2 53240] R1 KmxFilter;HIPS Core Filter Driver;c:\windows\system32\drivers\KmxFilter.sys [2009-6-8 58360] R2 CAISafe;CAISafe;c:\program files\ca\ca internet security suite\ca anti-virus plus\isafe.exe [2010-7-2 212992] R2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\ca\ca internet security suite\ccschedulersvc.exe [2010-7-2 206160] R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2009-8-14 150520] R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [2009-9-30 60920] R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2009-4-9 365952] R2 UmxAgent;HIPS Event Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2009-8-4 887288] R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2009-7-13 760664] R2 UmxPol;HIPS Policy Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2009-7-27 227832] R2 WinExtManager;WinSock Extention Manager;c:\windows\system32\mdmcls32.exe [2010-7-2 2347760] R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-4-9 193840] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-29 112128] R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2009-9-30 239608] S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 –> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?] S3 KmxAMVet;KmxAMVet;c:\windows\system32\drivers\KmxAMVet.sys [2009-3-27 598656] ============== File Associations =============== regfile="regedit.exe" "%1" =============== Created Last 30 ================ 2010-07-15 00:01:17 0 d—–w- c:\programdata\HP Product Assistant 2010-07-14 23:58:28 0 d—–w- c:\program files\common files\HP 2010-07-14 23:58:24 0 d—–w- c:\program files\common files\Hewlett-Packard 2010-07-14 23:57:00 1373528 —-a-r- c:\windows\hpzshl01.exe 2010-07-14 23:57:00 12054 —-a-r- c:\windows\hpwscr20.dat 2010-07-14 23:57:00 1140056 —-a-r- c:\windows\hpzmsi01.exe 2010-07-14 23:56:59 0 d—–w- c:\windows\yellowtail+1 2010-07-14 23:53:30 271704 —-a-w- c:\windows\system32\hpzids01.dll 2010-07-14 23:53:29 118272 —-a-w- c:\windows\system32\hpz3l5mu.dll 2010-07-14 23:51:34 729088 —-a-w- c:\windows\system32\hpwwiax4.dll 2010-07-14 23:51:34 593920 —-a-w- c:\windows\system32\hpwtscl3.dll 2010-07-14 23:51:34 364544 —-a-w- c:\windows\system32\hppldcoi.dll 2010-07-14 23:51:34 294912 —-a-w- c:\windows\system32\hpovst11.dll 2010-07-14 23:40:34 178295 —-a-w- c:\windows\hpwins20.dat 2010-07-14 23:38:51 0 d—–w- c:\programdata\HP 2010-07-14 03:20:12 0 d—–w- c:\program files\SpywareBlaster 2010-07-11 10:02:35 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf 2010-07-11 09:50:53 254 —-a-w- c:\windows\wininit.ini 2010-07-11 09:46:24 0 d—–w- c:\program files\ASIO4ALL v2 2010-07-11 09:45:10 225280 —-a-w- c:\windows\system32\rewire.dll 2010-07-11 09:44:50 1554944 —-a-w- c:\windows\system32\vorbis.acm 2010-07-11 09:44:22 0 d—–w- c:\program files\VstPlugins 2010-07-11 09:44:18 0 d—–w- c:\program files\Outsim 2010-07-11 09:41:48 0 d—–w- c:\program files\Image-Line 2010-07-04 10:01:54 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2010-07-04 10:01:54 49472 —-a-w- c:\windows\system32\netfxperf.dll 2010-07-04 10:01:54 297808 —-a-w- c:\windows\system32\mscoree.dll 2010-07-04 10:01:54 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2010-07-04 10:01:54 1130824 —-a-w- c:\windows\system32\dfshim.dll 2010-07-03 21:52:18 90892 —-a-w- c:\windows\system32\drivers\KmxAgent.asc 2010-07-03 17:15:06 0 d—–w- c:\program files\common files\Config 2010-07-03 17:14:34 0 d—–w- c:\program files\common files\Inet 2010-07-03 17:10:57 0 d—–w- c:\program files\common files\AnswerWorks 5.0 2010-07-03 17:10:35 4199784 —-a-w- c:\windows\system32\cdintf400.dll 2010-07-03 17:09:05 0 d—–w- c:\program files\common files\Intuit 2010-07-03 17:09:00 0 d—–w- c:\users\byron\appdata\roaming\Intuit 2010-07-03 17:09:00 0 d—–w- c:\program files\Quicken 2010-07-03 17:08:52 120 —-a-w- c:\windows\QUICKEN.INI 2010-07-03 17:08:26 0 d—–w- c:\programdata\Intuit 2010-07-03 16:48:54 0 d—–w- c:\program files\MagicISO 2010-07-03 14:29:50 0 d—–w- c:\windows\PCHEALTH 2010-07-03 14:27:13 0 d—–w- c:\program files\Microsoft Visual Studio 8 2010-07-03 10:19:24 80896 —-a-w- c:\windows\system32\MSNP.ax 2010-07-03 10:19:24 177664 —-a-w- c:\windows\system32\mpg2splt.ax 2010-07-03 10:19:22 293376 —-a-w- c:\windows\system32\psisdecd.dll 2010-07-03 10:19:21 428544 —-a-w- c:\windows\system32\EncDec.dll 2010-07-03 10:19:21 217088 —-a-w- c:\windows\system32\psisrndr.ax 2010-07-03 10:09:05 97800 —-a-w- c:\windows\system32\infocardapi.dll 2010-07-03 10:09:05 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2010-07-03 10:09:04 622080 —-a-w- c:\windows\system32\icardagt.exe 2010-07-03 10:09:04 37384 —-a-w- c:\windows\system32\infocardcpl.cpl 2010-07-03 10:09:04 11264 —-a-w- c:\windows\system32\icardres.dll 2010-07-03 10:09:03 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll 2010-07-03 10:04:15 158720 —-a-w- c:\windows\system32\mscorier.dll 2010-07-03 10:04:12 83968 —-a-w- c:\windows\system32\mscories.dll 2010-07-03 10:02:52 411136 —-a-w- c:\windows\system32\drivers\http.sys 2010-07-03 10:02:52 31232 —-a-w- c:\windows\system32\httpapi.dll 2010-07-03 10:02:52 24064 —-a-w- c:\windows\system32\nshhttp.dll 2010-07-03 10:02:08 0 d—–w- c:\program files\MSXML 4.0 2010-07-03 02:45:44 61440 —-a-w- c:\windows\system32\athihvui.dll 2010-07-03 02:45:44 397312 —-a-w- c:\windows\system32\athihvs.dll 2010-07-03 02:45:44 0 d—–w- c:\windows\system32\nn-NO 2010-07-03 02:41:13 766 —-a-w- c:\windows\system\CRIcon.ico 2010-07-02 22:51:11 108032 —-a-w- c:\windows\system32\ff_vfw.dll 2010-07-02 22:51:10 0 d—–w- c:\program files\ffdshow 2010-07-02 19:26:01 0 d—–w- c:\programdata\Logs 2010-07-02 19:25:17 95472 —-a-w- c:\windows\system32\Vetredir.dll 2010-07-02 19:25:17 201968 —-a-w- c:\windows\system32\Isafprod.dll 2010-07-02 19:25:17 128240 —-a-w- c:\windows\system32\Isafeif.dll 2010-07-02 19:23:42 0 d—–w- c:\program files\ISSThirdParty 2010-07-02 19:23:41 1054032 —-a-w- c:\windows\system32\cfgmig32.dll 2010-07-02 19:04:05 5845744 —-a-w- c:\windows\system32\win32cpr.dll 2010-07-02 19:04:05 286208 —-a-w- c:\windows\system32\winsfinst.exe 2010-07-02 19:04:05 2385136 —-a-w- c:\windows\system32\winsflt_x64.dll 2010-07-02 19:04:05 2347760 —-a-w- c:\windows\system32\mdmcls32.exe 2010-07-02 19:04:05 200704 —-a-w- c:\windows\system32\ssleay32.dll 2010-07-02 19:04:05 1872624 —-a-w- c:\windows\system32\winsflt.dll 2010-07-02 19:04:05 1377008 —-a-w- c:\windows\system32\svcprs32.exe 2010-07-02 19:04:05 1028096 —-a-w- c:\windows\system32\libeay32.dll 2010-07-02 19:04:04 2654208 —-a-w- c:\windows\system32\winsflte.dll 2010-07-02 19:04:03 7440 —-a-w- c:\windows\system32\sporder.dll 2010-07-02 19:04:03 0 d—–w- c:\windows\rnapxs 2010-07-02 19:02:01 0 d—–w- c:\program files\CA 2010-07-02 18:31:09 0 d—–w- c:\program files\CCleaner 2010-07-02 10:15:49 213504 —-a-w- c:\windows\system32\msv1_0.dll 2010-07-02 10:14:59 160256 —-a-w- c:\windows\system32\wkssvc.dll 2010-07-02 10:13:57 268288 —-a-w- c:\windows\system32\schannel.dll 2010-07-02 09:19:38 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-07-02 04:40:40 0 d—–w- c:\programdata\Yahoo! 2010-07-02 04:39:04 0 d—–w- c:\program files\Yahoo! 2010-07-02 03:25:13 0 d—–w- c:\program files\VideoLAN 2010-07-02 02:36:41 0 d—–w- c:\users\byron\appdata\roaming\BitTorrent 2010-07-02 02:34:39 0 d—–w- c:\program files\Ask.com 2010-07-02 02:34:35 0 d—–w- c:\program files\BitTorrent 2010-07-02 02:17:56 0 d—–w- c:\programdata\Sun 2010-07-02 02:17:43 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-07-02 02:04:01 0 d—–w- c:\programdata\CA 2010-07-02 01:57:52 0 d—–w- c:\programdata\CA-SupportBridge 2010-07-02 01:49:31 0 d—a-w- c:\windows\SMINST 2010-07-02 01:45:29 171520 —-a-w- c:\windows\system32\wintrust.dll 2010-07-02 01:45:28 98304 —-a-w- c:\windows\system32\cabview.dll 2010-07-02 01:41:07 2421760 —-a-w- c:\windows\system32\wucltux.dll 2010-07-02 01:40:54 87552 —-a-w- c:\windows\system32\wudriver.dll 2010-07-02 01:40:42 33792 —-a-w- c:\windows\system32\wuapp.exe 2010-07-02 01:40:42 171608 —-a-w- c:\windows\system32\wuwebv.dll 2010-07-02 01:37:26 0 d—–w- c:\users\byron\appdata\roaming\HP TCS 2010-07-02 01:36:05 0 –sha-r- c:\windows\system32\drivers\103C_HP_cNB_G60 Notebook PC_Y5335KV_0U_Q2CE9211DW5_E508165-002_4A_I3612_SWistron_V09.54_F.38_T090416_WV3-1_L409_M3003_J320_7Intel_867A_92.00_#100701_N10EC8136;168C002A_(NW142UA#ABA)_XMO BILE_CN10_Z_2F.38.MRK 2010-07-02 01:30:41 0 d-sh–w- C:\$RECYCLE.BIN 2010-07-02 01:27:30 0 d—–w- c:\program files\muvee Technologies 2010-07-02 01:27:23 0 d—–w- c:\program files\common files\muvee Technologies 2010-07-02 01:22:51 82432 —-a-w- c:\windows\system32\msxml4r.dll 2010-07-02 01:22:51 44544 —-a-w- c:\windows\system32\msxml4a.dll 2010-07-02 01:22:31 89088 ——w- c:\windows\system32\atl71.dll 2010-07-02 01:21:26 16070 —-a-w- c:\windows\system32\results.xml 2010-07-02 01:02:43 6815264 —-a-w- c:\windows\system\DriveIcon.dll 2010-07-02 01:02:43 64512 —-a-w- c:\windows\system32\drivers\RTSTOR.sys 2010-07-02 01:02:43 5430 —-a-w- c:\windows\system\MyMulti.ico 2010-07-02 01:00:45 920088 —-a-w- c:\windows\system32\igxpun.exe 2010-07-02 01:00:45 319456 —-a-w- c:\windows\system32\difxapi.dll 2010-07-02 01:00:45 0 d—–w- c:\windows\system32\Lang 2010-07-02 01:00:44 0 d—–w- C:\Intel 2010-07-02 01:00:29 0 d—–w- c:\program files\NetWaiting 2010-07-02 01:00:16 0 d—–w- c:\program files\CONEXANT 2010-07-02 00:59:34 123904 —-a-w- c:\windows\system32\drivers\Rtlh86.sys 2010-07-02 00:59:34 0 d—–w- c:\program files\Realtek 2010-07-02 00:59:26 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf 2010-07-02 00:59:07 0 d—–w- c:\program files\Synaptics 2010-07-02 00:58:03 53248 —-a-w- c:\windows\system32\CSVer.dll 2010-07-02 00:57:16 1093120 —-a-w- c:\windows\system32\drivers\athr.sys 2010-07-02 00:57:16 0 d—–w- c:\program files\Atheros 2010-07-02 00:57:13 0 d—–w- c:\programdata\Atheros ==================== Find3M ==================== 2010-07-14 23:54:39 86016 —-a-w- c:\windows\inf\infstrng.dat 2010-07-14 23:54:39 51200 —-a-w- c:\windows\inf\infpub.dat 2010-07-14 23:53:53 86016 —-a-w- c:\windows\inf\infstor.dat 2010-07-03 10:03:43 98504 —-a-w- c:\windows\fonts\consola.ttf 2010-07-02 01:23:17 505392 —-a-w- c:\windows\system32\msvcp71.dll 2010-07-02 01:23:17 353840 —-a-w- c:\windows\system32\msvcr71.dll 2010-07-02 01:23:17 1053232 —-a-w- c:\windows\system32\MFC71u.dll 2010-07-02 01:23:16 1066544 —-a-w- c:\windows\system32\MFC71.dll 2010-05-26 16:16:50 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-05-26 14:25:15 289792 —-a-w- c:\windows\system32\atmfd.dll 2010-05-04 18:42:57 833024 —-a-w- c:\windows\system32\wininet.dll 2010-05-04 18:37:45 78336 —-a-w- c:\windows\system32\ieencode.dll 2010-05-04 16:53:56 26624 —-a-w- c:\windows\system32\ieUnatt.exe 2010-05-01 13:53:49 2036224 —-a-w- c:\windows\system32\win32k.sys 2010-04-23 13:55:52 2048 —-a-w- c:\windows\system32\tzres.dll 2010-04-16 16:10:05 1314816 —-a-w- c:\windows\system32\quartz.dll 2010-04-16 16:05:50 28672 —-a-w- c:\windows\system32\Apphlpdm.dll 2010-04-16 14:17:56 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-04-09 10:32:47 665600 —-a-w- c:\windows\inf\drvindex.dat 2008-01-21 02:43:21 174 –sha-w- c:\program files\desktop.ini 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-04-09 10:32:46 8192 –sha-w- c:\windows\users\default\NTUSER.DAT ============= FINISH: 19:13:11.07 =============== MBRCheck, version 1.1.0 © 2010, AD \\.\C: –> \\.\PhysicalDrive0 \\.\D: –> \\.\PhysicalDrive0 Size Device Name MBR Status ——————————————– 298 GB \\.\PhysicalDrive0 Unknown MBR code Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: y Options: [1] Dump the MBR of a physical disk to file. [2] Restore the MBR of a physical disk with a standard boot code. [3] Exit. Enter your choice:
Post #4
Hi

Please do the following

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #5
ComboFix 10-07-15.01 - Byron 07/15/2010 12:02:39.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3002.1663 [GMT -7:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\athihvui.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-15 to 2010-07-15 )))))))))))))))))))))))))))))))
.

2010-07-15 19:14 . 2010-07-15 19:14 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-07-15 05:19 . 2010-07-15 05:19 ——– d—–w- c:\users\Byron\AppData\Local\HP
2010-07-15 04:47 . 2010-07-15 04:47 ——– d—–w- c:\programdata\Gtek
2010-07-15 04:46 . 2010-07-15 04:46 ——– d—–w- c:\users\Byron\AppData\Roaming\GTek
2010-07-15 04:43 . 2010-07-15 05:20 ——– d—–w- c:\users\Byron\AppData\Roaming\HP
2010-07-15 04:42 . 2010-07-15 04:42 ——– d—–w- c:\programdata\WEBREG
2010-07-15 03:25 . 2010-07-15 03:25 ——– d—–w- c:\programdata\WindowsSearch
2010-07-15 02:53 . 2010-07-15 02:53 93056 —-a-w- C:\aglcqpog.sys
2010-07-15 02:41 . 2010-07-15 18:50 ——– d—–w- c:\programdata\WinZip
2010-07-15 00:36 . 2007-11-07 02:15 1140056 ——w- c:\programdata\HP\Installer\Temp\hpzmsi01.exe
2010-07-15 00:36 . 2007-05-03 03:28 319984 ——w- c:\programdata\HP\Installer\Temp\difxapi.dll
2010-07-15 00:34 . 2010-07-15 00:34 544652 —-a-w- c:\programdata\HP\Installer\Temp\ENU-Package.exe
2010-07-15 00:01 . 2010-07-15 00:01 ——– d—–w- c:\programdata\HP Product Assistant
2010-07-14 23:58 . 2010-07-14 23:58 ——– d—–w- c:\program files\Common Files\HP
2010-07-14 23:58 . 2010-07-14 23:58 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2010-07-14 23:57 . 2008-01-08 12:44 12054 —-a-r- c:\windows\hpwscr20.dat
2010-07-14 23:57 . 2007-11-07 02:15 1140056 —-a-r- c:\windows\hpzmsi01.exe
2010-07-14 23:57 . 2007-11-07 02:04 1373528 —-a-r- c:\windows\hpzshl01.exe
2010-07-14 23:56 . 2010-07-14 23:57 ——– d—–w- c:\windows\yellowtail+1
2010-07-14 23:54 . 2007-12-04 01:55 278016 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp5mu.dll
2010-07-14 23:53 . 2007-11-07 02:10 271704 —-a-w- c:\windows\system32\hpzids01.dll
2010-07-14 23:53 . 2007-12-04 01:57 118272 —-a-w- c:\windows\system32\hpz3l5mu.dll
2010-07-14 23:51 . 2007-10-31 10:35 729088 —-a-w- c:\windows\system32\hpwwiax4.dll
2010-07-14 23:51 . 2007-10-31 10:35 593920 —-a-w- c:\windows\system32\hpwtscl3.dll
2010-07-14 23:51 . 2007-01-17 16:37 364544 —-a-w- c:\windows\system32\hppldcoi.dll
2010-07-14 23:51 . 2007-01-17 16:31 294912 —-a-w- c:\windows\system32\hpovst11.dll
2010-07-14 23:40 . 2010-07-15 05:30 178408 —-a-w- c:\windows\hpwins20.dat
2010-07-14 23:38 . 2010-07-15 04:39 ——– d—–w- c:\programdata\HP
2010-07-14 03:20 . 2010-07-14 03:23 ——– d—–w- c:\program files\SpywareBlaster
2010-07-14 01:23 . 2010-07-14 01:23 143976 —-a-w- c:\users\Byron\AppData\Roaming\Move Networks\uninstall.exe
2010-07-14 01:23 . 2010-07-14 01:23 ——– d—–w- c:\users\Byron\AppData\Roaming\Move Networks
2010-07-11 10:01 . 2010-07-11 10:01 ——– d—–w- c:\users\Default\AppData\Local\Microsoft Help
2010-07-11 09:46 . 2010-07-11 09:46 ——– d—–w- c:\program files\ASIO4ALL v2
2010-07-11 09:45 . 2006-06-20 08:56 225280 —-a-w- c:\windows\system32\rewire.dll
2010-07-11 09:44 . 2010-07-11 09:45 ——– d—–w- c:\program files\VstPlugins
2010-07-11 09:44 . 2010-07-11 09:44 ——– d—–w- c:\program files\Outsim
2010-07-11 09:41 . 2010-07-11 09:45 ——– d—–w- c:\program files\Image-Line
2010-07-11 07:14 . 2010-07-11 07:14 ——– d—–w- c:\users\Byron\AppData\Local\Qurb4
2010-07-04 20:05 . 2010-07-04 20:07 ——– d—–w- c:\users\Byron\AppData\Local\Adobe
2010-07-04 10:01 . 2009-11-08 17:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-07-04 10:01 . 2009-11-08 17:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-07-04 10:01 . 2009-11-08 17:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-07-04 10:01 . 2009-11-08 17:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-07-04 10:01 . 2009-11-08 17:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-07-03 19:16 . 2007-10-23 16:27 110592 —-a-w- c:\users\Byron\AppData\Roaming\U3\temp\cleanup.exe
2010-07-03 17:49 . 2007-10-23 16:22 3350528 —ha-w- c:\users\Byron\AppData\Roaming\U3\temp\Launchpad Removal.exe
2010-07-03 17:49 . 2010-07-11 23:32 ——– d—–w- c:\users\Byron\AppData\Roaming\U3
2010-07-03 17:15 . 2010-07-03 17:16 ——– d—–w- c:\program files\Common Files\Config
2010-07-03 17:14 . 2010-07-03 17:14 ——– d—–w- c:\program files\Common Files\Inet
2010-07-03 17:13 . 2010-07-03 17:13 7410688 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\191319-191429.dll
2010-07-03 17:12 . 2010-07-03 17:12 6301696 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\191127-191222.dll
2010-07-03 17:12 . 2010-07-03 17:12 5487616 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\19188-191916.dll
2010-07-03 17:12 . 2010-07-03 17:12 5686272 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\19153-191714.dll
2010-07-03 17:12 . 2010-07-03 17:12 2812928 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\191916-191106.dll
2010-07-03 17:12 . 2010-07-03 17:12 2844160 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\191714-19188.dll
2010-07-03 17:11 . 2010-07-03 17:11 7032320 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\191222-191319.dll
2010-07-03 17:11 . 2010-07-03 17:11 243032 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\QWPATCH.EXE
2010-07-03 17:11 . 2010-07-03 17:11 956 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\rebase.cmd
2010-07-03 17:11 . 2010-07-03 17:11 2776576 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\191429-19153.dll
2010-07-03 17:11 . 2010-07-03 17:11 230752 —-a-w- c:\programdata\Intuit\Quicken\Inet\Common\patch\Update\patchw32.dll
2010-07-03 17:10 . 2010-07-03 17:10 ——– d—–w- c:\program files\Common Files\AnswerWorks 5.0
2010-07-03 17:10 . 2009-09-08 19:42 4199784 —-a-w- c:\windows\system32\cdintf400.dll
2010-07-03 17:10 . 2009-09-08 19:40 26472 —-a-w- c:\programdata\Intuit\Quicken\Sku\RPM\Custom\billmind.exe
2010-07-03 17:10 . 2009-09-08 19:40 26472 —-a-w- c:\programdata\Intuit\Quicken\Sku\Premier\Custom\billmind.exe
2010-07-03 17:10 . 2009-09-08 19:40 26472 —-a-w- c:\programdata\Intuit\Quicken\Sku\Hab\Custom\billmind.exe
2010-07-03 17:10 . 2009-09-08 19:40 26472 —-a-w- c:\programdata\Intuit\Quicken\Sku\Deluxe\Custom\billmind.exe
2010-07-03 17:09 . 2010-07-03 17:09 ——– d—–w- c:\program files\Common Files\Intuit
2010-07-03 17:09 . 2010-07-03 17:17 ——– d—–w- c:\program files\Quicken
2010-07-03 17:09 . 2010-07-03 17:09 ——– d—–w- c:\users\Byron\AppData\Roaming\Intuit
2010-07-03 17:08 . 2010-07-03 17:08 ——– d—–w- c:\programdata\Intuit
2010-07-03 16:48 . 2010-07-03 16:48 ——– d—–w- c:\program files\MagicISO
2010-07-03 16:39 . 2010-07-03 16:39 ——– d—–w- c:\users\Byron\AppData\Roaming\CyberLink
2010-07-03 16:38 . 2010-07-03 16:39 ——– d—–w- c:\users\Public\CyberLink
2010-07-03 14:29 . 2010-07-03 14:29 ——– d—–w- c:\windows\PCHEALTH
2010-07-03 14:29 . 2010-07-03 14:29 ——– d—–w- c:\program files\Microsoft.NET
2010-07-03 14:27 . 2010-07-03 14:27 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2010-07-03 14:25 . 2010-07-03 14:25 ——– d—–w- c:\users\Byron\AppData\Local\Microsoft Help
2010-07-03 14:23 . 2010-07-03 14:23 ——– d—–r- C:\MSOCache
2010-07-03 10:19 . 2010-04-14 17:47 293376 —-a-w- c:\windows\system32\psisdecd.dll
2010-07-03 10:19 . 2010-04-14 17:46 428544 —-a-w- c:\windows\system32\EncDec.dll
2010-07-03 10:09 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-07-03 10:09 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2010-07-03 10:09 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2010-07-03 10:09 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2010-07-03 10:09 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2010-07-03 10:04 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2010-07-03 10:04 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2010-07-03 10:02 . 2010-02-20 23:39 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-07-03 10:02 . 2010-02-20 23:37 31232 —-a-w- c:\windows\system32\httpapi.dll
2010-07-03 10:02 . 2010-02-20 21:18 411136 —-a-w- c:\windows\system32\drivers\http.sys
2010-07-03 10:02 . 2010-07-03 10:02 ——– d—–w- c:\program files\MSXML 4.0
2010-07-03 02:45 . 2010-07-03 03:07 ——– d—–w- c:\windows\system32\nn-NO
2010-07-03 02:45 . 2009-05-18 23:22 397312 —-a-w- c:\windows\system32\athihvs.dll
2010-07-03 02:40 . 2010-07-03 02:40 ——– d—–w- c:\users\Byron\AppData\Roaming\InstallShield
2010-07-02 22:51 . 2010-05-25 03:33 108032 —-a-w- c:\windows\system32\ff_vfw.dll
2010-07-02 22:51 . 2010-07-02 22:51 ——– d—–w- c:\program files\ffdshow
2010-07-02 19:26 . 2010-07-02 19:26 ——– d—–w- c:\programdata\Logs
2010-07-02 19:25 . 2010-03-20 09:46 201968 —-a-w- c:\windows\system32\Isafprod.dll
2010-07-02 19:25 . 2010-03-20 09:46 95472 —-a-w- c:\windows\system32\Vetredir.dll
2010-07-02 19:25 . 2010-03-20 09:46 128240 —-a-w- c:\windows\system32\Isafeif.dll
2010-07-02 19:23 . 2010-07-02 19:23 ——– d—–w- c:\program files\ISSThirdParty
2010-07-02 19:23 . 2010-04-06 12:15 1054032 —-a-w- c:\windows\system32\cfgmig32.dll
2010-07-02 19:04 . 2010-07-02 19:04 5845744 —-a-w- c:\windows\system32\win32cpr.dll
2010-07-02 19:04 . 2010-07-02 19:04 1872624 —-a-w- c:\windows\system32\winsflt.dll
2010-07-02 19:04 . 2010-03-01 02:38 286208 —-a-w- c:\windows\system32\winsfinst.exe
2010-07-02 19:04 . 2010-03-01 02:37 1377008 —-a-w- c:\windows\system32\svcprs32.exe
2010-07-02 19:04 . 2010-03-01 02:36 2385136 —-a-w- c:\windows\system32\winsflt_x64.dll
2010-07-02 19:04 . 2010-03-01 02:33 2347760 —-a-w- c:\windows\system32\mdmcls32.exe
2010-07-02 19:04 . 2007-08-25 23:56 200704 —-a-w- c:\windows\system32\ssleay32.dll
2010-07-02 19:04 . 2007-08-25 23:56 1028096 —-a-w- c:\windows\system32\libeay32.dll
2010-07-02 19:04 . 2010-03-01 02:13 2654208 —-a-w- c:\windows\system32\winsflte.dll
2010-07-02 19:04 . 2010-07-02 19:04 ——– d—–w- c:\windows\rnapxs
2010-07-02 19:04 . 2002-01-01 20:02 7440 —-a-w- c:\windows\system32\sporder.dll
2010-07-02 19:02 . 2010-07-02 19:24 ——– d—–w- c:\program files\CA
2010-07-02 18:31 . 2010-07-02 18:31 ——– d—–w- c:\program files\CCleaner
2010-07-02 10:15 . 2009-09-10 17:30 213504 —-a-w- c:\windows\system32\msv1_0.dll
2010-07-02 10:14 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll
2010-07-02 10:13 . 2008-11-27 04:43 268288 —-a-w- c:\windows\system32\schannel.dll
2010-07-02 09:19 . 2010-05-21 21:14 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-07-02 04:43 . 2010-07-02 04:43 ——– d—–w- c:\users\Byron\AppData\Local\Yahoo
2010-07-02 04:40 . 2010-07-02 04:43 ——– d—–w- c:\users\Byron\AppData\Roaming\Yahoo!
2010-07-02 04:40 . 2010-07-02 04:40 ——– d—–w- c:\programdata\Yahoo!
2010-07-02 04:40 . 2010-06-01 17:32 607544 —-a-w- c:\programdata\Yahoo!\YUpdater\yupdater.exe
2010-07-02 04:39 . 2010-07-03 10:52 ——– d—–w- c:\program files\Yahoo!
2010-07-02 03:26 . 2010-07-12 18:32 ——– d—–w- c:\users\Byron\AppData\Roaming\vlc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-14 23:56 . 2009-04-09 11:30 ——– d—–w- c:\program files\HP
2010-07-14 23:55 . 2009-04-09 10:13 ——– d—–w- c:\programdata\Hewlett-Packard
2010-07-14 10:04 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-07-14 10:03 . 2009-04-09 11:12 ——– d—–w- c:\programdata\Microsoft Help
2010-07-14 01:23 . 2009-10-15 00:50 5642688 —-a-w- c:\users\Byron\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
2010-07-12 22:38 . 2009-04-09 11:26 ——– d—–w- c:\program files\Microsoft Silverlight
2010-07-11 10:14 . 2009-04-09 10:59 ——– d—–w- c:\program files\Microsoft Works
2010-07-11 10:02 . 2010-07-11 10:02 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-07-05 02:15 . 2009-04-09 11:16 ——– d—–w- c:\program files\Common Files\Adobe
2010-07-03 17:10 . 2009-04-09 10:13 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-03 16:38 . 2009-04-09 11:17 ——– d—–w- c:\programdata\CyberLink
2010-07-03 14:31 . 2006-11-02 12:37 ——– d—–w- c:\program files\MSBuild
2010-07-02 02:17 . 2009-04-09 11:27 ——– d—–w- c:\program files\Common Files\Java
2010-07-02 02:17 . 2009-04-09 11:27 ——– d—–w- c:\program files\Java
2010-07-02 02:09 . 2009-04-09 10:15 ——– d—–w- c:\programdata\Norton
2010-07-02 01:41 . 2009-04-09 11:31 ——– d—–w- c:\program files\SMINST
2010-07-02 01:37 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Sidebar
2010-07-02 01:36 . 2010-07-02 01:36 0 –sha-r- c:\windows\system32\drivers\103C_HP_cNB_G60 Notebook PC_Y5335KV_0U_Q2CE9211DW5_E508165-002_4A_I3612_SWistron_V09.54_F.38_T090416_WV3-1_L409_M3003_J320_7Intel_867A_92.00_#100701_N10EC8136;168C002A_(NW142UA#ABA)_XMO
BILE_CN10_Z_2F.38.MRK
2010-07-02 01:26 . 2009-04-09 11:17 ——– d—–w- c:\program files\CyberLink
2010-07-02 01:23 . 2009-04-09 11:17 1053232 —-a-w- c:\windows\system32\MFC71u.dll
2010-07-02 01:23 . 2008-08-06 22:29 353840 —-a-w- c:\windows\system32\msvcr71.dll
2010-07-02 01:23 . 2008-08-06 22:27 505392 —-a-w- c:\windows\system32\msvcp71.dll
2010-07-02 01:23 . 2009-04-09 11:17 1066544 —-a-w- c:\windows\system32\MFC71.dll
2010-07-02 01:23 . 2009-04-09 11:17 36864 —-a-w- c:\programdata\Temp\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
2010-07-02 01:22 . 2009-04-09 10:13 ——– d—–w- c:\program files\Common Files\InstallShield
2010-07-02 01:22 . 2009-04-09 09:59 ——– d—–w- c:\program files\Hewlett-Packard
2010-07-02 00:59 . 2010-07-02 00:59 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2010-06-09 08:06 . 2010-06-09 08:06 976832 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 —-a-w- c:\programdata\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
2010-05-26 22:24 . 2010-07-03 02:19 18488 —-a-w- c:\windows\Help\OEM\scripts\HPHC_BUY_BATTERY.exe
2010-05-26 16:16 . 2010-07-02 10:14 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:25 . 2010-07-02 10:14 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-05-04 18:42 . 2010-07-02 10:14 833024 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 18:37 . 2010-07-02 10:14 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-05-04 16:53 . 2010-07-02 10:14 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 13:53 . 2010-07-02 10:13 2036224 —-a-w- c:\windows\system32\win32k.sys
2010-04-23 13:55 . 2010-07-02 10:15 2048 —-a-w- c:\windows\system32\tzres.dll
2009-04-09 10:32 . 2009-04-09 10:25 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 22:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 145944]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-11-15 218408]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"cctray"="c:\program files\CA\CA Internet Security Suite\casc.exe" [2010-04-09 1721680]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= "c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.62087633\LinkAdvisor\CIDLinkAdvisor.dll" [2010-03-22 1852856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2009-03-27 22:27 79368 —-a-w- c:\windows\System32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\UmxSbxExw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
2008-09-30 23:56 972080 —-a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
2007-08-22 23:31 80896 —-a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 17:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-08-01 23:14 202032 —-a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
R3 KmxAMVet;KmxAMVet;c:\windows\system32\Drivers\KmxAMVet.sys [2009-03-27 598656]
S0 KmxAMRT;KmxAMRT;c:\windows\system32\DRIVERS\KmxAMRT.sys [2009-12-23 132088]
S0 KmxFw;KmxFw;c:\windows\System32\DRIVERS\kmxfw.sys [2009-08-07 107512]
S1 KmxAgent;KmxAgent;c:\windows\system32\DRIVERS\kmxagent.sys [2009-12-23 78840]
S1 KmxFile;KmxFile;c:\windows\system32\DRIVERS\KmxFile.sys [2009-09-03 53240]
S1 KmxFilter;HIPS Core Filter Driver;c:\windows\system32\DRIVERS\KmxFilter.sys [2009-06-08 58360]
S2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\CA\CA Internet Security Suite\ccschedulersvc.exe [2010-04-06 206160]
S2 KmxCF;KmxCF;c:\windows\system32\DRIVERS\KmxCF.sys [2009-08-14 150520]
S2 KmxSbx;KmxSbx;c:\windows\system32\DRIVERS\KmxSbx.sys [2009-09-30 60920]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]
S2 UmxAgent;HIPS Event Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [2009-08-04 887288]
S2 UmxCfg;HIPS Configuration Interpreter;c:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [2009-07-13 760664]
S2 UmxPol;HIPS Policy Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [2009-07-27 227832]
S2 WinExtManager;WinSock Extention Manager;c:\windows\System32\mdmcls32.exe [2010-03-01 2347760]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-29 112128]
S3 KmxCfg;KmxCfg;c:\windows\system32\DRIVERS\kmxcfg.sys [2009-09-30 239608]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\winsflt.dll
LSP: c:\windows\system32\VetRedir.dll
Handler: callingid - {086D03BA-57AC-4C8E-A33D-0BAABF742411} - c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.62087633\Toolbar\CallingIDToolbar.dll
FF - ProfilePath - c:\users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\g0fqu48y.default\
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.62087633\LinkAdvisor\Firefox\components\CallingIDLinkAdvisorGecko.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\users\Byron\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-15 12:19
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-07-15 12:25:12
ComboFix-quarantined-files.txt 2010-07-15 19:25

Pre-Run: 221,444,120,576 bytes free
Post-Run: 221,836,148,736 bytes free

- - End Of File - - 707EBA155187091EAC1A2646FEE3C7F2
Post #6 last edited
Hi

Please do the following:


  • Run MBRCheck.exe
  • Wait until you see the following line: Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Please push the 'Y' key and then press Enter
  • When program ask you Enter your choice: enter 2 and press the Enter key
  • Now the program will ask you "Enter the physical disk number to fix (0-99, -1 to cancel):"
  • Enter 0 and press the Enter key.
  • The program will show Available MBR codes:, followed by a list of operating systems.  Please enter 3 for Windows Vista, and then press Enter.
  • The program will prompt for confirmation.  Type 'YES' and hit Enter.
  • Left click on the title bar (where program name and path is written).
  • From menu chose Edit -> Select All
  • Hit the Enter key on your keyboard to copy selected text.
  • Paste that text into Notepad, save it to your desktop as "MBRCheck results.txt"
  • Restart your PC.
  • Post the text in "MBRCheck results.txt" here, please.
Post #7
MBRCheck, version 1.1.0 © 2010, AD \\.\C: –> \\.\PhysicalDrive0 \\.\D: –> \\.\PhysicalDrive0 Size Device Name MBR Status ——————————————– 298 GB \\.\PhysicalDrive0 Unknown MBR code Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: y Options: [1] Dump the MBR of a physical disk to file. [2] Restore the MBR of a physical disk with a standard boot code. [3] Exit. Enter your choice: 2 Enter the physical disk number to fix (0-99, -1 to cancel): 0 Available MBR codes: [ 0] Default (Windows Vista) [ 1] Windows XP [ 2] Windows Server 2003 [ 3] Windows Vista [ 4] Windows 2008 [ 5] Windows 7 [-1] Cancel Please select the MBR code to write to this drive: 3 Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue:
Post #8
Hi,

That's not the log I expected,

did you hit yes to have it fix the MBR?

Please reboot the computer and run the initial scan again.

thanks
Post #9
When I rebooted my computer, it would not load Windows. I had to use my System Recovery disks. Now, my computer says it only has 35 Gigs on it. I'm not quite sure what's happened, or what I need to do now.
Post #10
Hi

Your MBR was very seriously infected, and unfortunately this can happen occasionally

Lets see if we can find out what has happened and hopefully rectify the situation

Please run the following program:




Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in


    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.
Post #11
I'm glad you know what to do because I got really nervous after formatting the hard drive again and having only 38 of 58 Gigs, when I'm supposed to have 320 Gigs.


OTL logfile created on: 7/15/2010 7:38:53 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Administrator\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 53.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 58.00 Gb Total Space | 35.05 Gb Free Space | 60.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 10.92 Gb Total Space | 1.82 Gb Free Space | 16.70% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WIN-V3IINXB1IAT
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\16.0.0.125\InstStub.exe (Symantec Corporation)
PRC - c:\Program Files\MSN\Toolbar\3.0.0541.0\msntask.exe (Microsoft Corp.)
PRC - C:\WINDOWS\System32\wsqmcons.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Norton Internet Security) – C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (Recovery Service for Windows) – C:\Program Files\SMINST\BLService.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\System32\drivers\NIS\1000000.07D\srtsp.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS (Symantec Corporation)
DRV - (SRTSPX) – C:\WINDOWS\System32\drivers\NIS\1000000.07D\srtspx.sys (Symantec Corporation)
DRV - (athr) – C:\WINDOWS\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTSTOR) – C:\WINDOWS\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (igfx) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (IntcHdmiAddService) Intel® – C:\WINDOWS\System32\drivers\IntcHdmi.sys (Intel® Corporation)
DRV - (RTL8169) – C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (CnxtHdAudService) – C:\WINDOWS\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (SynTP) – C:\WINDOWS\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (NETw3v32) Intel® – C:\WINDOWS\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (HSF_DPV) – C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) – C:\WINDOWS\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (HpqKbFiltr) – C:\WINDOWS\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (yukonwlh) – C:\WINDOWS\System32\drivers\yk60x86.sys (Marvell)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2006/09/18 14:41:30 | 000,000,761 | —- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 90 Days ==========

[2010/07/15 19:37:21 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Administrator\Desktop\OTL.exe
[2010/07/15 17:03:16 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Roaming\U3
[2010/07/15 16:37:16 | 000,000,000 | —D | C] – C:\Windows\System32\x64
[2010/07/15 16:28:02 | 000,000,000 | —D | C] – C:\Windows\SMINST
[2010/07/15 16:27:46 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2010/07/15 16:10:36 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/07/15 16:07:19 | 000,000,000 | —D | C] – C:\Program Files\muvee Technologies
[2010/07/15 16:07:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\muvee Technologies
[2010/07/15 16:02:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\LightScribe
[2010/07/15 15:40:27 | 000,000,000 | —D | C] – C:\Windows\System32\Lang
[2010/07/15 15:40:26 | 000,000,000 | —D | C] – C:\Intel
[2010/07/15 15:40:13 | 000,000,000 | —D | C] – C:\Program Files\NetWaiting
[2010/07/15 15:40:13 | 000,000,000 | —D | C] – C:\Users\Administrator\AppData\Local\BVRP Software
[2010/07/15 15:39:59 | 000,000,000 | —D | C] – C:\Program Files\CONEXANT
[2010/07/15 15:38:39 | 000,123,904 | —- | C] (Realtek Corporation ) – C:\Windows\System32\drivers\Rtlh86.sys
[2010/07/15 15:38:38 | 000,000,000 | —D | C] – C:\Program Files\Realtek
[2010/07/15 15:38:12 | 000,000,000 | —D | C] – C:\Program Files\Synaptics
[2010/07/15 15:37:04 | 000,053,248 | —- | C] (Windows XP Bundled build C-Centric Single User) – C:\Windows\System32\CSVer.dll
[2010/07/15 15:37:04 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2010/07/15 15:36:21 | 001,093,120 | —- | C] (Atheros Communications, Inc.) – C:\Windows\System32\drivers\athr.sys
[2010/07/15 15:36:21 | 000,000,000 | —D | C] – C:\Program Files\Atheros
[2010/07/15 15:36:19 | 000,000,000 | —D | C] – C:\ProgramData\Atheros
[2010/07/15 15:32:37 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2010/07/15 15:30:19 | 000,000,000 | —D | C] – C:\Windows\Prefetch

========== Files - Modified Within 90 Days ==========

[2010/07/15 19:40:16 | 000,786,432 | -HS- | M] () – C:\Users\Administrator\NTUSER.DAT
[2010/07/15 19:37:23 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Administrator\Desktop\OTL.exe
[2010/07/15 18:40:55 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/15 18:40:55 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/15 17:04:20 | 000,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/15 17:04:20 | 000,595,684 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/15 17:04:20 | 000,101,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/15 16:52:55 | 000,020,087 | —- | M] () – C:\Users\Administrator\Desktop\Resume-1[1].docx
[2010/07/15 16:44:06 | 000,000,943 | —- | M] () – C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/15 16:41:34 | 000,000,284 | —- | M] () – C:\ProgramData\hpqp.ini
[2010/07/15 16:40:56 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/15 16:40:51 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/07/15 16:40:42 | 3149,078,528 | -HS- | M] () – C:\hiberfil.sys
[2010/07/15 16:40:05 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/15 16:30:17 | 000,305,800 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/07/15 16:27:09 | 000,524,288 | -HS- | M] () – C:\Users\Administrator\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 16:27:09 | 000,065,536 | -HS- | M] () – C:\Users\Administrator\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/15 16:27:07 | 000,820,110 | -H– | M] () – C:\Users\Administrator\AppData\Local\IconCache.db
[2010/07/15 16:25:55 | 000,012,860 | —- | M] () – C:\CTOERROR.flg
[2010/07/15 16:01:24 | 000,016,072 | —- | M] () – C:\Windows\System32\results.xml
[2010/07/15 15:38:33 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf
[2010/07/15 15:36:06 | 000,000,000 | RHS- | M] () – C:\Windows\System32\drivers\103C_HP_cNB_G60 Notebook PC_Y5335KV_0U_Q2CE9211DW5_E508165-002_4A_I3612_SWistron_V09.54_F.38_T090416_WV3-1_L409_M3003_J320_7Intel_867A_92.00_#100715_N10EC8136_(NW142UA#ABA)_XMOBILE_CN10
_Z_2F.38_G80862A42.MRK
[2010/07/15 15:35:02 | 000,001,356 | —- | M] () – C:\Users\Administrator\AppData\Local\d3d9caps.dat

========== Files Created - No Company Name ==========

[2010/07/15 16:52:54 | 000,020,087 | —- | C] () – C:\Users\Administrator\Desktop\Resume-1[1].docx
[2010/07/15 16:44:06 | 000,000,943 | —- | C] () – C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/15 16:10:58 | 000,012,860 | —- | C] () – C:\CTOERROR.flg
[2010/07/15 16:05:53 | 000,000,105 | —- | C] () – C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
[2010/07/15 16:05:45 | 000,000,032 | —- | C] () – C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
[2010/07/15 16:05:26 | 000,000,032 | —- | C] () – C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
[2010/07/15 16:04:59 | 000,000,032 | —- | C] () – C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
[2010/07/15 16:04:02 | 000,000,032 | —- | C] () – C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
[2010/07/15 16:03:05 | 000,000,284 | —- | C] () – C:\ProgramData\hpqp.ini
[2010/07/15 16:01:24 | 000,016,072 | —- | C] () – C:\Windows\System32\results.xml
[2010/07/15 16:00:31 | 3149,078,528 | -HS- | C] () – C:\hiberfil.sys
[2010/07/15 15:42:26 | 006,416,928 | —- | C] () – C:\Windows\System\DriveIcon.dll
[2010/07/15 15:42:26 | 000,005,430 | —- | C] () – C:\Windows\System\MyMulti.ico
[2010/07/15 15:38:33 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_SynTP_01000.Wdf
[2010/07/15 15:36:06 | 000,000,000 | RHS- | C] () – C:\Windows\System32\drivers\103C_HP_cNB_G60 Notebook PC_Y5335KV_0U_Q2CE9211DW5_E508165-002_4A_I3612_SWistron_V09.54_F.38_T090416_WV3-1_L409_M3003_J320_7Intel_867A_92.00_#100715_N10EC8136_(NW142UA#ABA)_XMOBILE_CN10
_Z_2F.38_G80862A42.MRK
[2008/07/06 13:29:46 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1518.dll
[2008/06/29 07:52:14 | 000,004,608 | —- | C] () – C:\Windows\System32\HdmiCoin.dll
[2006/11/02 05:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 00:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/03/09 02:58:00 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll

========== LOP Check ==========

[2010/07/15 16:40:06 | 000,008,202 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 14:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2008/01/20 19:24:42 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2008/06/06 11:23:31 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 14:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/07/15 16:25:55 | 000,012,860 | —- | M] () – C:\CTOERROR.flg
[2010/07/15 16:40:42 | 3149,078,528 | -HS- | M] () – C:\hiberfil.sys
[2010/07/15 16:40:40 | 3462,864,896 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 05:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 05:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 05:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 05:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 14:37:34 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2006/11/02 05:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/01/20 19:24:26 | 000,347,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\dxtmsft.dll
[2008/01/20 19:24:26 | 000,214,528 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\dxtrans.dll
[2008/01/20 19:24:42 | 000,242,744 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\rsaenh.dll
[2008/01/20 19:24:38 | 000,225,792 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/20 20:14:18 | 016,846,848 | —- | M] () – C:\WINDOWS\System32\config\COMPONENTS.SAV
[2008/01/20 20:14:08 | 000,106,496 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2008/01/20 20:14:18 | 000,020,480 | —- | M] () – C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 03:34:08 | 010,133,504 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 03:34:08 | 001,826,816 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2008/01/20 19:24:21 | 000,627,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/20 19:24:48 | 000,179,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 02:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\WINDOWS\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >





Here is Extras.txt


OTL Extras logfile created on: 7/15/2010 7:38:53 PM - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\Administrator\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 53.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 58.00 Gb Total Space | 35.05 Gb Free Space | 60.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 10.92 Gb Total Space | 1.82 Gb Free Space | 16.70% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WIN-V3IINXB1IAT
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{180B7E17-DFEF-4A8D-A98A-0C3697146368}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{49EB4377-CD16-440B-AEED-8CC50E168DD7}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"{D2C45D5E-10E2-4478-9705-48C8B81E66D1}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{E3C397BB-2111-4B99-8FF6-5A2E24ADABB2}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{FCDB5623-5A37-45FD-8E74-AB9FB838D857}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0054A0F6-00C9-4498-B821-B5C9578F433E}" = HP Help and Support
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 H2
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZero Preloader
"{38058455-8C21-4C2F-B2F6-14ED166039CB}" = HP Total Care Setup
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.7
"{57A5AEC1-97FC-474D-92C4-908FCC2253D4}" = HP Customer Experience Enhancements
"{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}" = Juno Preloader
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{665CBCA4-5AB0-414B-A288-3F8F99FEFC45}" = HP User Guides 0118
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{6A370610-3778-44AF-9AAC-69B2FD1A3356}" = Microsoft Live Search Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}" = Adobe Shockwave Player
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DD35C328-F115-BEDA-6EEE-E00C5AACCCBC}" = muvee Reveal
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE Creature Creator Trial Edition
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_HERMOSA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"NIS" = Norton Internet Security
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WildTangent hp Master Uninstall" = My HP Games

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/15/2010 7:31:45 PM | Computer Name = WIN-V3IINXB1IAT | Source = WinMgmt | ID = 10
Description =

Error - 7/15/2010 7:42:26 PM | Computer Name = WIN-V3IINXB1IAT | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 7/15/2010 7:30:20 PM | Computer Name = WIN-V3IINXB1IAT | Source = HTTP | ID = 15016
Description =

Error - 7/15/2010 7:31:45 PM | Computer Name = WIN-V3IINXB1IAT | Source = Service Control Manager | ID = 7000
Description =

Error - 7/15/2010 7:40:05 PM | Computer Name = WIN-V3IINXB1IAT | Source = Service Control Manager | ID = 7043
Description =

Error - 7/15/2010 7:40:57 PM | Computer Name = WIN-V3IINXB1IAT | Source = HTTP | ID = 15016
Description =

Error - 7/15/2010 7:42:26 PM | Computer Name = WIN-V3IINXB1IAT | Source = Service Control Manager | ID = 7000
Description =


< End of report >
Post #12
Hi

It looks like the recovery process may have damaged your partition table.

Press the WinKey + R to open a run box

type compmgmt.msc into the open run cox and hit Enter,


click on Storage->Disk Management in the left-hand pane of the window that opens.

Then, take a screenshot and upload it.

That will show what the physical layout of your drive is like.
Post #13
The screenshot was taken and saved but I can't upload it. I keep getting the message "Upload failed. You are not permitted to upload this type of file." I've saved it in both Works and Word. It says that the status is healthy and there are 228 GB unallocated.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI